Is it possible to check if the current ssh session used a password or public key authentication, without comparing /var/log/auth.log with my current client ip?

And in case if there is no other way how can i get the exact login-time-stamp? pinky returns only hh:mm and not a hh:mm:ss.


The answer to your first question is a negative. That information isn't present anywhere after login. Though if you trust the environment/user you can make the .ssh/authorized_keys file specify a variable to set when logging in with a specific key.

For the second question: parse /var/run/utmp yourself.


Would the lastlog command provide the info you want

lastlog --user luser
Username         Port     From             Latest
luser            pts/1    2a00:14f0:e090:8 Sun Jun  9 16:20:02 +0100 2013
  • ty, sadly i cant toggle both answers as "accepted and helpful" – inselberg Jun 9 '13 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.