Re: [cobalt-users] Last logins

[flash22@xxxxxxx]

On Fri, 19 Jan 2001, Hans van Kilsdonk wrote:

> Hi everyone!
> Here's a part of our last logins (last -50 -a):
> 
> rides1   pts/2        Thu Jan 18 20:14 - 20:16  (00:02)     <hostname>
> trechter pts/2        Thu Jan 18 20:04 - 20:04  (00:00)     <hostname>
...

> Can someone explain if this "intruder" has been in our system? And how can I
> check what he did?¿

Most likely, login doesn't associate a username with a process until
after login has been completed, same for ftp except anonymous...

I'd start with xferlog ans see if anything interesting was
uploaded...assuming you still have any logs ...

Using find to find files that are recent for userid is often interesting..

I'd also look at the mashine you ssh from, ssh is considerably weakened if
someone has access to the matching keys..or if you set it up to not need a
password...