- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- who connected to my account
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО04-14-2010 06:07 AM
тАО04-14-2010 06:07 AM
Is any Unix account to know , who connected my unix environment (user) , from which ip address, and when he/she was connected ,and what he did , with my unix evironment.
Thanks in advance
Pratibha
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО04-14-2010 06:16 AM
тАО04-14-2010 06:16 AM
SolutionProbably your first set of data will be from:
# last -R pratibbha
...or whatever your account name is.
As for "what" (s)he did, you might look at your '.sh_history' [assuming that it wasn't erased and assuming that you use the standard Poxix or Korn shell].
Regards!
...JRF...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО04-14-2010 06:17 AM
тАО04-14-2010 06:17 AM
Re: who connected to my account
Pete
Pete
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО04-14-2010 06:34 AM
тАО04-14-2010 06:34 AM
Re: who connected to my account
But someone deleted my data , so can't find details in .sh_history also
# last -R
is therer any way , or any script.
Many Thanks.
Pratibha
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО04-14-2010 06:43 AM
тАО04-14-2010 06:43 AM
Re: who connected to my account
> But someone deleted my data , so can't find details in .sh_history also
Then that may mark malicious intent.
> last -R
The
# last -R
Unless you have auditing turned on, finding "who" did "what" is very, very difficult. Current releases provide better tools.
Regards!
...JRF...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО04-14-2010 07:20 AM
тАО04-14-2010 07:20 AM
Re: who connected to my account
just do last -R -5 username
username --- name that u used for login
last -R -5 root
root pts/0 117.193.160.54 Wed Apr 14 11:18 still logged in
root pts/1 117.193.160.54 Wed Apr 14 10:46 - 10:53 (00:06)
root pts/0 117.193.160.54 Wed Apr 14 09:43 - 10:50 (01:06)
root pts/0 117.193.160.54 Wed Apr 14 09:36 - 09:40 (00:03)
root pts/1 122.164.238.216 Wed Apr 14 01:22 - 03:25 (02:03)
regards
MC
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО04-14-2010 08:13 AM
тАО04-14-2010 08:13 AM
Re: who connected to my account
As root, disable the account immediately and start looking at the history files.
if .sh_history has been modified then the intent of the person using the account would appear to be malicious.
SEP
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО04-14-2010 08:26 AM
тАО04-14-2010 08:26 AM
Re: who connected to my account
you could setup of a typeset mechanism to log items when the user logs in.
does someone have access to su or sudo your account? you could check the sudo/su logs.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО04-14-2010 12:26 PM
тАО04-14-2010 12:26 PM
Re: who connected to my account
Bill Hassell, sysadmin
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО04-15-2010 07:25 AM
тАО04-15-2010 07:25 AM