user log in report script ..

[someone_4]

Hey everyone ..
Hope everyone is having a great Hump Day ..
I have been asked to generate a user log in report. My boss wants to know who and when people have been loggging into our server so we can look for activity that is just not right. We mainly want ftp and telnet.Does anyone have any suggestion as to what extra logging I need to turn on or what logs I need to go though to get this?

Thanks
Richard

[Mark Greene_1]

"who" tells you who is logged in now, "last" gives you history, including ftp. The the man pages for more info.

HTH
mark

[Walter Bezdek]

Further to the reply already received...

You can also use lastb to see bad logins.

I was asked to do something similar to what you are asking about. In my case, I needed to log the IP address that each user logging in was coming from. What I did was the following:

1. Edit the /etc/profile file, as it is run whenever someone logs on.
2. Added code to gather this data and log to a file:

who -m | read -r VAR1 VAR2 VAR3
who -a | grep $VAR2 >> /var/adm/ttmp

Hope this helps!

Tony

[Mark Fenton]

if accounting is turned on, you can retreive a bunch of summary info from those logs:

man acctsh for details.

[Sandip Ghosh]

Turn on the inetd logs
#inetd -l

It will give you the IP address and the Machine Name (If the IP Add is resolved through DNS, otherwise it will give unknown)from where the user had logged in. You will get the PID No. also.

Hope this will solve your Problem.

Sorry I have not mentioned the file where you will get the output. It is /var/adm/syslog/syslog.log

Sandip