last output shows root remshd what is that mean?

[Verónica Muñoz Segovia]

When I performed a last command I'm able to see the following:

root remshd Wed Sep 15 09:33 still logged in
root remshd Wed Sep 15 09:29 still logged in

What is that mean?

I believe that somebody is connected to my server using remsh, am I wrong?

How can I detect who is that person?

Regards,

Vero.

[Sanjay_6 · Accepted solution]

Hi,

"last -R |grep root |pg" will give you the ip_address / dns resolved name of he client from where the connection came. And it does look like that some did a remsh to your box.

hope this helps.

Regds

[Verónica Muñoz Segovia]

Thanks,

That helps me a lot.

Regards,

Vero.

[Muthukumar_5]

There is two remshd related process running there. We can idenitfy their action's with WTMP file as,

who -RuW | grep -w 'root' |grep -w 'still logged in'

It will give all information's with pid / login tty / user etc. there