3

I'm familiar with using log show | grep 'sshd: error: PAM: authentication error for $user from $ip_address' to look through failed logon attempts from various IP addresses.

Is there an equivalent log that gets written whenever a successful SSH connection gets established and authenticated (ideally it would contain information about the client IP address).

I've looked throughout my log files and there does not seem to be logs that record successful logins.

1 Answer 1

5

The successful SSH logins are logged in e.g. /var/log/auth.log with:

sshd[20007]: Accepted password for username from 192.0.2.123 port 60979 ssh2
sshd[20007]: pam_unix(sshd:session): session opened for user username by (uid=0)
systemd-logind[613]: New session 12345 of user username.

Or, in case of publickey authentication:

sshd[20008]: Accepted publickey for username from 192.0.2.123 port 50460 ssh2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .