Check Active SSH Connections on Linux: who, ss & last
Check Active SSH Connections on Linux: who, ss & last
Set up continuous monitoring to check active SSH connections on your Linux server? Need to monitor remote access and detect unauthorized connections automati...
Why Monitoring SSH Connections Matters
Monitoring active SSH connections on your Linux server is critical for security, compliance, and access management. Unauthorized SSH connections can indicate security breaches, compromised accounts, or brute force attacks. Regular SSH connection monitoring helps detect suspicious access patterns, maintain audit trails, investigate security incidents, and ensure compliance with security policies.
Method 1: Check SSH Connections with ss Command
The ss command is the modern replacement for netstat and provides detailed information about network connections, including SSH.
Show Active SSH Connections
To see active SSH connections:
# Show active SSH connections
ss -o state established '( dport = :22 or sport = :22 )'
# Show SSH connections with process information
ss -tunp | grep :22
# Show all SSH-related connections
ss -tnp | grep sshd
Show Connection Details
To see detailed connection information:
# Show connections with timers
ss -o state established '( dport = :22 or sport = :22 )'
# Show connections with process IDs
ss -tunp | grep :22
# Count active SSH connections
ss -o state established '( dport = :22 or sport = :22 )' | wc -l
Method 2: Check SSH Connections with netstat
The netstat command is available on most Linux systems and can show SSH connection information.
Show Active SSH Connections
# Show active SSH connections
netstat -an | grep :22 | grep ESTABLISHED
# Show SSH connections with process information
netstat -tunp | grep :22
# Count active SSH connections
netstat -an | grep :22 | grep ESTABLISHED | wc -l
Show Who Is Logged In
# Show currently logged in users
who
# Show detailed login information
w
# Show last login information
last
Method 3: Automated SSH Connection Monitoring with Zuzia.app
Running these checks by hand works once. Zuzia's agent lets you repeat them on every server without logging in to each one.
How it works in Zuzia
- Install the Zuzia agent on the server with one command.
- Zuzia runs a basic security audit on the host and lists what it found. On paid plans, AI summarises the findings in plain language.
- The agent collects system logs, so you can read them in the panel instead of over SSH.
- Save the commands from this guide as a scheduled task and choose how often they run. If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account). On paid plans, AI can read the output and alert you only when it spots a problem.
Setting it up
- Add the server in the Zuzia dashboard and install the agent.
- Open the host's security audit and logs.
- Create a scheduled task with the check commands below, choose the hosts and frequency, and pick your notification channels.
Method 4: Advanced SSH Connection Monitoring Techniques
Track Connections by IP Address
To identify connection sources:
# Show connections grouped by IP
ss -tnp | grep :22 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn
# Show connections from specific IP
ss -tnp | grep :22 | grep "192.168.1.100"
# Count connections per IP
ss -tnp | grep :22 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c
Monitor Failed Connection Attempts
To detect brute force attacks:
# Check failed SSH attempts
sudo grep "Failed password" /var/log/auth.log | tail -20
# Count failed attempts by IP
sudo grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn
Real-World Use Cases for SSH Connection Monitoring
Security Audit
For security audits:
# Generate SSH connection report
ss -o state established '( dport = :22 or sport = :22 )' > ssh-audit-$(date +%Y%m%d).txt
# Check for root logins
who | grep root
# Check connection history
last | grep ssh
Incident Investigation
When investigating security incidents:
# Check active connections during incident
ss -tnp | grep :22
# Check connection history
last | head -20
# Check failed login attempts
sudo grep "Failed password" /var/log/auth.log | tail -50
Best Practices for SSH Connection Monitoring
1. Monitor SSH Connections Regularly
Check SSH connections every 30 minutes to 1 hour. More frequent checks may be needed for high-security environments. Use Zuzia.app automated monitoring to check connections continuously without manual intervention.
2. Monitor Failed Login Attempts
Failed login attempts can indicate brute force attacks. Monitor failed attempts and alert when thresholds are exceeded.
3. Track Connection Patterns
Monitor connection patterns over time to identify unusual activity. Alert on connections from unusual IP addresses or unusual times.
4. Monitor Root Logins
Root logins should be monitored closely. Alert on all root logins and verify they are authorized.
5. Maintain Audit Trails
Keep SSH connection logs for compliance and investigation purposes. Use Zuzia.app to store connection history in its database.
Troubleshooting Common SSH Connection Issues
Too Many Connections
If there are too many SSH connections:
# Identify connection sources
ss -tnp | grep :22 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn
# Check for connection abuse
ss -tnp | grep :22 | wc -l
# Review connection logs
sudo tail -100 /var/log/auth.log
Unauthorized Connections
If unauthorized connections are detected:
# Check active connections
ss -tnp | grep :22
# Check who is logged in
who
# Review connection history
last | head -20
FAQ: Common Questions About Checking SSH Connections
How often should I check SSH connections?
We recommend checking SSH connections every 30 minutes to 1 hour. More frequent checks may be needed for high-security environments. Use Zuzia.app automated monitoring to check connections continuously without manual intervention.
What if unexpected connections are detected?
You'll receive notifications when SSH connections are detected through Zuzia.app. You can then verify whether connections are authorized or indicate a security concern. Check connection details, verify with users, and take appropriate security actions if unauthorized connections are confirmed.
Can I see connection details?
Yes, the ss command shows connection details including source IP addresses, connection states, and process information, which can help identify the source of connections. Use ss -tnp | grep :22 for detailed information.
How do I detect unauthorized SSH connections?
Set up automated monitoring in Zuzia.app that compares current connections with expected patterns. Alert on connections from unusual IP addresses, unusual times, or for users who shouldn't have access. Monitor failed login attempts as they can indicate brute force attacks.
Can I track SSH connection patterns over time?
Yes, use Zuzia.app to store SSH connection data in its database. This allows you to track connection patterns over time, identify trends, and detect anomalies. Compare current connections with historical patterns to identify unusual activity.
How can I monitor SSH connections across multiple servers?
Zuzia.app allows you to add multiple servers and monitor SSH connections across all of them simultaneously. Each server executes commands independently, and all results are stored in Zuzia.app's database for centralized monitoring and analysis.
Does Zuzia.app use AI to analyze SSH connection patterns?
On paid plans, AI can read the output of your scheduled tasks and commands, explain it in plain language and alert you only when it spots a problem. Metric alerts work without AI: Zuzia alerts when CPU, RAM or load drifts from the server's normal and forecasts when a disk will fill up.