قالب وردپرس درنا توس
Home / How To / How to find active SSH connections on Linux

How to find active SSH connections on Linux



If you are a Linux system administrator and responsible for server management, you may often need to know how many ssh connections are active on your server and where the connections come from. There are several commands and tools available in Linux to find the active SSH connections on your server.

In this tutorial, we will show how to find active SSH connections using various methods in Linux.

Prerequisites

  • A server runs Linux operating system.
  • You have root access on that server.

Find active SSH connection with the who command

which is the Linux command line utility used to display a list of users currently logged into server.

Open your terminal and run the who command to find the active connections on your server:

  who 

You should get the following output:

  root pts / 0 2020-05-01 02:37 ( 27.61.161.61)
root pts / 1 2020-05-01 02:39 (45.58.38.21)

As you can see, there are two active SSH connections from IP 27.61.161.61 and 45.58.38.21.

Find active SSH connection with the w command

w is another command line utility that displays information about currently logging in users on your server. This command provides more information than who commands as active sessions and run process on those sessions.

You can run the w command shown below:

  w 

You should get the following output:

  02: 40:07 up 1 day, 18:35, 2 users, load average: 0.02 , 0.02, 0.00
USER PROGRAMS FROM [email protected] IDLE JCPU PCPU WHAT
root pts / 0 27.61.161.61 02:37 1.00s 0.04s 0.01s ssh [email protected]
root pts / 1 45.58.38.21 02:39 1.00s 0.02s 0.00s w

As you can see this command also shows idle time information, source IP, login time, load average value and processes.

Find active SSH connection with ps command

ps command also gives you information about active SSH sessions on your server. It gives you additional information such as PID for the active SSH connections.

You can run the ps command shown below

  ps auxwww | grip sshd: | grep -v grep 

You should see the following output:

  root 609 0.0 0.1 12160 7268? Ss Apr29 0:01 sshd: / usr / sbin / sshd -D [listener] 0 of 10-100 startups
root 35532 0.0 0.2 13864 8796? Ss 02:37 0:00 sshd: [email protected] / 0
root 35669 0.0 0.2 13860 8916? Ss 02:38 0:00 sshd: [email protected] / 1

Find active SSH connection with the netstat command

Netstat is a command line tool that can be used to display active or established SSH connections from remote hosts to your server.

You can run the netstat command shown below:

  netstat -tnpa | grab & # 39; ESTABLISHED. * sshd & # 39; 

You should see the following output:

  tcp 0 88 45.58.38.21:22 27.61.161.61:8363 ESTABLISHED 35532 / sshd: [email protected]
tcp 0 0 45.58.38.21:22 45.58.38.21:51166 ESTABLISHED 35669 / sshd: [email protected] 

Find active SSH connection with the last command

The last command is used to display the list of all logged in users and log out since the / var / log / wtmp file was created. With the last command, you can also find the active SSH connection information between client and server.

Run the following command to find the active SSH connections on your server.

  last -a | grep -i still 

You should see the following output:

  root pts / 1 Fri May 1 02:39 still logged in 45.58.38.21
root pts / 0 Fri May 1 02:37 am still logged in 27.61.161.61
restart system restart Wed Apr 29 08:04 am still running 5.4.0-26 generic

Find Active SSH Connection with ss command

ss is very similar to netstat and is used to display more information than other tools. You can use ssh command with grip to list the active SSH connection on your server.

Run the ss command with the handle shown below:

  ss | grep -i ssh 

You should see the following output:

  tcp ESTAB 0 0 45.58.38.21:51166 45.58.38.21:ssh
tcp ESTAB 0 56 45.58.38.21:ssh 27.61.161.61:8363
tcp ESTAB 0 0 45.58.38.21:ssh 45.58.38.21:51166

As you can see, there are two active connections from client IP 45.58.38.21 and 27.61.161.61.

Conclusion

In the above guide we learned how to find active SSH connections using different methods. You can now easily monitor who is logged in to your server.

  Hitesh Jethva

About Hitesh Jethva

Over 8 years of experience as a Linux system administrator. My skills include deep knowledge of Redhat / Centos, Ubuntu Nginx and Apache, Mysql, Subversion, Linux, Ubuntu, web hosting, web server, octopus proxy, NFS, FTP, DNS, Samba, LDAP, OpenVPN, Haproxy, Amazon web services, WHMCS, OpenStack Cloud , Postfix Mail Server, Security etc.


Source link