remote login
 

I have a two unix server ( serverA and serverB ) , I checked that a login in serverA ( who -u |grep pts/30) , this pts is from serverB (by telnet) , if I want to know which user (IP address) in serverB use the login ID "ora_usr" to login serverA , what can i do ? thx

serverA
======
#who -u |grep pts/30
ora_usr pts/30 Apr 29 11:45 serverB

You might want to try "ps -ftpts/30" to see all the processes running there. Its possible someone logged in as someone else then did an su to the ora user.

If it was done via ssh then doing "ps -ef |grep pts/30" ought to show you which sshd process is associated with pts/30.

You can then run "lsof -p <pid> |grep \>" on serverA where <pid> is the process ID revealed for sshd above and \> is literal. You would want to look at lines. This will give you the connection information similar to:

sshd 2483 orauser 3u IPv6 123965389 TCP serverA:ssh->serverB:58712 (ESTABLISHED)

If you then go to serverB and run "lsof |grep "serverA:ssh->serverB:58712" you should find the PID and user in the lsof output from serverB.

Note: serverA:ssh->serverB:58712 is an EXAMPLE only - you would need to figure out what goes there from the output you got from the original lsof.