How can I track who SSH'es into my linux machine?
The information of who logged in when is available in /var/log/auth.log
(or other log files on other distributions). There are multiple log monitoring programs that can extract the information you configure as relevant. On any sane system, every user authentication is logged.
To log every command invocation (but not their arguments), use process accounting, provided by the acct
package on Ubuntu. If the accounting subsystem is up and running, then lastcomm
shows information about finished processes.
You can also use who
or w
to see who is currently logged in to the system, including SSH users.