Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to be able to measure the bandwidth used by each user by their inbound ssh connections, into a linux box.

I measure most other traffic using iptables and user-matching, but inbound ssh sockets seem to be owned by root, so I can't use that approach here.

share|improve this question

1 Answer 1

Sadly, I think you're going to be chasing your own tail. The socket is owned by root... because sshd is running as root. The user is not established until AFTER the user has authenticated... but since the connection is never closed, the socket is still owned by root. Short of trying to do some sort of reverse-matching between the socket ID and the current user after the fact... I don't know how you would accomplish this. I have seen custom hacks directly into the openssh src that add some level of Traffic Accounting... but they are highly version specific, and I doubt you'll see one ever make it into the standard repository.

I found a hack-ish example of accounting after-the-fact. I question it's reliability, and accuracy... but it's better than nothing. Basically, it relies on your auth.log reporting on users' connection states. (i.e. connects/disconnects) and tail running continuously. Unfortunately, tail has a limit of 1-2 seconds minimum between updates... and there is a margin of error when it comes to monitoring the auth.log. (especially during log-rotates)

http://newspaint.wordpress.com/2011/08/02/ssh-traffic-accounting-on-linux/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.