2

I have an EC2 instance that is setup as an SFTP server using OpenSSH. It only allows connections on whitelisted IPs via TCP Port 22 (limited via an EC2 Security Group). I constantly have customers try to connect from other IPs that they have not been whitelisted. I'd like to track those attempted connections and the IPs they come from so I can help them figure out their IP addresses.

Is it possible to see these IP addresses from the server? Can I also see the connection attempt and get the SFTP username?

Improve this question

2 Answers 2

Reset to default
4

AWS has a feature called VPC Flow Log that captures all the traffic coming to a VPC or a particular subnet or a particular network interface. You can setup VPC Flow log and these logs are then populated to AWS CloudWatch. It gives a very descriptive Log information and you can filter your query from that. Check more on AWS VPC Flow Log

Improve this answer
1
  • 1
    It might be worthwhile pointing out that this is a feature of Virtual Private Cloud and not a standard AWS/EC2 feature.
    – Jeff
    Jan 22, 2016 at 19:07
1

If you want to see dropped traffic you'll need to do the whitelist using a firewall running on your EC2 instance, not the AWS infrastructure. (Your server cannot log/see traffic that it doesn't receive).

You may want to look into something like Fail2Ban.

A word of advice, there are bot nets that will try to connect to your IP (especially on EC2) via SSH using weak usernames and passwords. You'll only drive yourself insane trying to track down every failed login attempt or attempt to connect. A single box can get hundreds of these a day; you have been warned.

Improve this answer
1
  • haha ... This is actually the answer I was expecting. I just wanted to confirm. I think I'll just leave security extra tight at the moment. Thanks!
    – T. Brian Jones
    Jan 14, 2016 at 23:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .