Cybersecurity Triage
Read-only, sensitive outputSummarize SSH Auth Outcomes
You need a quick count of successful and failed SSH authentication methods from an auth log.
Command
awk '/sshd/ && /Accepted/ {print "accepted", $7} /sshd/ && /Failed password/ {print "failed", "password"} /sshd/ && /Failed publickey/ {print "failed", "publickey"}' logs/auth.log | sort | uniq -c | sort -nrBefore you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not treat this as a full incident timeline; review the matching source lines before making account or firewall changes.
Expected output
A count-sorted summary of accepted public-key logins and failed SSH authentication methods.
System impact
Read-only, sensitive output. Nothing changes. The command reads the auth log and counts matching SSH authentication outcomes.
Recovery / rollback: no state is changed.
When to use it
Use during SSH access triage when you need a fast read on whether noise is password guessing, stale keys, or real accepted access.
When not to use it
Do not treat this as a full incident timeline; review the matching source lines before making account or firewall changes.
next steps
Related commands
Show Failed SSH Public-Key Users
A failed public-key attempt often points to stale keys or the wrong account.
awk '/Failed publickey/ {print $9, $11}' logs/auth.log | sort | uniq -c | sort -nr
Count Failed SSH Login IPs
The loudest SSH source is usually visible with one count.
sed -n 's/.*Failed password .* from \([0-9.]*\) port.*/\1/p' logs/auth.log | sort | uniq -c | sort -nr
Count Failed SSH Login Users
Failed SSH attempts are noisy; grouping users makes the pattern readable.
sed -n 's/.*Failed password for \(invalid user \)\?\([^ ]*\) from .*/\2/p' logs/auth.log | sort | uniq -c | sort -nr
List Accepted SSH Login Sources
Successful SSH logins are the access events worth anchoring first.
awk '/Accepted publickey/ {print $1, $2, $3, $9, $11}' logs/auth.log
Summarize SSH Authorized Key Types
Key inventory gets more useful when old key types stand out.
find /home -path '*/.ssh/authorized_keys' -exec awk '{print $1}' {} + 2>/dev/null | sort | uniq -c | sort -nr
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.