Home / ubuntu / Questions / 873926
Accepted
NonStandardModel
Asked: 2017-01-20 13:13:27 +0800 CST

How can I see who and when logged remotely to my computer?

  • 772

Is there any log file that saves the information of who and when logged to my computer using ssh, sshfs or some other method? Is it also possible to find some info about what was he doing (like for example the files transferred to other machine...)?

I am using Ubuntu 14.04.

ssh

1 Answers

  1. Best Answer

    Yes, (remote) logins are logged, namely in /var/log/auth.log.

    You can easily search the file for password SSH logins via

    grep sshd.\*password.\* /var/log/auth.log

    or for public key authentication via:

    grep sshd.\*publickey.\* /var/log/auth.log

    Example:

    Jan 19 22:22:29 awesome-no-standard-model-server sshd[12883]: Accepted publickey for nostandardmodel from 1d01:2031:3284:be99:c34d:d7ae:fa1:d4ba port 33324 ssh2: RSA SHA256:NRnnaK7EaRjGOBhb9qE7X12f5s5yfNzb9C32TTJ3VoI

    Whether the user used SSH to get a shell and run commands, to access files on a file system, as a tunnel to connect to some other machine, as a tunnel to access VNC, to push to a git repo, or to do anything else, doesn't matter. They all show up the way the example shows it. If the user uses SFTP and in the same minute pushes to a repo 10 times and opens 20 sessions on a terminal, you see 31 such entries mentioning the user, the time, the user's IP address, etc., that minute in the log.

    Whether there are records of other activity done by the user depends on the exact activity. It may be enabled by default or need to be enabled if desired. E.g., to log file transfer activity via SFTP: https://serverfault.com/questions/73319/sftp-logging-is-there-a-way

    • 6