I connect to my server via ssh. I am the only person who has access to connect to the server. After connecting via ssh, I run the following command:
sudo netstat -tupn
The output includes the following two lines:
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address
tcp 0 0 MY.SERVER.IP.ADDRESS:22 MY.HOME.IP.ADDRESS:54886 ESTABLISHED 18677/0
tcp 0 324 MY.SERVER.IP.ADDRESS:22 MY.HOME.IP.ADDRESS:55096 ESTABLISHED 18843/1
Based on my limited knowledge, it seems like these two lines from the output are related to my ssh connection. I believe this is true because the port is 22, and the foreign address is my home IP address.
I'm trying to understand what these 2 lines represent. Why are there two connections shown for my single ssh connection?
Also, would netstat a good tool to use to see if someone has gained unauthorized access to my server? If someone did, would I see their connection in the netstat output?
ps auxf
show aboutsshd
processes. Are there also two of them? What is your configuration? Do you use port forward? Or Agent forwarding?