Monitoring ssh connections in slackware..

Ryuji Yamazaki · 05-14-2006, 06:36 AM

Im a windows convert , been on slackware for a month now and i never looked back ..Few days ago i managed to get my ssh running so i can connect to my pc remotely. Question is how do i monitor my ssh connections when im at home ? Is the program already included in slackware or is it a seperate download and if so what is it called ?

I did not post this in the newbie forum because i realised that diff distros have diff packages and programs to do certain things (/me remembers the 1 hour he spent following an rpm tutorial) .
Thanx for your time , any help would be greatly appreciated..

ps: win xp cd makes a great coaster..

Alien Bob · 05-14-2006, 10:33 AM

The command

Code:

 grep -e ' sshd\[\w*\]: ' /var/log/messages

will show you what connection attempts the ssh daemon accepted or denied.
A program like logwatch can distill this information from the messages log on a daily basis for you and send these results as an email.

Eric

Ryuji Yamazaki · 05-14-2006, 12:08 PM

ahh it works, thanx bob really appreciate it.. is there anyway i can monitor it in real time ? Like a connection monitor running so i can see how many and who are the users that are connected at any given time? Once again thanx

Alien Bob · 05-14-2006, 12:36 PM

Well....

Code:

who

will show everyone who's currently logged in and

Code:

last -25

will give you a list of the last 25 logins (that includes local terminal logins as well as remote ssh logins).

Eric

Ryuji Yamazaki · 05-14-2006, 12:41 PM

Thanx again bob , yer a life saviour

evilDagmar · 05-15-2006, 02:34 AM

Provided the wiki doesn't explode (it's been feeling poorly of late) you might want to peruse a page I wrote about blocking ssh brute force attacks with iptables. Unless you intend to use tcp_wrappers to deny access to your sshd from all but a few, trusted locations (like you should) then you're going to see about 100-300 connections a day coming from sites all over the place doing lame dictionary attacks. The techniques outlined on that page will stop those attacks on the second connection.

Note that before you upgrade to iptables 1.3.5 you'll want to take a look at your kernel config (if you're not using the default Slackware kernel) and make sure you've actually got netfilter support enabled, and it wouldn't hurt to just turn on everything under there as modules.

Ryuji Yamazaki · 05-15-2006, 06:55 AM

Page wont display hmm.. ill try later.. anyways thanx for the suggestion evil.

Linux~Powered · 05-15-2006, 10:03 AM

Also, if your running Gkrellm you can go to the Internet setup and specify what port you want gkrellm to keep and eye one. Gkrellm shows when someone logs into that port, how many connections, etc.. Neat little tool. I have mine set up to show SSH (22) and FTP (21).