Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

(I can't decide between posting this here or on SuperUser but since this is for a sysadmin purpose, this seems like a better fit)

I have a situation where SSH clients will request a port forward using the -R option of SSH. At connection time, I want to be able to log which ports they forwarded.

I plan to do this by forcing a particular command to run (command=my-command in the authorized_keys file, that is) which will do this logging and then run the original command (login or user specified).

The only way I've found to do this so far requires running sudo and feels pretty hacky:

sudo lsof -aPni@ -Fn -p12345 | grep "^n" | grep -v '\->' | awk -F: '{print $NF}' | sort | uniq* where 12345 is the process ID of the sshd that is handling this connection (i.e. the parent process of whatever script I run to check it.

Is there anything more elegant (a la the SSH_* environment variables that get set for other connection information) available to me?

* For the curious, the first part of the command gets all network ports bound to local interface (-i@ and (-a) belonging to process 12345 (-p12345) and formats it for machine readability (-Fn). The -P and -n flags makes it give the raw port numbers and network addresses. The second part (grep "^n") gives me back just the network information. The next part (grep -v '\->') eliminates established connections (thereby leaving "listening" ports). The next part (awk -F: '{print $NF}') uses awk to get the last field separated by ':', giving me the port (I don't use cut here because for an IPv6 connection, the field number might change). The last 2 parts just give me a unique list of ports. I put this explanation here because lsof is a fantastic command to know, and everyone should.

share|improve this question

You can set the logging level of sshd to DEBUG1 and then grep the logs, you'll be looking for a line such as:

Dec 25 21:40:25 d34dh0r53 sshd[21963]: debug1: Local forwarding listening on ::1 port 8085.

Depending on which log file you use and the permissions you won't need to be root to read it.

share|improve this answer
Thanks. That's a good option to consider to bypass needing sudo, but still feels rather hacky. I'd also need to sweep those logs pretty often because they could start getting pretty big. Are there other security implications of leaving the SSH verbosity that high? – bjeanes Dec 26 '11 at 16:20

ssh ~ keys ?

~# List forwarded connections.

share|improve this answer
Ok ... neat trick. I hadn't seen those escape sequence commands before, and one of them may have just solved another problem of mine (so have an upvote). However, the output of that is and the other entry only shows up if a connection is established, not listening. I need to see what ports are listening. In any case, that output doesn't seem to show ports, just ssh channel info (I think). – bjeanes Dec 26 '11 at 21:41
Also, it seems these can only be executed by the SSH client, whereas I need to pull this info automatically on the SSH host. – bjeanes Dec 26 '11 at 21:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.