How can I track who SSH'es into my linux machine?

Question

I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a low-usage box and so I think this would be a nice way to see what activity is happening on it.

Along these same lines, I heard it was not possible to track when things are done on the box via non-interactive shells, such as rsync or just remotely executing single commands via ssh. Is that true, or is there a way to log and track this as well?

Solution 1

The information of who logged in when is available in /var/log/auth.log (or other log files on other distributions). There are multiple log monitoring programs that can extract the information you configure as relevant. On any sane system, every user authentication is logged.

To log every command invocation (but not their arguments), use process accounting, provided by the acct package on Ubuntu. If the accounting subsystem is up and running, then lastcomm shows information about finished processes.

Solution 2

You can also use who or w to see who is currently logged in to the system, including SSH users.

Solution 3

You can also try entering the command last into the console, which displays all recent log-ins, including the user name they logged in under (but does not record if they changed their user name after logging in), IP, date, and duration of time logged in.

This command was mentioned by @jasonwryan in a comment here.

Comments

[Adrian Cornish]

/var/log/secure.log is another common logfile

[jasonwryan]

last might be a better option for what the OP was looking for...

[Sirex]

indeed. "last" is the command you want.

[PaulBGD]

This is a MUCH better answer then the selected one.

[mcdoomington]

Fine. I will update it.

[Merlin]

I could not find the appropriate log file, last was exactly what I needed.

[Dizzie KX]

cat: /var/log/messages: No such file or directory