SSH session risk
How InfraFence scores every SSH session from 0 to 100 - authentication method, login hour, privileged commands - and raises the score when other detectors fire during the session.
Last updated:
A successful login is not proof of a legitimate user. The agent follows every SSH session from login to logout and gives it a risk score from 0 to 100 when it ends.
It is on by default (SSH session tracking enabled under Settings › Agent), reads the same authentication log as SSH brute-force detection, and only observes: it never ends a session.
What raises the score
| Factor | Points |
|---|---|
| Logged in with a password instead of a key | 15 |
| Login between 22:00 and 05:59 | 10 |
sudo used to read /etc/shadow or /etc/passwd |
30 |
sudo running a downloaded script (curl or wget piped to a shell) |
30 |
| A user created with UID 0 | 25 |
A user deleted (userdel) |
15 |
A password changed (passwd) |
10 |
| A crontab changed | 10 |
| Each alert from another detector while the session is open | 40 |
Each command factor counts once per session; the total stops at 100. The agent records sudo, useradd, userdel, passwd, crontab and su from the authentication log.
Correlation with the other detectors
With Sigma detection enabled (on by default), every security event the agent reports while a session is open (web firewall, file integrity, malware, port scan, outbound or DNS) at or above the Sigma minimum level (warning by default) adds 40 points to that session. A login followed by a new SSH key and a reverse shell does not go unnoticed.
Recurring automation
A deployment panel such as Coolify, or a backup job, logs in as root with the same key from the same address every few minutes. Scored like a person, each of those sessions would be critical. The agent (1.0.35 or later) keeps the login times of each user, address and key fingerprint for a week, and recognises a recurring automation when:
- the series started at least 6 hours ago;
- it has at least 6 logins from a private address, or 12 from a public one (logins less than 30 seconds apart count as one);
- the gaps are regular: most of them within 10%, or a minute, of the usual gap, which is between 1 minute and 1 day.
Its sessions are still recorded, with the factor Recurring automation. The context factors (a first login from the address, the night, alerts from other detectors) are left out, but its commands still count: a session that does something risky still scores. A new key, a new address or a password login is scored as usual.
What you see
The event ssh_session is reported at logout: critical from 50 points, warning from 25, info below. On the server's Network tab, sessions show their score as Low (0 to 39), Medium (40 to 69) or High (70 to 100), their factors, and the start and end of the login key's fingerprint.
Sessions shorter than 5 seconds with no commands are not reported, nor are the accounts of common monitoring tools (Nagios, Zabbix, Prometheus, Icinga, Checkmk and similar).