Question on security..

[Robert Watson]

On Tue, 15 Jan 2008, Richard Bates wrote:

> I know login failures are logged in /var/log/auth.log
>
> is there a way to log the login of users in this log say something like
>
> Jan 15 10:59:00 MyServer sshd[91869]: User bates authenticated from 
> 172.18.1.139
> Jan 15 10:59:00 MyServer sshd[91869]: User bates Disconnected from 
> 172.18.1.139

The normal system lastlog, accessed via last(1), does this fairly well.  As 
you notch up the level of logging on sshd, it should also be able to do that. 
However, I tend to use audit for the above type of functionality, as the 
results are more parseable using tools like auditreduce.  There's a handbook 
chapter on how to configure and use audit, should you be looking for something 
a bit more on that scale of things.

Robert N M Watson
Computer Laboratory
University of Cambridge