I imagined command last, would also give me mysql over ssh tunnels list. But I was wrong. Is there a place where this tunnels are logged?

Ubuntu server 12.04.


The last command will only show those ssh sessions that actually included a shell started at the remote end. Most tunnel sessions don't do that, which is why they're not counted there.

However, the authentication logs will still show the SSH connections. That will often be /var/log/secure or /var/log/auth.log, but you may need to check your syslog setup to find the setup.

Another way to find out what is what would be to look at it from the other end. From MySQL's point of view, a connection made via an SSH tunnel will look just like a connection from localhost. So if you can see a connection from userA at a time when userA was not logged in to the machine, and the connection still is from localhost, then that would have been made through a tunnel.

  • Makes sense. Ty! :) Apr 1 '14 at 16:07

If you'd like to understand who might be logged in right now, use netstat with option to show process pid/name and filter for ssh and mysql, you will immediately see established ssh sessions and tunnels:

$ netstat -atpn|grep ssh

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.