topic Re: Log telnet session username in Operating System - HP-UX

Log telnet session username

Laszlo Csizmadia — Mon, 17 May 2004 06:54:15 GMT

How is it possible to log which user is using telnet to login?
Inted -l logs only the hostname in the syslog but not the username, like:
May 17 13:50:28 aaenwh2 inetd[29548]: telnet/tcp: Connection from unknown (10.117.243.242) at Mon May 17 13:50:28 2004

As I see telnetd don't offer a logging capability in HPUX 11.X.
How to do then?

Thanks in advance...

Re: Log telnet session username

Fred Ruffet — Mon, 17 May 2004 07:08:04 GMT

Hi !

By adding some code in /etc/profile. Detect wether the session is telnet (the father of your shell process should be a telnetd). In that case, use logger to log aline in syslog.

Regards,

Fred

Re: Log telnet session username

Sanjay Kumar Suri — Mon, 17 May 2004 07:22:40 GMT

You can use last/lastb to view history of successful/unsuccessful logins.

sks

Re: Log telnet session username

Brian Hackley — Tue, 18 May 2004 07:57:46 GMT

Lazsio,

A user that logs in via telnet has a TTY of pts/t** as viewed in ps -ef, who -a, or last output.

Hope that helps a little,
-> Brian Hackley

Re: Log telnet session username

Bharat Katkar — Tue, 18 May 2004 08:05:55 GMT

Hi there,

See if
# who -R

Helps in any way.

Regards,

Re: Log telnet session username

Dave La Mar — Tue, 18 May 2004 12:47:52 GMT

We routinely do this by placing the following in the /etc/profile and outputting to a file.

last -R | head -1

Best regards,

dl

Re: Log telnet session username

Geoff Wild — Tue, 18 May 2004 13:04:49 GMT

We do this in .profile for root:

# Set up logging
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
export HISTFILE
date >>$HISTFILE
HISTSIZE=500
export HISTSIZE

Rgds...Geoff

Re: Log telnet session username

Dani Seely — Tue, 18 May 2004 13:30:35 GMT

Hey Laszlo,
To find out who is accessing the system remotely (ftp, telnet, secure shell), I simply do:

# last -R |grep -v console

Very simple, hope this helps.

Re: Log telnet session username

RAC_1 — Tue, 18 May 2004 13:47:35 GMT

If you have tcp wrappers. you can put the services in /hosts.deny and hosts.allow and then you will get everything logged in syslog.log

Like you want to allow ftp to all, the
/etc/hosts.allow will ike follows

ftp:ALL

Then whoever does ftp gets logged in syslog.log with username

Anil

Re: Log telnet session username

Laszlo Csizmadia — Wed, 19 May 2004 00:55:53 GMT

As telnetd doesn't have any logging facility finally I putted this line in the /etc/profile:
who -mR|awk '{if(match($2, "pts\/t")) print}'>>/tmp/telnet.log

Thanks for the help...