Sometimes you may just want to know how many ssh connections on one of your server, and where the client come from?

Here just some of my tips. To be exact, the ways described below not exactlly limited to 'ssh session', but also can be for other login session, for example rlogin, telnet etc.. But, for most of real cases, people should use ssh other than others for remote login.

Get ip from environment varialbes

There are two envronment variables you can get

SSH_CLIENT and SSH_CONNECTION

$ echo $SSH_CLIENT
10.90.97.85 51839 22
$ echo $SSH_CONNECTION
10.90.97.85 51839 10.90.97.3 22

In the case above, $SSH_CLIENT shows client ip, client port and server port.

While, $SSH_CONNECTION shows client ip, client port and server ip and port

It's a quick way to get connection info in script, good for logging.

Pinky

 $ pinky
Login    Name              TTY      Idle   When             Where
test                       pts/0    00:06  2015-01-23 11:07 server1.fibrevillage.com
john                       pts/1    00:12  2015-01-19 11:49 server2.fibrevillage.com
ddes                       pts/2    3d     2015-01-23 11:06 server3.fibrevillage.com
...

Different with $SSH_CLIENT, it tells you all connections on the host and where they came from

 who

It's very much like pinky, tells you the list of login user name, tty, login time and remote machine

who
test              pts/0 2015-01-23 11:07 server1.fibrevillage.com
john              pts/1  2015-01-19 11:49 server2.fibrevillage.com
ddes              pts/2  2015-01-23 11:06 server3.fibrevillage.com

w

Like pinky and who, it list all login user info, but with more info:

$ w
 15:04:07 up 138 days,  3:35, 10 users,  load average: 0.04, 0.01, 0.00
USER     TTY      FROM               LOGIN@   IDLE   JCPU   PCPU WHAT
tapeguy  pts/0    s1.fibrevillage.com  Fri11   31.00s  0.05s  0.05s -bash
tapeguy  pts/1   s2.fibrevillage.com 19Jan15 17:12   1.74s  0.16s -bash
tapeguy  pts/2   s3.fibrevillage.com  Fri11    3days  0.03s  0.03s -bash
tapeguy  pts/3   s4.fibrevillage.com 19Jan15 18:42   0.53s  0.52s mysql -u taper -p smallhsm_test

netstat

$ netstat | grep ssh
tcp        0      0 s4.fibrevillage.com:ssh    s1.fibrevillage.com:51169      ESTABLISHED
tcp        0      0 s4.fibrevillage.com:ssh    s1.fibrevillage.com:46307      ESTABLISHED
tcp        0      0 s4.fibrevillage.com:ssh    s1.fibrevillage.com:51824      ESTABLISHED

[tapeguy@pps02 var]$ netstat -tapen | grep ssh

tcp        0      0 10.12.1.138:53941          10.12.1.137:22224          ESTABLISHED 502        289566175  7027/ssh  
Note: (Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)

 last

last searches  back  through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created, seems not same as other tools above shows live connections, however, there is a way to find live connections.q

$ last -i | grep ' still logged in'
root        pts/6         10.12.1.100     Mon Jan 26 14:44   still logged in   
tapeguy  pts/10       10.90.97.242   Fri Jan 23 12:32   still logged in   
tapeguy  pts/5        10.90.97.242    Fri Jan 23 11:15   still logged in   
tapeguy  pts/0        10.90.97.242    Fri Jan 23 11:07   still logged in   
tapeguy  pts/2        10.90.97.242    Fri Jan 23 11:06   still logged in   

ssh library

Yes, you can always call ssh library to get it, in the case below shows within ssh connection session, it got ip from environment variable $SSH_CLIENT:

public static String getIpAddress() throws TaskExecFailException{
    ConnBean cb = new ConnBean(host, username, password);
    SSHExec ssh = SSHExec.getInstance(cb);
    ssh.connect();
    CustomTask sampleTask = new ExecCommand("echo \"${SSH_CLIENT%% *}\"");
    String Result = ssh.exec(sampleTask).sysout;
    ssh.disconnect();   
    return Result;
}

Of course, you need ssh library installed. libss2-devel