replay every login on a linux box with last

your linux box remembers everything, you just have to ask

every time someone logs into a linux machine, whether it's you sshing in from your laptop or something shady poking around at 3am, the system quietly writes that down. no spyware needed, it's baked into the os. the tool that reads this history back to you is called last, and it's one of the fastest ways to check "wait, who's been on this box."

the command

last -5

this pulls the 5 most recent login entries from the system's login records, usually stored in /var/log/wtmp. drop the -5 and it dumps the whole history the log still holds. each line shows you the username, the terminal or session type, the source ip or hostname they connected from, and the login/logout timestamps.

reading the output without getting confused

a typical line looks like this:

root     pts/0        192.168.1.42     Mon Jan 8 14:02   still logged in

break it down left to right: who logged in, which terminal/session they used, where they came from, and when it started along with whether it's still active or when it ended. if you see a login from an ip you don't recognize, or a user account you didn't create, that's your cue to dig deeper, not panic, just investigate.

keep an eye out for a special entry called reboot, it just tells you when the system last restarted, not an actual user session.

why this matters for defense

most people never look at this until something's already gone wrong. that's backwards. checking your login history should be a regular habit, like checking your bank statement. it's how you catch things early:

a login from a country you've never been to. a service account logging in interactively when it should never do that. someone logging in at 4am when your whole household is asleep. these are the small anomalies that forensic investigators live for, and you have the same access they do.

the limits you need to know

last is reading a log file, and log files can be edited or wiped by anyone with root access. if an attacker gets full control of your box, they can clear wtmp and erase their tracks. so treat last as your first check, not your only one. pair it with checking /var/log/auth.log (debian/ubuntu) or /var/log/secure (rhel/centos) for more detail on authentication attempts, including failed ones that last won't show you.

lastb -10

that variant, lastb, shows failed login attempts instead of successful ones. if you're seeing a pile of failed logins for accounts that don't exist or shouldn't be reachable remotely, that's a sign someone's knocking on your door.

the takeaway

run last -5 right now on any linux box you own. it takes two seconds and costs nothing. make it a habit, weekly if you're paranoid, monthly if you're not. if something looks off, don't just delete the account and move on, pull the auth logs, check what that session actually did, and lock down ssh with key based auth and fail2ban so brute forcing isn't even an option. the goal isn't to become a full time incident responder, it's to know your own system well enough that when something's wrong, you notice immediately instead of six months later.