Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to find out which user screwed up the ssh config. There's nothing in anyone's bash history. But I did see when a bunch of ssh-related errors in the logs that started at a specific time.

I'm thinking I could narrow it down by finding out who was logged on then. Is this possible on linux?

(On a side note: this is for a class, the other users are my classmates, they're doing the same thing, and we're all aware that everyone is snooping on our activity)

share|improve this question

Check the output of lastlog. Check also utmp(5).

share|improve this answer
It might pay to mention that last outputs the info ... – tink Apr 8 '13 at 2:00

You can check with /var/log/secure file

/var/log/secure Contains information related to authentication and authorization privileges. For example ssh logs all the messages here, including unsuccessful login.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .