Monitoring Remote logins to Linux server.

Remote login enabled servers have greater vulnerability so it is always recommended to monitor the remote access to the server. Remote access detailes are logged in to a file, /var/log/wtmp.

Since this is a binary file, use the following command to print the out put to screen.

utmpdump /var/log/wtmp | less

Scan through the remote login IPs and you if found any login attempts from undesirable sources, you may block them.