Is it possible to monitor SSH activity within the local network of the organization? Specifically is it possible to:

  1. View open SSH connections per user/machine along with the servers they are connected to
  2. Sniff SSH traffic. What if the system administrator knows my SSH keys?

If I configure my SSH server to accept connections on port 80 instead of port 22 will it look like I'm browsing some web pages on the remote machine? Basically I want to be able to maintain SSH connection to some server and not worry that someone within the network wiretaps the communication.


View open SSH connections per user/machine along with the servers they are connected to

When network traffic leaves your system, unless you are physically connected to another system via a crossover cable, it traverses at least one intermediate system. Software on these intermediate systems can record metadata about each packet, including source IP/port and destination IP/port. Advanced software can even do things like tie together TCP flows, know what protocol is being used, and note things like time, duration, and bytes transferred.

For SSH, it would be difficult to correlate network traffic to the user generating it without help from the system involved, but if there is some program on the user's system recording who starts which process and the command line arguments thereof, obviously that can be deduced.

Sniff SSH traffic. What if the system administrator knows my SSH keys?

SSH is encrypted, which means while the above information can be gleaned (which is true of anything that traverses the network), the content or payload of the transmission will be protected.

It's possible to decrypt this if the SSH key is known.

  • Could you please also comment on the last part of the question - if I switch from port 22 to port 80 on the remote machine, will it appear as if I'm browsing some web pages on the remote machine to these advanced intermediate systems? Or is it possible to tell the protocol used just from the structure of the TCP traffic? – ak0 Jun 25 '15 at 18:14
  • It's possible to tell the protocol used from the structure of the traffic, but that's an advanced operation that would be on an advanced firewall or gateway device. A basic firewall that is simply set to allow any traffic on port 80 would allow it. If you want to make it look like HTTPS traffic on the protocol level, you have set up and tunnel your SSH through an HTTPS tunnel (adding latency and slowness) - I believe there are tools to accomplish this if you have a system outside of the network that can accept incoming connections. – LawrenceC Jun 25 '15 at 19:50

Secure Shell

SSH by definition is secure as all traffic is encrypted whilst in transit across all networks. Wiretapping is not something that you have to worry about with SSH.

The entire purpose of SSH is to create an encrypted connection between the client and the server to ensure that none of the information transmitted between them can be seen on any network other than in its encrypted form.

Changing the port would do little to disguise the traffic anyway but it is not necessary, as like I said SSH is completely encrypted. This would only be 'Security through Obscurity' at best anyway which is not security in anyway, shape or form.

Breached Keys

If the system administrators have your SSH keys then wiretapping would not be your concern as they could directly connect to the server let alone decrypt traffic sent over the network.

It is unlikely they have your keys as these cannot be sniffed out when sent, as they are encrypted in transit.

View Network Connections

Network admins will be able to pinpoint that your user account and computer is connected to a specific IP address on port 22 but that's all they will be able to see. I would not consider this a great concern as long as your servers security is correctly configured.

On an Internet facing SSH server, one or two network admins are most likely your least likely people to be targeting your server, you will most likely find that people are already constantly attacking it, this is called 'the background noise of the Internet'. This can be seen by reviewing your auth logs. As long as only key auth is enabled this is not a concern but I personally like to run fail2ban too to filter out these connections.

SSH Security Concerns

The biggest concern when using SSH is to ensure that attackers cannot gain access to the SSH server itself, normally through brute force attacks but this can also be done via much more sophisticated targeted attacks.

The simplest and quickest way to secure an SSH server is to enable key auth authentication rather than password authentication.

If possible you should remove your SSH server from the Internet and only allow access either internally or through a VPN connection.

There are many more ways to secure an SSH server such as two factor security and packet knocking.

Telnet Example

It is for these exact reasons that telnet is largely not in mass use anymore. As it does not encrypt the connection, everything is sent across the network in plain text, including the password, meaning that anyone on the network that is packet sniffing or monitoring connection logs can easily obtain username and password information and anything else sent over a telnet connection.

Further Information

More information about SSH can be found here...

Man page for SSH

OpenSSH Website (One of the largest SSH Servers)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.