Command to know ALL IP login from X user ?

000

• August 21, 2014 05:54

Hi, As user root, I need know ALL IP from where X user connect to server using cPanel. How I can know this please ? And how know all login into FTP ? Thanks

• 

  server9host

  • August 21, 2014 11:11

  Hello, Using below command you can check cPanel server user IP and FTP user IP : For cPanel use coomand : netstat -n | grep :2083 For WHM use coomand : netstat -n | grep :2087 For FTP use coomand : netstat -n | grep :21

  0
• 

  000

  • August 21, 2014 11:57

  [quote="server9host, post: 1713332">For cPanel use coomand : netstat -n | grep :2083
  Thanks. root@hn [~]# netstat -n | grep :2083 root@hn [~]# We like know some as root@hn [~]# list all history IPs connecteds to cpanel using username ABC root@hn [~]# list all history IPs connecteds to FTP using username ABC this surely is in LOGS, but how find all IPs useds by user ABC to connect ? Thanks

  0
• 

  24x7server

  • August 21, 2014 12:52

  Hello, For the cPanel login and access logs you will have to check : /usr/local/cpanel/logs/access_log file grep ABC /usr/local/cpanel/logs/access_log
  And for the FTP, Please try with the following command grep ABC /var/log/messages
  

  0
• 

  000

  • August 21, 2014 14:26

  Thanks![quote="24x7server, post: 1713401">grep ABC /usr/local/cpanel/logs/access_log
  
  Yes!, is tru, show any access to cPanel. :) [quote="24x7server, post: 1713401">grep ABC /var/log/messages
  
  Ouch!, just I need logs by IP of access of user ABC, but you command return empty:root@hn [~]# grep user /var/log/messages root@hn [~]#
  :( Please... Some command to show list of IPs of access log of user ABC Thanks!

  0
• 

  cPanelMichael

  • August 21, 2014 15:14

  Hello :) You may also find the following log file helpful for cPanel/WHM logins: /usr/local/cpanel/logs/login_log FTP activity is logged to /var/log/messages but it's possible there was no FTP activity for that user if you do not see any entries. Thank you.

  0
• 

  000

  • August 21, 2014 17:07

  [quote="cPanelMichael, post: 1713671">FTP activity is logged to /var/log/messages but it's possible there was no FTP activity for that user if you do not see any entries.
  Thanks. The this user YES login ! And the pont is: in /home/ABC/www/ exist files: grafic_XXX_1.jpg grafic_XXX_2.jpg grafic_XXX_3.jpg but user ABC say "I no upload, maybe a hacker..." Then I need detect FROM WHAT IP the user ABC upload this files XXX by FTP "how I see IPs LOG to USER ABC connection FTP ? Thanks

  0
• 

  cPanelMichael

  • August 21, 2014 17:54

  Did you check the cPanel access log to see if the files were uploaded via File Manager? Or, you can check the domain access logs to see if the files were uploaded through a PHP script (/usr/local/apache/domlogs/$username/). Thank you.

  0
• 

  000

  • August 21, 2014 19:20

  [quote="cPanelMichael, post: 1713892">Did you check the cPanel access log to see if the files were uploaded via File Manager? Or, you can check the domain access logs to see if the files were uploaded through a PHP script (/usr/local/apache/domlogs/$username/). Thank you.
  Greath help! Thanks :) ... and how I can check if files maybe upload by FTP ?

  0
• 

  cPanelMichael

  • August 21, 2014 19:28

  FTP activity is logged to /var/log/messages, as previously mentioned. Again, as mentioned, it's possible there is no FTP activity logged for that user. Thank you.

  0
• 

  000

  • August 22, 2014 16:42

  [quote="cPanelMichael, post: 1714062">...it's possible there is no FTP activity logged for that user.
  Thanks. And why no exist log FTP to X user if X user yes log into server from months back? ( we never stop this LOG )

  0
• 

  cPanelMichael

  • August 22, 2014 16:51

  Are you sure the log was not rotated? You might see files named "messages.1, messages.2" if the log was rotated at some point. Thank you.

  0
• 

  000

  • August 23, 2014 13:29

  [quote="cPanelMichael, post: 1714751">You might see files named "messages.1, messages.2" if the log was rotated at some point.
  Thanks. I open and seek into /var/log/messages /var/log/messages-20140810 /var/log/messages-20140817 but in this files no exist the string ABC ( I need find log of user ABC ) Then I try with OTHERS usernames and NOTHING exist. In this files no exist the strings user2 oserzz etc... No exist LOGs of users in server. What is wrong in my cPanel config ?

  0
• 

  cPanelMichael

  • August 25, 2014 16:49

  How are you searching the log files? For instance, are you using the "grep" command? Make sure you use lowercase characters when searching these files. Also, if your logs are rotated then older entries may have already been removed. Thank you.

  0

Please sign in to leave a comment.