[Klug-general] Auditing SSH login sessions

[Paul Littlefield]

On 27/05/11 12:52, Colin McCarthy wrote:
> Thans everyone for responses. Alan's 'last' command seems to do the trick, as I have similar output.
> Although the user account in question does not have ssh next to any of the entries, but pts/1, pts/2, pts/8 etc.

Ah, you really need to see the 'ssh' line. Did you check /var/log/auth.log?

> What does the pts/* stand for?

It literally stand for 'pseudo terminal slave' and means a remote session.

If you were standing in front of the keyboard and monitor and logged in you would see 'tty'...

paully   tty7         Fri May 27 12:19   still logged in    :0
paully   tty7         Fri May 27 08:26 - 08:57  (00:30)     :0

Paully