checking who&where remote login to the server

[York Lee]

who can tell me how to check who&where remote login to the server. thank you very much!

[Anup]

You can use the netstat -a to list the opened ports and sockets. Telnet uses port 23.

[Anup]

Forgot to add that "who" can be used to list the currently logged in users. You might want to write a script to put a few lines in a log somewhere everytime a new user logs in.

[Elif Gius]

Hi,

you can use "netstat -an" or "arp -a" to see the connected systems...
if you have samba installed you can even use nmblookup - NetBIOS over TCP/IP client used to lookup NetBIOS names

[U.SivaKumar_2]

Hi,

Give this command

#who -u | more


regards,
U.SivaKumar

[John Palmer]

last -R also give you information about when users logged in/out and also the name/IP address that they connected from.

Regards,
John

[Telia BackOffice]

What John do with a last -R command is perfect, but what it really do is this:
/usr/sbin/acct/fwtmp < /var/adm/wtmp > /var/tmp/wtmp.tmp
now you could make changes to it, you could remove you own entry with:
vi /var/tmp/wtmp.tmp
and then recreate the wtmp file by doing this:
/usr/sbin/acct/fwtmp -ic < /var/tmp/wtmp.tmp > /var/adm/wtmp

BR
Jannik

[Bill McNAMARA_1]

try
who -R

see syslog.log for ftp logins..

Later,
Bill

[Darrell Allen]

To add to the previous good replies...

last gets it's info from /var/adm/wtmp. If it doesn't exist, simply touch it. You'll need to keep watch over the size of this file as it grows without bounds.

who, by default, displays info about the currently logged in users. You can get historical info by specifying /var/adm/wtmp as an option:
who -R /var/adm/wtmp

man last and who for more info.

Darrell