Cybersecurity Triage
Read-onlyCheck Whether SSH Is Publicly Bound
You need to see whether SSH is listening on a non-localhost address.
Command
ss -ltnp | awk '$4 ~ /:22$/ && $4 !~ /^127[.]/ {print}'Before you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not treat bind address alone as access policy; compare it with firewall sources and cloud security groups.
Expected output
Any SSH listener on port 22 that is not bound only to localhost.
System impact
Read-only. Nothing changes. awk filters socket output for non-local SSH bind addresses.
Recovery / rollback: no state is changed.
When to use it
Use during SSH hardening checks or before deciding whether firewall source restrictions are enough.
When not to use it
Do not treat bind address alone as access policy; compare it with firewall sources and cloud security groups.
Watch this command run
Command transcript
This sanitized transcript shows the commands and output shape without exposing host details.
$ ss -ltnp | grep ':22'
LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=801,fd=3))$ ufw status numbered | grep '22/tcp'
[ 1] 22/tcp ALLOW IN 203.0.113.0/24$ ss -ltnp | awk '$4 ~ /:22$/ && $4 !~ /^127[.]/ {print}'
LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=801,fd=3))View commands shown
These are the commands shown in the sanitized transcript.
Commands shown
ss -ltnp | grep ':22'ufw status numbered | grep '22/tcp'ss -ltnp | awk '$4 ~ /:22$/ && $4 !~ /^127[.]/ {print}'
next steps
Related commands
Check Whether Databases Listen Publicly
The fastest database security check is the listening address.
ss -ltnp | awk '$4 ~ /:(5432|3306)$/ {print}'
Find Public Listeners Not Allowed by UFW
The process was public, but the firewall did not mention it.
comm -13 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '$4 ~ /^(0[.]0[.]0[.]0|[[]::[]]|[*]):/ {n=split($4,a,":"); print a[n]}' | sort -u)
Show Local-Only Database Listeners
The database was listening, but only on localhost.
ss -ltnp | awk '$4 ~ /^127[.]0[.]0[.]1:(5432|3306|6379)$/ {print}'
Find Allowed Ports with No Listener
An open firewall rule can outlive the service it was created for.
comm -23 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '/LISTEN/ {n=split($4,a,":"); print a[n]}' | sort -u)
Show Publicly Bound Listeners
Localhost services are different from public listeners.
ss -ltnp | awk 'NR==1 || $4 ~ /^(0[.]0[.]0[.]0|[[]::[]]|[*]):/'
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Useful for
- LPIC-1 style command-line practice
- LFCS style performance tasks
- Linux+ style troubleshooting review
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.