There are several people with root access to a particular VM I am in charge of. I would like to find out which IP address was used to log into root.

  • 1
    You can access logs to see what commands were done previously: sudo less /root/.bash_history, I am still trying to research this, seems like a really good question :)
    – ryekayo
    Aug 21, 2014 at 21:07
  • 2
    – Nidal
    Aug 21, 2014 at 21:09
  • 6
    If someone logs in as root, they can do pretty much whatever they want to remove any logs they need too...
    – Comintern
    Aug 22, 2014 at 1:30
  • 4
    As a side note, you should disallow root direct log in. It is a big security issue.
    – fedorqui
    Aug 22, 2014 at 9:24

5 Answers 5


You can use the last command to get this information

# last|head
phemmer  ssh     Wed Aug 20 21:08 - 21:08  (00:00)
phemmer  pts/13      Wed Aug 20 14:00 - 18:43  (04:43)
phemmer  ssh      Wed Aug 20 14:00 - 18:43  (04:43)
phemmer  ssh          ::1              Wed Aug 13 23:08 - 23:08  (00:00)
phemmer  ssh          ::1              Wed Aug 13 23:08 - 23:08  (00:00)
phemmer  ssh          ::1              Wed Aug 13 23:07 - 23:07  (00:00)
phemmer  pts/15     Thu Aug  7 19:00 - 19:00  (00:00)
phemmer  ssh     Thu Aug  7 19:00 - 19:00  (00:00)
phemmer  :0                            Wed Jul 30 20:06   still logged in
reboot   system boot  3.13.2-gentoo    Wed Jul 30 20:05   still running

As you can no doubt see, the 3rd column will show the remote IP address in the event of an SSH login.

last uses the /var/log/wtmp file, so this method is similar to G-Man's answer (just a bit simpler since you don't have to specify the path to the file).


This depends on your distribution or OS. sshd will log each login somewhere, and will include the relevant IP address in the login a format like this:

Aug 20 15:56:53 machine sshd[2728]: Accepted publickey for root from port 49297

That part is consistent, but how you get there can vary. On systems based on systemd, use journalctl:

journalctl /usr/bin/sshd

to list out all log messages from the sshd executable. You can grep that out for root logins or other criteria, and limit it by date with --since and --until (see man journalctl).

Alternatively and historically, messages will be logged into (usually) somewhere in /var/log. Commonly sshd messages go into /var/log/auth.log, but the exact file can vary substantially. Whichever one it is:

grep sshd /var/log/auth.log

will give you broadly equivalent output to the journalctl version.


The command

who /var/log/wtmp

should show information like what who shows, but going back in time.

  • Nice trick but IMO you're better off just using last
    – Creek
    Aug 23, 2014 at 3:23

You should not allow people to use ssh by logging in directly as root (using the root password or a certificate in /root/.ssh/authorized_keys) if you want to audit who logged in as root. Instead, use one account for each person and let them use sudo to gain root permissions. In this way you will find in the appropriate log (the position of the log file depends on which distribution you have, you can even configure the log daemon to send the messages to another machine) the message user john ran the command 'sudo rm -rf /'. Well, maybe you won't find easily that one command in logs though.

  • 2
    First, this doesn't answer the question. Second, you should always have a way to rescue the system. What happens when you're using LDAP authentication, and your LDAP server dies? How are you going to log into the box?
    – phemmer
    Aug 22, 2014 at 3:42
  • 4
    @Patrick First, the question start with "there are several people with root access to a particular VM", so it makes sense to suggest that the right approach is not auditing IP but instead auditing users. Second, the issue you pose is unrelated: if a person is supposed to access a machine in an emergency of LDAP not working she should have his own local account, and if she's supposed to do administration work in such an emergency the local account shall have sudo power. There is never a real reason to share an account between two people, but a person could have two accounts if needed.
    – pqnet
    Aug 22, 2014 at 5:50
  • The question isn't asking how to change their design, it's asking how to get an IP address. As for your other solution, now you have a local account (possibly several), with a password that never expires. I wouldn't consider that an improvement.
    – phemmer
    Aug 22, 2014 at 16:53
  • @Patrick whatever. You manage your own server, I manage mine. You made your point, people will read your comment and decide.
    – pqnet
    Aug 22, 2014 at 16:56
  • 1
    @Patrick improvement over what? Having separate user accounts for separate people is almost certainly an improvement over having several people share a single root account.
    – jw013
    Aug 26, 2014 at 21:25

From the brief description you have provided it seems it would be better if you set up a log monitoring system. It would help you monitor the logins, create alerts, compare the data of several days, and yes of-course Graphs for all that.

But if you need to monitor it temporarily, you can use last command.

last | grep root | grep -v tty | awk '{print $3}'

This will give you the list of IPs or Hostnames from where, root user has logged-in.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .