Two of the most important questions in security are: Who accessed what, and when did they access it?
If you have any Linux or Unix machines, you’ll likely find answers in the secure shell daemon (SSHD) log, which allows remote access to the system.
Most Linux systems these days ship with systemd, including Ubuntu, Debian, Amazon Linux 2, and CentOS. On these systems, you can view logs via the journalctl command. In our case, we’re interested in the secure shell (SSH) unit.
$ journalctl -u ssh
Mar 25 20:25:36 web0 sshd[14144]: Accepted publickey for ubuntu from 10.103.160.144 port 59200 ssh2: RSA SHA256:l/zFNib1vJ+64nxLB4N9KaVhBEMf8arbWGxHQg01SW8
Mar 25 20:25:36 web0 sshd[14144]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Mar 25 20:39:12 web0 sshd[14885]: pam_unix(sshd:session): session closed for user ubuntu
...
You can see the fingerprint of the SSH key is included in the logs. Failed login attempts will appear like this:
Mar 30 17:10:35 web0 sshd[5561]: Connection closed by authenticating user ubuntu 10.103.160.144 port 38860 [preauth]
If you want to view ssh logs from a specific time range, you can use the since and until flags. Some examples:
$ journalctl -u ssh --since yesterday
$ journalctl -u ssh --since -3d --until -2d # logs from three days ago
$ journalctl -u ssh --since -1h # logs from the last hour
$ journalctl -u ssh --until "2022-03-12 07:00:00"
To watch the ssh logs in realtime, use the follow flag:
$ journalctl -fu ssh
Use Ctrl-C to exit out of the log monitor.
On older systems, or systems without systemd, you’ll likely find the sshd log at /var/log/auth.log. You’ll need root permissions to view it, and you’ll probably want to search specifically for sshd logs, like so:
$ sudo grep sshd /var/log/auth.log
If you’re looking for a quick overview of who’s logged in recently rather than an in-depth audit log, try the lastlog command:
$ lastlog
Username Port From Latest
root **Never logged in**
daemon **Never logged in**
bin **Never logged in**
sys **Never logged in**
...
ubuntu pts/0 10.103.160.144 Wed Mar 30 17:52:11 +0000 2022
Knowing how to view ssh logs isn’t much help if the logs you’re looking for haven’t been retained. By default, journald retains logs until they consume up to 10% of available disk space.
It’s also recommended to increase the sshd log level from the default. Put this setting in /etc/ssh/sshd_config:
LogLevel VERBOSE
This will include more details in the sshd log, like the PID of the user’s login shell. For debugging purposes, you can also try LogLevel DEBUG.
Verbose SSHD logs answer who connected, from where and when. Then they stop at the session boundary. The log records that a session opened and closed, but not the commands that ran inside it. For debugging, that works, but for an audit or an incident review, it leaves you having to infer behavior from timestamps.
That gap is where privileged session recording and monitoring come into play. Secret Server records the session from credential checkout to logoff, with searchable keystroke data for proxied SSH sessions. Now, a review can watch what happened. Privileged remote access applies the same recording to internal and third-party users connecting without a VPN. Keep your SSHD logs for day-to-day troubleshooting, but hand your session records to an auditor.
On most modern systems, journalctl provides a convenient, standardized way to view ssh logs. On other systems, you can find the sshd log at /var/log/auth.log. For quick inspections, you can also use the lastlog command. Whichever method you use, configure your servers with the proper log retention and verbosity settings.