sshmonitor/sshMonitor.sh

#!/usr/bin/env bash

fileSSHConnections="/tmp/.sshActualConnections"
logDir="/tmp/"

main(){
  checkRoot
  haveProgram strace wget lsof awk
  printActualSSHConnections
  monitoringSocket
}

checkRoot(){
  if [ "$(whoami)" != "root" ]; then echo -e "\e[31m\e[1m[NOT OK]\e[0m Run it with root please" && exit ; fi
}

haveProgram(){
  for i in $@; do type $i &> /dev/null ; if [ $? == 1 ]; then echo "$i not found. Please install it"; fi ; done
}

printActualSSHConnections(){
  lsof -c ssh 2>/dev/null | grep IPv4 | awk '{ print $2,$9 }' | cat -n | tee $fileSSHConnections
}

monitoringSocket(){
  if [ $(wc -l $fileSSHConnections | cut -d " " -f 1) != 0 ];then
    read -p "Enter option number: " nOption
    pidSSH=$(cat $fileSSHConnections | awk '{ print $2 }' | head -n $nOption | tail -n 1)
    strace -p $pidSSH | tee -a $logDir/sshMonitor-$pidSSH.log
  else
    echo "No ssh connection found"
  fi
}

main