hello,

I have an ssh service running so my friends can log in (I also know that having an open service on this port on the internet makes it possible for anyone to gain access), but how do I check to see when they have logged in because I might not be on the system when they are, so doing "who" would not work.

Is there some sort of logfile somewhere that keeps track of who logged in and what time?

In addition to that, I know it is possible (if they decided to mess with my computer, or if a hacker broke in) to edit or alter logfiles to hide the event of them gaining access to the system. What are some good ways to defend against this as well?

Sorry for so many questions, I'm not very knowledgeable about networking no matter despite how much I have read about it.

Thanks a lot,
otacon

Also, if I wanted to execute commands or a custom script whenever someone logs in, what method should I go about doing it, and what script/file should I put the line in?

Thanks again,
otacon

check wtmp in /var/logs. It will show who has logged in, also auth.log

And, they don't have permissions (check) by default to write to your log directories on most distributions if they are a regular user. That is why there is root separate from users. Do a google search on "restricting users + linux", that should come up with some good stuff if you want to add some extra security. Also install tripwire (a tool to see what files have been changed), and start getting into the habit of checking your logs (maybe install a log monitoring program like logchecker, that will automatically email you notifications)?

I believe the commands your looking for are 'last' and 'lastb'

last will show you all successful loggings, and lastb will show all the bad loggins.

If you are running debian or other distor which uses auth loggs then you can check /var/log/auth to see when they logged into this is also useful for seeing if there is anyone else trying to log in since last doesn't keep that long of a history to show. You can go back further by viewing older archieved logs. auth.0 auth.1 etc...