I'm noodling with the idea of managing SSH connections on Linux server using a program (not sure what it will be written in yet) that monitors inbound and outbound connections. Is there a way to detect an ssh connection before it is fully established. I'm looking for something that is event driven or another method that is very lightweight in terms of processing power. The closer to real-time detection the better.

When I say "monitoring" I mean the program will check to see if the inbound/outbound connection is authorized for that user/process. If not it will shut it down. Why? Because I have many systems internally that can ssh between each other and I can't use iptables to block access between systems or the ssh white list.


  • Why isn't user authorization enough? Is there a particular reason you want to block on IPs?
    – RoraΖ
    Commented Jul 7, 2015 at 13:05
  • Yes. Some users have wheel rights on the target box. Once they are there then they could ssh to another internal box, without me finding out until after the fact. It's about security. If a ssh key gets shared or stolen then I want to limit the damage they could do with that. So the program will also monitor time of day access too.
    – Rick
    Commented Jul 7, 2015 at 13:12

2 Answers 2


This can probably be done with the Snort Intrusion Prevention System, though Snort rules for SSH are generally used for things like brute force login detection and seeking SSH exploits.

However, I think you'll find that being too draconian, especially on sysadmin-type employees, will likely trigger attrition. Set a corporate policy if you must, but don't enforce it so strictly.


If you don't trust your employee, fire him.

If you trust him (in general), give hime some NDA with fine penalties to sign, to motivate him to think twice what he's doing. And focus on protecting from external threats.

My point is, there is no real protection against well-motivated insider with admin rights and enough time to slowly/carefully do some rogue activities. So instead on trying to protect at technical level, just employ the right people and give them the right documents to sign.

  • That is not always possible, especially when vendors require access. Relying on peoples good will is a recipe for disaster. Keeping people honest through logging, auditing and rule management might not prevent everything that could happen from a human interaction perspective; but it certainly helps.
    – Rick
    Commented Jul 7, 2015 at 16:38
  • I didn't write about relying on people's good will. I wrote about employing the right people at first, and then giving them strong NDAs to sign. Of course logging everything will also help, but from the perspective of priorities, it's more quick & effective to [1] give people NDAs, [2] focus on external threats, [3] prepare the process of replacing untrusted people, [4] then strengthen protections against internal threats having in mind particular untrusted people and particular access rights, and finally [5] start the prepared process. Commented Jul 7, 2015 at 16:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .