topic Re: Finding the ip from where the commands are fired in Operating System - Linux

Finding the ip from where the commands are fired

nish_1 — Mon, 01 Mar 2010 07:25:31 GMT

Hi,

I would like to know in linux how to find out the terminal from where the commands are fired and if possible the IP address of the machine where the terminal is opened.

This is required as continuous deletion of my project folders and files are happening though we have separate userid and password for the project.

TIA

Re: Finding the ip from where the commands are fired

Dennis Handly — Mon, 01 Mar 2010 07:56:23 GMT

Who has permission to delete your directories and files? Only you and root?
Any crontab entries to delete "old" files?

Re: Finding the ip from where the commands are fired

nish_1 — Mon, 01 Mar 2010 08:24:24 GMT

The user we use has the execute permissions also.whomever logins with this userid have full access to the files

Re: Finding the ip from where the commands are fired

Hemmetter — Mon, 01 Mar 2010 14:12:40 GMT

Hi Nish

have you tried last(1)?
It list all that info.

rgds
HGH

Re: Finding the ip from where the commands are fired

nish_1 — Tue, 02 Mar 2010 08:29:58 GMT

Hi,

last command gives the output as follows

nish pts/7 10.66.123.221 Tue Mar 2 13:45 still logged in

I require the command fired from this particular terminal along with IP.Can u please suggest?

Re: Finding the ip from where the commands are fired

Hemmetter — Tue, 02 Mar 2010 09:06:27 GMT

Hi nish,

have a look at your shell-history ( e.g. ~/sh_history, ~/.bash_history etc) or if no history is configured have a look at sh(1), bash(1) or csh(1) etc. to configure one.

e.g. add lines like this to /home/nish/.bashrc:
export HISTFILE=~/.bash_history_$(basename $(tty) )
export HISTTIMEFORMAT='%F %T '

The you can audit all commands invoked.

rgds
HGH

Re: Finding the ip from where the commands are fired

nish_1 — Tue, 02 Mar 2010 10:18:32 GMT

Hi Hemmetter,

After exporting these variables in the home directory .sh_history file got formed instead of a file like .bash_history_7.Can you pls explain on this?

Re: Finding the ip from where the commands are fired

nish_1 — Tue, 02 Mar 2010 10:47:55 GMT

thanks Hemmetter.It worked and now i can track it :) .

Re: Finding the ip from where the commands are fired

nish_1 — Tue, 02 Mar 2010 10:53:31 GMT

Magical answer

Re: Finding the ip from where the commands are fired

Hemmetter — Tue, 02 Mar 2010 11:05:00 GMT

Hi again

the HISTFILE variable in this form distingishes between the tty's and makes it possible to relate it to IP-Address via last-output.

rgds
HGH