[Klug-general] Auditing SSH login sessions

[Paul Littlefield]

On 27/05/11 12:40, James Morris wrote:
> Last reads /var/log/wtmp by default, rather than /var/log/auth.log

Hhhmm, here's some output from one of my servers...

$ last -a plittlefield

plittlef pts/0        Fri May 27 12:43   still logged in    192.168.0.73
plittlef ssh          Fri May 27 12:43   still logged in    192.168.0.73
plittlef pts/0        Fri May 27 12:42 - 12:43  (00:01)     192.168.0.73
plittlef ssh          Fri May 27 12:42 - 12:43  (00:01)     192.168.0.73
plittlef pts/0        Fri May 27 12:31 - 12:42  (00:11)     192.168.0.73
plittlef ssh          Fri May 27 12:31 - 12:42  (00:11)     192.168.0.73

...and that shows ssh logins, so Colin should be fine.

Paully