SSH connection

[Deepa_4]

Hi,

I want to know the users(IP address of other machines) who ssh in to my machine.
How can I ?

Thanks,
Deepa

[Claudio Cilloni]

I don't know exactly who to know who is logged through ssh, but with the command

# w

you can see generally who is logged, and in the 'FROM' column you have the host name/ip address of the remote machine. If the FROM column says '-', it means it is a local user.

Ciao
Claudio

[Steven E. Protter]

who -l will attempt to provide a hostname or provide the ip addy.

[root@jerusalem root]# who -l
root pts/0 Oct 28 07:19 (hpweb.investmenttool.com)



who -q --count
# gets you a count.
last

SEP

[Jerome Henry]

Hi,
Try who
[root@jh root]# who
usul :0 Oct 28 10:30
usul pts/0 Oct 28 12:39 (:0.0)
root pts/1 Oct 28 14:23 (192.168.152.126)


hth

J

[Alexander Chuzhoy]

simple:
netstat |grep ssh

[Brian Bergstrand]

Check auth.log and system.log too. SSH should log connections by default. If it's not logging, then enable logging in sshd_config (LOG_LEVEL).

HTH.

[Huc_1]

I use this for that

# lsof -i

also and more specificly.

# lsof -i | grep -i "ssh"

lsof usualy is found in /usr/sbin/lsof

read man lsof this is an extremely versatil tool.


J-P

[frans tigelaar]

Hi,

You can edit your config files:

vi /etc/ssh/sshd_config
-----
# FT - Level = DEBUG instead of INFO edit also /etc/syslog.conf
LogLevel DEBUG

vi /etc/syslog.conf
-----
# FT - This will dump ssh connections to log.
*.=debug /var/log/debug.log
auth.* /var/log/auth.log

[K.C. Chan]

check out your secure log in /var/log dir.