Tracking foreign ssh connections with PORT

2 messages in this thread

list Alessandro Tinivelli · Tue, 3 Jan 2017 10:15:31 +0000 ·

Hi all, I was trying to setup an alert when a server has established SSH connections with a "foreign" remote IP (i.e. not beginning with 192.168).
It seem to be working so I'm posting, it maybe it's useful for someone.
Any comment or correction will be appreciated.

P.S.: change host name and the regex accordingly with your ip addressing

HOST=host01
        PORT "LOCAL=%([.:]22)$" "REMOTE=%^(?!(192\.168)).+" state=ESTABLISHED MAX=0 COLOR=red TRACK=SSH_fconn "TEXT=SSH foreign connections"

P.P.S.: very useful site for composing regexp https://regex101.com/ :)

list Henrik Størner · Tue, 03 Jan 2017 11:18:38 +0100 ·

▸ quoted from Alessandro Tinivelli

 
Den 03-01-2017 11:15, Alessandro Tinivelli skrev:

Hi all, I was
trying to setup an alert when a server has established SSH connections
with a "foreign" remote IP (i.e. not beginning with 192.168).

HOST=host01

PORT "LOCAL=%([.:]22)$" "REMOTE=%^(?!(192.168)).+"
state=ESTABLISHED MAX=0 COLOR=red TRACK=SSH_fconn "TEXT=SSH foreign
connections"

Neat, I like that :-) 
Regards,
Henrik

Tracking foreign ssh connections with PORT 🔗 link

Tracking foreign ssh connections with PORT