Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am unsure of how to log successful ssh attempts that match an IP address from GOOD_IPS. So far I am only logging incoming and outgoing attempts whether or not the related IP addresses are allowed or not. How would I write a statement that logs all successful SSH login attempts that match an address from GOOD_IPS and also one that logs successful and denied attempts from addresses outside of GOOD_IPS?

#allow ssh for ip addresses in GOOD_IPS chain
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p TCP --sport 22 -m state --state NEW -j GOOD_IPS
iptables -A OUTPUT -p tcp --sport 22 --syn -j LOG --log-prefix "iptables: ssh outgoing attempt"
iptables -A OUTPUT -p TCP --sport 22 -m state --state NEW -j DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 --syn -j LOG --log-prefix "iptables: ssh incoming attempt"
iptables -A INPUT -p TCP --dport 22 -m state --state NEW -j GOOD_IPS
iptables -A INPUT -p TCP --dport 22 -m state --state NEW -j DROP 
#ip addresses can be easily added 
iptables -A GOOD_IPS -s -j ACCEPT
#iptables -A GOOD_IPS -s -j ACCEPT
share|improve this question
I think iptables can't know about ssh sucessfull logins. I think you must deal with sshd logins. – Brigo Apr 15 '13 at 15:01
ill look into that, i suppose whats left is a statement that logs any attempt to login with an ip address from GOOD_IPS with the prefix "iptables: ssh login attempt - good_ips $IP_ADDRESS – bigl Apr 15 '13 at 15:07

I agree with Brigo that iptables is ill-suited to protocol-aware issues like logging successful logins; that's for sshd's logging. But you can log connection attempts with

iptables -I INPUT 1 -p tcp --dport 22 -s a.b.c.d/e -m state --state NEW -j LOG --log-prefix "ssh login attempt: "

where a.b.c.d/e is your good ip range, with mask (eg,

share|improve this answer
where you have -s a.b.c.d/e is it possible to point it to the GOOD_IPS to match any from the chain? – bigl Apr 15 '13 at 16:06
I don't know, it depends what's in the chain. If you post the whole of the chain in your question (iptables -L GOOD_IPS -n -v), we can say whether it might be suitable for use like that. – MadHatter Apr 15 '13 at 17:38

This is not possible, as iptables cannot see the relevant data.

Something like iptables -A INPUT -m string --string "SUCCESS" -j LOG might have worked, were it not that SSH is encrypting this information, rendering it unusable for iptables.

Besides, all (succesful) attempts are already logged in /var/log/secure (or wherever your distribution onfigures this to be logged to). Why not look there?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.