Howto know each ssh users logs in at least every 24hrs

gian2oo1 · 04-18-2005, 12:32 AM

Hello! I frequently use different computers in different cities to work off (this cannot be changed) and I have them rsync everyday to one of my servers @ home. What I am trying to accomplish is a small admin webpage listing everyday my last sync and that my backup was successful. I was thinking maybe just dumping this data into an html file and using apache to view it via the http protocol. I created something similar to this that uses simple shell scripts to see if "backup_log" exists and then cross-checking it's date with todays date to see if it backed up today. BUT, I find sometimes a backup finished at 12:01 AM for say and my script things the back never happened (until tomorrow). Would it be better to check the backup_logs date with a 24 hour check thing? (Maybe in Perl, I don't know much perl, or can this be done via shell scripts?)

Or maybe grep through /var/log/messages for that users account ssh login crosschecked by there last login and make sure it hasn't been over 24 hours? (i'm using ssh to transfer the file via rsync). Do anyone know any scripts that may help me, or do you know a better way to accomplish this so i know every user i specify logs in every 24 hours at least via ssh? Again my main goal is knowing every PC logs in under 24 hours, so anyone suggestions would be appreciated if you think it would work.

Thanks for any help, i appreciate it.

-Gian Spicuzza

peter_robb · 04-18-2005, 01:38 AM

I use the nail programme from within a user's .bashrc file
Every time they login, they send a very short email..

http://nail.sourceforge.net

gian2oo1 · 04-18-2005, 02:29 AM

Dear peter_robb,

Thanks for the suggestion. After the daily backups, I would have a bunch of emails, correct? I was looking for something like a single webpage or a single email that would show all my users successful login instead of a few single emails. I'll look into nail and see if there are any options that may be useful, thank you very much for the suggestion.

-Gian

keefaz · 04-18-2005, 04:09 AM

Add -v to your rsync command and output result to a log file like :

Code:

00  12  *   *   *   rsync -e ssh -rzv server:/some/stuff /home/stuff > /home/sync.log 2>&1

Then download the sync.log file say at 12:30 with a crontab or if there is a web server
running on each machine with php, you could just do a php script :

PHP Code:



<pre> 
<?php echo htmlentities(file_get_contents("/home/sync.log")); ?> 
</pre>

gian2oo1 · 04-20-2005, 12:21 PM

keefaz,

Thanks for the suggestion I'll look into that.

I also found when a user logs in, a line is added to /var/log/messages that looks like this:

Apr 20 00:20:29 oscar sshd[24257]: Accepted publickey for gian from 208.47.17.112 port 2034 ssh2

How about if I make a script that checks every 24 hours and crosschecks that date above to the last 24hours? Would that work? It seems pretty simple too. If that is suitable, would it be an easy script to write or would it be wise to hire a freelance programmer to draft it up?

Thanks for your suggestions I think I'm getting pretty far,

Gian Spicuzza

keefaz · 04-20-2005, 12:36 PM

There is also the w command with something like :

Code:

w -h | grep -v ' - '