monitoring network stats and user stats

robertkwild · 11-21-2017, 01:12 PM

hi all,

made a sftp server and added a few users and they can upload/download to thier home folder but now i want to monitor the network traffic ie upload /download speed from each individual connections ie the host/ip of the users if not just a total upload/download and also what user is connected to the sftp server, what folder they have access to ie uploading to or downloading to

thanks,

rob

robertkwild · 11-22-2017, 02:25 AM

found two good ones, still looking -

the below monitors traffic on port 22 plus the username connected -
watch -n 0.5 lsof -n -i :22

this one monitors total rx/tx -
bwm-ng

Turbocapitalist · 11-22-2017, 03:54 AM

As far as which folders or files they are using, that can be set up by modifying what the SFTP subsystem logs if you are using OpenSSH server. Set a Match block for the group of users and force them into SFTP mode with modified logging:

Code:

Match Group watched
       ForceCommand internal-sftp -f LOCAL0 -l INFO
       Banner /etc/ssh/watched.banner.txt

Then configure your system log daemon to sort messages with log facility of LOCAL0 into their own file. You'll really want to do that because the logging at that level is quite noisy.

However, if you don't want the users roaming around the system when logged in, you can chroot them into a specific directory or hierarchy of directories.