[gentoo-user] Re: How send mail when user login on ssh or local ?

[Harry Putnam <reader@newsguy.com>]

Vagner Rodrigues <vagner@litrixlinux.org> writes:

> Hi Folks !
>
>
>  Somebody  know how I to  so send mail with  IP and Date/time  when same
> user login on shell  ( remote or local ) ?
>
> I work with another admin's  and I never told me  when they access and
> for what  my server  to do something,  I try log but this can be erased 
> and maybe mail can help me about access and with this I can Ask about
> this access.

Do you really think the other admins would be erasing logs?

one way to get some input would be to run your own script that calls 
`w' who `who' every half hour and writes it to a file with `>>' redirect.

Then once a day the script could mail you the resulting file.

If the other admins are logging in as root... you would see where they
were logging in from... and possibly identify them that way... also
`w' may give a little hint as to what they are doing.

Some scanning of the output file would reveal quite a lot of info over
time. 

look at `man w' or `man who' for what you would be getting

The output might look something like this...showing who is logged in
and from where:

 w
[...]
USER    TTY FROM              LOGIN@  IDLE WHAT
jhc      p1 pool-173-70-160-  2:36AM     0 /bin/ksh 
cytroic  p3 fw1.appliedcard. 02Jul09 7days screen -x 
st       p4 mais2.cat.utexas Wed07PM 20:26 -bash 
rob      pa 216-239-45-4.goo Sun11PM    27 screen -rd 
dwa      ph 68-116-196-242.d  8:10PM  1:00 -bash 
reader   pk c-98-215-178-110  9:57PM     0 w 
mage     pq c-65-34-215-99.h Fri10PM 5days screen -r 


Or use `who' to get a full print of the remote hosts users are logging
in from:

  who 
jhc      ttyp1    Jul 30 02:36   (pool-173-70-160-108.nwrknj.fios.)
cytroic  ttyp3    Jul  2 13:59   (fw1.appliedcard.com)
st       ttyp4    Jul 29 19:05   (mais2.cat.utexas.edu)
rob      ttypa    Jul 26 23:50   (216-239-45-4.google.com)
dwa      ttyph    Jul 30 20:10   (68-116-196-242.dhcp.oxfr.ma.char)
reader   ttypk    Jul 30 21:57   (c-98-215-178-110.hsd1.in.comcast)
mage     ttypq    Jul 24 22:49   (c-65-34-215-99.hsd1.fl.comcast.n)