How to Find Active SSH Connections in Linux

As a Linux system administrator, you might need to check the number and status of active ssh connections on your server for better server management. In this article, you will learn How to Find Active SSH Connections in Linux to manage server. With the help of various Linux commands and tools, you can check active SSH connections and achieve your administrative or monitoring purposes especially when multiple users are connected to a Linux server via SSH.

In the end, you will be able to a list of active SSH connections on your system.

SSH in A Simple Word

Secure Shell or SSH is a secured network protocol that enables administrators and developers to access securely their remote computers in a network. This popular and effective protocol helps to manage remote systems and applications by providing strong encryption. Using its various commands, you will be able to check for active SSH connections on the remote host.

For secure management, remote access to resources, software patches, and upgrades, SSH is frequently used in data centers. The protocol also makes it possible to administer protected routers, maintain server hardware, and control virtualization platforms.

How Essential is Finding Active SSH Connections?

With the help of SSH, you can provide a situation for multiple users to connect to a Linux server. For security reasons and administrative/monitoring purposes, you are recommended to list and check all connected SSH sessions. It is wise to continue keeping an eye out for unwanted SSH logins on your remote servers and to take the required precautions, such as protecting your server or turning off password authentication.

To view who’s connected over SSH, there are various solutions that are explained in this tutorial. Test the suggested commands to find out which one meets your needs and expectations.

Prerequisites to List Connected SSH Sessions on Linux

To let this tutorial works correctly, provide the options below:

• A Server running Linux VPS.
• A non-root user with sudo privileges.

Most Used Commands to Find Active SSH Connections in Linux

Secure Shell (SSH) is a network protocol that provides secure remote access to any unsecured network. Previously, you read about Setup and Using SSH Key on Linux Server. In order to keep your system secure and manage your server, you must know the ways you can check active SSH connections in Linux to list all of them or view SSH connection history.

Let’s go through this article to be an expert in finding all your recent active ssh connections on your Linux node. All tools and commands you need to list the connected SSH sessions are explained in the following. By running the commands you can easily observe active SSH connections in the outputs. Just Join us and Enjoy.

Solution 1. netstat Command

To show active or Established SSH connections from the remote hosts to your server, you can use the netstat command. To view all network connections, network interfaces, and routing tables, type:

netstat -tnpa | grep 'ESTABLISHED.*sshd'

Solution 2. ss Command

The ss command is the new version of netstat. To dump socket statistics and display more TCP and state information than other tools, you can use the useful ss command:

ss | grep -i ssh

Solution 3. last Command

Another command which helps you Find Active SSH Connections in Linux is the last command. A list of all users who have logged in and out since the creation of the file /var/log/wtmp is displayed by the last command after doing a search across it. You can also use this command to list connected SSH sessions using the latest “-i” command. To also find the active SSH connection information between the client and server run the below command:

last -a | grep -i still

Solution 4. who Command

Who is currently logged into the system can be seen with the who command. In this way, you are able to see the source IP addresses and the connected users. A list of the users who are now logged into the server is displayed by the Linux command-line tool known as who. Obviously, you cannot view SFTP connections by executing the who command since they are not shell login sessions.

The “who -a” command can be used to display a list of all connected SSH sessions. All users, including those not currently logged in via the system console, are displayed via the -a option. Your username, terminal, and login date and time will be displayed in the outcome.

To find the active connections on your server, open your terminal and run the command below:

who

who -a

The “who -u” command can also be used to view a list of all connected SSH sessions. The user, terminal, and login time are all displayed by this command.

who -u

Solution 5. w Command

The w command gives more information than who and last command. It shows details about the users who are currently logged in to the system, along with the processes that each one is performing. You can use the “w -h” command, which omits the header and merely displays the process, to list all connected SSH sessions.

You may also find out how long the session has been idle by using the w command. You can set your Linux host to automatically kill such idle SSH sessions if the SSH session is left running for an extended length of time as this constitutes a security breach. To use this command, type:

w

w -h

Generally, the w command provides more details about the active processes for each user than the who command does.

Solution 6. ps Command

The ps command provides you with details about the open SSH connections on your server. It provides you with some further details, such as the PID of the active SSH connections.

Open your terminal and run the following command to find the active connections on your server:

ps auxwww | grep sshd: | grep -v grep

FAQ

Conclusion

In this article, you learned How to Find Active SSH Connections in Linux to manage server. Several command-line programs for listing connected SSH sessions on Linux have been covered. The output format and specific options for each command vary, so it’s up to you to decide which one best meets your requirements. After finding and viewing all connected SSH connections, you are ready to secure your server. If security is your no 1 concern, learn more on Best Security Practices to Secure SSH Server in Linux.

If you know some commands to Find Active SSH Connections in Linux, then the comment section is all yours.