Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

There are several people with root access to a particular VM I am in charge of. I would like to find out which IP address was used to log into root.

share|improve this question
1  
You can access logs to see what commands were done previously: sudo less /root/.bash_history, I am still trying to research this, seems like a really good question :) –  ryekayo Aug 21 at 21:07
2  
5  
If someone logs in as root, they can do pretty much whatever they want to remove any logs they need too... –  Comintern Aug 22 at 1:30
3  
As a side note, you should disallow root direct log in. It is a big security issue. –  fedorqui Aug 22 at 9:24

5 Answers 5

This depends on your distribution or OS. sshd will log each login somewhere, and will include the relevant IP address in the login a format like this:

Aug 20 15:56:53 machine sshd[2728]: Accepted publickey for root from 192.168.1.2 port 49297

That part is consistent, but how you get there can vary. On systems based on systemd, use journalctl:

journalctl /usr/bin/sshd

to list out all log messages from the sshd executable. You can grep that out for root logins or other criteria, and limit it by date with --since and --until (see man journalctl).

Alternatively and historically, messages will be logged into (usually) somewhere in /var/log. Commonly sshd messages go into /var/log/auth.log, but the exact file can vary substantially. Whichever one it is:

grep sshd /var/log/auth.log

will give you broadly equivalent output to the journalctl version.

share|improve this answer

You can use the last command to get this information

# last|head
phemmer  ssh          192.168.0.24     Wed Aug 20 21:08 - 21:08  (00:00)
phemmer  pts/13       192.168.0.2      Wed Aug 20 14:00 - 18:43  (04:43)
phemmer  ssh          192.168.0.2      Wed Aug 20 14:00 - 18:43  (04:43)
phemmer  ssh          ::1              Wed Aug 13 23:08 - 23:08  (00:00)
phemmer  ssh          ::1              Wed Aug 13 23:08 - 23:08  (00:00)
phemmer  ssh          ::1              Wed Aug 13 23:07 - 23:07  (00:00)
phemmer  pts/15       192.168.0.20     Thu Aug  7 19:00 - 19:00  (00:00)
phemmer  ssh          192.168.0.20     Thu Aug  7 19:00 - 19:00  (00:00)
phemmer  :0                            Wed Jul 30 20:06   still logged in
reboot   system boot  3.13.2-gentoo    Wed Jul 30 20:05   still running

As you can no doubt see, the 3rd column will show the remote IP address in the event of an SSH login.

last uses the /var/log/wtmp file, so this method is similar to G-Man's answer (just a bit simpler since you don't have to specify the path to the file).

share|improve this answer

You should not allow people to use ssh by logging in directly as root (using the root password or a certificate in /root/.ssh/authorized_keys) if you want to audit who logged in as root. Instead, use one account for each person and let them use sudo to gain root permissions. In this way you will find in the appropriate log (the position of the log file depends on which distribution you have, you can even configure the log daemon to send the messages to another machine) the message user john ran the command 'sudo rm -rf /'. Well, maybe you won't find easily that one command in logs though.

share|improve this answer
2  
First, this doesn't answer the question. Second, you should always have a way to rescue the system. What happens when you're using LDAP authentication, and your LDAP server dies? How are you going to log into the box? –  Patrick Aug 22 at 3:42
4  
@Patrick First, the question start with "there are several people with root access to a particular VM", so it makes sense to suggest that the right approach is not auditing IP but instead auditing users. Second, the issue you pose is unrelated: if a person is supposed to access a machine in an emergency of LDAP not working she should have his own local account, and if she's supposed to do administration work in such an emergency the local account shall have sudo power. There is never a real reason to share an account between two people, but a person could have two accounts if needed. –  pqnet Aug 22 at 5:50
    
The question isn't asking how to change their design, it's asking how to get an IP address. As for your other solution, now you have a local account (possibly several), with a password that never expires. I wouldn't consider that an improvement. –  Patrick Aug 22 at 16:53
    
@Patrick whatever. You manage your own server, I manage mine. You made your point, people will read your comment and decide. –  pqnet Aug 22 at 16:56
    
@Patrick improvement over what? Having separate user accounts for separate people is almost certainly an improvement over having several people share a single root account. –  jw013 Aug 26 at 21:25

The command

who /var/log/wtmp

should show information like what who shows, but going back in time.

share|improve this answer
    
Nice trick but IMO you're better off just using last –  Creek Aug 23 at 3:23

From the brief description you have provided it seems it would be better if you set up a log monitoring system. It would help you monitor the logins, create alerts, compare the data of several days, and yes of-course Graphs for all that.

But if you need to monitor it temporarily, you can use last command.

last | grep root | grep -v tty | awk '{print $3}'

This will give you the list of IPs or Hostnames from where, root user has logged-in.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.