How to trace rlogin users

[ashan]

Hi, how do I trace rlogin users.When I grep
for syslog.log I cant get more info.

Regards

Ashan

[Chris Wilshaw]

If you use

last -R

that will show you the name/ip address of the machine that they connected from.

[suki]

Hi ,
You can get all the info related with who are the persons logged in and what are the interfaces they used to connect by issueing
#last -R
If provided you have a valid /var/adm/wtmp file.

-suki

[Steven E. Protter]

In addition to the information provided above if you have the -l logging option in your /etc/inetd.conf file you will see a log of all rlogin entries in your /var/adm/syslog/syslog.log file.

With Secure shell being free however, there is probably not a good reason not to dump the insecure Berkely protocols and go with ssh.

There are plenty of posts in my name showing how easy it is to upgrade and get the same functionality.

SEP

[ashan]

Hi SEP,

how to add in the /etc/inetd.conf

give a example please.

Regards

Ashan

[V.Tamilvanan]

Hi,
You can use the logging facility of inetd itself. To enable you need to execute
#/usr/sbin/inetd -l

This command can be executed online.

Whenever a connetion established to your server using inetd services it will be logged in /var/adm/syslog/syslog.log file.

HTH

[V. V. Ravi Kumar_1 · Accepted solution]

Hi,

Add -l to this line in ur /etc/inetd.conf file.

login stream tcp nowait root /usr/lbin/rlogind rlogind -l

Reread inetd
#inetd -c

This will log to /var/adm/syslog/syslog.log

Regards

[Robert-Jan Goossens]

Hi Ashan,

Next step could be running accounting.
change START_ACCT to 1 in /etc/rc.config.d/acct
start accounting by running /sbin/init.d/acct start
All users commands are now logged in /var/adm/pacct. You can list commands with the command # lastcomm. By sure that you have enough space in /var.

Hope it helps,

Robert-Jan.

[V. V. Ravi Kumar_1]

hi,
in my earlier post i think i was wrong, -l to rlogind line in /etc/inetd.conf only limits the normal users expect root to use .rhosts for authentication.

inetd -l will do your work.

sorry for the same.
Regards