List Accepted SSH Login Sources

You need to list accepted SSH public-key logins with user and source IP.

Command

awk '/Accepted publickey/ {print $1, $2, $3, $9, $11}' logs/auth.log

Before you run this

Risk: safe. Do not assume these are the only access events unless you also search for password, keyboard-interactive, and other Accepted patterns.

Expected output

Accepted SSH login rows with date, time, user, and source IP.

System impact

Nothing changes. The command reads auth.log and prints timestamp, username, and source IP from accepted public-key events.

Recovery / rollback: no state is changed.

When to use it

Use when building an SSH access timeline or checking which accounts had successful key-based logins.

When not to use it

Do not assume these are the only access events unless you also search for password, keyboard-interactive, and other Accepted patterns.

Watch this command run

Example output from a temporary Linux lab

This example uses disposable sample files and sanitized output so you can inspect the shape of the result before touching a real system.

demo@lab:~$

$ grep 'Accepted publickey' logs/auth.log

Jun 25 10:01:41 vps sshd[111]: Accepted publickey for alice from 198.51.100.20 port 61422 ssh2: ED25519 SHA256:alicekey
Jun 25 10:04:22 vps sshd[121]: Accepted publickey for deploy from 198.51.100.21 port 60444 ssh2: ED25519 SHA256:deploykey

$ awk '/Accepted publickey/ {print $1, $2, $3, $9, $11}' logs/auth.log

Jun 25 10:01:41 alice 198.51.100.20
Jun 25 10:04:22 deploy 198.51.100.21

View reproducible demo details

This page shows the sanitized shell transcript and the setup steps needed to reproduce the example.