1

lastletter

who命令从/var/adm/utmpx中读取信息
The command reads the binary file
/var/adm/utmpx to obtain this information and information about where
the users logged in from.


The who -m command outputs information about only the current
terminal window.


rusers -l从/usr/lib/netsvc/rusers/rpc.rusersd读取信息


finger -l
finger -m从/etc/passwd文件读取信息


last 从/var/adm/wtmpx文件读取信息
last -n 5 reboot
reboot system boot Wed Feb 20 13:20
reboot system boot Wed Feb 20 13:18
reboot system boot Fri Feb 1 12:46
reboot system boot Thu Jan 17 09:02
reboot system boot Thu Jan 17 08:55

# last user9
user9 console :0 Mon Dec 17 10:38 still logged in
user9 console :0 Fri Dec 14 10:18 - 10:25 (00:07)
(output truncated


You can log failed command-line login attempts in the
/var/adm/loginlog file.默认情况下，此文件不存在，需手动建立
# touch /var/adm/loginlog
# chown root:sys /var/adm/loginlog
# chmod 600 /var/adm/loginlog

su - username

who am i

$ su user2
password: EnterPassword
$ who am i
user1 pts/2 Dec 17 12:18 (129.147.4.12)
An alternative to the who am i command is the who -m command.


whoami    The whoami command resides in the /usr/ucb directory.

$ whoami
user1
$ pwd
/export/home/user1
$ su
password: EnterPassword
# whoami
root



Dec 17 12:35:47 sys41 su: [ID 810491 auth.crit] ’su root’ failed for
usera on /dev/pts/2
会记录到/var/adm/messages下面


/etc/default/su文件里可指定su命令记录的日志位置，默认是/va/adm/sulog文件
# more /var/adm/sulog
SU 10/20 14:50 + console root-sys
SU 10/20 16:55 + pts/2 user3-root
SU 11/05 11:21 - pts/3 user1-root


有密码的用户，在登陆时会经过文件/etc/hosts.equiv 、 $HOME/.rhosts的验证
这两个文件系统默认不存在
The host names in the /etc/hosts.equiv and $HOME/.rhosts files must
be the official name of the host, not one of its alias names.

The /etc/hosts.equiv file is not checked at all if the remote user
requesting local access is the root user.







本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u1/40476/showart_326403.html