Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In a multi server architecture, is it possible to find out from which machine a user logged into current machine using ssh?

For example, user1 logged into host1. From there, the user logged into host2 as sruser using ssh.

In above example, would it be possible to trace the sruser session of host2 back to user1 session in host1?

Would it be possible to get the hostname or terminal of user1 session?

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

If you are an ordinary user on host2, you can see who is currently logged in from where with the who command, and who logged in from where in the past with the last command. Both show the remote host name or IP address for ssh logins; this is usually host1, but can be a gateway that relayed the ssh connection.

It is in principle impossible to know who user1 is. After all, host1 might not even be running a multiuser system, or might be an anonymous relay. This doesn't mean user2 has absolute privacy amongst the known users of host1; for example, if you're the administrator on host2, and the user uses public key authentication, and you've configured the ssh server to dump information about the public key used, then you can find out the user's public key, and perhaps correlate it from information obtained elsewhere.

Some past questions on Super User may interest you:

share|improve this answer
    
Thanks for the links and the explanation, Gilles! –  Srikanth Mar 16 '11 at 12:05
add comment

The who and last commands might be useful for displaying the host from which users are connected.

share|improve this answer
add comment

Not sure about Solaris but on Linux lsof -u user | grep \:ssh should work fine

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.