Command-line tools for monitoring system access
Active Connections, Inside and Out
Even more than local activities, connections to and from the outside world are interesting. The w
and whowatch
programs already mentioned gave you some information about activity over the network. An additional tool to use is ss
, which is part of the standard set of tools of any Linux installation. The name of the program comes from socket statistics, and in terms of functionality, it has similarities with netstat
[4], in that it inspects the network sockets for, TCP, UDP, DCCP, and RAW connections and connections to Unix domain sockets. In addition to the statistical information, it lists the existing connections.
The ss
tool offers a variety of options [5]. By using
ss -pl | grep 17500
you will see which processes opened port 17500. In Listing 8, you can see that would be Dropbox, the file exchange service. Option -p
stands for --processes
and displays the process names. The -l
option stands for --listening
and limits the output to existing listening connections only.
Listing 8
Using ss
To obtain a list of all of the existing TCP connections (e.g., IMAP, LDAP, IRC, SSH, HTTP, HTTPS, NFS, and AFS via IPv4 and IPv6), use ss -t
(Listing 9). ESTAB is shown when a connection has been established. CLOSW-WAIT is displayed when the socket is about to close. The other columns show the local and remote IP addresses and the port or the network protocol.
Listing 9
Output of ss -t
You can restrict the output even further if you invoke individual options by employing Boolean operations. The following example filters out all of the existing HTTP connections (Listing 10). You can attain this with option -o state established
or conversely by explicitly stating the network protocol http
for the source address and destination address. Use sport
for source port and dport
for destination port. Again, you must enclose the string in simple quotation marks so that the shell does not evaluate the expression but rather passes it on to ss
as is.
Listing 10
Using ss Filters
You can also filter HTTPS connections that come from outside using the dst
(for destination) keyword and specifying the https
protocol (Listing 11).
Listing 11
Filtering Connections from Outside
History Book
In addition to the active connections, simple system archeology sheds light on activities from the past. By searching the file /var/log/auth.log
, you can figure out which users have logged in and logged out. As the admin user, you can also see the last 10 activities using sshd
. In Listing 12, you can see who logged in, who logged out, and any errors.
Listing 12
Examining auth.log
The last
tool (installed by default on Ubuntu) provides an overview of the last user sessions. It parses the /etc/log/wtmp
file and provides all the activities associated with the login and logout time in reverse order (i.e., the most recent events appear at the top). Listing 13 shows an excerpt from the logged activities where the login, the terminal, the computer of origin, and the time of use are displayed. Currently logged-in users can be identified by the words still logged in in the last column.
Listing 13
Excerpt of Logged Activities
The lastlog
command (included by default on Ubuntu) shows you which authorized users have logged in. It scans the /etc/log/lastlog
file and sorts the output with the user data in /etc/passwd
. Listing 14 shows the login names, the terminal, the source IP addresses, and the last time the user logged in.
Listing 14
Output from lastlog
Conclusion
The tools presented here can give you a clear overview of which users have been on or not been on the systems you manage. You can also obtain insight into the current state of the system and look back at who accessed the system in the past.
Further information about the users can be obtained by using the finger
, cfinger
, or pinky
tools. Gnome enthusiasts can find information in the documentation of the gnome-nettool
program, which uses a nice graphical interface.
Acknowledgments
The author thanks Wolfram Eifler and Axel Beckert for their input and comments for this article.
Infos
- Mosh mobile shell: http://mosh.mit.edu/
- "Persistence: SSH over unreliable connections" by Axel Beckert, Linux Magazine, issue 144, 2012: http://www.linux-magazine.com/Issues/2012/144/Mosh-and-AutoSSH/%28language%29/eng-US
- whowatch, http://sourceforge.net/projects/whowatch/
- Netstat: http://linux.die.net/man/8/netstat
- ss: Display linux TCP/UDP network and socket information: http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html
« Previous 1 2
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.
-
XZ Gets the All-Clear
The back door xz vulnerability has been officially reverted for Fedora 40 and versions 38 and 39 were never affected.
-
Canonical Collaborates with Qualcomm on New Venture
This new joint effort is geared toward bringing Ubuntu and Ubuntu Core to Qualcomm-powered devices.
-
Kodi 21.0 Open-Source Entertainment Hub Released
After a year of development, the award-winning Kodi cross-platform, media center software is now available with many new additions and improvements.
-
Linux Usage Increases in Two Key Areas
If market share is your thing, you'll be happy to know that Linux is on the rise in two areas that, if they keep climbing, could have serious meaning for Linux's future.
-
Vulnerability Discovered in xz Libraries
An urgent alert for Fedora 40 has been posted and users should pay attention.
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.