Quick command line script for authenticated IPs

Somewhat useful if you feel like your system may be compromised, check out who has logged in recently with:

cat /var/log/auth.log* | grep Accepted | grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | uniq | sort

Leave a Reply