who connected to my account

[pratibha_kajbale]

Hi Team,

Is any Unix account to know , who connected my unix environment (user) , from which ip address, and when he/she was connected ,and what he did , with my unix evironment.

Thanks in advance
Pratibha

[James R. Ferguson · Accepted solution]

Hi:

Probably your first set of data will be from:

# last -R pratibbha

...or whatever your account name is.

As for "what" (s)he did, you might look at your '.sh_history' [assuming that it wasn't erased and assuming that you use the standard Poxix or Korn shell].

Regards!

...JRF...

[Pete Randall]

Possibly /var/adm/wtmp, searched with the last command could help.


Pete

[pratibha_kajbale]

Thanks Guys,

But someone deleted my data , so can't find details in .sh_history also
# last -R command it ok , .. but i don't know what is username ..

is therer any way , or any script.

Many Thanks.
Pratibha

[James R. Ferguson]

Hi (again):

> But someone deleted my data , so can't find details in .sh_history also

Then that may mark malicious intent.

> last -R command it ok , .. but i don't know what is username ..

The is the account (login) name that you want to query. It sounds as if you want to see all recent connection activity. If so, do:

# last -R

Unless you have auditing turned on, finding "who" did "what" is very, very difficult. Current releases provide better tools.

Regards!

...JRF...

[madhuchakkaravarthy]

hi

just do last -R -5 username

username --- name that u used for login

last -R -5 root
root pts/0 117.193.160.54 Wed Apr 14 11:18 still logged in
root pts/1 117.193.160.54 Wed Apr 14 10:46 - 10:53 (00:06)
root pts/0 117.193.160.54 Wed Apr 14 09:43 - 10:50 (01:06)
root pts/0 117.193.160.54 Wed Apr 14 09:36 - 09:40 (00:03)
root pts/1 122.164.238.216 Wed Apr 14 01:22 - 03:25 (02:03)

regards
MC

[Steven E. Protter]

Shalom,

As root, disable the account immediately and start looking at the history files.

if .sh_history has been modified then the intent of the person using the account would appear to be malicious.

SEP

[rmueller58]

after the fact is pretty difficult.

you could setup of a typeset mechanism to log items when the user logs in.

does someone have access to su or sudo your account? you could check the sudo/su logs.

[Bill Hassell]

And it may not have been someone who logged into your account -- root can delete anything, anywhere, anytime. If someone has the root password, they can do anything. Look at root's .sh_history file. Also use last -R root to see when root was logged in, and use su.log to see if someone used su to become root.

[Mike Miller_8]

If nothing shows up in the sulog, you may want to restrict root access to only the console.