{"id":554,"date":"2010-02-16T15:51:22","date_gmt":"2010-02-16T15:51:22","guid":{"rendered":"http:\/\/kedar.nitty-witty.com\/?p=554"},"modified":"2015-07-21T12:25:29","modified_gmt":"2015-07-21T12:25:29","slug":"audit-checking-login-history-to-know-who-did-that-on-redhat-linux","status":"publish","type":"post","link":"https:\/\/kedar.nitty-witty.com\/blog\/audit-checking-login-history-to-know-who-did-that-on-redhat-linux","title":{"rendered":"Audit-Checking login history-to know WHO DID THAT on Redhat Linux"},"content":{"rendered":"

I’m using Redhat Linux (RHEL 5). Yesterday I saw a bit suspicious activities and data movements under my “home” (\/home\/username directory).
\nI thought of investigate \/ audit through my Redhat\u00a0linux machine and catch the “Right Person” \/ “Who did it”.<\/p>\n

Following are the steps I followed: [which if you follow, you may follow.]<\/p>\n

1. Retrieve all successful logins on the system<\/h3>\n

cat \/var\/log\/secure* | grep Accepted > logins.txt
\nNow logins.txt will contain all successfull logins to you Redhat\u00a0linux system.
\nYou may go through the file and have a manual first look up.<\/p>\n

\n

2. Check users at perticular time<\/strong><\/p>\n

Other command to find out last login details of perticular users we have\u00a0last, lastb<\/strong> commands which shows listing of last logged in users.<\/p>\n

The last program, which prints a detailed report of the times of the most recent user logins, does so by scanning the \/var\/log\/wtmp file.<\/p>\n

Output includes following details:<\/p>\n

User name
\nTty device number
\nLogin date and time
\nLogout time
\nTotal working time<\/p>\n

It also has an option to search logins at perticular time as follows:
\nlast -t YYYYMMDDHHMMSS – Display the state of logins as of the specified time.<\/p>\n

Files used in this are:
\n\/etc\/utmp – This is a binary file that contains a record for every active tty line.
\n\/var\/adm\/wtmp – Keeps track of both logins and logouts.<\/p>\n

3. finger – It’s a user information lookup program<\/h3>\n

Finally you can get more information about user with the finger command.<\/p>\n

finger -ls user-id<\/strong> – Above command will tell you linux user’s login name, real name, terminal name, write status, home directory, home phone number, login shell, mail status, and the contents of the files .plan .project .pgpkey .forward<\/p>\n

So, ultimately I got the Right Person and later came to know he was in my “home” to do “right” tasks only.
\nI don’t know if any other way is available but this is one of the way I approched.<\/p>\n","protected":false},"excerpt":{"rendered":"I’m using Redhat Linux (RHEL 5). Yesterday I saw a bit suspicious activities and data movements under my “home” (\/home\/username directory). I thought of investigate \/ audit through my Redhat\u00a0linux…\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[6],"tags":[241,59,244,426,242,243],"class_list":["post-554","post","type-post","status-publish","format-standard","category-technical","tag-audit-linux","tag-linux","tag-login-history","tag-technical","tag-who-did-that","tag-who-logged-in"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t