Linux: Find out who was logged on when?

Question

I need to find out which user screwed up the ssh config. There's nothing in anyone's bash history. But I did see when a bunch of ssh-related errors in the logs that started at a specific time.

I'm thinking I could narrow it down by finding out who was logged on then. Is this possible on linux?

(On a side note: this is for a class, the other users are my classmates, they're doing the same thing, and we're all aware that everyone is snooping on our activity)

Answer 1

Check the output of lastlog. Check also utmp(5).

Answer 2

You can check with /var/log/secure file

/var/log/secure Contains information related to authentication and authorization privileges. For example ssh logs all the messages here, including unsuccessful login.