topic Re: SSH connection in Operating System - Linux

SSH connection

Deepa_4 — Tue, 28 Oct 2003 08:01:33 GMT

Hi,

I want to know the users(IP address of other machines) who ssh in to my machine.
How can I ?

Thanks,
Deepa

Re: SSH connection

Claudio Cilloni — Tue, 28 Oct 2003 08:11:24 GMT

I don't know exactly who to know who is logged through ssh, but with the command

# w

you can see generally who is logged, and in the 'FROM' column you have the host name/ip address of the remote machine. If the FROM column says '-', it means it is a local user.

Ciao
Claudio

Re: SSH connection

Steven E. Protter — Tue, 28 Oct 2003 08:21:49 GMT

who -l will attempt to provide a hostname or provide the ip addy.

[root@jerusalem root]# who -l
root pts/0 Oct 28 07:19 (hpweb.investmenttool.com)

who -q --count
# gets you a count.
last

SEP

Re: SSH connection

Jerome Henry — Tue, 28 Oct 2003 08:25:57 GMT

Hi,
Try who
[root@jh root]# who
usul :0 Oct 28 10:30
usul pts/0 Oct 28 12:39 (:0.0)
root pts/1 Oct 28 14:23 (192.168.152.126)

hth

J

Re: SSH connection

Alexander Chuzhoy — Tue, 28 Oct 2003 08:49:28 GMT

simple:
netstat |grep ssh

Re: SSH connection

Brian Bergstrand — Tue, 28 Oct 2003 10:14:10 GMT

Check auth.log and system.log too. SSH should log connections by default. If it's not logging, then enable logging in sshd_config (LOG_LEVEL).

HTH.

Re: SSH connection

Huc_1 — Tue, 28 Oct 2003 10:23:02 GMT

I use this for that

# lsof -i

also and more specificly.

# lsof -i | grep -i "ssh"

lsof usualy is found in /usr/sbin/lsof

read man lsof this is an extremely versatil tool.

J-P

Re: SSH connection

frans tigelaar — Mon, 03 Nov 2003 11:16:34 GMT

Hi,

You can edit your config files:

vi /etc/ssh/sshd_config
-----
# FT - Level = DEBUG instead of INFO edit also /etc/syslog.conf
LogLevel DEBUG

vi /etc/syslog.conf
-----
# FT - This will dump ssh connections to log.
*.=debug /var/log/debug.log
auth.* /var/log/auth.log

Re: SSH connection

K.C. Chan — Mon, 03 Nov 2003 22:24:10 GMT

check out your secure log in /var/log dir.