I’m using Redhat Linux (RHEL 5). Yesterday I saw a bit suspicious activities and data movements under my “home” (\/home\/username directory).
\nI thought of investigate \/ audit through my Redhat\u00a0linux machine and catch the “Right Person” \/ “Who did it”.<\/p>\n
Following are the steps I followed: [which if you follow, you may follow.]<\/p>\n
cat \/var\/log\/secure* | grep Accepted > logins.txt
\nNow logins.txt will contain all successfull logins to you Redhat\u00a0linux system.
\nYou may go through the file and have a manual first look up.<\/p>\n
\n
2. Check users at perticular time<\/strong><\/p>\n Other command to find out last login details of perticular users we have\u00a0last, lastb<\/strong> commands which shows listing of last logged in users.<\/p>\n The last program, which prints a detailed report of the times of the most recent user logins, does so by scanning the \/var\/log\/wtmp file.<\/p>\n Output includes following details:<\/p>\n User name It also has an option to search logins at perticular time as follows: Files used in this are: Finally you can get more information about user with the finger command.<\/p>\n finger -ls user-id<\/strong> – Above command will tell you linux user’s login name, real name, terminal name, write status, home directory, home phone number, login shell, mail status, and the contents of the files .plan .project .pgpkey .forward<\/p>\n So, ultimately I got the Right Person and later came to know he was in my “home” to do “right” tasks only.
\nTty device number
\nLogin date and time
\nLogout time
\nTotal working time<\/p>\n
\nlast -t YYYYMMDDHHMMSS – Display the state of logins as of the specified time.<\/p>\n
\n\/etc\/utmp – This is a binary file that contains a record for every active tty line.
\n\/var\/adm\/wtmp – Keeps track of both logins and logouts.<\/p>\n3. finger – It’s a user information lookup program<\/h3>\n
\nI don’t know if any other way is available but this is one of the way I approched.<\/p>\n","protected":false},"excerpt":{"rendered":"I’m using Redhat Linux (RHEL 5). Yesterday I saw a bit suspicious activities and data movements under my “home” (\/home\/username directory). I thought of investigate \/ audit through my Redhat\u00a0linux…\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[6],"tags":[241,59,244,426,242,243],"class_list":{"0":"post-554","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-technical","7":"tag-audit-linux","8":"tag-linux","9":"tag-login-history","10":"tag-technical","11":"tag-who-did-that","12":"tag-who-logged-in"},"aioseo_notices":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/kedar.nitty-witty.com\/blog\/wp-json\/wp\/v2\/posts\/554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kedar.nitty-witty.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kedar.nitty-witty.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kedar.nitty-witty.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kedar.nitty-witty.com\/blog\/wp-json\/wp\/v2\/comments?post=554"}],"version-history":[{"count":2,"href":"https:\/\/kedar.nitty-witty.com\/blog\/wp-json\/wp\/v2\/posts\/554\/revisions"}],"predecessor-version":[{"id":2294,"href":"https:\/\/kedar.nitty-witty.com\/blog\/wp-json\/wp\/v2\/posts\/554\/revisions\/2294"}],"wp:attachment":[{"href":"https:\/\/kedar.nitty-witty.com\/blog\/wp-json\/wp\/v2\/media?parent=554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kedar.nitty-witty.com\/blog\/wp-json\/wp\/v2\/categories?post=554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kedar.nitty-witty.com\/blog\/wp-json\/wp\/v2\/tags?post=554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}