How can I track who SSH'es into my linux machine?

Question

I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a low-usage box and so I think this would be a nice way to see what activity is happening on it.

Along these same lines, I heard it was not possible to track when things are done on the box via non-interactive shells, such as rsync or just remotely executing single commands via ssh. Is that true, or is there a way to log and track this as well?

Answer 1

The information of who logged in when is available in /var/log/auth.log (or other log files on other distributions). There are multiple log monitoring programs that can extract the information you configure as relevant. On any sane system, every user authentication is logged.

To log every command invocation (but not their arguments), use process accounting, provided by the acct package on Ubuntu. If the accounting subsystem is up and running, then lastcomm shows information about finished processes.

Answer 2

You can also use who or w to see who is currently logged in to the system, including SSH users.

Answer 3

You can also try entering the command last into the console, which displays all recent log-ins, including the user name they logged in under (but does not record if they changed their user name after logging in), IP, date, and duration of time logged in.

This command was mentioned by @jasonwryan in a comment here.

Answer 4

You can also modify the bash shell to do some rsylog.

Effectively, you setup rsyslog on a remote host to accept specific connections. Then modify the host shell on which you want to monitor - by compiling your version, with one which has the following enabled:

vi config-top.h
#define SYSLOG_HISTORY
#if defined (SYSLOG_HISTORY)
#  define SYSLOG_FACILITY LOG_USER
#  define SYSLOG_LEVEL LOG_INFO
#endif

Once compiled with this enabled, you can replace bash with this version OR have users be logged into this one by redirecting their logins to it.

For more info:

https://www.pacificsimplicity.ca/blog/remote-logging-using-syslog-and-logging-shell-commands-remotely

Answer 5

These 2 commands give the same result, I used them a lot to check who have logged in.

Note: 22.22.22.22 logged in 4 times, and still in there.

last




root     pts/0        22.22.22.22    Fri Apr 23 08:36   still logged in
root     pts/0        22.22.22.22    Fri Apr 23 08:29 - 08:36  (00:06)
root     pts/0        22.22.22.22    Fri Apr 23 08:27 - 08:29  (00:02)
root     pts/0        22.22.22.22    Fri Apr 23 08:25 - 08:27  (00:01)
root     pts/0        22.22.22.22    Thu Apr 15 11:51 - 12:00  (00:09)
reboot   system boot  5.4.0-51-generic Thu Apr 15 11:50   still running

wtmp begins Thu Apr 15 11:50:06 2021

============

grep -E "Accepted publickey" /var/log/auth.log




Apr 23 12:25:50 server sshd[59026]: Accepted publickey for root from 22.22.22.22 port 62685 ssh2: RSA SHA256:12
Apr 23 12:27:41 server sshd[59165]: Accepted publickey for root from 22.22.22.22 port 63240 ssh2: RSA SHA256:12
Apr 23 12:29:52 server sshd[60083]: Accepted publickey for root from 22.22.22.22 port 63860 ssh2: RSA SHA256:12
Apr 23 08:36:27 server sshd[63873]: Accepted publickey for root from 22.22.22.22 port 49318 ssh2: RSA SHA256:12

Answer 6

Usually when some one logs into a user system then in /var/log/messages it gets printed as:

sshd[18468]: Accepted keyboard-interactive/pam for root from 134.64.66.666 port 49867 ssh2

So just grep the messages as:

grep -E "Accepted keyboard-interactive/pam for" /var/log/messages