up vote 4 down vote favorite
share [g+] share [fb]

On a Linux server, how would I find a list of all current SSH connections, or disconnect a specific SSH connection?

link|improve this question
80% accept rate
Are you interested in incoming or outgoing SSH connections? or both? – Shawn Chin Feb 15 '11 at 17:41
2  
This question is more relevant to superuser – SurvivalMachine Feb 15 '11 at 17:41
I'm only interested with incoming connections. – Cerin Feb 15 '11 at 17:45
feedback

migrated from stackoverflow.com Feb 15 '11 at 17:55

This question came from our site for professional and enthusiast programmers.

4 Answers

up vote 4 down vote accepted

If you're planning to do this interactively, the simplest would be to simply invoke who and see if there are any users from a remote host.

[you@host]$ who
user1      :0           Feb  8 09:45
user1      pts/1        Feb 14 17:56 (:0.0)
malcolm    pts/3        Feb 15 17:50 (cockpit.serenity.com)
reynold    pts/2        Feb 15 17:48 (host123.firefly.co.uk)

This is of course not foolproof, but is extremely simple to type up on demand and easily process with the human eye.

As @gravyface pointed out, if you include a -u option who will also print out the associated PID which you can then pass to kill to terminate a connection.

link|improve this answer
-u will give you the PID. – gravyface Feb 15 '11 at 18:41
@gravyface Thanks. will include in answer. – Shawn Chin Feb 15 '11 at 19:47
feedback
up vote 4 down vote

How about using lsof?

# lsof -i |grep ":ssh"

sshd    1943      root    3u  IPv6   5698       TCP *:ssh (LISTEN)
sshd    1943      root    4u  IPv4   5700       TCP *:ssh (LISTEN)
sshd    3217      root    3r  IPv4   9687       TCP www.example.com:ssh->192.168.61.11:7341 (ESTABLISHED)
sshd    3220      user1   3u  IPv4   9687       TCP www.example.com:ssh->192.168.61.11:7341 (ESTABLISHED)
sshd    3327      root    3r  IPv4  10595       TCP www.example.com:ssh->192.168.61.11:7385 (ESTABLISHED)
sshd    3330      user2   3u  IPv4  10595       TCP www.example.com:ssh->192.168.61.11:7385 (ESTABLISHED)

You should then be able to kill the offending connection (e.g., to disconnect user2):

# kill -9 3330
link|improve this answer
1  
Use lsof -i tcp:22 and you won't need the grep. – Shawn Chin Feb 15 '11 at 19:52
feedback
up vote 1 down vote

To view the ssh connections you can do a netstat -atn | grep ':22'. It shows all connections on port 22.

To drop the connection, you can try finding the PID of the sshd (SSH Daemon) with ps-ax.

Edit: I think you can find the PID of their bash session (or equivalent shell). Killing that should drop them alright.

Another resource: this thread has some tips on the subject.

link|improve this answer
I have no active connections on my current machine, but netstat still lists a tcp and tcp6 connection. What would I do with the PID of sshd? Are you implying I should kill the entire SSH server just to drop a single connection? – Cerin Feb 15 '11 at 17:43
@Cerin Those two connections show that it's listening on those ports (only) – Rudu Feb 15 '11 at 17:46
You didn't specify, but I shoul have though of it. Sorry :/ – Rodrigo Hahn Feb 15 '11 at 17:47
feedback
up vote 0 down vote

Try this:

$ ps aux | grep sshd

To disconnect them you could kill PID (where PID is the process Id in the second column), if you have root privileges, or are the user in question.

link|improve this answer
This only shows sshd is running and the user the connection was established with (not number of connections, what IP it's from) – Rudu Feb 15 '11 at 17:50
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.