If you have a Linux server, there is a possibility that you have several users accessing the system. You may want to know who is logged on your system, when a particular user logged to the Linux system. You may also want to know from which IP address your system was accessed.
Even if you don’t have multiple users, someone probably have tried to access your Linux server. Trust me, this may sound weird but it’s a common thing these days for bots to try and access your Linux servers. Don’t believe me? Just check the bad login attempts on your server to see if someone tried to login to your system.
Let me show you how to view the Linux login history so that you are aware of who is accessing your system and from where.
Viewing Linux login history
Linux is very good at keeping logs of everything that goes on your system. Quite naturally, it also stores logs about login and login attempts. The login information is stored in three places:
- /var/log/wtmp – Logs of last login sessions
- /var/run/utmp – Logs of the current login sessions
- /var/log/btmp – Logs of the bad login attempts
Let’s see these things in a bit detail.
1. View history of all logged users
To view the history of all the successful login on your system, simply use the command last.
The output should look like this. As you can see, it lists the user, the IP address from where the user accessed the system, date and time frame of the login. pts/0 means the server was accessed via SSH.
abhi pts/0 126.96.36.199 Wed Mar 13 13:31 still logged in root pts/0 188.8.131.52 Wed Mar 13 13:30 - 13:31 (00:00) servesha pts/0 184.108.40.206 Tue Mar 12 12:07 - 14:25 (02:17) servesha pts/0 220.127.116.11 Tue Mar 5 12:32 - 12:38 (00:06) root pts/0 18.104.22.168 Mon Mar 4 13:35 - 13:47 (00:11) wtmp begins Mon Mar 4 13:35:54 2019
The last line of the output tells you the when was the wtmp log file was created. This is important because if the wtmp file was deleted recently, last command won’t be able to show history of the logins prior to that date.
You may have a huge history of login sessions so it’s better to pipe the output through less command.
2. View login history of a certain user
If you just want to see the login history of a particular user, you can specify the user name with last command.
You’ll see the login information of only the selected user:
last servesha servesha pts/0 22.214.171.124 Tue Mar 12 12:07 - 14:25 (02:17) servesha pts/0 126.96.36.199 Tue Mar 5 12:32 - 12:38 (00:06) wtmp begins Mon Mar 4 13:35:54 2019
3. Display IP addresses in login history instead of hostname
You couldn’t see it in the previous output but by default, last command shows the hostname instead of the IP address of the user. If you are on a sub-network, you’ll probably see only the hostnames.
You can force to display the IP addresses of the previously logged users with the -i option.
4. Display only last N logins
If your system has a good uptime, perhaps your login history would be huge. As I mentioned earlier, you can use the less command or other file viewing commands like head or tail.
Last command gives you the option to display only certain number of login history.
Just replace N with the number you want. You can also combine it with the username.
5. View all the bad login attempts on your Linux server
Now comes the important part: checking the bad login attempts on your server.
You can do that in two ways. You can either use the last command with the btmp log file:
last -f /var/log/btmp
or you can use the lastb command:
Both of these commands will yield the same result. The lastb is actually a link to the last command with the specified file.
root ssh:notty 188.8.131.52 Wed Mar 13 14:34 - 14:34 (00:00) sindesi ssh:notty 184.108.40.206 Wed Mar 13 14:34 - 14:34 (00:00) root ssh:notty 220.127.116.11 Wed Mar 13 14:34 - 14:34 (00:00) sindesi ssh:notty 18.104.22.168 Wed Mar 13 14:34 - 14:34 (00:00) root ssh:notty 22.214.171.124 Wed Mar 13 14:34 - 14:34 (00:00)
Bad logins could be an incorrect password entered by a legitimate user. It could also be a bot trying to brute force your password.
You have to analyze here and see if you recognize the IPs in the log. If there has been too many login attempts from a certain IP with user root, probably someone is trying to attack your system by bruteforcing.
You should deploy Fail2Ban to protect your server in such cases. Fail2Ban will ban such IPs from your server and thus giving your server an extra layer of protection.
I hope this tutorial teach you to view login history in Linux and now you can use this knowledge to better manage and protect your Linux system.
If you liked this article, please share it on social media and subscribe to our newsletter for more Linux related tutorials.