ssh ip logs

Linux and Unix-Like Linux
1

Hi All,

Where can I find the ssh logs the list of IPs connected (or failed) to the server?

Or I need to enable that on openssh? Where?

Right now, I can only see failed login on /var/log/messages like below

Feb  5 17:30:12 localhost pam_tally[18936]: pam_tally: pam_get_uid; no such user admin
Feb  5 17:30:12 localhost PAM-Wheel[18936]: unknown user admin
Feb  5 17:33:59 localhost pam_tally[20027]: pam_tally: pam_get_uid; no such user admin2
Feb  5 17:33:59 localhost PAM-Wheel[20027]: unknown user admin2

Thank you for any comments you may add.

---------- Post updated at 05:46 PM ---------- Previous update was at 05:41 PM ----------

Still no luck. The admin user that I'm investigation is not on /var/log/secure*.

I wonder where it coming from, I checked all the crontab scripts, it's not there.

---------- Post updated at 06:15 PM ---------- Previous update was at 05:46 PM ----------

Where is this coming from

Feb  5 17:30:12 localhost pam_tally[18936]: pam_tally: pam_get_uid; no such user admin
Feb  5 17:30:12 localhost PAM-Wheel[18936]: unknown user admin

No log on /var/log/secure. I tried ssh, ftp and sftp. Everything is being log on secure but the log coming from admin is no where log on secure. That admin2, I'm the one who did that but it's log on secure.

2

how about /var/log/auth.log

3

Nope, it's not there too because I did below

cd /var/log

grep admin *

and that didn't get any findings

and that log didn't exist on my red hat ent 4...

4

Hi,

You can excute the last command

#last with various options to see who are all the users logged into the system via ssh and also locally.

Thanks,
R.Gopinath