Ssh lineage table-based tracking of user login sessions
An illustrative system includes a processor configured to: determine that a first user login session and a second user login session have a parent-child relationship that indicates that a particular user is associated with both the first and second user login sessions; link first user login activity performed during the first user login session and second user login activity performed during the second user login session to the user; and identify, at least in part by using an ssh lineage table, an original login session associated with a subsequent chain of login sessions; and a memory coupled to the processor and configured to provide the processor with instructions.
1 . A system comprising:
a processor configured to:
determine that a first user login session and a second user login session have a parent-child relationship that indicates that a particular user is associated with both the first and second user login sessions;
link first user login activity performed during the first user login session and second user login activity performed during the second user login session to the user; and
identify, at least in part by using an ssh lineage table, an original login session associated with a subsequent chain of login sessions; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system of claim 1 , wherein:
the processor is further configured to receive first information associated with the first user login activity and second information associated with the second user login activity; and
the determining is based on the first information and the second information.
3 . The system of claim 2 , wherein the first information and the second information are received, respectively, from a first agent on a first host and a second agent on a second host.
4 . The system of claim 3 , wherein the first host and second host are different.
5 . The system of claim 3 , wherein the first host and second host are the same.
6 . The system of claim 2 , wherein the first information is obtained in response to identifying one or more ssh connection records occurring within a first time period.
7 . The system of claim 1 , wherein the determining that the first user login session and second user login session have the parent-child relationship includes matching a pair of ssh connection records occurring within a first time period, wherein a first member of a matched pair corresponds to a source of a connection and wherein a second member of the matched pair corresponds to a destination of the connection.
8 . The system of claim 1 , wherein the determining that the first user login session and second user login session have the parent-child relationship includes matching a pair of ssh connection records in which a first member of a matched pair occurs within a first time period and wherein a second member of the matched pair occurs outside the first time period.
9 . The system of claim 1 , wherein the determining that the first user login session and the second user login session have the parent-child relationship includes matching a pair of ssh connection records, and wherein, in response to a determination that multiple matches are possible, a pair having a smallest delta between respective start times is selected.
10 . The system of claim 1 , wherein the determining that the first user login session and the second user login session have the parent-child relationship includes matching a pair of ssh connection records using a GUID included by a client in a connection request.
11 . The system of claim 1 , wherein the linking the first user login activity and the second user login activity includes joining an ssh connection record and a new login record.
12 . The system of claim 1 , wherein at least one of the first login session and the second login session is included in the subsequent chain of login sessions.
13 . The system of claim 1 , wherein the original login session occurs on a first machine and wherein at least one session included in the subsequent chain of login sessions occurs on a second machine that is different from the first machine.
14 . The system of claim 1 , wherein the processor is configured to identify the original login session by recursively determining adjacency relationships between login sessions.
15 . The system of claim 1 , wherein the linking the first user login activity and the second user login activity includes associating a process to a child process using a process hierarchy.
16 . A method comprising:
determining that a first user login session and a second user login session have a parent-child relationship that indicates that a particular user is associated with both the first and second user login sessions;
linking first user login activity performed during the first user login session and second user login activity performed during the second user login session to the user; and
identifying, at least in part by using an ssh lineage table, an original login session associated with a subsequent chain of login sessions.
17 . The method of claim 16 , further comprising:
receiving first information associated with the first user login activity and second information associated with the second user login activity;
wherein the determining is based on the first information and the second information.
18 . The method of claim 17 , wherein the first information and the second information are received, respectively, from a first agent on a first host and a second agent on a second host.
19 . A non-transitory computer readable storage medium comprising computer instructions stored thereon that, when executed by a processor, cause the processor to:
determining that a first user login session and a second user login session have a parent-child relationship that indicates that a particular user is associated with both the first and second user login sessions;
linking first user login activity performed during the first user login session and second user login activity performed during the second user login session to the user; and
identifying, at least in part by using an ssh lineage table, an original login session associated with a subsequent chain of login sessions.
20 . The non-transitory computer readable storage medium of claim 19 , wherein the computer instructions, when executed by the processor, are further to:
receiving first information associated with the first user login activity and second information associated with the second user login activity;
wherein the determining is based on the first information and the second information.