On Sun, Feb 19, 2012 at 11:36:38AM -0800, Denis Heidtmann wrote: > I think the core of my question is what is the likely result of my > saying YES to the login request?
Use `last | less` and see who actually logged in when you did the approval, then see what they did while logged on. For instance, mine looks like: michael pts/3 shed.jamhome.us Sun Feb 19 13:29 still logged in michael pts/0 shed.jamhome.us Sun Feb 19 10:28 still logged in gritton pts/3 c-174-52-130-208 Mon Feb 13 21:53 - 21:53 (00:00) michael pts/1 shed.jamhome.us Mon Feb 13 15:50 still logged in michael pts/0 hive.michaelsnet Sun Feb 12 05:16 - 06:10 (00:53) gritton pts/0 c-174-52-133-59. Sun Feb 5 19:15 - 19:16 (00:01) michael pts/4 shed.jamhome.us Sun Feb 5 05:14 - 05:33 (00:19) wtmp begins Sun Feb 5 05:14:05 2012 There's me logging in from two other hosts on the local net and (Jamie) Gritton logging in for a minute or so once a week. Alternatively you can examine /var/log/auth.log for the time you're intested in and see if you approved an ftp, ssh or ____? login -- Michael Rasmussen, Portland Oregon Other Adventures: http://www.jamhome.us/ or http://westy.saunter.us/ Fortune Cookie Fortune du jour: Don't forget to thank your angel. ~ http://someoneoncetoldme.com/gallery/23052008 _______________________________________________ PLUG mailing list PLUG@lists.pdxlinux.org http://lists.pdxlinux.org/mailman/listinfo/plug