List Accepted SSH Login Sources

You need to list accepted SSH public-key logins with user and source IP.

Command

awk '/Accepted publickey/ {print $1, $2, $3, $9, $11}' logs/auth.log

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not assume these are the only access events unless you also search for password, keyboard-interactive, and other Accepted patterns.

Expected output

Accepted SSH login rows with date, time, user, and source IP.

System impact

Read-only, sensitive output. Nothing changes. The command reads auth.log and prints timestamp, username, and source IP from accepted public-key events.

Recovery / rollback: no state is changed.

When to use it

Use when building an SSH access timeline or checking which accounts had successful key-based logins.

When not to use it

Do not assume these are the only access events unless you also search for password, keyboard-interactive, and other Accepted patterns.

Watch this command run

Command transcript

This sanitized transcript shows the commands and output shape without exposing host details.

demo@lab:~$

$ grep 'Accepted publickey' logs/auth.log

Jun 25 10:01:41 vps sshd[111]: Accepted publickey for alice from 198.51.100.20 port 61422 ssh2: ED25519 SHA256:alicekey
Jun 25 10:04:22 vps sshd[121]: Accepted publickey for deploy from 198.51.100.21 port 60444 ssh2: ED25519 SHA256:deploykey

$ awk '/Accepted publickey/ {print $1, $2, $3, $9, $11}' logs/auth.log

Jun 25 10:01:41 alice 198.51.100.20
Jun 25 10:04:22 deploy 198.51.100.21

View commands shown

These are the commands shown in the sanitized transcript.