簡(jiǎn)介

服務(wù)器通常會(huì)打開(kāi)遠(yuǎn)程連接端口。 此時(shí)，我們就會(huì)關(guān)注用戶登錄記錄。

在 Linux 上，有關(guān)用戶登錄的信息記錄在 utmp(/var/run/utmp)、wtmp(/var/log/wtmp)、btmp(/var/log/btmp) 和 lastlog(/var/log/lastlog) 等文件中。

查看當(dāng)前登錄著的用戶

who、w 和 users 等命令通過(guò) utmp(/var/run/utmp) 文件查詢當(dāng)前登錄用戶的信息。

w

會(huì)有系統(tǒng)對(duì)應(yīng)的啟動(dòng)信息，登錄用戶數(shù)，負(fù)載，和登錄用戶信息，信息比較多。

11:25:23 up 36 min, 1 user, load average: 0.00, 0.01, 0.02USER TTY FROM LOGIN@ IDLE JCPU PCPU WHATroot pts/1 manjaro.example.com 11:15 3.00s 0.05s 0.00s w

who

用戶名，終端，登錄時(shí)間(主機(jī) IP 或者對(duì)應(yīng)的域名)

root pts/1 2020-03-23 11:15 (manjaro.example.com)

users

這個(gè)就直接顯示登錄的用戶，沒(méi)有其他信息，信息比較簡(jiǎn)潔。

root

歷史用戶登錄信息

last 和 ac 命令通過(guò) wtmp (/var/log/wtmp) 文件查詢當(dāng)前與過(guò)去登錄系統(tǒng)的用戶的信息。

last

root pts/0 manjaro.example. Mon Mar 23 11:26 still logged inroot pts/1 gateway Mon Mar 23 11:15 - 11:26 (00:11)root pts/0 gateway Mon Mar 23 11:14 - 11:15 (00:00)reboot system boot 3.10.0-1062.18.1 Mon Mar 23 10:48 - 11:29 (00:41)reboot system boot 3.10.0-1062.18.1 Mon Mar 23 10:47 - 10:48 (00:00)root pts/0 gateway Mon Mar 23 10:37 - down (00:10)root pts/0 gateway Mon Mar 23 10:37 - 10:37 (00:00)reboot system boot 3.10.0-957.el7.x Mon Mar 23 10:35 - 10:47 (00:11)wtmp begins Mon Mar 23 10:35:50 2020

ac –debug

這個(gè)命令，默認(rèn)沒(méi)有安裝

yum -y install psacct

可以通過(guò) yum 直接安裝

ac --debug---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-957.el7.x86_64 |Mon Mar 23 10:35:50 2020/var/log/wtmp:1: problem: time warp (Thu Jan 1 08:00:00 1970 -> Mon Mar 23 10:35:50 2020)---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-957.el7.x86_64 |Mon Mar 23 10:35:53 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 1814| |Mon Mar 23 10:35:53 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 1814| |Mon Mar 23 10:35:53 2020---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 3641|gateway |Mon Mar 23 10:37:03 2020** pts/0 root Mon Mar 23 10:37:03 2020---------------------------------------------------------------------------CURRENT REC: |pts/0 |8| | 3637| |Mon Mar 23 10:37:07 20200.00 root (logout)---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 3685|gateway |Mon Mar 23 10:37:24 2020** pts/0 root Mon Mar 23 10:37:24 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |8|tty1| 1814| |Mon Mar 23 10:47:37 2020/var/log/wtmp:8: problem: missing login record for `tty1'** pts/0 root Mon Mar 23 10:37:24 2020---------------------------------------------------------------------------CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-957.el7.x86_64 |Mon Mar 23 10:47:38 20200.17 root (shutdown)---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:47:46 2020---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:47:50 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 616| |Mon Mar 23 10:47:50 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 616| |Mon Mar 23 10:47:50 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |8|tty1| 616| |Mon Mar 23 10:47:59 2020/var/log/wtmp:14: problem: missing login record for `tty1'---------------------------------------------------------------------------CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:01 2020---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:25 2020---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:27 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 617| |Mon Mar 23 10:48:27 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 617| |Mon Mar 23 10:48:27 2020---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 8379|gateway |Mon Mar 23 11:14:46 2020** pts/0 root Mon Mar 23 11:14:46 2020---------------------------------------------------------------------------CURRENT REC: root |pts/1 |7|ts/1| 8401|gateway |Mon Mar 23 11:15:07 2020** pts/0 root Mon Mar 23 11:14:46 2020** pts/1 root Mon Mar 23 11:15:07 2020---------------------------------------------------------------------------CURRENT REC: |pts/0 |8| | 8376| |Mon Mar 23 11:15:45 20200.02 root (logout)** pts/1 root Mon Mar 23 11:15:07 2020---------------------------------------------------------------------------CURRENT REC: |pts/1 |8| | 8398| |Mon Mar 23 11:26:51 20200.20 root (logout)---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 8511|manjaro.example.com |Mon Mar 23 11:26:52 2020** pts/0 root Mon Mar 23 11:26:52 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |8|tty1| 617| |Mon Mar 23 11:31:45 2020/var/log/wtmp:25: problem: missing login record for `tty1'** pts/0 root Mon Mar 23 11:26:52 2020---------------------------------------------------------------------------CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:47 20200.08 root (shutdown)---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:54 2020---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:56 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 605| |Mon Mar 23 11:31:56 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 605| |Mon Mar 23 11:31:56 2020---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 1192|manjaro.example.com |Mon Mar 23 11:32:02 2020** pts/0 root Mon Mar 23 11:32:02 20200.07 root (catch-up)total 0.53

查看登錄失敗記錄

lastb 命令通過(guò) btmp(/var/log/btmp) 文件查詢所有登錄系統(tǒng)失敗的用戶的信息。

lastb

admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)

btmp begins Mon Mar 23 11:38:00 2020

所有用戶最后一次登錄記錄

lastlog 命令通過(guò) lastlog(/var/log/lastlog) 文件查詢用戶最后一次登錄的信息。

lastlog

Username Port From Latestroot pts/0 manjaro.example. Mon Mar 23 11:32:02 +0800 2020bin **Never logged in**daemon **Never logged in**adm **Never logged in**lp **Never logged in**sync **Never logged in**shutdown **Never logged in**halt **Never logged in**mail **Never logged in**operator **Never logged in**games **Never logged in**ftp **Never logged in**nobody **Never logged in**systemd-network **Never logged in**dbus **Never logged in**polkitd **Never logged in**sshd **Never logged in**postfix **Never logged in**chrony **Never logged in**jalright pts/1 Mon Mar 23 11:15:40 +0800 2020