List SSH Users: Easy Linux Commands

Have you ever wondered who else is logged into your Linux server via SSH? It's a common question, especially when you're managing a system and need to keep track of active users. You might have tried the usual commands like w, who, or finger and found that they don't give you the complete picture. Don't worry, guys, you're not alone! In this article, we'll dive deep into how to accurately display all currently connected SSH users on your Linux system. We’ll cover various methods, explain why some common commands might fall short, and provide you with the most reliable techniques to get the information you need.

Why the Usual Commands Fall Short

First off, let's address the elephant in the room: why commands like w, who, and finger sometimes don't show all SSH users. These utilities primarily rely on the /var/run/utmp or /var/log/wtmp files to gather information about logged-in users. However, these files might not always accurately reflect SSH connections, especially in modern Linux distributions that use systemd for process management. Systemd introduces its own user management mechanisms, which means the traditional methods might miss users who have logged in through SSH.

When you run w, who, or finger, you're essentially asking the system to consult these legacy files. If a user's session isn't properly recorded in these files (which can happen for various reasons, such as how SSH sessions are initiated or if there are issues with session management), they won't show up in the output. This can be particularly frustrating when you're trying to monitor system activity or troubleshoot user access issues. It’s crucial to understand these limitations so you can employ more effective methods.

The good news is that there are alternative ways to get a more complete and accurate list of SSH users. These methods often involve querying the system's process list directly or using utilities that are more aware of systemd's session management. By understanding these alternatives, you can ensure you have a reliable way to monitor who's connected to your system at any given time. So, let's explore some of these methods in detail.

Method 1: Using the ps Command

The ps command is a powerful utility for displaying information about active processes. By filtering the output of ps, we can identify processes associated with SSH connections, effectively revealing the users who are currently logged in. This method is particularly useful because it directly examines the system's process table, providing a real-time snapshot of active sessions. Here’s how you can use ps to list SSH users:

ps -ef | grep sshd | grep -v grep

Let's break down this command:

• ps -ef: This part of the command tells ps to display all processes (-e) with full format listing (-f). The full format includes the user associated with each process, which is crucial for our goal.
• grep sshd: This filters the output of ps to only include lines that contain "sshd." SSH connections are managed by the sshd daemon, so this narrows down the results to relevant processes.
• grep -v grep: This excludes the grep process itself from the results, cleaning up the output and making it easier to read.

The output of this command will show lines that include the username, process ID (PID), and other details about the SSH connections. For example, you might see something like:

root      1234     1  0 08:00 ?        00:00:00 sshd: user1@pts/0
root      5678     1  0 08:15 ?        00:00:00 sshd: user2@pts/1

In this example, user1 and user2 are currently logged in via SSH. The pts/0 and pts/1 indicate the pseudo-terminals they are using. This method is quite reliable because it directly queries the process table, giving you an accurate view of active SSH sessions. It's also relatively simple to use and doesn't require any special permissions beyond what's needed to run ps. This makes it a go-to option for many system administrators and users.

Method 2: Using the who Command with a Twist

As we discussed earlier, the who command sometimes falls short because it relies on legacy files. However, there's a way to make it more effective by combining it with other tools. Specifically, we can use who in conjunction with awk and sort to get a cleaner and more comprehensive list of SSH users. This approach leverages the strengths of who while addressing its limitations through additional processing.

Here's the command you can use:

who | awk '{print $1}' | sort -u

Let's break down what each part of this command does:

• who: This command, as usual, lists the users who are currently logged into the system. However, the raw output can include a lot of information we don't need for this purpose.
• awk '{print $1}': This part uses awk to extract the first field from each line of the who output. The first field typically contains the username, which is exactly what we're interested in.
• sort -u: This sorts the usernames and removes any duplicates. The -u option ensures that each username appears only once in the output, even if the user has multiple SSH sessions.

By combining these tools, we can effectively filter and clean the output of who, making it more useful for identifying unique SSH users. For example, if the raw who output looks like this:

user1    pts/0        2024-07-24 08:00 (192.168.1.100)
user2    pts/1        2024-07-24 08:15 (192.168.1.101)
user1    pts/2        2024-07-24 08:30 (192.168.1.102)

The command will produce a cleaner output like this:

user1
user2

This method provides a straightforward way to get a list of unique users logged in via SSH. While it still relies on the who command, the additional filtering and sorting steps make it more reliable and easier to read. It's a great option when you need a quick list of users without the extra details provided by other methods. This is a clever trick that can help you get the information you need without delving into more complex commands.

Method 3: Checking the /var/log/auth.log File

The /var/log/auth.log file is a treasure trove of information about authentication events on your system, including SSH logins. By examining this file, you can identify successful SSH login attempts and, therefore, determine who is currently connected. This method is particularly useful for auditing and security purposes, as it provides a historical record of login activity. However, it requires root privileges to access the log file, so keep that in mind.

To check /var/log/auth.log for SSH login activity, you can use the following command:

sudo grep "Accepted publickey" /var/log/auth.log | awk '{print $11}' | sort -u

Let's break down this command step by step:

• sudo grep "Accepted publickey" /var/log/auth.log: This part of the command uses grep to search the /var/log/auth.log file for lines containing the phrase "Accepted publickey." This phrase indicates a successful SSH login using public key authentication, which is a common and secure method.
• awk '{print $11}': This uses awk to extract the 11th field from each matching line. In the log entries for successful SSH logins, the 11th field typically contains the username.
• sort -u: As before, this sorts the usernames and removes duplicates, giving you a clean list of unique users.

The output of this command will be a list of usernames that have successfully logged in via SSH using public key authentication. For example, you might see:

user1
user2

This method is especially valuable because it not only shows who is currently logged in but also provides a historical record of SSH login attempts. This can be helpful for security analysis and troubleshooting. However, it's important to note that this method only captures logins using public key authentication. If users are logging in using passwords, you'll need to adjust the grep pattern accordingly. Additionally, log files can grow quite large over time, so you might want to combine this method with log rotation or other log management techniques.

Method 4: Using lastlog Command

The lastlog command is another handy tool for checking the last login time of users, which can help you identify who might still be connected via SSH. Unlike the previous methods that show real-time connections, lastlog provides information about the most recent login for each user. This can be useful for spotting users who have active sessions without directly querying the process table.

Here's how you can use the lastlog command to get a list of recently logged-in users:

lastlog | grep ssh | awk '{print $1}'

Let's dissect this command:

• lastlog: This command displays the last login information for each user on the system. By default, it shows the username, the terminal they logged in from, and the time of their last login.
• grep ssh: This filters the output of lastlog to only include lines that contain "ssh." This ensures that we're only looking at SSH login sessions.
• awk '{print $1}': This extracts the first field from each line, which is the username.

The output will be a list of users who have recently logged in via SSH. For example, you might see:

user1
user2

This method is particularly useful when combined with other methods. For instance, if you use ps to see active processes and then lastlog to check the last login time, you can get a more complete picture of user activity. It's important to note that lastlog relies on the /var/log/lastlog file, which may not always be perfectly up-to-date. However, it provides a valuable snapshot of user login history.

One limitation of lastlog is that it only shows the last login time. If a user has logged in multiple times, you'll only see the most recent session. Additionally, lastlog might not be as accurate in environments where users frequently log in and out. Despite these limitations, it remains a useful tool for system administrators and users who need to monitor login activity and identify potential active sessions. By understanding how lastlog works and its strengths and weaknesses, you can effectively incorporate it into your system monitoring toolkit.

Conclusion

Identifying all currently connected SSH users on a Linux system can sometimes feel like a puzzle, but with the right tools and techniques, it becomes a straightforward task. We've explored several methods, from using the ps command to examining the /var/log/auth.log file and leveraging the lastlog command. Each method has its strengths and weaknesses, and the best approach often depends on your specific needs and environment. Remember, the traditional commands like w, who, and finger might not always provide a complete picture, so it's essential to have alternative methods in your arsenal.

By combining these techniques, you can ensure you have a reliable way to monitor SSH user activity on your Linux system. Whether you're managing a single server or a fleet of virtual machines on GCP, knowing who is connected and when they logged in is crucial for security, troubleshooting, and overall system management. So go ahead, guys, try out these methods and keep your system secure and well-monitored!