[Klug-general] Auditing SSH login sessions
Paul Littlefield
info at paully.co.uk
Fri May 27 13:19:37 UTC 2011
On 27/05/11 12:52, Colin McCarthy wrote:
> Thans everyone for responses. Alan's 'last' command seems to do the trick, as I have similar output.
> Although the user account in question does not have ssh next to any of the entries, but pts/1, pts/2, pts/8 etc.
Ah, you really need to see the 'ssh' line. Did you check /var/log/auth.log?
> What does the pts/* stand for?
It literally stand for 'pseudo terminal slave' and means a remote session.
If you were standing in front of the keyboard and monitor and logged in you would see 'tty'...
paully tty7 Fri May 27 12:19 still logged in :0
paully tty7 Fri May 27 08:26 - 08:57 (00:30) :0
Paully
More information about the Kent
mailing list