Overview

Regularly reviewing who logged in, from where, and what they did helps you detect unauthorised access early. This article covers the built-in tools for auditing logins and active sessions on a Linux Pod.

Before you begin

• Root or sudo access.
• Log rotation keeps old entries for a limited time, so check regularly rather than relying on history from months ago.

Checking who has logged in

1. Recent successful logins:

bash last -a | head -20

1. Failed login attempts:

bash sudo lastb | head -20

1. Currently logged-in users and their activity:

bash who w

1. Authentication log (search for accepted and failed SSH logins):

bash sudo grep "Accepted" /var/log/auth.log sudo grep "Failed password" /var/log/auth.log

On RHEL-family systems the file is /var/log/secure. With systemd, you can query the journal:

bash sudo journalctl -u ssh --since "7 days ago" | grep -i accepted

1. Look for privilege escalation using sudo:

bash sudo grep "sudo:" /var/log/auth.log

1. List listening services and open connections:

bash sudo ss -tulpn

Steps to act on findings

1. Investigate any login from an unexpected country, IP or time.
2. Confirm the account should exist; disable or delete unknown users:

bash sudo passwd -l <user> sudo userdel -r <user>

1. Remove unrecognised SSH keys from ~/.ssh/authorized_keys.
2. Rotate passwords and keys if you suspect compromise.
3. Add Fail2ban and key-only SSH to prevent repeats.

Troubleshooting

• Problem: lastb shows nothing. Solution: On some distributions failed logins are only in the auth log; read /var/log/auth.log or /var/log/secure instead.

Related articles

• [Hardening SSH]
• [Installing and configuring Fail2ban]
• [Incident response: what to do if you are compromised]