SSH Session Monitor

SSH Session Monitor is an open-source console application developed for Windows, designed to provide comprehensive monitoring of Microsoft OpenSSH Server via the Windows event log. This utility offers administrators valuable insights into active SSH connections and session activities, ensuring a secure and well-audited environment.

Key Features:

• Real-time Connection Monitoring: Display details of all established SSH connections including user identity, source IP address, connection duration, and the process owning the connection.
• Session Command Reconstruction: View an ongoing terminal session's commands and associated PowerShell transcript output live, aiding in the review of user activities.
• Enhanced Event Correlation: Seamlessly correlate events from various sources, such as OpenSSH, Security, Sysmon, and PowerShell, by associating them through process generation and logon IDs.
• Persistent Logging: Store normalized events in an SQLite database with Write-Ahead Logging (WAL) mode for data integrity, allowing a clean resumption of monitoring after restarts.
• Audit Gap Reporting: Identify and report missing capture data, ensuring compliance with audit and logging policies necessary for command and output capture.

Operation:

SSH Session Monitor functions in a purely read-only mode. It integrates seamlessly with existing OpenSSH Server deployments without the need for additional SSH daemons, proxies, bastions, or in-session agents. Importantly, the application does not intercept keystrokes, capture credentials, or manipulate existing SSH sessions in any manner.

Requirements:

• Operating System: Windows 10/11 or Windows Server 2019+
• .NET 8 SDK for building the application
• Microsoft OpenSSH Server installed
• Administrator rights required to access the Security event log

User Interface:

The terminal UI is designed to facilitate ease of use:

• Tab: Switch between connections and command/output panes.
• Up/Down Arrows: Navigate between connections or scroll through command/output.
• Page Up/Page Down: Scroll through command/output by page.
• End: Jump back to live output display.
• R: Refresh capture status.
• Q or Ctrl+C: Exit the application.

For ease of setup and operation, the application includes helpful commands for configuring the necessary event sources and logging features on Windows systems. The development and testing environment has comprehensive test coverage to ensure reliability and performance, utilizing sanitized XML from representative event logs as fixtures.

SSH Session Monitor empowers system administrators to maintain transparency and control over SSH activities within their environments, bolstering both security and compliance.