who for ftp

[R. Wood]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Allegedly, on Tue, Mar 31, 2009 at 01:47:39PM -0400, Bob Jonkman stated:
> I have some logins on my server using SCP or SFTP; is there any way to
> see who it is?  The 'who' command only shows SSH and console
> sessions...
> 
> Thanx,
> --Bob.

Interesting question: how to check this in real time?  Would netstat or
lsof be of use?

Another idea that floats to mind (this will check past behaviour, but
not real-time/current behaviour I *think*) is checking users'
'.bash_history' file entries for an 'scp' command.

Example (untested):
# find /home -name '.bash_history' -exec grep -H 'scp' {} \;

I'd be interested to know if anyone knows a bulletproof method to do
this...

HTH,
Raymond
- -- 
"Be Nice, or Leave - By Order of the Management"
(Sign above door, Black Sheep Inn, Wakefield)
GPG Fingerprint: 2E4D 8605 DD48 E80F F893  1C02 B65D 86D9 3B3C 0E03
Encrypted E-mail Preferred
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJ0ooztl2G2Ts8DgMRAqTBAKDCWC684RWpaXN8gic9n1BPJmoZ9ACgkgjU
J03WE2xBj98gqvhR8dsagNY=
=hN31
-----END PGP SIGNATURE-----