Cybersecurity Triage
Read-only, sensitive outputShow Accepted SSH Logins
You need to find successful SSH public-key logins in an auth log.
Command
grep 'Accepted publickey' logs/auth.logBefore you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not assume password logins are absent unless you also search other Accepted patterns.
Expected output
Accepted public-key login lines including user and source IP.
System impact
Read-only, sensitive output. Nothing changes. The command filters successful public-key login lines.
Recovery / rollback: no state is changed.
When to use it
Use when building a quick access timeline or checking unexpected SSH access.
When not to use it
Do not assume password logins are absent unless you also search other Accepted patterns.
next steps
Related commands
List Accepted SSH Login Sources
Successful SSH logins are the access events worth anchoring first.
awk '/Accepted publickey/ {print $1, $2, $3, $9, $11}' logs/auth.log
Show Successful Logins and sudo Use
Access reviews need both who logged in and who elevated privileges.
grep -E 'Accepted publickey|sudo:' /var/log/auth.log 2>/dev/null
Summarize SSH Auth Outcomes
SSH logs get easier to read once accepted and failed methods are counted.
awk '/sshd/ && /Accepted/ {print "accepted", $7} /sshd/ && /Failed password/ {print "failed", "password"} /sshd/ && /Failed publickey/ {print "failed", "publickey"}' logs/auth.log | sort | uniq -c | sort -nr
Show Recent sudo Commands
Privilege use is one of the fastest first-response signals.
grep 'sudo:' logs/auth.log | tail -n 10
Show Failed SSH Public-Key Users
A failed public-key attempt often points to stale keys or the wrong account.
awk '/Failed publickey/ {print $9, $11}' logs/auth.log | sort | uniq -c | sort -nr
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.