I have set up telnet access to my linux box. How do I check to see the history (who, what, when) of who has accessed my machine? Is this possible?

Thanks.

try the command "last" or hit /var/log

I tried the "last" command and it displays the user login only, that is for users physically at the machine. Where in the /var/ directory might I find this info?

How about looking at /var/log/secure
I personaly run this as
#tail -f /var/log/secure > /mywebserver/root/secure &

then I monitor result from my web browser. This log will show you all services logins attempted whether it's telnet, ftp, mail...etc..and when tailing it, you will see it as it happens.
If you really wanna see every single traffic that come thru, try command #tcpdump you can do man on it for options.
But basically to look and find past stuff in linux, you have to check logs and they are usualy under /var/log/*

Hope this helped.

1 members found this post helpful.

When I have some linuxly problems LQ is my place to find solutions.

Are you sure it's not
tail -f /var/log/secure >> /mywebserver/root/secure &

Otherwise that will rewrite the file without appending on it.

Or can you not just make a symlink to /var/log/secure ?