Command-line tools for monitoring system access

Active Connections, Inside and Out

Even more than local activities, connections to and from the outside world are interesting. The w and whowatch programs already mentioned gave you some information about activity over the network. An additional tool to use is ss, which is part of the standard set of tools of any Linux installation. The name of the program comes from socket statistics, and in terms of functionality, it has similarities with netstat [4], in that it inspects the network sockets for, TCP, UDP, DCCP, and RAW connections and connections to Unix domain sockets. In addition to the statistical information, it lists the existing connections.

The ss tool offers a variety of options  [5]. By using

ss -pl | grep 17500

you will see which processes opened port 17500. In Listing 8, you can see that would be Dropbox, the file exchange service. Option -p stands for --processes and displays the process names. The -l option stands for --listening and limits the output to existing listening connections only.

Listing 8

Using ss

 

To obtain a list of all of the existing TCP connections (e.g., IMAP, LDAP, IRC, SSH, HTTP, HTTPS, NFS, and AFS via IPv4 and IPv6), use ss -t (Listing  9). ESTAB is shown when a connection has been established. CLOSW-WAIT is displayed when the socket is about to close. The other columns show the local and remote IP addresses and the port or the network protocol.

Listing 9

Output of ss -t

 

You can restrict the output even further if you invoke individual options by employing Boolean operations. The following example filters out all of the existing HTTP connections (Listing 10). You can attain this with option -o state established or conversely by explicitly stating the network protocol http for the source address and destination address. Use sport for source port and dport for destination port. Again, you must enclose the string in simple quotation marks so that the shell does not evaluate the expression but rather passes it on to ss as is.

Listing 10

Using ss Filters

 

You can also filter HTTPS connections that come from outside using the dst (for destination) keyword and specifying the https protocol (Listing 11).

Listing 11

Filtering Connections from Outside

 

History Book

In addition to the active connections, simple system archeology sheds light on activities from the past. By searching the file /var/log/auth.log, you can figure out which users have logged in and logged out. As the admin user, you can also see the last 10 activities using sshd. In Listing 12, you can see who logged in, who logged out, and any errors.

Listing 12

Examining auth.log

 

The last tool (installed by default on Ubuntu) provides an overview of the last user sessions. It parses the /etc/log/wtmp file and provides all the activities associated with the login and logout time in reverse order (i.e., the most recent events appear at the top). Listing 13 shows an excerpt from the logged activities where the login, the terminal, the computer of origin, and the time of use are displayed. Currently logged-in users can be identified by the words still logged in in the last column.

Listing 13

Excerpt of Logged Activities

 

The lastlog command (included by default on Ubuntu) shows you which authorized users have logged in. It scans the /etc/log/lastlog file and sorts the output with the user data in /etc/passwd. Listing 14 shows the login names, the terminal, the source IP addresses, and the last time the user logged in.

Listing 14

Output from lastlog

 

Conclusion

The tools presented here can give you a clear overview of which users have been on or not been on the systems you manage. You can also obtain insight into the current state of the system and look back at who accessed the system in the past.

Further information about the users can be obtained by using the finger, cfinger, or pinky tools. Gnome enthusiasts can find information in the documentation of the gnome-nettool program, which uses a nice graphical interface.

Acknowledgments

The author thanks Wolfram Eifler and Axel Beckert for their input and comments for this article.

Infos

  1. Mosh mobile shell: http://mosh.mit.edu/
  2. "Persistence: SSH over unreliable connections" by Axel Beckert, Linux Magazine, issue 144, 2012: http://www.linux-magazine.com/Issues/2012/144/Mosh-and-AutoSSH/%28language%29/eng-US
  3. whowatch, http://sourceforge.net/projects/whowatch/
  4. Netstat: http://linux.die.net/man/8/netstat
  5. ss: Display linux TCP/UDP network and socket information: http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html

The Author

Frank Hofmann studied computer science at the Technical University of Chemnitz. Currently, he is working in Büro 2.0 (http://www.buero20.org) in Berlin as an open source network expert and service provider specializing in printing and typesetting (http://www.efho.de). He is also a co-founder of the training company Wizards of FOSS (http://www.wizards-of-foss.de/). Mr. Hoffmann has coordinated the regional meeting of the Linux Users Groups within the region of Berlin-Brandenburg since 2008.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Querying Sockets with ss

    The unassuming ss utility is easy to understand and easy to type, but it adds some powerful options to your admin toolkit.

  • GPG Key Management

    PGP/GnuPG is becoming increasingly popular, thanks to digital crime and government surveillance. We take a look behind the scenes and show how you can keep your keyring current and valid.

  • Bash Tricks

    The Bash shell is powerful and infinitely expressive. In this article we describe some tricky techniques you can use to enhance and customize your Bash environment.

  • Sshutout and Fail2ban

    Services that require a username and password for login are potential targets for dictionary attacks. Sshutout and Fail2ban introduce time penalties for invalid attempts.

  • 2FA

    Protect your system from unwanted visitors with two-factor authentication.

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News