How can I find a process which was started from some ssh session.

For instance, I gave same ssh cridentials (aka. userzxc/passwordzxc) for my several friends which IPs i already know.

My goal is to find out the link between the special ssh session and some running/started process to control who could bring down/crash/destroy/etc. services on my machine.

  1. Maybe there are apps/services for that
  2. Or maybe there are several commands to make it happen

Thank you.

  • 1
    What about pstree -lnu | less or pstree -lnupa | less ? Look for sshd ot for user names in their output.
    – user17530
    Mar 28, 2016 at 10:48
  • @skwllsp cool, I will dig that way :) thanks. p.s. i need to also output ssh client ip information insteard of PIDs of sshd :) Mar 28, 2016 at 11:59
  • sudo lsof -i will tell you which PIDs are connecting to what network addresses. Mar 28, 2016 at 20:03

3 Answers 3


What about

pstree -lnu | less 


pstree -lnupa | less 

Look for sshd or for username in their output.

  1. Add special user and group for each of your friends
  2. Use SELinux with Permissive mode

Each user should have their own credentials, so it's just a matter of displaying all the processes of a given user. If you have a process ID, you can know which user started it by running ps -Af and looking in the “USER” column (many other combinations of options will list this information, check the ps man page on your system). Given a user bob, ps -u bob will list all of that user's processes. If you want to see what processes are running on your system, htop is a convenient interactive process explorer.

The command who lists active sessions. For SSH sessions, it lists the original IP address. You can find more information in the system logs (the location depends on your distribution, for example /var/log/auth.log on Debian with SysVinit). The commands last and lastcomm (part of the acct package, often not installed by default) provide some information about past sessions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .