有关Linux 用户登录记录小议

简介

服务器通常会打开远程连接端口。 此时，我们就会关注用户登录记录。

在 Linux 上，有关用户登录的信息记录在 utmp(/var/run/utmp)、wtmp(/var/log/wtmp)、btmp(/var/log/btmp) 和 lastlog(/var/log/lastlog) 等文件中。

查看当前登录着的用户

who、w 和 users 等命令通过 utmp(/var/run/utmp) 文件查询当前登录用户的信息。

w

会有系统对应的启动信息，登录用户数，负载，和登录用户信息，信息比较多。

11:25:23 up 36 min, 1 user, load average: 0.00, 0.01, 0.02USER TTY FROM LOGIN@ IDLE JCPU PCPU WHATroot pts/1 manjaro.example.com 11:15 3.00s 0.05s 0.00s w

who

用户名，终端，登录时间(主机 IP 或者对应的域名)

root pts/1 2020-03-23 11:15 (manjaro.example.com)

users

这个就直接显示登录的用户，没有其他信息，信息比较简洁。

root

历史用户登录信息

last 和 ac 命令通过 wtmp (/var/log/wtmp) 文件查询当前与过去登录系统的用户的信息。

last

root pts/0 manjaro.example. Mon Mar 23 11:26 still logged inroot pts/1 gateway Mon Mar 23 11:15 - 11:26 (00:11)root pts/0 gateway Mon Mar 23 11:14 - 11:15 (00:00)reboot system boot 3.10.0-1062.18.1 Mon Mar 23 10:48 - 11:29 (00:41)reboot system boot 3.10.0-1062.18.1 Mon Mar 23 10:47 - 10:48 (00:00)root pts/0 gateway Mon Mar 23 10:37 - down (00:10)root pts/0 gateway Mon Mar 23 10:37 - 10:37 (00:00)reboot system boot 3.10.0-957.el7.x Mon Mar 23 10:35 - 10:47 (00:11)wtmp begins Mon Mar 23 10:35:50 2020

ac –debug

这个命令，默认没有安装

yum -y install psacct

可以通过 yum 直接安装

ac --debug---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-957.el7.x86_64 |Mon Mar 23 10:35:50 2020/var/log/wtmp:1: problem: time warp (Thu Jan 1 08:00:00 1970 -> Mon Mar 23 10:35:50 2020)---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-957.el7.x86_64 |Mon Mar 23 10:35:53 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 1814| |Mon Mar 23 10:35:53 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 1814| |Mon Mar 23 10:35:53 2020---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 3641|gateway |Mon Mar 23 10:37:03 2020** pts/0 root Mon Mar 23 10:37:03 2020---------------------------------------------------------------------------CURRENT REC: |pts/0 |8| | 3637| |Mon Mar 23 10:37:07 20200.00 root (logout)---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 3685|gateway |Mon Mar 23 10:37:24 2020** pts/0 root Mon Mar 23 10:37:24 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |8|tty1| 1814| |Mon Mar 23 10:47:37 2020/var/log/wtmp:8: problem: missing login record for `tty1'** pts/0 root Mon Mar 23 10:37:24 2020---------------------------------------------------------------------------CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-957.el7.x86_64 |Mon Mar 23 10:47:38 20200.17 root (shutdown)---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:47:46 2020---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:47:50 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 616| |Mon Mar 23 10:47:50 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 616| |Mon Mar 23 10:47:50 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |8|tty1| 616| |Mon Mar 23 10:47:59 2020/var/log/wtmp:14: problem: missing login record for `tty1'---------------------------------------------------------------------------CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:01 2020---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:25 2020---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:27 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 617| |Mon Mar 23 10:48:27 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 617| |Mon Mar 23 10:48:27 2020---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 8379|gateway |Mon Mar 23 11:14:46 2020** pts/0 root Mon Mar 23 11:14:46 2020---------------------------------------------------------------------------CURRENT REC: root |pts/1 |7|ts/1| 8401|gateway |Mon Mar 23 11:15:07 2020** pts/0 root Mon Mar 23 11:14:46 2020** pts/1 root Mon Mar 23 11:15:07 2020---------------------------------------------------------------------------CURRENT REC: |pts/0 |8| | 8376| |Mon Mar 23 11:15:45 20200.02 root (logout)** pts/1 root Mon Mar 23 11:15:07 2020---------------------------------------------------------------------------CURRENT REC: |pts/1 |8| | 8398| |Mon Mar 23 11:26:51 20200.20 root (logout)---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 8511|manjaro.example.com |Mon Mar 23 11:26:52 2020** pts/0 root Mon Mar 23 11:26:52 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |8|tty1| 617| |Mon Mar 23 11:31:45 2020/var/log/wtmp:25: problem: missing login record for `tty1'** pts/0 root Mon Mar 23 11:26:52 2020---------------------------------------------------------------------------CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:47 20200.08 root (shutdown)---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:54 2020---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:56 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 605| |Mon Mar 23 11:31:56 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 605| |Mon Mar 23 11:31:56 2020---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 1192|manjaro.example.com |Mon Mar 23 11:32:02 2020** pts/0 root Mon Mar 23 11:32:02 20200.07 root (catch-up)total 0.53

查看登录失败记录

lastb 命令通过 btmp(/var/log/btmp) 文件查询所有登录系统失败的用户的信息。

lastb

admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)

btmp begins Mon Mar 23 11:38:00 2020

所有用户最后一次登录记录

lastlog 命令通过 lastlog(/var/log/lastlog) 文件查询用户最后一次登录的信息。

lastlog

Username Port From Latestroot pts/0 manjaro.example. Mon Mar 23 11:32:02 +0800 2020bin **Never logged in**daemon **Never logged in**adm **Never logged in**lp **Never logged in**sync **Never logged in**shutdown **Never logged in**halt **Never logged in**mail **Never logged in**operator **Never logged in**games **Never logged in**ftp **Never logged in**nobody **Never logged in**systemd-network **Never logged in**dbus **Never logged in**polkitd **Never logged in**sshd **Never logged in**postfix **Never logged in**chrony **Never logged in**jalright pts/1 Mon Mar 23 11:15:40 +0800 2020