找出谁以我身份登录，使用su

Question

在Linux上，可以（如果他有sudo权限）登录，并控制其他用户帐户/用户名，执行sudo su - username

但有没有办法找出这样登录的人，并使用了我的帐户？

Answer 1

/var/log/auth.log包含ubuntu中的sudo尝试的日志记录信息

Answer 2

您可以使用last命令。

man last：

  

last，lastb - 显示上次登录用户的列表

DESCRIPTION

       last  searches  back through the /var/log/wtmp file (or the file desig‐
       nated by the -f option) and displays a list of all users logged in (and
       out)  since  that  file was created.  One or more usernames and/or ttys
       can be given, in which case last will show only  the  entries  matching
       those  arguments.  Names of ttys can be abbreviated, thus last 0 is the
       same as last tty0.