Who is logged into this box?

2009-01-11 Thread Dotan Cohen
On a machine that I have root access to, how can I see who is logged into the machine? Specifically, I suspect that a malicious entity is logging on in a compromised account over SSH, even while the account's user is sitting at the machine and logged in, so if I can catch two simultaneous login

Re: Who is logged into this box?

2009-01-11 Thread steve
Dotan Cohen wrote: On a machine that I have root access to, how can I see who is logged into the machine? Specifically, I suspect that a malicious entity is logging on in a compromised account over SSH, even while the account's user is sitting at the machine and logged in, so if I can catch

Re: Who is logged into this box?

2009-01-11 Thread Bob Cox
On Sun, Jan 11, 2009 at 10:54:25 +0200, Dotan Cohen (dotanco...@gmail.com) wrote: On a machine that I have root access to, how can I see who is logged into the machine? Specifically, I suspect that a malicious entity is logging on in a compromised account over SSH, even while the account's

Re: Who is logged into this box?

2009-01-11 Thread Dotan Cohen
2009/1/11 steve sfrei...@roadrunner.com: Dotan Cohen wrote: On a machine that I have root access to, how can I see who is logged into the machine? Specifically, I suspect that a malicious entity is logging on in a compromised account over SSH, even while the account's user is sitting at the

Re: Who is logged into this box?

2009-01-11 Thread steve
Dotan Cohen wrote: 2009/1/11 steve sfrei...@roadrunner.com: Dotan Cohen wrote: On a machine that I have root access to, how can I see who is logged into the machine? Specifically, I suspect that a malicious entity is logging on in a compromised account over SSH, even while the account's

Re: Who is logged into this box?

2009-01-11 Thread Rick Thomas
On Jan 11, 2009, at 4:16 AM, steve wrote: i often wondered where some of these commands got their name from myself. w? and that is short for user in what way?? It's short for who(1), which does much the same thing, but differently. Rick -- To UNSUBSCRIBE, email to

Re: Who is logged into this box?

2009-01-11 Thread Tzafrir Cohen
On Sun, Jan 11, 2009 at 09:01:57AM +, Bob Cox wrote: Just typing w (without the quotes) should be adequate. While we're at it: w # (with the quotes) will actually do the same thing on the shell ;-) -- Tzafrir Cohen | tzaf...@jabber.org | VIM is http://tzafrir.org.il |

Re: Who is logged into this box?

2009-01-11 Thread Bob Cox
On Sun, Jan 11, 2009 at 10:01:59 +, Tzafrir Cohen (tzaf...@cohens.org.il) wrote: On Sun, Jan 11, 2009 at 09:01:57AM +, Bob Cox wrote: Just typing w (without the quotes) should be adequate. While we're at it: w # (with the quotes) will actually do the same thing on the shell

Re: Who is logged into this box?

2009-01-11 Thread Koh Choon Lin
Just typing w (without the quotes) should be adequate. While we're at it: w # (with the quotes) will actually do the same thing on the shell who has more info than w. :) -- Koh Choon Lin -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe.

Re: Who is logged into this box?

2009-01-11 Thread Dotan Cohen
2009/1/11 Koh Choon Lin kohchoonl...@gmail.com: w # (with the quotes) will actually do the same thing on the shell who has more info than w. :) You tell me! -- Dotan Cohen http://what-is-what.com http://gibberish.co.il א-ב-ג-ד-ה-ו-ז-ח-ט-י-ך-כ-ל-ם-מ-ן-נ-ס-ע-ף-פ-ץ-צ-ק-ר-ש-ת

Re: Who is logged into this box?

2009-01-11 Thread Paul Cartwright
On Sun January 11 2009, Dotan Cohen wrote: how can I see who is logged into the machine? # who -uT pbc + tty7 2009-01-08 11:28 . 18900 (:0) pbc + pts/02009-01-08 15:58 . 19067 (:0.0) pbc + pts/12009-01-08 11:28 00:16 19067 (:0.0)

Re: Who is logged into this box?

2009-01-11 Thread Paul Cartwright
On Sun January 11 2009, Tzafrir Cohen wrote: Just typing w (without the quotes) should be adequate. While we're at it: w # (with the quotes) will actually do the same thing on the shell ;-) wow.. fully formatted and much better info than even who -uT!!! -- Paul Cartwright Registered Linux

Re: Who is logged into this box?

2009-01-11 Thread Michael Shuler
Dotan Cohen wrote: On a machine that I have root access to, how can I see who is logged into the machine? Specifically, I suspect that a malicious entity is logging on in a compromised account over SSH, even while the account's user is sitting at the machine and logged in, so if I can catch

Re: Who is logged into this box?

2009-01-11 Thread Robert Brockway
On Sun, 11 Jan 2009, Dotan Cohen wrote: On a machine that I have root access to, how can I see who is logged into the machine? Specifically, I suspect that a malicious entity is logging on in a compromised account over SSH, even while the account's user is sitting at the machine and logged in,

Re: Who is logged into this box?

2009-01-11 Thread Dotan Cohen
2009/1/11 Michael Shuler mich...@pbandjelly.org: Since it has not been mentioned in the other replies, I would certainly think that scrutiny of /var/log/auth.log is due. The logs should show you when the user has logged in, and from what remote IP addresses. it should be quite simple to

Re: Who is logged into this box?

2009-01-11 Thread Dotan Cohen
2009/1/11 Robert Brockway rob...@timetraveller.org: On Sun, 11 Jan 2009, Dotan Cohen wrote: On a machine that I have root access to, how can I see who is logged into the machine? Specifically, I suspect that a malicious entity is logging on in a compromised account over SSH, even while the

Re: Who is logged into this box?

2009-01-11 Thread Chris Jones
On Sun, Jan 11, 2009 at 05:16:14PM EST, Dotan Cohen wrote: 2009/1/11 Robert Brockway rob...@timetraveller.org: On Sun, 11 Jan 2009, Dotan Cohen wrote: Like fine underwear, passwords should be changed every few months for good measure. What? You recommend changing underwear every few

Re: Who is logged into this box?

2009-01-11 Thread Dotan Cohen
2009/1/12 Chris Jones cjns1...@gmail.com: On Sun, Jan 11, 2009 at 05:16:14PM EST, Dotan Cohen wrote: 2009/1/11 Robert Brockway rob...@timetraveller.org: On Sun, 11 Jan 2009, Dotan Cohen wrote: Like fine underwear, passwords should be changed every few months for good measure. What? You