need a help with the shell script to trace which user are logged on

[I.Delic]

hi,

i'm not good at shel programming and i need one script. This script schould chek who is logged on my system. If one user for exampel JEF logged on i should get immediately a messeg with informatin about this user ( username and time).
If user JEF exit my system i should get a another messega with the same information.

I should get only two message ( log on and log of)

I hoop i don't ask to much

Thank you in advance

IDriz

[Alex Lavrov.]

The command you should use is:

who

put it in crontab for every 5 minutes and let the script check who's logged in, then you keep the current status and at the next check, compare the new status with the old and that way you can know what users logged in and who logged out.

[renarios]

Hi IDriz,

I guess this is what you like:

#!/bin/sh

TMPFILE=/var/tmp/whocount
if [[ -f ${TMPFILE} ]]
then
oldcount=$(cat ${TMPFILE})
else
oldcount=0
fi

newcount=$(who|wc -l)

if (( ${oldcount} != ${newcount} ))
then
whoisthere=$(who)
mailx -m -s "Changing logins on UNIX can" you@domain.com << EOF
Hi,

These persons are logged in currently:
${whoisthere}
EOF
fi

echo ${newcount} > ${TMPFILE}

exit

Put above in a shell script and cron it.
Another possibility is to put this in a loop.

I hope this helped,

Renarios

[I.Delic]

Thank you for your script's.

I was not realy clear about what i want.
I should get a messege if only for exampele user JEF log on.
This user is an extern company who's helping as with one of our application.
I should know when they are connected to our system.

Thank you in advance.

[Alex Lavrov.]

Ther previous script is good enough for you, just add a condition about JEF and that's it.

[renarios]

Only 2 points, you Scroodge???

Well try this then:

#!/bin/sh

TMPFILE=/var/tmp/whocount
if [[ -f ${TMPFILE} ]]
then
oldcount=$(cat ${TMPFILE})
else
oldcount=0
fi

newcount=$(who|wc -l)

if (( ${oldcount} != ${newcount} ))
then
whoisthere=$(who|grep JEF)
mailx -m -s "Changing logins on UNIX can" you@domain.com << EOF
Hi,

These persons are logged in currently:
${whoisthere}
EOF
fi

echo ${newcount} > ${TMPFILE}

exit

Put this in a cronjob every 1 minute or put it in a loop with a timeout.

Renarios

[Alex Lavrov.]

You also can put in the .profile, command that will mail the ligin message to you. .profile is run every time user logins into the system. But because you cannot be sure that the user will logout and maybe will just close the ssh/telnet window you still need some script to monitor his presence in the system.

[Victor Fridyev]

Hi,

I agree with Alex, but the better place for this test is /etc/profile. You can add something like that:
USERS="JEF HJK POU"
for usr in $USERS; do
if [ $LOGNAME = $usr ]; then
date|mailx -s "$usr is loged in" yourmail
fi
done

Such a script permits you to controle more than one hacker


HTH

[Alex Lavrov.]

But still I'm trying to figure out what would be the best way to know when user logged out. Monitoring the logged in users will do the work, but it's kinda "ugly" solution. Because, as I understood, "JEF" will be in the system only several times during the week, so what's the point of the running script every minute in the cron ...

btw, hello Victor, I think we spoke over the phone last week, regarding the 11.09 version of Service Guard :)

[I.Delic]

Thank you for your solutions.
I wil use both of them.
Victor kan you help me with this script of you. Do i have to put this code in the profile file (letterly) of somethings els.
Pleas help me because your solutions is somthing i'm looking for.
Another issue is log of (exit from the sessie). Kan i use the same script or i have to wait for the another solutioons?

Thank you in advance

Idriz

[I.Delic]

sorry for my english

i mean

Victor kan you help me with this script of you. Do i have to put this code in the profile file (literally) of somethings els.

Thank you


Idriz

[Victor Fridyev]

Hi,

You can copy/paste the script into /etc/profile before the string with "trap" at the end of the file

Good luck

[I.Delic]

Victor,

Does it works with the logoff too ?


Idriz

[Alex Lavrov.]

No, it will not work with logoff, it's only executes when the user logs in

[Victor Fridyev]

Hi,

As far as I know. there is not a common file for logoff as /etc/profile for logon.
If you want to know about users' logoff, you will have to add into each user's .profile something like that:
trap 'echo $LOGNAME|mailx -s "$LOGNAME logged off" youremail' 0 1 2 3 15
Actually, I can't understand why you want to know about logoff. If you need to know such things, transfer your computer into trusted mode, you will have full logging.

HTH and good luck

[Geoff Wild]

Add a .logout file as well as a trap to .profile:

# cat .logout

# this line will add a line to the user's .sh_history
print -s "### logout at `/usr/bin/date` ###"


In .profile:

trap "$HOME/.logout" 0


You can also add the mailx in the .logout as well...
echo $LOGNAME|mailx -s "$LOGNAME logged off" youremail


Rgds...Geoff