In Linux system environment, wher it's a root user or or users, after logging in and performing operations, we can use history command to view history records. But if multiple people log in to a server, and someone accidentally deletes important data one day, n checking history records (using history command) is not very helpful. Because history only works for user who logs in, even root user cannot get history of or users. So, is re any way to record IP address of login and history of operations of a certain username? The answer is yes.

Using last Command to View Login History and IP

这东西... By adding following code to vi /etc/profile file, you can achieve this: (Enter vi and press i to enter insert mode. After entering code, press esc to cancel insert mode, n press :wq to s*e and exit)

PS1= ...

Example Output of last Command

Here is an example output of last command:

$ last -f /var/log/wtmproot
    pts/0        192.168.1.100   Fri Apr 14 09:00   still logged in
    root     pts/0        192.168.1.100   Thu Apr 13 17:32 - 18:25  (00:52)
    root     pts/0        192.168.1.100   Thu Apr 13 17:00 - 17:32  (00:32)

From above output, we can see login history information recorded in /var/log/wtmp file.

Using lastlog Command to View Last Login Information

The lastlog command can view last login information of all users in system, including username, login time, and login IP address. When using lastlog, you can add -u parameter to view login information of a specified user. For example:

$ lastlog -u root
    Username         Port     From             Latest
    root             pts/0    192.168.1.100    Fri Apr 14 09:00:01 +0800 2025

The above output shows last login time and IP address of root user.，多损啊！

Using fail2ban to Monitor and Block Suspicious IP Addresses

fail2ban is a very powerful tool that can monitor system logs and automatically block access from suspicious IP addresses according to configuration. This can effectively prevent brute force attacks and DDoS attacks.

Monitoring User Login IP Addresses

In addition to viewing login history, we can also take some measures to monitor login IP addresses of users to improve overall security of system.

Conclusion

By using above methods, we can effectively monitor login IP addresses of users in Linux systems and improve overall security of system.

This HTML document is a basic representation of an article with incorrect grammar, misspellings, and a lack of proper formatting to resemble a poorly written piece by someone who may not h*e been educated.

---