adminLinux User Session and Login Audit Checklist
User session and login auditing helps system admins understand who accessed a server, from where, when and through which method. This is important for security, troubleshooting and incident response.
Core principle
Login history is operational evidence. If a server changes unexpectedly, first ask who logged in and what changed around that time.
Checklist
- Check currently logged-in users.
- Check recent login history.
- Check failed login attempts.
- Check sudo users.
- Check SSH authorized keys.
- Check authentication logs.
- Identify unknown IPs or users.
- Review commands if shell history is available and trusted.
- Remove or lock unknown users carefully.
- Document access review findings.
Reusable lesson
This applies to VPS security, SSH hardening, hacked server investigation, team access control and production change auditing.
When to Use This Checklist
Use this checklist when reviewing Linux server access, suspected compromise, unknown changes or security hardening.
Required Tools
SSH access, who, w, last, auth logs, sudo group, authorized_keys, user list
Before You Start
Do not delete users before confirming whether they are legitimate service, deployment or admin accounts.
Structured Checklist Steps
- Check active sessions.
- Check login history.
- Check failed logins.
- Review sudo users.
- Review SSH keys.
- Read auth logs.
- Identify unknown access.
- Review shell history if appropriate.
- Lock unknown users carefully.
- Document findings.
Verification Steps
- Active users are known.
- Recent login sources are reviewed.
- Unknown access is investigated.
- Sudo users are accounted for.
- SSH keys are documented.
Rollback Plan
If locking a user breaks deployment or service access, restore minimum required access and document the account purpose clearly.
Common Mistakes
- Ignoring failed login patterns.
- Forgetting authorized_keys.
- Deleting service users blindly.
- Trusting shell history completely after compromise.
- No access inventory.
Related Commands
who
w
last -a | head
lastb | head
getent group sudo
find /home -name authorized_keys -type f -print
sudo tail -n 100 /var/log/auth.log