On January 8, 2004 12:38 pm, Michael Sullivan wrote: > In my daily logwatch I am seeing in the sshd section multiple ssh > logins, but they do not say which user logged on. I know there's been > an "ssh is broken" chain of posts, but I haven't been reading them. Is > there a way that I can stop these accesses or at least see where they > are coming from? Thanks! > > -Michael Sullivan- Logwatch should be giving you full info, but... You can look in your logs: grep -i ssh /var/log/secure You should see lines that include something like: sshd[9367]: Accepted publickey for <userid> from <IP> port 33488 ssh2 You can search the archives for the posts you missed at: http://marc.theaimsgroup.com/?l=redhat-list&r=1&w=2 -- Pete Nesbitt, rhce -- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list
