search

sshlog / agent

SSH Session Monitoring Daemon
http://www.sshlog.com
Other
475 stars 22 forks source link

Logging if someone jumps through the host #12

Open jm23-23 opened 1 year ago

jm23-23 commented 1 year ago

Hi, I was looking for a tool that would help me log an event when someone uses the server as a proxy to connect to other hosts. It is commonly known that this is a typical vector of hacker activity, so the ability to log such events would be helpful in increasing server security. Unfortunately, apart from examples, I did not find any other triggers that could be used, and I checked that “connection_established” does not log sessions in which someone uses the server as a proxy (jumphost). Any hints?

matthill commented 1 year ago

I think if someone were to proxy through your SSH server, it should show up as an "ssh" command event. For example, seeing an ssh command shortly after connection establishment, or seeing the :ssh -W" command option would probably tell you when this is happening.