Access SSH client IP address, within a screen session

问题

Accessing the IP address of a connecting SSH client is possible via environment variables (such as SSH_CONNECTION), as described in

Find the IP address of the client in an SSH session

In a GNU screen session though, those environment variables are defined by whoever started the screen to begin with. Is there any way to also get hold of the SSH connection information, for someone who enters an already-existing screen session later, like from another host?

I can't think of a way to determine this, but this can be useful in cases where screen sessions are shared between different people, for example.

回答1:

If the screen session is launched as root, you can but it won't be perfectly reliable

1. If two users type in the same screen window, they will both interact within the same shell. One can write a command. The other can press the <enter> key.

2. You have to get access to the environment variable SSH_CONNECTION (or better SSH_CLIENT) which is only possible if you are root, or if you use the same user inside the screen session.

Supposing you are root inside the screen session, you can know the last user active in a screen session by using the ps command and finding the last active session.

ps h -C screen katime -o pid,user

By using the pid, and accessing the /proc/<pid>/environ file, you can get the SSH_CLIENT variable.

sed -z '/SSH_CLIENT/p;d' /proc/`ps h -C screen katime -o pid |head -1`/environ

--> SSH_CLIENT=257.31.120.12

All of this suppose that your screen is executed as root

You can also chose to log all the active connections. For such need, I would suggest you to store both the full list of connections and their last activity.

ps eh -C screen kstime -o pid,atime | while read pid stime; do echo -n "$stime: ";\
    gawk -v 'RS=\0' -F= '$1=="SSH_CLIENT" {print $2}' /proc/$pid/environ; done

Result:
00:00:00: 257.31.120.12 61608 22
00:07:11: 258.1.2.3.4 49947 22

Note that you can also parse the result of the ps eh -C screen kstime -o args command if you find it easier.

EDIT:

This is a working Debian command to get all users currently connected to the same screen session:

 find /var/run/screen/
     -name $(pstree -sp $$ |sed 's/.*screen(\([0-9]*\)).*/\1/;q').*
     -printf "%h\n"
      | cut -f2 -d-

回答2:

You can check the output of the last command that would list of all IP addresses or hostnames of all connection made if sshd is the only way to connect to server.

ec2-user]# last
ec2-user pts/0        115.250.185.183  Sun May 29 13:49   still logged in
ec2-user pts/0        115.250.140.241  Sat May 28 07:26 - 10:15  (02:48)
root     pts/4        113.21.68.105    Tue May  3 10:15 - 10:15  (00:00)

Alternatively (on Linux), you can check /var/log/secure where sshd will usually log all details of all the connections made even if they don't result in successful logins.

回答3:

If you're trying to support the multi-display mode ('screen -x'), then as someone said above you are likely out of luck.

One the other hand, if you could assume single-user mode, then you could create a wrapper/alias for the screen command that carries along an environment variable into screen (see 'screen -X stuff ...'); in this case you are just passing along SSH_CLIENT that will have the appropriate value.

If you can assume a given username comes from a single location (or, if more than one location, then simply choose most recent), then you can do some grep/sed on output of 'last' command.

client_ip=`last -ai | grep "still logged in" | grep "$USER " | grep -v '0.0.0.0' | tail -n 1 | sed 's/.* //g'`
echo "Hello $client_ip"

回答4:

If your screen is starting usually in detached mode, then in your .screenrc, add the the following:

shell -$SHELL

Then your screen will have all the the variables. For currently running screens that you are stuck with, simply run.

source ~/.bash_profile

Replace the path and the file name to match your environment.

来源：https://stackoverflow.com/questions/37478810/access-ssh-client-ip-address-within-a-screen-session