How to detect which user has logged from one server to another(root access only)

Question

The question seems to be quite confusing plz go through it slowly.

We have 2 servers loadbuild/clearcase in which every user has a unique ID and another one is the lab(running on wind-river linux) to which any loadbuild/clearcase user can ssh as **root**@192.xxx.xx from the loadbuild/clearcase server.

If you observe every loadbuild/clearcase user accesses the lab as a same user ie root I wish to find out which user has logged in to the lab and at what time or has given an ssh **root**@192.xxx.xx from loadbuild/clearcase server to the lab.

Answer 1

You can try following commands on all your servers and see the logging details.

 utmpdump /var/log/wtmp

If you login as root/or any other user, then that detail will be avialble on your loadbuild/clearcase server.

Answer 2

The lastlog command will show you who's logged in, when they logged in, and from where they came from.

Sample output:

Username         Port     From             Latest
root             pts/1    192.168.1.150    Wed Dec 18 16:57:55 -0500 2013