On Sun, Feb 19, 2012 at 11:36:38AM -0800, Denis Heidtmann wrote:
> I think the core of my question is what is the likely result of my
> saying YES to the login request?
Use `last | less` and see who actually logged in when you did the approval,
then see what they did while logged on.
For instance, mine looks like:
michael pts/3 shed.jamhome.us Sun Feb 19 13:29 still logged in
michael pts/0 shed.jamhome.us Sun Feb 19 10:28 still logged in
gritton pts/3 c-174-52-130-208 Mon Feb 13 21:53 - 21:53 (00:00)
michael pts/1 shed.jamhome.us Mon Feb 13 15:50 still logged in
michael pts/0 hive.michaelsnet Sun Feb 12 05:16 - 06:10 (00:53)
gritton pts/0 c-174-52-133-59. Sun Feb 5 19:15 - 19:16 (00:01)
michael pts/4 shed.jamhome.us Sun Feb 5 05:14 - 05:33 (00:19)
wtmp begins Sun Feb 5 05:14:05 2012
There's me logging in from two other hosts on the local net and (Jamie) Gritton
logging in for a minute or so once a week.
Alternatively you can examine /var/log/auth.log for the time you're intested
in and see if you approved an ftp, ssh or ____? login
--
Michael Rasmussen, Portland Oregon
Other Adventures: http://www.jamhome.us/ or http://westy.saunter.us/
Fortune Cookie Fortune du jour:
Don't forget to thank your angel.
~ http://someoneoncetoldme.com/gallery/23052008
_______________________________________________
PLUG mailing list
[email protected]
http://lists.pdxlinux.org/mailman/listinfo/plug
