[Linux] lastlog

/etc/passw파일에 정의되어 있는 모든 계정의 최근접속정보를 확인하는 명령어입니다. 주로 서버의 보안점검을 위하여 필수적으로 확인해보아야하는 명령어입니다. 간단히 lastlog라고만 하면 모든 계정의 마지막 접속정보를 출력해줍니다. 사용형식        lastlog [-u login-name] [-t days] 사용예 #1 간단히 lastlog라고만 하면 다음과 같이 서버의 모든 계정에 대한 최근접속정보를 확인할 수 있습니다. [root@host3 bin]# lastlog Username         Port     From             Latest root             pts/1    192.168.0.2      금 10월  3 22:08:03 +0900 2003 bin                                        **Never logged in** daemon                                     **Never logged in** adm                                        **Never logged in** lp                                         **Never logged in** sync                                       **Never logged in** shutdown                                   **Never logged in** halt                                       **Never logged in** mail                                       **Never logged in** news                                       **Never logged in** uucp                                       **Never logged in** operator                                   **Never logged in** games                                      **Never logged in** gopher                                     **Never logged in** ftp                                        **Never logged in** nobody                                     **Never logged in** ntp                                        **Never logged in** rpc                                        **Never logged in** vcsa                                       **Never logged in** nscd                                       **Never logged in** sshd                                       **Never logged in** rpm                                        **Never logged in** mailnull                                   **Never logged in** smmsp                                      **Never logged in** rpcuser                                    **Never logged in** nfsnobody                                  **Never logged in** pcap                                       **Never logged in** xfs                                        **Never logged in** wnn                                        **Never logged in** named                                      **Never logged in** gdm                                        **Never logged in** desktop                                    **Never logged in** postgres                                   **Never logged in** apache                                     **Never logged in** postfix                                    **Never logged in** squid                                      **Never logged in** webalizer                                  **Never logged in** bible            pts/2    192.168.0.2      목  9월 18 23:44:18 +0900 2003 bible1           pts/2    192.168.0.202    목  9월 18 23:46:11 +0900 2003 bible2           pts/3    192.168.0.111    목  9월 18 23:46:56 +0900 2003 sspark                                     **Never logged in** bible5                                     **Never logged in** mysql                                      **Never logged in** [root@host3 bin]# 사용예 #2 만약 특정계정만의 최근접속정보를 확인하고자 한다면 다음과 같이 -u 옵션과 함께 사용하시면 됩니다.   [root@host3 bin]# lastlog -u bible Username         Port     From             Latest bible            pts/2    192.168.0.2      목  9월 18 23:44:18 +0900 2003 [root@host3 bin]# 사용예 #3 lastlog는 최근 몇일까지의 마지막접속정보를 확인할 수도 있습니다. 다음은 최근 30일까지의 최근접속정보를 확인한 것입니다. [root@host3 bin]# lastlog -t 30 Username         Port     From             Latest root             pts/1    192.168.0.2      금 10월  3 22:08:03 +0900 2003 bible            pts/2    192.168.0.2      목  9월 18 23:44:18 +0900 2003 bible1           pts/2    192.168.0.202    목  9월 18 23:46:11 +0900 2003 bible2           pts/3    192.168.0.111    목  9월 18 23:46:56 +0900 2003 [root@host3 bin]#