I'm new to SLES and I need to know what IP address executed a command. I've searched and all I came across this but I do not have /var/log/auth.log or /var/log/secure. I don't know if it has to be SSH only. I do know how to view the history of an user (.bash_history) but it doesn't saves the IP address, just the command.

Is there anyway to do this in SLES? 11 specifically even if it's with SSH.

  • 1
    In situations like this, you have to do investigative work. You need to look at the last command and determine who logged in, and go from there. Unless you specifically setup the system in that manner, you cannot log bash history that way unless you create your own aliases and functions. You may want to view cisecurity.org's website and find SLES benchmarks and read up on auditd for this case. – Sokel Aug 30 '16 at 20:43

An IP address doesn't execute a command. Commands are always executed by a program that runs locally. Normally the relevant forensic information regarding who ran a command is the user who ran this program.

It is possible to trace back a command to a server that listens for input over the network, e.g. find that some command was launched from a session that was created by an SSH server process and then find what remote machine that server process is listening to. If the command is executed in a terminal, then this information can be obtained by checking which terminal the command is executed in and running who to see which user is executing this command and where they logged in from. After the fact, the association between time, user terminal and IP address can be accessed with last.

Individual commands are not logged by default. If you want to do that, you have to set it up. An easy, low-overhead way is with process accounting: install acct, make sure that the service is enabled, and then each individual command (but not its argument) is logged. Run lastcomm to see the log associating commands, times and terminals. You can then cross the information with the IP addresses reported by last.

| improve this answer | |
  • Sorry, I meant the IP of the user that executed the command. – Splendonia Aug 31 '16 at 16:25
  • @Splendonia I know, and as I explain, that concept is not well-defined. A user could be logged in from different IP addresses. You can make the link if you can associate the command with a particular terminal. – Gilles 'SO- stop being evil' Aug 31 '16 at 16:39

Add this code to /etc/profile

mkdir /var/log/history;chmod 777 /var/log/history
USER_IP=`who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'`
export HISTFILE=/var/log/history/$(whoami)-$USER_IP-history

You olso can add history filename to using date.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.