0

I was grepping through /var/log/auth.log and noticed that for some reason, not every time, but sometimes when I would log in via SSH I would see entries like the following - where there were multiple sessions opened (at the exact same time) for one SSH login:

Aug 19 20:48:44 <redacted> sshd[1409]: pam_unix(sshd:session): session opened for user <redacted> by (uid=0)
Aug 19 20:48:44 <redacted> systemd-logind[403]: New session 16 of user <redacted>.
Aug 19 20:49:11 <redacted> sshd[1452]: pam_unix(sshd:session): session opened for user <redacted> by (uid=0)
Aug 19 20:49:11 <redacted> systemd-logind[403]: New session 17 of user <redacted>.
Aug 19 20:49:11 <redacted> sshd[1453]: pam_unix(sshd:session): session opened for user <redacted> by (uid=0)
Aug 19 20:49:11 <redacted> systemd-logind[403]: New session 18 of user <redacted>.
Aug 19 20:49:11 <redacted> sshd[1456]: pam_unix(sshd:session): session opened for user <redacted> by (uid=0)
Aug 19 20:49:11 <redacted> systemd-logind[403]: New session 19 of user <redacted>.
Aug 19 20:49:11 <redacted> sshd[1454]: pam_unix(sshd:session): session opened for user <redacted> by (uid=0)
Aug 19 20:49:11 <redacted> sshd[1457]: pam_unix(sshd:session): session opened for user <redacted> by (uid=0)
Aug 19 20:49:11 <redacted> systemd-logind[403]: New session 21 of user <redacted>.
Aug 19 20:49:11 <redacted> systemd-logind[403]: New session 20 of user <redacted>.

And then multiple sessions closed when the same (single) SSH connection was disconnected:

Aug 19 20:52:56 <redacted> sshd[1764]: pam_unix(sshd:session): session closed for user <redacted>
Aug 19 20:52:56 <redacted> systemd-logind[403]: Removed session 23.
Aug 19 21:04:11 <redacted> sshd[1409]: pam_unix(sshd:session): session closed for user <redacted>
Aug 19 21:04:11 <redacted> systemd-logind[403]: Removed session 16.
Aug 19 21:04:27 <redacted> sshd[1454]: pam_unix(sshd:session): session closed for user <redacted>
Aug 19 21:04:27 <redacted> systemd-logind[403]: Removed session 20.
Aug 19 21:04:27 <redacted> sshd[1453]: pam_unix(sshd:session): session closed for user <redacted>
Aug 19 21:04:27 <redacted> systemd-logind[403]: Removed session 18.
Aug 19 21:04:27 <redacted> sshd[1452]: pam_unix(sshd:session): session closed for user <redacted>
Aug 19 21:04:27 <redacted> systemd-logind[403]: Removed session 17.
Aug 19 21:04:27 <redacted> sshd[1457]: pam_unix(sshd:session): session closed for user <redacted>
Aug 19 21:04:27 <redacted> systemd-logind[403]: Removed session 21.
Aug 19 21:04:27 <redacted> sshd[1456]: pam_unix(sshd:session): session closed for user <redacted>
Aug 19 21:04:27 <redacted> systemd-logind[403]: Removed session 19.

When I run:

loginctl list-sessions

I see:

SESSION        UID USER             SEAT             TTY             
       317       1000 <redacted>

Only one session id, which would be a more logical 1-1 ratio between sessions and logins, but as evidenced above; there has definitely been occasions where that wasn't the case.

Just wondering if this is something to be concerned about security-wise, and whether or not someone could offer an explanation that would make sense as too why so many sessions would be opened from one SSH login on some occasions, but others not?

  • What client are you using to connect to the server? You mention sometimes, do you have any idea if it is about time, computer client or activities? – Hugo Glez Sep 4 '18 at 13:29
  • Have you tried looking at the process tree? In particular the pids quoted in the logs. – William Hay Sep 4 '18 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.