How see that do user, which was connect from remsh?

[dnn]

Hello!

In LAST I see session that was connect from remsh. How see that do user, which was connect from remsh? There is not this info in syslog.log.

Thanks!

[Chris Wilshaw]

If the user is just executing a single command, or a script via remsh

eg:

remsh server "uptime"

then there is no record of it on the local server itself - you'd need to check out their .sh_history file on the remote server from which they ran the command.

If they're running

remsh server

then commands are logged to the .sh_history file (or equivalent) as normal.

It's also possible that it's a cron job that's running a remsh command, in which case you'd need to check the job details on the remote server to see what it was doing.

[Bharat Katkar]

Hi,
One way it is possible is:

1. # who ( lists all sessions )
Get tty from this of sessions.

2. # ps -t tty
This shows "rlogind" daemon running on that tty if it is connected through remsh.

Regards,

[Muthukumar_5]

last command will give only remsh from the /var/adm/wtmp log. You can do like in /etc/profile as,


--/etc/profile--

ps | grep -q 'rlogin'
if [[ $? -eq 0 ]]
then
echo "`date` $LOGNAME is logging from who -mu" >> /tmp/remsh.log
fi

hth.

[Muthukumar_5]

Change the script as,

ps | grep -q 'rlogin'
if [[ $? -eq 0 ]]
then
echo "`date` $LOGNAME is logging from `who -mu`" >> /tmp/remsh.log
echo "...... if you want more" >> /tmp/remsh.log
fi

hth.

[dnn]

Thank you very much for reply! :)