You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<p>This command is used to search through system log files to display logs of accepted SSH session logins. Let’s break it down step by step:</p>
18
+
19
+
<ol>
20
+
<li>
21
+
<strong><code>zgrep</code></strong>
22
+
<ul>
23
+
<li><code>zgrep</code> is a command-line utility that works like <code>grep</code>, but it can search through both compressed (e.g., <code>.gz</code>) and uncompressed files.</li>
24
+
<li>In this case, it looks for occurrences of the term <strong><code>sshd</code></strong> (the SSH daemon) in the specified log files.</li>
25
+
</ul>
26
+
</li>
27
+
<li>
28
+
<strong><code>/var/log/auth.log*</code></strong>
29
+
<ul>
30
+
<li>This specifies the log files to search.</li>
31
+
<li><code>auth.log</code> is a common log file that stores authentication-related logs (like SSH login attempts).</li>
32
+
<li>The <code>*</code> allows the command to search through all files that match the pattern, including older or compressed versions (e.g., <code>auth.log.1</code>, <code>auth.log.2.gz</code>, etc.).</li>
33
+
</ul>
34
+
</li>
35
+
<li>
36
+
<strong><code>-h</code></strong>
37
+
<ul>
38
+
<li>The <code>-h</code> option suppresses the printing of file names in the output. This is useful when multiple files are searched, and you only care about the log content, not which file it came from.</li>
39
+
</ul>
40
+
</li>
41
+
<li>
42
+
<strong><code>|</code> (Pipe)</strong>
43
+
<ul>
44
+
<li>The pipe sends the output of the first command (<code>zgrep sshd</code>) as input to the next command (<code>grep -F 'Accepted'</code>).</li>
45
+
</ul>
46
+
</li>
47
+
<li>
48
+
<strong><code>grep -F 'Accepted'</code></strong>
49
+
<ul>
50
+
<li><code>grep</code> searches for lines containing the literal string <strong><code>Accepted</code></strong>.</li>
51
+
<li>The <code>-F</code> option tells <code>grep</code> to interpret the search string literally (not as a regular expression).</li>
52
+
</ul>
53
+
</li>
54
+
</ol>
55
+
56
+
<p><strong>Purpose:</strong><br>
57
+
The full command filters logs to show entries where the SSH daemon (<code>sshd</code>) indicates an <strong>accepted login attempt</strong>, i.e., successful SSH authentications.</p>
58
+
59
+
<p><strong>Example Output:</strong><br>
60
+
You might see output like this:</p>
61
+
62
+
<preclass="col-md-12"><codeclass="language-clike">Jan 27 12:45:23 server-name sshd[12345]: Accepted password for user1 from 192.168.1.100 port 54321 ssh2
63
+
Jan 27 14:12:34 server-name sshd[12346]: Accepted publickey for user2 from 10.0.0.200 port 59876 ssh2</code></pre>
64
+
65
+
<p>This output tells you:</p>
66
+
<ul>
67
+
<li>The date and time of the login.</li>
68
+
<li>The user who logged in.</li>
69
+
<li>The IP address from which they connected.</li>
70
+
<li>The authentication method (e.g., <code>password</code> or <code>publickey</code>).</li>
*While the previous section was mainly my own usage, I found a <b>great source</b> for monitoring failed attempts and <i>this part of the article takes a lot of references</i> from it:<br>
78
+
<ahref="https://www.tecmint.com/find-failed-ssh-login-attempts-in-linux/">Tecmint Article: Find failed ssh login attepts in linux</a><br><br>
79
+
<h4>Listing All Failed SSH Login Attempts</h4>
80
+
The simplest way of listing all failed login attempts:
To display a list of all IP addresses that tried and failed to log in to the SSH server alongside the number of failed attempts of each IP address, issue the below command.
Searches the <code>/var/log/auth.log</code> file for lines containing the phrase <em>"Failed password"</em>. These lines typically indicate failed SSH login attempts.
100
+
</li>
101
+
<li>
102
+
<strong>awk '{print $11}'</strong>:
103
+
Extracts the 11th field from each line. In failed login log entries, the 11th field usually contains the IP address of the machine attempting to log in.
104
+
</li>
105
+
<li>
106
+
<strong>uniq -c</strong>:
107
+
Counts the number of occurrences of each unique IP address.
108
+
</li>
109
+
<li>
110
+
<strong>sort -nr</strong>:
111
+
Sorts the output in numeric, reverse order so that IPs with the highest number of failed attempts appear first.
112
+
</li>
113
+
</ul>
114
+
<br><br>
115
+
<h4>Using journalctl to retrieve real time attempts</h4>
Queries the system logs for entries specifically related to the <code>ssh.service</code>. The <code>_SYSTEMD_UNIT</code> filter ensures that only logs generated by the SSH service are included.
124
+
</li>
125
+
<li>
126
+
<strong>|</strong> (pipe):
127
+
Passes the output of the <code>journalctl</code> command as input to the next command.
128
+
</li>
129
+
<li>
130
+
<strong>egrep "Failed|Failure"</strong>:
131
+
Searches the logs for lines containing the words <em>"Failed"</em> or <em>"Failure"</em>. This extended regular expression (<code>egrep</code>) helps pinpoint entries related to failed login attempts or failures in SSH connections.
0 commit comments