With this line, we can check how many times our users had logged in with SSH:
cat /etc/passwd | cut -d ":" -f 1 | sort | uniq | while read line ; do echo -n $line" "; zgrep "user $line" /var/log/auth.log* | grep -i ssh | grep -vi fail | grep -vi invalid | wc -l; done | sort -n -r -k 2
On my system, the only user which has logged in was my own user:
filipi 52
And for non SSH logins:
cat /etc/passwd | cut -d ":" -f 1 | sort | uniq | while read line ; do echo -n $line" "; zgrep "user $line" /var/log/auth.log* | grep -vi fail | grep -vi invalid | wc -l; done | sort -n -r -k 2
cat /etc/passwd | cut -d ":" -f 1 | sort | uniq | while read line ; do echo -n $line" "; zgrep "user $line" /var/log/auth.log* | grep -i ssh | grep -vi fail | grep -vi invalid | wc -l; done | sort -n -r -k 2
On my system, the only user which has logged in was my own user:
filipi 52
And for non SSH logins:
cat /etc/passwd | cut -d ":" -f 1 | sort | uniq | while read line ; do echo -n $line" "; zgrep "user $line" /var/log/auth.log* | grep -vi fail | grep -vi invalid | wc -l; done | sort -n -r -k 2
Comments
Post a Comment