From /var/log/auth.log
These show up as login failures in daily security run output (which they aren't really).
Code:
Feb 23 13:20:00 abc sshd[78779]: user rihad login class unicode [preauth]
Feb 23 13:20:00 abc sshd[78779]: Failed unknown for rihad from 192.168.0.4 port 55967 ssh2
Feb 23 13:20:00 abc sshd[78779]: user rihad login class unicode [preauth]
Feb 23 13:20:00 abc sshd[78779]: Failed unknown for rihad from 192.168.0.4 port 55967 ssh2
Feb 23 13:20:00 abc sshd[78779]: user rihad login class unicode [preauth]
Feb 23 13:20:00 abc sshd[78779]: Accepted publickey for rihad from 192.168.0.4 port 55967 ssh2: RSA SHA256:xxx
Last edited by a moderator: