Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to find out which user screwed up the ssh config. There's nothing in anyone's bash history. But I did see when a bunch of ssh-related errors in the logs that started at a specific time.

I'm thinking I could narrow it down by finding out who was logged on then. Is this possible on linux?

(On a side note: this is for a class, the other users are my classmates, they're doing the same thing, and we're all aware that everyone is snooping on our activity)

share|improve this question

Check the output of lastlog. Check also utmp(5).

share|improve this answer
It might pay to mention that last outputs the info ... – tink Apr 8 '13 at 2:00

You can check with /var/log/secure file

/var/log/secure Contains information related to authentication and authorization privileges. For example ssh logs all the messages here, including unsuccessful login.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.