Wonder where SSH sessions come from?

Today I needed to connect to a customer site to check something and the last time I connected to this site was 6 month ago. At that time I installed tmux on one of their Linux servers. So I was hoping my tmux session was still there and could reuse it.

However, my VPN history for this site have been flushed since I haven’t worked on it for a long time, I forgot which server has tmux installed! They have more than 20 Linux servers and I searched it on a few of them with no luck. I could continue to connect to each one of them to check or there could be something to easliy give me a hint?

Usually I connect to a database server via SSH, so if my tmux session is still alive with SSH session connecting to the database sever and I should be able to see which servers SSH sessions come from to determine my tmux box.

Then the question is how do I find out SSH sessions connecting to a server? Well there are lots of ways as mentioned below:

  1. checking logs for example: /var/log/audit/audit.log on Oracle Linux 6
  2. netstat -tnpn |grep ssh
  4. ss |grep ssh
  5. w, who -a, who
  6. last | grep “still logged in”

I just used who and got my tmux server back!


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s