9

On a Linux server, how would I find a list of all current SSH connections, or disconnect a specific SSH connection?

Improve this question
3
  • Are you interested in incoming or outgoing SSH connections? or both?
    – Shawn Chin
    Feb 15, 2011 at 17:41
  • 2
    This question is more relevant to superuser
    – SurvivalMachine
    Feb 15, 2011 at 17:41
  • I'm only interested with incoming connections.
    – Cerin
    Feb 15, 2011 at 17:45

4 Answers 4

Reset to default
14

If you're planning to do this interactively, the simplest would be to simply invoke who and see if there are any users from a remote host.

[you@host]$ who
user1      :0           Feb  8 09:45
user1      pts/1        Feb 14 17:56 (:0.0)
malcolm    pts/3        Feb 15 17:50 (cockpit.serenity.com)
reynold    pts/2        Feb 15 17:48 (host123.firefly.co.uk)

This is of course not foolproof, but is extremely simple to type up on demand and easily process with the human eye.

As @gravyface pointed out, if you include a -u option who will also print out the associated PID which you can then pass to kill to terminate a connection.

Improve this answer
3
  • 2
    -u will give you the PID.
    – gravyface
    Feb 15, 2011 at 18:41
  • this does not show the IPs if there are multiple connections on one user
    – Somebody
    Apr 8, 2013 at 19:40
  • For some reason, this didn't work. From a remote machine, I logged into my machine using ssh, and in my machine, I executed a who -u. Killing the pid didn't terminate the connection on my remote machine. However, following that I did a lsof -i | grep ":ssh" suggested in the answer by @kce, I got a different pid; killing that process terminated the connection. Maybe there are multiple processes that are started because of an ssh connection and killing the one displayed by who doesn't terminate the connection; that's my explanation.
    – Neo M Hacker
    Mar 22, 2016 at 0:12
8

How about using lsof?

# lsof -i |grep ":ssh"

sshd    1943      root    3u  IPv6   5698       TCP *:ssh (LISTEN)
sshd    1943      root    4u  IPv4   5700       TCP *:ssh (LISTEN)
sshd    3217      root    3r  IPv4   9687       TCP www.example.com:ssh->192.168.61.11:7341 (ESTABLISHED)
sshd    3220      user1   3u  IPv4   9687       TCP www.example.com:ssh->192.168.61.11:7341 (ESTABLISHED)
sshd    3327      root    3r  IPv4  10595       TCP www.example.com:ssh->192.168.61.11:7385 (ESTABLISHED)
sshd    3330      user2   3u  IPv4  10595       TCP www.example.com:ssh->192.168.61.11:7385 (ESTABLISHED)

You should then be able to kill the offending connection (e.g., to disconnect user2):

# kill -9 3330
Improve this answer
2
  • 3
    Use lsof -i tcp:22 and you won't need the grep.
    – Shawn Chin
    Feb 15, 2011 at 19:52
  • Only if you run the ssh and don't specify the -p option..
    – Jindra Helcl
    Apr 24, 2017 at 19:00
1

To view the ssh connections you can do a netstat -atn | grep ':22'. It shows all connections on port 22.

To drop the connection, you can try finding the PID of the sshd (SSH Daemon) with ps-ax.

Edit: I think you can find the PID of their bash session (or equivalent shell). Killing that should drop them alright.

Another resource: this thread has some tips on the subject.

Improve this answer
3
  • I have no active connections on my current machine, but netstat still lists a tcp and tcp6 connection. What would I do with the PID of sshd? Are you implying I should kill the entire SSH server just to drop a single connection?
    – Cerin
    Feb 15, 2011 at 17:43
  • @Cerin Those two connections show that it's listening on those ports (only)
    – Rudu
    Feb 15, 2011 at 17:46
  • You didn't specify, but I shoul have though of it. Sorry :/
    – Please treat your mods well.
    Feb 15, 2011 at 17:47
0

Try this:

$ ps aux | grep sshd

To disconnect them you could kill PID (where PID is the process Id in the second column), if you have root privileges, or are the user in question.

Improve this answer
1
  • This only shows sshd is running and the user the connection was established with (not number of connections, what IP it's from)
    – Rudu
    Feb 15, 2011 at 17:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .