Log telnet session username

[Laszlo Csizmadia]

How is it possible to log which user is using telnet to login?
Inted -l logs only the hostname in the syslog but not the username, like:
May 17 13:50:28 aaenwh2 inetd[29548]: telnet/tcp: Connection from unknown (10.117.243.242) at Mon May 17 13:50:28 2004

As I see telnetd don't offer a logging capability in HPUX 11.X.
How to do then?

Thanks in advance...

[Fred Ruffet]

Hi !

By adding some code in /etc/profile. Detect wether the session is telnet (the father of your shell process should be a telnetd). In that case, use logger to log aline in syslog.

Regards,

Fred

[Sanjay Kumar Suri]

You can use last/lastb to view history of successful/unsuccessful logins.

sks

[Brian Hackley]

Lazsio,

A user that logs in via telnet has a TTY of pts/t** as viewed in ps -ef, who -a, or last output.

Hope that helps a little,
-> Brian Hackley

[Bharat Katkar]

Hi there,

See if
# who -R

Helps in any way.

Regards,

[Dave La Mar]

We routinely do this by placing the following in the /etc/profile and outputting to a file.

last -R | head -1

Best regards,

dl

[Geoff Wild]

We do this in .profile for root:

# Set up logging
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
export HISTFILE
date >>$HISTFILE
HISTSIZE=500
export HISTSIZE


Rgds...Geoff

[Dani Seely]

Hey Laszlo,
To find out who is accessing the system remotely (ftp, telnet, secure shell), I simply do:

# last -R |grep -v console

Very simple, hope this helps.

[RAC_1]

If you have tcp wrappers. you can put the services in /hosts.deny and hosts.allow and then you will get everything logged in syslog.log

Like you want to allow ftp to all, the
/etc/hosts.allow will ike follows

ftp:ALL

Then whoever does ftp gets logged in syslog.log with username

Anil

[Laszlo Csizmadia]

As telnetd doesn't have any logging facility finally I putted this line in the /etc/profile:
who -mR|awk '{if(match($2, "pts\/t")) print}'>>/tmp/telnet.log

Thanks for the help...