Самый простой вариант - проверить /var/log/auth.log:
grep username /var/log/auth.log
Так же можно воспользоватьтся командой last:
$ last and3001
and3001 tty7 :0 Wed Apr 24 16:25 gone - no logout
and3001 tty8 :1 Wed Apr 24 16:24 - down (00:00)
and3001 tty7 :0 Tue Apr 23 20:12 - down (20:06)
and3001 tty7 :0 Tue Apr 23 18:30 - crash (01:42)
(...SNIP...)
and3001 tty7 :0 Tue Apr 2 16:52 - down (00:31)
and3001 tty7 :0 Tue Apr 2 03:14 - crash (13:37)
И еще может помочь lastlog:
$ lastlog
Username Port From Latest
root **Never logged in**
daemon **Never logged in**
bin **Never logged in**
sys **Never logged in**
(...SNIP...)
usbmux **Never logged in**
and3001 tty1 Wed Apr 25 04:19:53 -0700 2019
vnstat **Never logged in**