Steve.org.uk

locations is a simple script which can be used to display the locations from which users logged onto your machine from.

This was inspired by a similar script discussed in the Perl For System Administration book from O Reilly.

By default this script will display all the users who have logged into your box from more than three distinct locations - this may be tweaked via the '--count=N' argument.

Alternatively you may ask for a report on all the hosts all users have logged in from, via 'locations --show'.

The script is written in perl, and requires the use of a GNU last command. If you're running a Debian GNU/Linux system you will have this. (Basically I require the presence of the '-a' flag to last, this allows the hostname to be correctly identified without truncation).

Usage is fairly straight-forward and obvious, the following options are supported:

Usage: locations { options }
Options:
    --count N    The maximum number of expected login locations.
    --help       Show this help text.
    --host host  Show all users who logged in from the given host.
    --list       List all users, and the locations from which they logged in.
    --user login Show all hosts from which the given user logged in.
    --version    Show the version number of this script.

Download the tarball and run 'make install' to install the script to /usr/sbin, and the documentation to /usr/local/share.

After that create a crontab entry either in your personal file, or under the system wide /etc/cron.{daily weekly} directory:

# Report on users who have logged in from more than five machines -
# this is potentially suspicious.
0 0 * * * /usr/sbin/locations --count=5

This will cause the script to be run daily, or weekly.

You may also download this package from my apt-get repository. Alternatively you can find the source code below.

• locations-1.1.tar.gz [13k]