Mastering Linux Security and Hardening - Second Edition

Generating authentication reports

You can generate user authentication reports without having to define any audit rules. Just use aureport with the -au option switch (remember au, the first two letters of authentication):

[donnie@localhost ~]$ sudo aureport -au[sudo] password for donnie:Authentication Report============================================# date time acct host term exe success event============================================1. 10/28/2017 13:38:52 donnie localhost.localdomain tty1 /usr/bin/login yes 942. 10/28/2017 13:39:03 donnie localhost.localdomain /dev/tty1 /usr/bin/sudo yes 1023. 10/28/2017 14:04:51 donnie localhost.localdomain /dev/tty1 /usr/bin/sudo yes 147. . .. . .239. 12/12/2017 11:50:20 charlie 192.168.0.222 ssh /usr/sbin/sshd ...