-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Tuesday 22 Jul 2003 3:13 pm, Mark Knecht wrote:
> Hi,
> Under Gentoo, are there any logs written that show who has logged into a
> machine using ssh? Redhat had some files (var/log/secure) that had this
> sort of stuff, but I'm not spotting the equivalent here.
[EMAIL PROTECTED] auth # cat /etc/syslog.conf | grep auth
auth,authpriv.* /var/log/auth/auth.log
auth,authpriv.none;\
auth,authpriv.none;\
#*.*;auth,authpriv.none -/var/log/syslog/syslog.log
[EMAIL PROTECTED] auth # tail -f auth.log
Jul 22 10:43:16 caesar su(pam_unix)[384]: session closed for user root
Jul 22 10:43:18 caesar sshd(pam_unix)[379]: session closed for user mark
Jul 22 11:01:50 caesar sshd[534]: Accepted password for root from
195.200.23.20 port 2205
Jul 22 11:01:50 caesar sshd(pam_unix)[534]: session opened for user root by
(uid=0)
Jul 22 11:02:46 caesar sshd(pam_unix)[534]: session closed for user root
Jul 22 15:15:33 caesar sshd[2167]: Accepted password for mark from
195.200.23.87 port 4314 ssh2
Jul 22 15:15:34 caesar sshd(pam_unix)[2169]: session opened for user mark by
(uid=1000)
Jul 22 15:15:37 caesar su(pam_unix)[2174]: session opened for user root by
mark(uid=1000)
- --
Mark
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQE/HUdpzrmqzOOQUj8RAoSSAKCPT00ypeUdljXtj6c+a+tCa5YhOACgkcTs
wyaqMJmnW2NKD1mQ/U/OCqo=
=+kEa
-----END PGP SIGNATURE-----
--
[EMAIL PROTECTED] mailing list
