Name: Monitoring and auditing SSH connection attempts
Uploaded: 2019-01-26T11:52:31-06:00
Description: Learn how to audit SSH logs and trails to ensure your remote host has not been compromised. The lastlog command will help you with your audit trail to help scrutinize possibly undesired connection attempts.

Create a New SSH Public and Private Key Set

Copy an SSH key to a remote server using ssh-copy-id

SSH into a remote server

Simplify connections with SSH config files

Use scp to securely copy files remotely over SSH

Configure local and remote port forwarding with an SSH tunnel

Use SSH escape sequences and codes

Check and verify SSH fingerprints

Modify server configuration to lock down incoming SSH connections

Monitoring and auditing SSH connection attempts

SSH for Remote Server Authentication

Learn how to audit SSH logs and trails to ensure your remote host has not been compromised. The lastlog command will help you with your audit trail to help scrutinize possibly undesired connection attempts.

https://app.egghead.io/api/v1/lessons/bash-monitoring-and-auditing-ssh-connection-attempts/subtitles

Instructor: [00:00] Connection attempts are logged to /var/log/off.log. Open that file and you will be able to see authentication attempts to the server, including the user that tried to log in, the IP address of the connection attempt, the port used, and other information.

[00:20] Type lastlog. This command will show you the most recent login attempt for all users. To find the last login for a specific user, type lastlog-u, followed by the username. You can use a combination of monitoring rights to the offlogfile, along with the lastlog command, as tools in your arsenal to audit or monitor SSH connection attempts.

[00:46] If you are concerned that someone has accessed the server with a specific username, you can log into that user account and view their Bash history file. This .bash_history file within a user's home directory will contain every command that was ever executed within a Bash prompt. You can use this history of executed commands to further scrutinize any possible unauthorized SSH connection attempts.

Monitoring and auditing SSH connection attempts

Share this video with your friends

Course

SSH for Remote Server Authentication