The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Command to know ALL IP login from X user ?

Discussion in 'General Discussion' started by 000, Aug 21, 2014.

  1. 000

    000 Well-Known Member

    Joined:
    Jun 3, 2008
    Messages:
    150
    Likes Received:
    0
    Trophy Points:
    16
    Hi,

    As user root,

    I need know ALL IP from where X user connect to server using cPanel.

    How I can know this please ?

    And how know all login into FTP ?

    Thanks
     
  2. server9host

    server9host Well-Known Member

    Joined:
    Sep 18, 2013
    Messages:
    160
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    India
    cPanel Access Level:
    Root Administrator
    Hello,

    Using below command you can check cPanel server user IP and FTP user IP :

    For cPanel use coomand : netstat -n | grep :2083
    For WHM use coomand : netstat -n | grep :2087
    For FTP use coomand : netstat -n | grep :21
     
  3. 000

    000 Well-Known Member

    Joined:
    Jun 3, 2008
    Messages:
    150
    Likes Received:
    0
    Trophy Points:
    16
    Thanks.

    Code:
    root@hn [~]# netstat -n | grep :2083
    root@hn [~]#[CODE]
    
    We like know some as
    
    root@hn [~]# list all history IPs connecteds to cpanel using username ABC
    root@hn [~]# list all history IPs connecteds to FTP using username ABC
    
    this surely is in LOGS, but how find all IPs useds by user ABC to connect ?
    
    Thanks
     
  4. 24x7server

    24x7server Well-Known Member

    Joined:
    Apr 17, 2013
    Messages:
    1,146
    Likes Received:
    34
    Trophy Points:
    48
    Location:
    India
    cPanel Access Level:
    Root Administrator
    Hello,


    For the cPanel login and access logs you will have to check : /usr/local/cpanel/logs/access_log file

    Code:
    grep ABC /usr/local/cpanel/logs/access_log
    And for the FTP, Please try with the following command

    Code:
    grep ABC /var/log/messages
     
  5. 000

    000 Well-Known Member

    Joined:
    Jun 3, 2008
    Messages:
    150
    Likes Received:
    0
    Trophy Points:
    16
    Thanks!
    Yes!, is tru, show any access to cPanel.

    :)

    Ouch!, just I need logs by IP of access of user ABC, but you command return empty:
    Code:
    root@hn [~]# grep user /var/log/messages
    root@hn [~]#
    :(

    Please...

    Some command to show list of IPs of access log of user ABC

    Thanks!
     
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    You may also find the following log file helpful for cPanel/WHM logins:

    /usr/local/cpanel/logs/login_log

    FTP activity is logged to /var/log/messages but it's possible there was no FTP activity for that user if you do not see any entries.

    Thank you.
     
  7. 000

    000 Well-Known Member

    Joined:
    Jun 3, 2008
    Messages:
    150
    Likes Received:
    0
    Trophy Points:
    16
    Thanks.

    The this user YES login !

    And the pont is: in /home/ABC/www/
    exist files:

    grafic_XXX_1.jpg
    grafic_XXX_2.jpg
    grafic_XXX_3.jpg

    but user ABC say "I no upload, maybe a hacker..."

    Then I need detect FROM WHAT IP the user ABC upload this files XXX by FTP

    ¿how I see IPs LOG to USER ABC connection FTP ?

    Thanks
     
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Did you check the cPanel access log to see if the files were uploaded via File Manager? Or, you can check the domain access logs to see if the files were uploaded through a PHP script (/usr/local/apache/domlogs/$username/).

    Thank you.
     
  9. 000

    000 Well-Known Member

    Joined:
    Jun 3, 2008
    Messages:
    150
    Likes Received:
    0
    Trophy Points:
    16
    Greath help!

    Thanks :)

    ... and how I can check if files maybe upload by FTP ?
     
  10. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    FTP activity is logged to /var/log/messages, as previously mentioned. Again, as mentioned, it's possible there is no FTP activity logged for that user.

    Thank you.
     
  11. 000

    000 Well-Known Member

    Joined:
    Jun 3, 2008
    Messages:
    150
    Likes Received:
    0
    Trophy Points:
    16
    Thanks.

    And why no exist log FTP to X user if X user yes log into server from months back?

    ( we never stop this LOG )
     
  12. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
  13. 000

    000 Well-Known Member

    Joined:
    Jun 3, 2008
    Messages:
    150
    Likes Received:
    0
    Trophy Points:
    16
    Thanks.

    I open and seek into

    /var/log/messages
    /var/log/messages-20140810
    /var/log/messages-20140817

    but in this files no exist the string

    ABC

    ( I need find log of user ABC )

    Then I try with OTHERS usernames and NOTHING exist.

    In this files no exist the strings

    user2
    oserzz

    etc...

    No exist LOGs of users in server.

    What is wrong in my cPanel config ?
     
  14. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    How are you searching the log files? For instance, are you using the "grep" command? Make sure you use lowercase characters when searching these files. Also, if your logs are rotated then older entries may have already been removed.

    Thank you.
     
Loading...

Share This Page