How can I find a process which was started from some ssh session.

For instance, I gave same ssh cridentials (aka. userzxc/passwordzxc) for my several friends which IPs i already know.

My goal is to find out the link between the special ssh session and some running/started process to control who could bring down/crash/destroy/etc. services on my machine.

  1. Maybe there are apps/services for that
  2. Or maybe there are several commands to make it happen

Thank you.

  • 1
    What about pstree -lnu | less or pstree -lnupa | less ? Look for sshd ot for user names in their output. – user17530 Mar 28 '16 at 10:48
  • @skwllsp cool, I will dig that way :) thanks. p.s. i need to also output ssh client ip information insteard of PIDs of sshd :) – Alexander.Iljushkin Mar 28 '16 at 11:59
  • sudo lsof -i will tell you which PIDs are connecting to what network addresses. – Xiong Chiamiov Mar 28 '16 at 20:03

What about

pstree -lnu | less 


pstree -lnupa | less 

Look for sshd or for username in their output.

| improve this answer | |
  1. Add special user and group for each of your friends
  2. Use SELinux with Permissive mode
| improve this answer | |

Each user should have their own credentials, so it's just a matter of displaying all the processes of a given user. If you have a process ID, you can know which user started it by running ps -Af and looking in the “USER” column (many other combinations of options will list this information, check the ps man page on your system). Given a user bob, ps -u bob will list all of that user's processes. If you want to see what processes are running on your system, htop is a convenient interactive process explorer.

The command who lists active sessions. For SSH sessions, it lists the original IP address. You can find more information in the system logs (the location depends on your distribution, for example /var/log/auth.log on Debian with SysVinit). The commands last and lastcomm (part of the acct package, often not installed by default) provide some information about past sessions.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.