Debian – See all SSH login attempts

by mikho • October 23, 2013 • 7 Comments

Guess I’m not the only one who have a lot of unauthorized login attempts via SSH on my Linux servers.
With a simple command, you can watch failed or successful login attempts in /var/log/auth.log.

#As root or via sudo, type this to see all failed login attempts

cat /var/log/auth.log | grep 'sshd.*Invalid'

1	cat /var/log/auth.log \| grep 'sshd.*Invalid'

#If you want to see successful logins, type this

cat /var/log/auth.log | grep 'sshd.*opened'

1	cat /var/log/auth.log \| grep 'sshd.*opened'

Anyways, the first thing you should do on a new server is to disable password logins, only allowing logins using private keys.
You can read about it here.