I noticed, that every 15 minutes there is ssh attempts to remote server. How can I detect what proccess trying connect to remote host via ssh?

  • What do you mean which process? Assuming they fail to login then they don't get chance to try to execute any process. These attempts are completely normal for any SSH server on a public IPv4 address. You might want to look into fail2ban to help block them. – Philip Couling May 2 at 10:04
  • Do you know the IP address, that the login attempt comes from? – ctrl-alt-delor May 2 at 10:18
  • You can run in cycle (with delay in 1-2 minutes) following pipeline netstat -tnp | grep ':20' >> /tmp/ssh.log. After some couple of time (assume in 30 min) you can check /tmp/ssh.log and possibly application will be founded. It's not convenient but I hope it helps to you. – Yurij Goncharuk May 2 at 10:37
  • There is attempts from my pc to another server. – zeronight May 2 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.