How does public key authentication works in openssh?
To make it completely clear what is happening, the public key authentication works in two steps. One is just informative and the other checks to whole keypair.
The first step
is just checking if the offered public key matches some of the keys available in the servers
authorized_keys file and is not logged as an error in default log level, because many people just store their keys in agent or somewhere and offer them to all the servers. This usually falls back to password authentication. If you set up VERBOSE log level, you should see also this message in
/var/log/secure (at least with recent rhel6
The second step
verifies the possession of private part and it does the real asymmetrical cryptography and if this one fails, it should be logged, because it is more like failed authentication attempt.
Is brute-force feasible?
The point of not-logging public-key authentication attempts is also the think, that this basically can't be target for any bruteforce attack, since the state space is too large (ex. 1024b key) in comparison to passwords, where you can try all 8 characters passwords (around 64b or entropy max., but usually much less since you can use many heuristics -- vocabulary, only alphabet, and so on). In the keys you have just one large number.
There are logs on RHEL!
On RHEL/CentOS/Fedora you can use the advance of
audit, which contains also these failed authentication attempts. You can find them in
USER_AUTH events with
I hope it will help you a bit.