Catching users !

[Simon R Wootton]

I have a situation with one of my users where I believe they are logging in using a different user id to gain greater access to our systems. I really need to see historically where particular users were logged in (using IP address) at a point in time. The 'last' command doesn't seem to give me the IP address where the user was logged in, is there any way I can match an IP address with a user historically ?? I realise it's a long shot but it would be really useful !

Does wtmp hold any valuable info ?

All help rewarded !!!

Thankyou
Simon

[Jean-Luc Oudart · Accepted solution]

if you use last -R yuo will get the IP@

man last

Rgds,
Jean-Luc

[Chris Wilshaw]

As an extra note to the above reply, tracking back to an IP address may not prove anything if the address is part of a DHCP pool.

If you use static addresses, you should be OK though (unless your users are smart enough to change their IP address too before logging in).

[Bill Hassell]

This sounds fairly serious so you may need to take drastic actions once you discover the abusers. I would start by changing the password on the compromised login acctounts, notifying the real owner of the account to never share a password and depending on your company's security policy (you do have one don't you?) have appropriate disciplinary action take place. And I would hope that you do NOT have multiple UID=0 accounts on your system! This is the first place that a hacker will try to attack your system. If you need assistance from other users to perform certain sysadmin tasks as root, get a copy of sudo and never give out the root password.

[Jean-Luc Oudart]

On Chris comments,
It would depend on your "lease" policy for DHCP and how far back in time you want to track the suer IP@

Rgds,
Jean-Luc

[Keith Bevan_1]

Simon,

Lock,disable or password change the account in question.

See who complains ! Only the owner of the account will shout, and they should be educated about login/password confidentiality.

Next have a look back at last -R for previous and current logged users and ip address details. Its a guide but not a fool-proof way of tracking the originator/source

Keith