Keep Track Of User Logins

locations is a simple script which can be used to display the locations from which users logged onto your machine from.

This was inspired by a similar script discussed in the Perl For System Administration book from O Reilly.

By default this script will display all the users who have logged into your box from more than three distinct locations - this may be tweaked via the '--count=N' argument.

Alternatively you may ask for a report on all the hosts all users have logged in from, via 'locations --show'.


The script is written in perl, and requires the use of a GNU last command. If you're running a Debian GNU/Linux system you will have this. (Basically I require the presence of the '-a' flag to last, this allows the hostname to be correctly identified without truncation).


You may also download this package from my apt-get repository. Alternatively you can find the source code below.


Download the tarball and run 'make install' to install the script to /usr/sbin, and the documentation to /usr/local/share.

After that create a crontab entry either in your personal file, or under the system wide /etc/cron.{daily weekly} directory:

# Report on users who have logged in from more than five machines -
# this is potentially suspicious.
0 0 * * * /usr/sbin/locations --count=5

This will cause the script to be run daily, or weekly.