What's the most effective way to monitor SSH access in Gentoo Linux?

My Gentoo box is operating locally behind my broadband router. I have SSH port forwarding on the router and a DNS entry pointing to my router on the internet. Is there a way to silently record what external domain/IP the incoming connection to my Gentoo box comes from?

Similarly what's the best method of recording all network traffic to and from this box, again without being noisy about it?

  • What do you mean by silently record? Is your intent to log activity without having evidence of the logging on the system being monitored? – Eli Heady Mar 23 '13 at 2:27
  • yeah pretty much. I'm suspicious that there may be unauthorised access so I want to sandbox the machine and monitor access to it without advertising that fact. – user34789 Mar 23 '13 at 2:41
  • An unfortunate reality of compromised systems is that you can't fully trust what they are telling you about user activity (or most anything else really). The best way to monitor suspected breached systems is from other locations on the network, typically between the untrusted node and it's network gateway, unless you have moderately sophisticated network gear that offers you more flexibility. – Eli Heady Mar 23 '13 at 2:47
  • I wouldn't consider remote syslog forwarding to be especially revealing in the context of your wish to avoid tipping off unauthorized users, unless they are monitoring changes to your log configurations and network utilization. If you add details of your log daemon, someone might be able to offer you configuration recommendations (though you'll surely find examples in other Q's else where on this site) – Eli Heady Mar 23 '13 at 2:55

User authorization events are typically logged by the system logging daemon in /var/log. The default locations vary between distros, but it is often /var/log/auth, /var/log/auth.log, /var/log/secure. I don't have a Gentoo system handy, but the default install used to feature syslog-ng and log these events to /var/log/auth.log.

There are a variety of ways to audit network traffic, the best one depends on the level of detail you need to retain and what sort of additional equipment you can use to accomplish the monitoring.

If you are concerned about the risk of compromise on a system, you should consider forwarding whatever auditing solution you choose to another system that is inaccessible (except for logging) from the one you are monitoring. Successful attackers would likely remove evidence of their breach from the local logging systems.


you have many solution to do it, for example iptraf or tcpdump package can store your packets.

  • For the SSH connection monitoring I just want to record where the connections are coming from and who is logging on, what's the cleanest way to do that without recording using full packet inspection? – user34789 Mar 23 '13 at 0:08
  • no, you can specify rule for tcpdump such as : tcpdump -i eth0 port 22 for more info , please read man pcap-filter and man tcpdump – PersianGulf Mar 23 '13 at 0:14
  • even you can limit more, if you don't know tcpdump please start from a tutorial such as : danielmiessler.com/study/tcpdump oh by the way, don't forget to IO redirection to store packets or -o option instead of io redirection. – PersianGulf Mar 23 '13 at 2:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.