I'm noodling with the idea of managing SSH connections on Linux server using a program (not sure what it will be written in yet) that monitors inbound and outbound connections. Is there a way to detect an ssh connection before it is fully established. I'm looking for something that is event driven or another method that is very lightweight in terms of processing power. The closer to real-time detection the better.
When I say "monitoring" I mean the program will check to see if the inbound/outbound connection is authorized for that user/process. If not it will shut it down. Why? Because I have many systems internally that can ssh between each other and I can't use iptables to block access between systems or the ssh white list.