Hey everyone, still pretty new to the whole DevOps side of things, so I hope this isn't a silly question.
We're starting to use NordLayer more heavily for team access. I'm worried about "ghost" users—accounts for people who've left the company but might still be active. What's the best, simple way to monitor for that? I'm thinking maybe checking connection logs? But I'm not sure where to start or what to look for exactly.
From a basic Linux and Docker background, my instinct is to script something, but maybe there's a built-in feature or a common practice I'm missing? Any guidance would be super helpful 😅
I'm a senior product analyst at a 150-person SaaS company where my team owns both product analytics and, due to some historical quirks, the monitoring of our internal security posture, including VPN access. We've used NordLayer in production for about 18 months for our developer and support team remote access.
**Core Comparison: Approaches to Monitoring for Dormant VPN Accounts**
1. **Built-in Activity Log Scraping**
NordLayer's admin panel provides a connection events log, but it's a manual UI check with limited historical depth. You can script against their Admin API to pull these events. In my experience, the API is functional but the event data lacks granular detail like continuous session heartbeat; you mainly get connection and disconnection timestamps. The effort to build a reliable check is about 2-3 days of work for a script that runs daily, parses the JSON, and flags users with no connections for, say, 45 days. The main limitation is you're only checking for successful connections, not attempted failed logins from a dormant account.
2. **Syslog Forwarding to a SIEM**
NordLayer can forward logs to a SIEM via syslog (found under "Security -> Event logging" in the admin panel). We route these to a small Graylog instance we run. The setup took a full afternoon to configure the forwarding and build the Graylog pipeline and alerts. This gives you a centralized log and the ability to set alerts on specific event types. However, the log schema is fixed, and the "User disconnected" event is sometimes delayed. The win is having all authentication events in one place for correlation.
3. **SCIM / Identity Provider Sync Vigilance**
If you've integrated NordLayer with an identity provider like Okta or Azure AD via SCIM, the best monitoring is often a compliance report from the IdP itself. You can create a report listing users provisioned to NordLayer and compare it against your HR system's active employee list. This is a preventative control, not a detective one. The effort is low if your IdP is already the source of truth, but the gotcha is that SCIM de-provisioning can sometimes fail silently if the NordLayer API is unreachable, leaving orphaned accounts.
4. **Periodic User List Audit Script**
This is the simplest, most reliable method we've settled on for a definitive check. We run a Python script weekly that uses the NordLayer API to fetch the full list of licensed users and their statuses (`active`, `invited`, `blocked`). We compare that list against an export from our HRIS (BambooHR). Any user in NordLayer not found in the HRIS export is flagged for review. The script is about 80 lines of code and runs in a scheduled Lambda function. Its clear win is simplicity and accuracy for catching pure "ghosts." Its limitation is it won't catch a compromised active account.
**My Pick**
For your described worry about "accounts for people who've left the company," I'd recommend starting with the **Periodic User List Audit Script**. It directly answers the question "Do we have any users who shouldn't be here at all?" with minimal moving parts. To decide between a script and a SIEM approach, tell us: 1) Do you have a central employee directory (like an HRIS) you can reliably query via API? and 2) Are you also concerned about detecting *failed* login attempts from these ghost accounts?
Data > opinions
That's a great question, and not silly at all. Starting with connection logs is the right instinct. Since you mentioned having a Linux/Docker background, scripting against NordLayer's API is totally doable.
One tip from when we set up something similar: don't just look for connections from inactive accounts. Also watch for accounts that *only* connect from IPs outside your country or typical working hours. It can be a clearer signal than just a date threshold.
Let us know what you find when you start poking at the logs!
Always testing the next best thing.
That's a solid tip about checking IP geolocation and time patterns. It moves from simple "last seen" logic to actual behavioral anomaly detection.
Just a caveat from our setup: don't rely solely on geolocation. Our devs travel, and support folks work odd hours. We built a small baseline of "normal" for each active user over a 30-day window - typical locations and times - and then flagged deviations from that. A brand new account connecting only from an unusual IP is a much higher-fidelity alert than a long-tenured engineer on vacation.
What did you use to enrich the IP data? We started with a simple local MaxMind DB.