View SSH port log?

[bakerboy]

Hi guys/gals,

I know how to check /var/log/secure but what I want to be able to determine is if anyone is using my server as a tunnel and if so what IP they are eventually connecting to, secure logs don't show where a connection goes just where the user has connected from.

Example: user Tom connects via SSH tunnel to server B on 1.2.3.4:6688 . Server A is obviously the conduit.

Where in the logs on Server A can I find the IP address that Tom connected to? Can I?

Server is Centos 5.1. Hope you can help!

BB.

[jledhead]

so from your example, user1 ssh connects to server1, from there he initiates another connection using ssh client to some where else?

If that is correct then I don't think the ssh client will be able to log in that way. You may need to do some firewall management, even if its just a pass thru, to capture the info you need.

[bakerboy]

It's more a question of if user Tom has Putty set up to create an SSH tunnel using Server A to get to Server B. Would that sort of action be recorded in the log and if so where?

[davidanand]

hello,

No if u are the serve As root user check the netstat -anp that will display the
current connections from the server and to the server ..