Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Solaris machine ( Solaris 10 )

Is it possible to see from my machine ( logs ) which machines are try to connect to my machine by SSH?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

On a Solaris 10 system I have to hand ssh connections (and other auth related information) are logged to

/var/log/auth.log

e.g.

Oct 10 15:15:46 solbase sshd[1481]: [ID 800047 auth.info] Accepted publickey for iain from 192.168.254.188 port 52197 ssh2

is a connection by me to a Solaris 10 machine and

Oct 10 15:17:33 solbase sshd[1481]: [ID 800047 auth.info] Received disconnect from 192.168.254.188: 11: disconnected by user

is a disconnect from the same machine.

share|improve this answer
    
Lucky Iain, not being stuck in the late '90s like me! Upvote for you! –  MadHatter Oct 10 '12 at 14:29
add comment

Yes. Assuming your logs are set up reasonably standardly (and that Sun hasn't been varying things gratuitously), you should see something much like these logs, which are from /var/log/secure on a Solaris 8 box that I have handy:

A successful login (using a public key rather than a password):

Oct 10 15:09:15 xxxx sshd[22706]: [ID 800047 auth.info] Accepted publickey for myuser from 192.168.1.87 port 56035 ssh2

A failed attempt:

Oct 10 15:09:27 xxxx sshd[22726]: [ID 800047 auth.info] Illegal user fred from 192.168.1.87
Oct 10 15:09:27 xxxx sshd[22726]: [ID 800047 auth.info] Failed none for illegal user fred from 192.168.1.87 port 56036 ssh2
Oct 10 15:09:28 xxxx sshd[22726]: [ID 800047 auth.error] error: Could not get shadow information for NOUSER
Oct 10 15:09:28 xxxx sshd[22726]: [ID 800047 auth.info] Failed password for illegal user fred from 192.168.1.87 port 56036 ssh2
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.