6

I figured out the timestamp of a specific rm -r command run on an Ubuntu machine from history.

Now, I want to get the IP of the user who executed this command. Is there any way I can do this?

2
  • 4
    Welcome to Unix & Linux. All users at that time: yes. The specific user: no...
    – Fabby
    May 9, 2019 at 9:25
  • Hello and welcome @Dawny33. Please precise which OS you are looking to get this information for (Linux? AIX? Solaris? and which version), this will help us find solution appropriate to your needs and to what's available on that platform (auditing services exist, but differ amongst vendors) May 9, 2019 at 15:14

2 Answers 2

8

You can use the last command which lists all users last logged in/out time:

> last
root     pts/1        10.1.6.120       Tue Jan 28 05:59   still logged in   
root     pts/0        10.1.6.120       Tue Jan 28 04:08   still logged in   
root     pts/0        10.1.6.120       Sat Jan 25 06:33 - 08:55  (02:22)    
root     pts/1        10.1.6.120       Thu Jan 23 14:47 - 14:51  (00:03)    
root     pts/0        10.1.6.120       Thu Jan 23 13:02 - 14:51  (01:48)    
root     pts/0        10.1.6.120       Tue Jan  7 12:02 - 12:38  (00:35)    

wtmp begins Tue Jan  7 12:02:54 2014
2
  • 4
    This is the best you can do, I think, but note that the user could actually have had open sessions from multiple IPs. So you can't be 100% sure that the command was run by any one IP.
    – terdon
    May 9, 2019 at 10:14
  • Despite being accepted by the OP this does not at all answer the question. At most it provides important information required for an analysis of the incident, but does not show any correlation of what user executed the command.
    – 0xSheepdog
    May 9, 2019 at 18:13
7

Since you have the timestamp of when the command was run, if you also know the user that ran it you can narrow it down to what IP was logged into the system as that user at that time.

The last command can show you who was logged in during what times.

If you have multiple users logging into the same account, this is one of the reasons you should not be doing that and make sure to give everyone their own account.

1
  • 1
    This answer is more inline with a proper postmortem analysis to reconstruct what activities are associated with which user IDs and sessions.
    – 0xSheepdog
    May 9, 2019 at 18:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .