monitor sftp traffic per user

gernonimo · 03-22-2009, 10:56 AM

i've a server where users can login per internal-sftp which is included in the openssh package. Is it somehow possible to log the traffic caused by a specific user?
thanks in advance,
gernonimo

anomie · 03-22-2009, 03:09 PM

Log the traffic in what way? On RHEL-family distros, logins (for example) are already logged to /var/log/secure.

acid_kewpie · 03-22-2009, 05:33 PM

I'd think they mean bandwidth of each user using sftp. Not aware of any specific tools for this, or way to automatically get the data from sftp itself. There may be a way to use the iptables --owner module to associate each stream with the process spawned by the ssh service, but not sure how that would work on the server side, if at all.

gernonimo · 03-22-2009, 05:44 PM

I want to monitor the traffic regarding "volume" - the amount of transfered data for every user over a specified time period. I also taught that there might be a possibility to do this with iptables!? Probably sombebody does have some information for me

Thank you!