0

I am exploring methods to correlate my current SSH session with the SSHD logs.

I aim to extract specific information from the SSHD logs that pertain to my SSH session only.

Jul 04 09:39:06 linuxbox sshd[1122]: Accepted publickey for testuser from 1.2.3.4 port 123 ssh2: RSA-CERT ID test (serial 1) CA RSA fingerprint...

One option was to map the sshd pid logged during ssh login sshd[1122] to the current ssh session pid. But I could not find a way to get current ssh session pid.

Or Is there any other way to map my session to the sshd logs apart from matching PID?

testuser@linuxbox:~$
testuser@linuxbox:~$ sudo systemctl status sshd
* ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2023-07-04 09:10:20 UTC; 29min ago
       Docs: man:sshd(8)
             man:sshd_config(5)
    Process: 1023 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
   Main PID: 1024 (sshd)
      Tasks: 1 (limit: 1109)
     Memory: 2.7M
     CGroup: /system.slice/ssh.service
             `-1024 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
Jul 04 09:39:03 linuxbox sshd[1122]: rexec line 126: Deprecated option UsePrivilegeSeparation
Jul 04 09:39:06 linuxbox sshd[1122]: Accepted publickey for testuser from 1.2.3.4 port 123 ssh2: RSA-CERT ID test (serial 1) CA RSA fingerprint...
Jul 04 09:39:06 linuxbox sshd[1122]: pam_unix(sshd:session): session opened for user testuser by (uid=0)
testuser@linuxbox:~$ date
Tue 04 Jul 2023 09:39:50 AM UTC
testuser@linuxbox:~$ ps -ef | grep sshd
root         881       1  0 09:05 ?        00:00:00 sshd: testuser [priv]
root         884       1  0 09:05 ?        00:00:00 sshd: testuser [priv]
testuser     893     881  0 09:05 ?        00:00:00 sshd: testuser@pts/0
testuser     904     884  0 09:05 ?        00:00:00 sshd: testuser@notty
root        1024       1  0 09:10 ?        00:00:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root        1122    1024  0 09:39 ?        00:00:00 sshd: testuser [priv]
testuser    1124    1122  0 09:39 ?        00:00:00 sshd: testuser@pts/1
testuser    1151    1125  0 09:39 pts/1    00:00:00 grep --color=auto sshd
testuser@linuxbox:~$
Z0OM
  • 3,149
Karthick
  • 123

2 Answers2

1

To get the PID of your current session, you can use pstree with the -s flag ("show parents of the selected process").

$ pstree -sp $$
systemd(1)───sshd(1583)───sshd(30575)───sshd(30577)───tcsh(30579)───pstree(30915)

The relevant PID of your session is the child of the main PID sshd process, which you can find using:

$ systemctl show -p MainPID sshd
MainPID=1583

So the PID of your session is 30575.

And once you have the PID of your current session, you can use journalctl:

journalctl -u sshd _PID=30575
aviro
  • 5,532
1

The OpenSSH SSH server sets a couple of environment variables that you can use:

$ ssh localhost
Last login: Tue Jul  4 17:36:10 2023 from ::1
$ set | grep SSH
SSH_CLIENT='::1 50359 22'
SSH_CONNECTION='::1 50359 ::1 22'
...

SSH_CONNECTION contains four values: The client-side IP address and port for the session, and the server-side address and port which the client connected to. In my example, "::1" is the IPv6 localhost address. SSH_CLIENT isn't documented but contains three of the same values--my guess is it's an older environment variable which was superseded by SSH_CONNECTION.

Some log entries by the sshd process also contain the client's address and port, such as the "accepted pubkey" line from your example. You ought to be able to link the remote session to a particular set of log entries that way.

Kenster
  • 3,410