I need to find out which user screwed up the ssh config. There's nothing in anyone's bash history. But I did see when a bunch of ssh-related errors in the logs that started at a specific time.

I'm thinking I could narrow it down by finding out who was logged on then. Is this possible on linux?

(On a side note: this is for a class, the other users are my classmates, they're doing the same thing, and we're all aware that everyone is snooping on our activity)


Check the output of lastlog. Check also utmp(5).

| improve this answer | |
  • It might pay to mention that last outputs the info ... – tink Apr 8 '13 at 2:00

You can check with /var/log/secure file

/var/log/secure Contains information related to authentication and authorization privileges. For example ssh logs all the messages here, including unsuccessful login.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.