How can I track who SSH'es into my linux machine?

The information of who logged in when is available in /var/log/auth.log (or other log files on other distributions). There are multiple log monitoring programs that can extract the information you configure as relevant. On any sane system, every user authentication is logged.

To log every command invocation (but not their arguments), use process accounting, provided by the acct package Install acct on Ubuntu. If the accounting subsystem is up and running, then lastcomm shows information about finished processes.


You can also use who or w to see who is currently logged in to the system, including SSH users.

Tags:

Security

Ssh

Logs