From owner-freebsd-current@FreeBSD.ORG Tue Jan 15 17:59:39 2008 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 518BA16A419 for ; Tue, 15 Jan 2008 17:59:39 +0000 (UTC) (envelope-from tim1timau@yahoo.com) Received: from web50306.mail.re2.yahoo.com (web50306.mail.re2.yahoo.com [206.190.38.60]) by mx1.freebsd.org (Postfix) with SMTP id E766E13C447 for ; Tue, 15 Jan 2008 17:59:38 +0000 (UTC) (envelope-from tim1timau@yahoo.com) Received: (qmail 73825 invoked by uid 60001); 15 Jan 2008 17:32:58 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=3gFMIrFY/eruJhL/1SPyV8nVOnhwNFgPZiVse8P9iU4gnEhoOl/sdkT8fs95i0OyX4FKEL8MJA6kj/YI0x4jH1eW6gjdjHkl1VmlXFSTWAYZYAv6Mpls45WuKExW3yduu1kHHGCqXqDRvRFEOx6rY03WSrf5gbtsCfaLQ/8F38c=; X-YMail-OSG: ot8DlTYVM1kxkvH06jd6UFHQ6S7kCb_SRMWRvPZJCpssPd1FwSkN8pZzXk4aeaC7tTwU1j6usG0iW6qtdEpVnEAVI1.PCzkQhqDOf9mpYH2EXOFjHYV9dM8Bogcgww-- Received: from [203.49.197.51] by web50306.mail.re2.yahoo.com via HTTP; Tue, 15 Jan 2008 09:32:57 PST Date: Tue, 15 Jan 2008 09:32:57 -0800 (PST) From: Tim Clewlow To: Richard Bates , freebsd-current@freebsd.org In-Reply-To: <9419F125-F8F9-4FFB-A9F0-CF59DC9278C9@telehouse.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Message-ID: <24594.73739.qm@web50306.mail.re2.yahoo.com> Cc: Subject: Re: Question on security.. X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Jan 2008 17:59:39 -0000 --- Richard Bates wrote: > I know login failures are logged in /var/log/auth.log > > is there a way to log the login of users in this log > say something like > > Jan 15 10:59:00 MyServer sshd[91869]: User bates authenticated from > 172.18.1.139 > Jan 15 10:59:00 MyServer sshd[91869]: User bates Disconnected from > 172.18.1.139 > > ================================ > === Richard Bates > === TELEHOUSE America > ================================ > Hello, login successes are also logged in /var/log/auth.log - if you just want to see the successful ssh logins, then do: # cat /var/log/auth.log | grep -e "ssh.*Accept" If you want to see a list of currently logged in users, then do: # who Cheers, Tim. ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping