On Debian Squeeze I have sshd set up to not permit password logins and require key based authentication.

I notice that when I attempt to log in from the WAN into my box with a bad SSH key, I do not get the "Failed publickey...." message in auth.log. I only get "Connection from...." logged and that's it.

When I log in from within my LAN to my box with a bad key, I do get "Failed publickey...." logged. I want to be able to log all failed publickey attempts to SSH.

Does anyone have any advice as to why it's not logging failed keys from the WAN?


I generally recommend increasing the default logging for sshd.The default loglevel is INFO, which gives you some minimal levels of information, but certainly not all. I recommend cranking that up to VERBOSE which will give you such events as the fingerprint of the key used for authentication, a log message when the user logs off, and should contain the failures that you're interested in.

Edit your /etc/ssh/sshd_config and find the setting for LogLevel. Change that such that it is


Then restart the sshd service.

  • Thanks Scott. Sorry, I should have mentioned before that I already changed logging to VERBOSE. This did not fix the issue, however. – user158389 Feb 10 '13 at 19:59
  • @user158389: I blame Debian because it's always easier to debugging anything related to authentication. – Scott Pack Feb 10 '13 at 20:03
  • FACEPALM. I am an idiot. I was trying to connect from the WAN via a small shell server I have at Rackspace. The user account that I was using did not have an SSH key. Once I generated a key, then tried to connect to my SSH server in question, it logged the Failed publickey. So it looks like if the user has no key, it does not get logged in auth.log. – user158389 Feb 10 '13 at 20:12
  • @user158389: Which does make quite a bit of sense since there's no key to fail. – Scott Pack Feb 11 '13 at 1:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.