One of my accounts was comprimised, where do I find a log with SSH/FTP logins?

[BianchiDude]

One of my accounts was comprimised, where do I find a log with SSH/FTP logins?

 

[mctDarren]

Try /var/log/secure or /var/log/messages?

 

[rhysmcmurdo]

last

will show you a list of users and when they last logged on (Via ssh).

To view an older file, you can run last -f /var/log/wtmp.(Whatever you want to lookup)

 

[BianchiDude]

Thanks! I found the SSH logins, where do I find the FTP logins?

 

[rhysmcmurdo]

Thanks! I found the SSH logins, where do I find the FTP logins?

/var/log/messages

 

[FrankyKnife]

OMG... thx sooooo much!

i looked for that for months now... everyone says something differerent like ftp..., xferlog..., pureftp..., aaaaaaaaaaaah!

also inside cpanel the ftp logs are not there, only http logs.


...now the ftp logs are called: 'messages' :D lol
(who should this know.. crazy world!?!)