I have a jump server, that many of the clients that connect to it, are sitting behind a NAT, unfortunately, all those clients also uses the same user to connect.

Given I have root access for the jump server and I can configure sshd (and other tools?) as I want, can you think of any technique to distinguish different ssh sessions that came from different origin (node)?


  • With what goal? – Sven Apr 4 at 18:59
  • 1
    Get rid of the jump box and use a VPN, IPv6, or both. – Michael Hampton Apr 4 at 19:00
  • @MichaelHampton, this environment is given and I can't affect how it is used. – Eytan Naim Apr 4 at 19:07
  • 2
    Then give everyone their own user accounts on the jump box. There is no reason anyone should ever share accounts. This is horrible bad practice. – Michael Hampton Apr 4 at 19:09
  • 3
    You have rejected every possible solution. You will have to get approval for one of them. – Michael Hampton Apr 4 at 19:12

As mentioned in the comments, there is no way to distinguish the same credential for the same user from the same IP address.

Create a user per person. This ties access to their identity, which may be required depending on your compliance environment. And allows other authentication factors like one time passwords from a device they own.

Create a credential per person. Could be a unique ssh key, unique credentials to connect to the VPN, or both.

Use IPv6. While NAT is fine for many use cases, you want to identify per user connections which NAT won't give you. However, you will not know exactly which user with just the IP address unless you control the end point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.