How to log the IP address of anyone who logged in to my account using a remote login?

Question

I have an account on a remote server. I log in to the account using Remote Viewer in Ubuntu, or sometimes with ssh.

How can I log the IP each time someone logs in to my account on the remote server? Is it possible to make a script in the account?

Answer 1

The IP address is most probably already being logged. You haven't given any info on what the remote server really is; you mentioned ssh, so I'm going to assume it's a Linux server.

Linux logs login attempts to syslog. It depends on the distribution on where in particular the log messages you're interested in go, but they are almost certainly somewhere in /var/log, and there's a good chance they go to /var/log/messages. You can find the right file by grepping all files in /var/log for the name of the right program, for example:

grep sshd /var/log/*

Note that the logger daemon needs to be started at boot for logging to work (most probably it is, but some distros don't enable it, like Gentoo).

Answer 2

The command who --ips shows the IP addresses of all users currently logged in. The "who am i" command gives a user his own record only, so who --ips am i will give a user a record like this, showing his IP address:

joe  pts/16  Jul 3  09:07   10.20.0.5

To log just the IP address, you can add a couple of lines in the user's .profile file to capture only the 6th field, something like this:

who --ips am i | awk '{print $6}' >> ip_addr.log

Answer 3

As noted in another answer the information is being logged.

In ubuntu there is a log file call /var/log/auth.log

Jul 4 13:16:27 aaronhost sshd[14326]: Accepted publickey for aaron from 172.16.0.205 port 44961 ssh2 Jul 4 13:16:27 aaronhost sshd[14326]: pam_unix(sshd:session): session opened for user aaron by (uid=0)

Here I logged in as my self in to the same machine. Where my machines hostname is aaronhost.

These links my also be useful http://en.wikipedia.org/wiki/Utmp