How can I see if users are logged in over sftp?

Question

I run a linux file server for my office and we user SFTP for remote partners to login and download files. Is there a way to see if there are any active connections or logins so I can know when it is safe to perform maintenance on the machine?

Since the machine is almost constantly serving large files, scheduled maintenance is often bumped off due to someone either upload

Answer 1

I think you can use the command line program who to see this. I have noticed some reports that doing so doesn't work, but I still think it may work (maybe it's an ssh setting).

sftp is built on top of SSH. It stands for the "SSH File Transfer Protocol". And when you're logged in over ssh, 'who' will include you as a logged in user with its output. So I'd expect this to work with active sftp sessions too.

This discussion from 2008 also suggests that you may use 'netstat' for this. It also includes a suggestion to run 'who' via 'watch' so you can see updates without doing anything.

Answer 2

You can also do:

ps -ef | grep '[s]shd' | grep -v ^root

which should show any sshd sessions (which are used for sftp). I notice on my machine my sshd process command line contains '$USER@notty' which makes sense since I'm not logged in with a terminal session. You could tighten up the grep above with:

ps -ef | grep '[s]shd:.*@notty' | grep -v ^root

BTW: the square brackets in the grep are to not have the 'grep sshd' process show up in the process list. [s]shd matches sshd, but doesn't match itself. It saves a 'grep -v grep'