Monitor and audit SSH connection attempts

Link copied

Attach video time

SSH connection attempts are recorded in /var/log/auth.log. Open this file to review authentication activity, including the username used, the source IP address, the connection port, and other details:

cat /var/log/auth.log

For a continually updating view while new attempts are recorded, use tail:

tail -f /var/log/auth.log

The lastlog command shows the most recent login attempt for every user on the server:

lastlog

To check the most recent login for one specific user, pass the username with the -u option:

lastlog -u username

You can combine monitoring of /var/log/auth.log with lastlog to audit SSH activity. The log shows the details of each authentication attempt, while lastlog gives you a quick summary of the latest login for each account.

If you suspect that someone accessed the server through a particular user account, inspect that user’s .bash_history file. It is stored in the user’s home directory and contains commands executed from a Bash prompt:

cat /home/username/.bash_history

Replace username with the account you are investigating. Review the commands for unexpected activity, such as account changes, modified files, downloaded tools, or attempts to hide evidence. This gives you another source of information when you are scrutinizing a potentially unauthorized SSH connection.