Command-line tools for monitoring system access
Active Connections, Inside and Out
Even more than local activities, connections to and from the outside world are interesting. The w
and whowatch
programs already mentioned gave you some information about activity over the network. An additional tool to use is ss
, which is part of the standard set of tools of any Linux installation. The name of the program comes from socket statistics, and in terms of functionality, it has similarities with netstat
[4], in that it inspects the network sockets for, TCP, UDP, DCCP, and RAW connections and connections to Unix domain sockets. In addition to the statistical information, it lists the existing connections.
The ss
tool offers a variety of options [5]. By using
ss -pl | grep 17500
you will see which processes opened port 17500. In Listing 8, you can see that would be Dropbox, the file exchange service. Option -p
stands for --processes
and displays the process names. The -l
option stands for --listening
and limits the output to existing listening connections only.
Listing 8
Using ss
To obtain a list of all of the existing TCP connections (e.g., IMAP, LDAP, IRC, SSH, HTTP, HTTPS, NFS, and AFS via IPv4 and IPv6), use ss -t
(Listing 9). ESTAB is shown when a connection has been established. CLOSW-WAIT is displayed when the socket is about to close. The other columns show the local and remote IP addresses and the port or the network protocol.
Listing 9
Output of ss -t
You can restrict the output even further if you invoke individual options by employing Boolean operations. The following example filters out all of the existing HTTP connections (Listing 10). You can attain this with option -o state established
or conversely by explicitly stating the network protocol http
for the source address and destination address. Use sport
for source port and dport
for destination port. Again, you must enclose the string in simple quotation marks so that the shell does not evaluate the expression but rather passes it on to ss
as is.
Listing 10
Using ss Filters
You can also filter HTTPS connections that come from outside using the dst
(for destination) keyword and specifying the https
protocol (Listing 11).
Listing 11
Filtering Connections from Outside
History Book
In addition to the active connections, simple system archeology sheds light on activities from the past. By searching the file /var/log/auth.log
, you can figure out which users have logged in and logged out. As the admin user, you can also see the last 10 activities using sshd
. In Listing 12, you can see who logged in, who logged out, and any errors.
Listing 12
Examining auth.log
The last
tool (installed by default on Ubuntu) provides an overview of the last user sessions. It parses the /etc/log/wtmp
file and provides all the activities associated with the login and logout time in reverse order (i.e., the most recent events appear at the top). Listing 13 shows an excerpt from the logged activities where the login, the terminal, the computer of origin, and the time of use are displayed. Currently logged-in users can be identified by the words still logged in in the last column.
Listing 13
Excerpt of Logged Activities
The lastlog
command (included by default on Ubuntu) shows you which authorized users have logged in. It scans the /etc/log/lastlog
file and sorts the output with the user data in /etc/passwd
. Listing 14 shows the login names, the terminal, the source IP addresses, and the last time the user logged in.
Listing 14
Output from lastlog
Conclusion
The tools presented here can give you a clear overview of which users have been on or not been on the systems you manage. You can also obtain insight into the current state of the system and look back at who accessed the system in the past.
Further information about the users can be obtained by using the finger
, cfinger
, or pinky
tools. Gnome enthusiasts can find information in the documentation of the gnome-nettool
program, which uses a nice graphical interface.
Acknowledgments
The author thanks Wolfram Eifler and Axel Beckert for their input and comments for this article.
Infos
- Mosh mobile shell: http://mosh.mit.edu/
- "Persistence: SSH over unreliable connections" by Axel Beckert, Linux Magazine, issue 144, 2012: http://www.linux-magazine.com/Issues/2012/144/Mosh-and-AutoSSH/%28language%29/eng-US
- whowatch, http://sourceforge.net/projects/whowatch/
- Netstat: http://linux.die.net/man/8/netstat
- ss: Display linux TCP/UDP network and socket information: http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html
« Previous 1 2
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.
-
ZorinOS 17.1 Released, Includes Improved Windows App Support
If you need or desire to run Windows applications on Linux, there's one distribution intent on making that easier for you and its new release further improves that feature.
-
Linux Market Share Surpasses 4% for the First Time
Look out Windows and macOS, Linux is on the rise and has even topped ChromeOS to become the fourth most widely used OS around the globe.
-
KDE’s Plasma 6 Officially Available
KDE’s Plasma 6.0 "Megarelease" has happened, and it's brimming with new features, polish, and performance.
-
Latest Version of Tails Unleashed
Tails 6.0 is based on Debian 12 and includes GNOME 43.
-
KDE Announces New Slimbook V with Plenty of Power and KDE’s Plasma 6
If you're a fan of KDE Plasma, you'll be thrilled to hear they've announced a new Slimbook with an AMD CPU and the latest version of KDE Plasma desktop.
-
Monthly Sponsorship Includes Early Access to elementary OS 8
If you want to get a glimpse of what's in the pipeline for elementary OS 8, just set up a monthly sponsorship to help fund its continued existence.
-
DebConf24 to be Held in South Korea
Busan will be the location of the latest DebConf running July 28 through August 4