Home / server / Questions / 235831
Accepted
Cerin
Asked: 2011-02-16 09:32:55 +0800 CST

Managing SSH Connections

  • 772

On a Linux server, how would I find a list of all current SSH connections, or disconnect a specific SSH connection?

linux command-line-interface ssh

4 Answers

  1. Best Answer

    If you're planning to do this interactively, the simplest would be to simply invoke who and see if there are any users from a remote host.

    [you@host]$ who
user1      :0           Feb  8 09:45
user1      pts/1        Feb 14 17:56 (:0.0)
malcolm    pts/3        Feb 15 17:50 (cockpit.serenity.com)
reynold    pts/2        Feb 15 17:48 (host123.firefly.co.uk)

    This is of course not foolproof, but is extremely simple to type up on demand and easily process with the human eye.

    As @gravyface pointed out, if you include a -u option who will also print out the associated PID which you can then pass to kill to terminate a connection.

    • 14

  2. How about using lsof?

    # lsof -i |grep ":ssh"

sshd    1943      root    3u  IPv6   5698       TCP *:ssh (LISTEN)
sshd    1943      root    4u  IPv4   5700       TCP *:ssh (LISTEN)
sshd    3217      root    3r  IPv4   9687       TCP www.example.com:ssh->192.168.61.11:7341 (ESTABLISHED)
sshd    3220      user1   3u  IPv4   9687       TCP www.example.com:ssh->192.168.61.11:7341 (ESTABLISHED)
sshd    3327      root    3r  IPv4  10595       TCP www.example.com:ssh->192.168.61.11:7385 (ESTABLISHED)
sshd    3330      user2   3u  IPv4  10595       TCP www.example.com:ssh->192.168.61.11:7385 (ESTABLISHED)

    You should then be able to kill the offending connection (e.g., to disconnect user2):

    # kill -9 3330
    • 8

  3. To view the ssh connections you can do a netstat -atn | grep ':22'. It shows all connections on port 22.

    To drop the connection, you can try finding the PID of the sshd (SSH Daemon) with ps-ax.

    Edit: I think you can find the PID of their bash session (or equivalent shell). Killing that should drop them alright.

    Another resource: this thread has some tips on the subject.

    • 1

  4. Try this:

    $ ps aux | grep sshd

    To disconnect them you could kill PID (where PID is the process Id in the second column), if you have root privileges, or are the user in question.

    • 0