Do you have a question? Post it now! No Registration Necessary. Now with pictures!
- Posted on
- Question about SSH_CONNECTION
May 30, 2004, 8:06 pm
rate this thread
at ip address a.b.c.d displays this with phpinfo:
_ENV["SSH_CONNECTION"] j.k.l.m 16586 w.x.y.z 22
Presumably, this means that root is logged in via SSH, from a machine at
ip address j.k.l.m (using his outbound port 16586), right?
But wouldn't the webhost's ip (a.b.c.d) normally appear instead of
w.x.y.z, or alternatively, what is the significance of w.x.y.z. appearing
instead of the website's a.b.c.d? (a.b.c.d and w.x.y.z are totally
different networks, in fact one allocated via LACNIC and the other via
Could a vpn connection appear this way, or could this be the result of
some very hacked routing (e.g. could the box at w.x.y.z be virtually
Sorry for munging the ip's but this question involves a spammer's
operation and I'd prefer not to give away the game just yet.
Re: Question about SSH_CONNECTION
Right, kind of. What it *probably* means is that root *was* logged in
from that address when they started the service (apache, I guess).
Web hosts often have 2 interfaces, one public and one admin interface.
Typically, admin-type services like ssh don't listen on the public
It could be a VPN, tunnel interface, IP alias, or root could have just
changed those environment variables by hand.
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
- » ssh on command line: force using a group size (prime size) of 1024 (and no...
- — Newest thread in » Secure Shell Forum