Tracking telnet to secure shell access conversions

[Scott Lindstrom_2]

I need to track which users are still coming in via telnet, rlogin, etc versus those that have converted over to secure shell. I need to collect this data from a variety of servers over the course of time (until everyone is coming in ssh). Before I start writing a script to do this, I thought I'd ask if someone already has something similar.

TIA,
Scott Lindstrom

[Steven E. Protter · Accepted solution]

The last command is a good start.

It gives good output from /var/adm/syslog/wtmp

lastb command shows bad logins.

I'm attaching a login checker script you can modify for your purposes.

SEP

[Scott Lindstrom_2]

Steve -

It turns out I'm not getting ssh logins logged via last (like some other posts I've found here on the forums), but as long as I can find who is using any of the other login methods, that solves my problem.

Scott

[ConnieK]

Scott,

Your syslog should be capturing access attempts whether failed or successful, plus it indicates which type of access the connection was. You could write a simple script to grep "connect" and filter the telnetd/sshd/ftp access from your syslog and write the output to a file. I have a script running from cron everyday to send me output (as below):

Nov 5 22:08:46 6C:xxxx telnetd[1215]: connect from ###.##.##.###
Nov 5 08:03:06 6E:xxxx sshd[2655]: Accepted password for userxx from xxx.xx.xx.xxx port 1690 ssh2

If you need the exact script, I can post.

HTH - Connie

[Scott Lindstrom_2]

Connie -

My understanding is that I would have to issue 'inetd -l' to get the enhanced logging in syslog. This isn't something we want to do.

As long as I can get who is *not* using ssh, I can write the report I need to write.

Thanks for your reply. Being a Unix newbie, I love these forums!

Scott

[Scott Lindstrom_2]

I just realized we have our syslog split into multiple log files, so the invalid login attempts via ssh *are* being reported; just not in syslog.log.

Scott