1

I have several remote systems connecting to my server via SSH to establish tunnels.

They authenticate using a public key, their user is locked and their shell is set to /usr/sbin/nologin

It all works fine except with this setup the output from last username is empty for those accounts.

Is there a workaround to get last login info for those? I need the IP and connection time.

Thank you for reading.

1 Answer 1

2

You could use awk on /var/log/secure or /var/log/auth.log (depending on the distro).

On my CentOS 7 I get the following when I log in remotely:

Dec  8 21:58:20 <server hostname> sshd[8387]: Accepted publickey for gareth from 1.2.3.4 port 58392 ssh2: RSA 55:89:f9:20:db:c6:e0:6f:ff:d4:a7

The above was for interactive login but a similar entry was created for sftp login.

Therefore:

awk '/sshd.*Accepted/ {print $1,$2,$3,$9,$11}' /var/log/secure

should give you:

Dec 8 21:58:20 gareth 1.2.3.4
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .