SSH Monitoring with PRTG

SSH (Secure Shell) is a protocol that creates an encrypted connection between two systems, enabling them to exchange data securely over unsecured connections.

Think of it as sending a padlocked box made of bulletproof steel through the post. While somebody might be able to get their hands on the box without permission, doing so would be useless, because the tough material and padlock mean they wouldn't be able to open it and find out what's inside.

Similarly, while somebody might be able to intercept data transferred over SSH, they wouldn't be able to make sense of it without the encryption key.

The SSH client initiates a connection to the SSH server on a specific port (default is port 22).

The SSH server responds with its public key and a list of supported encryption and hashing algorithms.

The client and server negotiate to select a mutually supported encryption, hashing, and SSH key exchange algorithm.

The client and server use the chosen key exchange algorithm (e.g., Diffie-Hellman) to securely generate a shared secret key. This key is used to encrypt the session.

The client uses the server's public key to verify the server’s identity. If the server’s public key matches a known and trusted key stored on the client, the server is authenticated.

The client must authenticate itself to the server using one or more methods such as:

• The client sends a password to the server (encrypted).
• The client uses a private key to sign a message. The server verifies this signature using the client’s public key.

Once both the server and client are authenticated, an encrypted session is established using the shared secret key.

All data sent between the client and server is encrypted, ensuring confidentiality and integrity. SSH can be used for various purposes such as remote command execution, file transfer (using SCP or SFTP), and tunneling other protocols.

SSH (Secure Shell) monitoring refers to the process of overseeing and tracking activities and connections related to SSH, a protocol used for securely accessing remote computers. Main aspects include:

• Session logs: Monitoring logs to track when users connect and disconnect, including timestamps and source IP addresses.
• Failed login attempts: Keeping an eye on failed login attempts to identify potential brute-force attacks or unauthorized access attempts.
• Concurrent sessions: Monitoring the number of active SSH sessions to detect unusual activity or resource usage.
• Command logging: Tracking commands executed by users during their SSH sessions to audit actions and detect malicious activities.
• File transfers: Monitoring file uploads and downloads via SCP or SFTP to ensure data security and compliance with policies.
• Unusual patterns: Detecting unusual login patterns, such as access from unusual locations or at unusual times.
• Intrusion detection: Integrating with intrusion detection systems (IDS) to correlate SSH activity with other network events for comprehensive security monitoring.
• Resource usage: Monitoring the resources consumed by SSH sessions, such as CPU and memory usage, to ensure system performance.
• Latency and throughput: Tracking the performance of SSH connections to diagnose network issues or bottlenecks.
• Access control: Ensuring that only authorized users can establish SSH connections.

PRTG can collect health and performance data and system information from any device that supports SSH access. This includes macOS, Linux, and UNIX-based hardware or software. SSH's security, encryption, and remote access and command execution capabilities also make it a good choice for monitoring storage area networks.

In PRTG's device settings, key in the login details for the system you want to monitor, ideally with root access. That's it. PRTG will connect to it and establish the connection. You can log in with a password or OpenSSH-RSA private key, and set it up so any new devices are added to your monitoring environment automatically.

PRTG supports ciphers, MACs, key exchange algorithms, and host key algorithms. Here's a list of the specific values we support.

In PRTG, “sensors” are the basic monitoring elements. One sensor usually monitors one measured value in your network, for example the traffic of a switch port, the CPU load of a server, or the free space on a disk drive. On average, you need about 5-10 sensors per device or one sensor per switch port.