Notification about SSH connection to Linux VM

Question

Hi
we build Linux Ubuntu VM on Azure with public IP , and SSH enabled.
I build log analytics on it.

How can i get notification when someone connect SSH?
What i find is NSG flow logs, but this can log only to Storage. And this is pain to find some info there.

Answer 1

@Belan Marek
I understand you wish to get notifications whenever there is an SSH session made to your Linux VM. Please correct me if I am misunderstanding.

If you have your VM onboarded in the Azure Monitor Virtual Machine Insights, then, in the Log Analytics Workspace where the agents are connected, you will get details about each connection that every process running on the agents are initiating / receiving.
All that data is stored in a table called VMConnection, and then you could use a query like this to find out the required info:

VMConnection
| where Direction == "inbound"
| where Protocol == "tcp"
| where DestinationPort == 22
| summarize FirstEvent = min(TimeGenerated), LastEvent = max(TimeGenerated),NumberOfConnections = count() by Computer, RemoteIp

The above query how many incoming SSH connections (TCP 22) were detected from each RemoteIP, together with some additional information like when the first and last connections were done. You should be able to create an alert based on monitoring the above information.

Another popular option not exclusive to Azure is to setup an email alert from the VM. This will send an email everytime someone logins with SSH to your server. Please see this blog post for information on how this can be done.

Hope this helps. Let me know if you have further questions or need help.

-------------------------------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Disclaimer: This response contains a reference to a third-party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites; therefore, Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there.
There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software from the Internet.

Answer 2

Have a look at the procedure I shared here: https://learn.microsoft.com/en-us/answers/questions/764226/is-it-possible-to-create-an-alert-when-someone-log.html
Hope, this helps you also