Active Connections, Inside and Out

Even more than local activities, connections to and from the outside world are interesting. The w and whowatch programs already mentioned gave you some information about activity over the network. An additional tool to use is ss, which is part of the standard set of tools of any Linux installation. The name of the program comes from socket statistics, and in terms of functionality, it has similarities with netstat [4], in that it inspects the network sockets for, TCP, UDP, DCCP, and RAW connections and connections to Unix domain sockets. In addition to the statistical information, it lists the existing connections.

The ss tool offers a variety of options  [5]. By using

ss -pl | grep 17500

you will see which processes opened port 17500. In Listing 8, you can see that would be Dropbox, the file exchange service. Option -p stands for --processes and displays the process names. The -l option stands for --listening and limits the output to existing listening connections only.

To obtain a list of all of the existing TCP connections (e.g., IMAP, LDAP, IRC, SSH, HTTP, HTTPS, NFS, and AFS via IPv4 and IPv6), use ss -t (Listing  9). ESTAB is shown when a connection has been established. CLOSW-WAIT is displayed when the socket is about to close. The other columns show the local and remote IP addresses and the port or the network protocol.

You can restrict the output even further if you invoke individual options by employing Boolean operations. The following example filters out all of the existing HTTP connections (Listing 10). You can attain this with option -o state established or conversely by explicitly stating the network protocol http for the source address and destination address. Use sport for source port and dport for destination port. Again, you must enclose the string in simple quotation marks so that the shell does not evaluate the expression but rather passes it on to ss as is.

You can also filter HTTPS connections that come from outside using the dst (for destination) keyword and specifying the https protocol (Listing 11).

History Book

In addition to the active connections, simple system archeology sheds light on activities from the past. By searching the file /var/log/auth.log, you can figure out which users have logged in and logged out. As the admin user, you can also see the last 10 activities using sshd. In Listing 12, you can see who logged in, who logged out, and any errors.

The last tool (installed by default on Ubuntu) provides an overview of the last user sessions. It parses the /etc/log/wtmp file and provides all the activities associated with the login and logout time in reverse order (i.e., the most recent events appear at the top). Listing 13 shows an excerpt from the logged activities where the login, the terminal, the computer of origin, and the time of use are displayed. Currently logged-in users can be identified by the words still logged in in the last column.

The lastlog command (included by default on Ubuntu) shows you which authorized users have logged in. It scans the /etc/log/lastlog file and sorts the output with the user data in /etc/passwd. Listing 14 shows the login names, the terminal, the source IP addresses, and the last time the user logged in.

Conclusion

The tools presented here can give you a clear overview of which users have been on or not been on the systems you manage. You can also obtain insight into the current state of the system and look back at who accessed the system in the past.

Further information about the users can be obtained by using the finger, cfinger, or pinky tools. Gnome enthusiasts can find information in the documentation of the gnome-nettool program, which uses a nice graphical interface.