I'm looking to log connections/disconnections from outgoing ssh sessions. Is this something auditd can do? I am able to get logs via auditbeat of the connections going outbound but the tricky part is tracking when the session is disconnected..

I have even tried using ss and parsing that every 1 second via filebeat, as ss has a field for connection status, but the status only ever shows established.

Example output of what I would be looking for would be:




Got it working after some research. Here is for anyone else wanting to know how to do it:

iptables -A OUTPUT -p tcp --dport 22 -m state --state NEW -j LOG --log-prefix "Connection established: "
iptables -A OUTPUT -p tcp --dport 22 --tcp-flags FIN FIN -j LOG --log-prefix "Connection closed: "
iptables -A OUTPUT -p tcp --dport 22 --tcp-flags RST RST -j LOG --log-prefix "Connection closed: "
| improve this answer | |
  • If you are a firewall admin which do this for security reasons keep in mind this only works as long as the remote ssh server listens on port 22. If you need to protocol it for legal reasons you could add a ssh proxy inside your local network which monitors all connection and then block all other unneeded ports. – Maze Mar 5 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.