Cybersecurity Triage
Read-only, sensitive outputList Accepted SSH Login Sources
You need to list accepted SSH public-key logins with user and source IP.
Command
awk '/Accepted publickey/ {print $1, $2, $3, $9, $11}' logs/auth.logBefore you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not assume these are the only access events unless you also search for password, keyboard-interactive, and other Accepted patterns.
Expected output
Accepted SSH login rows with date, time, user, and source IP.
System impact
Read-only, sensitive output. Nothing changes. The command reads auth.log and prints timestamp, username, and source IP from accepted public-key events.
Recovery / rollback: no state is changed.
When to use it
Use when building an SSH access timeline or checking which accounts had successful key-based logins.
When not to use it
Do not assume these are the only access events unless you also search for password, keyboard-interactive, and other Accepted patterns.
next steps
Related commands
Summarize SSH Auth Outcomes
SSH logs get easier to read once accepted and failed methods are counted.
awk '/sshd/ && /Accepted/ {print "accepted", $7} /sshd/ && /Failed password/ {print "failed", "password"} /sshd/ && /Failed publickey/ {print "failed", "publickey"}' logs/auth.log | sort | uniq -c | sort -nr
Show Accepted SSH Logins
During first response, successful logins matter more than background noise.
grep 'Accepted publickey' logs/auth.log
Show Failed SSH Public-Key Users
A failed public-key attempt often points to stale keys or the wrong account.
awk '/Failed publickey/ {print $9, $11}' logs/auth.log | sort | uniq -c | sort -nr
Show Successful Logins and sudo Use
Access reviews need both who logged in and who elevated privileges.
grep -E 'Accepted publickey|sudo:' /var/log/auth.log 2>/dev/null
Count Failed SSH Login IPs
The loudest SSH source is usually visible with one count.
sed -n 's/.*Failed password .* from \([0-9.]*\) port.*/\1/p' logs/auth.log | sort | uniq -c | sort -nr
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.