iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To investigate SSH activity, first find the host’s authoritative log (a traditional authentication file or the systemd journal), then filter for failed and accepted authentication events, correlate the account, source address, method and session records, and only then decide whether activity indicates scanning, a successful login or a likely compromise. A burst of failures is evidence of probing or brute-force activity, not proof that anyone got in.
1. Find where this host records SSH events
Linux distributions do not all store SSH messages in the same place. A syslog-oriented system may write to an authentication log such as /var/log/auth.log; another distribution may use a different file. A systemd-based host may keep the authoritative records in the journal instead of a flat file. Identify the logging arrangement before searching, or you risk concluding that no events exist simply because you looked in the wrong location.
Check the systemd journal
Try both common service-unit names, because the daemon may be registered as ssh or sshd:
sudo journalctl -u ssh --since "24 hours ago" --output short-iso
sudo journalctl -u sshd --since "24 hours ago" --output short-isoThe -u (or --unit) option restricts output to one systemd service. --since and --until define a time window, and short-iso prints an unambiguous, RFC 3339-style timestamp. If one command returns no entries, that may mean the unit name is different or that the host uses another logging path; it does not by itself mean SSH has had no activity.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
For a live investigation, follow new messages as they arrive:
sudo journalctl -f -u ssh
# On systems where the daemon is named sshd:
sudo journalctl -f -u sshd-f (or --follow) keeps printing new entries until you press Ctrl+C. Save the original output, including timestamps and hostnames, before applying filters so that later analysis retains timezone and context.
Recommended Free Tools
Check a traditional authentication log
On a syslog-oriented host, inspect the authentication log configured for that distribution. Fail2Ban commonly reads /var/log/auth.log, but the actual path and rotation policy are distribution-specific. Check the logging configuration and rotated files when the incident window is older than the current file. Restrict access to copied logs because they can contain usernames, addresses and session details.
2. Read the fields in an SSH record
For every relevant line, capture the following fields. Do not rely on a single keyword while discarding the surrounding record.
| Field | What it tells you | Why it matters |
|---|---|---|
| Timestamp and timezone | When the daemon recorded the event | Lets you align attempts with maintenance windows, alerts and other hosts. Keep the original timezone. |
| Hostname and daemon/process | Which machine and SSH process emitted the line | Prevents mixing records from several systems and helps identify the service unit to query. |
| Result wording | For example, Failed password, Invalid user or Accepted |
Separates rejected credentials, unknown accounts and successful authentication. |
| Account name | The username presented or accepted | Shows whether attempts target real accounts, common guesses or many unrelated names. |
| Source address or hostname | Where the connection originated | Enables grouping by source. Prefer the logged IP address over reverse-DNS names for attribution. |
| Source port | The client-side TCP port | Useful for preserving the exact event and correlating with network records; it is not an identity. |
| Pre-authentication marker | Whether the failure happened before a session was authenticated | Helps distinguish connection-stage probing from activity after login. |
Repeated failures from one address in a short period are more suspicious than isolated failures spread across unrelated addresses. Still, an address is an origin for a connection, not proof of a person or organization: proxies, compromised machines and shared networks can obscure the operator.
3. Filter the records without losing context
Search a traditional log
These searches find the most useful SSH authentication messages in a conventional log:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
sudo grep -E 'Failed password|Invalid user|authentication failure|Accepted ' /var/log/auth.log
sudo grep -E 'Failed password|Invalid user|authentication failure' /var/log/auth.log
| awk '{print $(NF-5)}' | sort | uniq -c | sort -nr | headThe second command attempts to count source addresses, but the awk field position is not universal. Message formats vary by distribution, daemon version and logging configuration. Inspect representative lines first and verify that the selected field really contains an address. Fail2Ban filters are designed to parse failed-authentication messages and extract a host address; use those parsing rules rather than assuming one column number works everywhere.
When investigating a time window, first copy the unfiltered lines to a protected case file, then run narrower searches. This preserves lines that may not match your initial regular expression, such as session-open, session-close or privilege-escalation records.
Search the journal by time and unit
Use explicit bounds when reconstructing an event:
sudo journalctl -u ssh --since "2026-10-14 18:00" --until "2026-10-15 06:00" --output short-iso
sudo journalctl -u sshd --since "2026-10-14 18:00" --until "2026-10-15 06:00" --output short-isoReplace the example times with the incident window and use the unit that exists on the host. A journal may also contain messages from PAM, sudo or other services; retain those related records when a login appears to have succeeded.
4. Tell probing apart from a successful SSH login
| Log evidence | What you can conclude | What you still need to check |
|---|---|---|
Failed password |
A password authentication attempt was rejected. | Whether attempts repeat, which account was targeted, and whether a later accepted event came from the same source. |
Invalid user |
The presented username was not a recognized account at that point. | Whether the source cycles through many names or changes behavior after a valid account is found. |
authentication failure |
An authentication-related check failed; the exact mechanism depends on the surrounding fields. | The account, source, method and adjacent PAM/sshd messages. |
Accepted |
The server accepted one authentication method for one account. | Whether it was expected, which key or method was used, what session followed and whether privilege escalation occurred. |
A regular cadence, many usernames or a concentrated burst from one source strongly suggests automated probing or brute-force activity. It remains evidence of attempts, not proof of compromise. Conversely, searching only for password failures misses other authentication paths. OpenSSH supports password, public-key, keyboard-interactive, GSSAPI and host-based authentication. A public-key login succeeds only when the server authorizes the matching public key, normally through the account’s ~/.ssh/authorized_keys; no password-failure line is required.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What makes an accepted event suspicious?
Compare the accepted line with information you control:
- Is the account expected to log in at that time?
- Does the source address match an administrator’s normal network, jump host or maintenance system?
- Does the method match the account’s approved password, key or interactive login process?
- Was the corresponding key recently created, replaced or added to
~/.ssh/authorized_keys? - Do session-open, session-close, command, sudo or audit records show activity that fits the stated work?
One Accepted line is not automatically malicious. An unfamiliar address is a reason to validate the session, not a standalone attribution. Check the account owner, maintenance schedule and key inventory before declaring an incident.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
5. Reconstruct a suspected successful session
Preserve the original SSH lines and work outward from the accepted event. The following sequence keeps the conclusion tied to evidence rather than a single line.
- Record the accepted event. Write down its timestamp, account, source address and authentication method exactly as logged.
- Expand the time window. Review several minutes before and after the event for pre-authentication failures, session-open and session-close messages, assigned process or TTY information, and disconnects.
- Check privilege changes. Correlate the account and time with
sudoor other privilege-escalation records. Availability and detail depend on the host’s PAM, sudo and audit configuration. - Inspect key authorization. Compare the account’s
~/.ssh/authorized_keyswith a known-good inventory. An unexpected key change is important evidence, but preserve the file and its metadata before editing it. - Validate historical accounting. Use
lastto see whether the session appears in wtmp and whether its address and duration fit the SSH record. - Compare with other telemetry. If your host has firewall, endpoint, shell or audit logs, align their timestamps and account identifiers with the SSH session. Do not infer missing events merely because another log is silent.
If compromise is plausible, preserve logs, restrict further access according to your incident procedure and involve the person responsible for the system. Changing files or deleting keys before preservation can destroy evidence and make the timeline harder to establish.
6. Use last to validate session history
The last command reads the system-wide wtmp login and logout accounting file and prints entries newest first. Where an accounting record stores an address, -i prints the numeric IP instead of a hostname:
last -ai | head -30This is useful for checking whether an accepted SSH session has a matching historical entry, its apparent duration and the address recorded by login accounting. It is not a replacement for sshd authentication logs: failed attempts generally do not appear in wtmp, and retention depends on rotation and local configuration. Treat a missing last entry as an accounting limitation to investigate, not proof that the accepted event was false.
7. Use Fail2Ban as rate control, not as a verdict
Fail2Ban scans logs such as /var/log/auth.log, applies filters to detect repeated failed authentication and updates firewall rules to reject new connections for a configurable period. Its jails combine a filter with an action. A systemd backend can read journal entries instead of a flat file.
| Setting | Meaning | Operational question |
|---|---|---|
findtime |
The window in which matching failures are counted. | Is the window long enough to catch slow attempts without combining unrelated events? |
maxretry |
How many filter matches are allowed before the jail acts. | Could a legitimate user trip the threshold, and are all relevant authentication methods covered? |
bantime |
How long the action blocks a source. | Does the duration reduce repeated noise while avoiding an operational lockout? |
| Backend and filter | Where events are read and which failure patterns are recognized. | Does the backend match this host’s journal or log file, and does the filter parse its actual message format? |
| Action and allowlist | How traffic is blocked and which trusted addresses are exempt. | Could the firewall action block an administrator or a shared egress address? |
After installation and configuration, inspect the active jails:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
sudo fail2ban-client status
sudo fail2ban-client status sshdDocument the selected findtime, maxretry, bantime, backend and action. Also record how addresses are handled. Reverse and forward DNS can disagree, so logging and reviewing the real IP address is safer than treating a hostname as identity.
A ban shows that a configured threshold was crossed; it does not establish who operated the address or whether an account was compromised. Fail2Ban’s own documentation describes its role as reducing the rate of incorrect authentication attempts, not eliminating the risk of weak authentication.
8. Strengthen the authentication path after investigation
Use the findings to reduce the attack surface rather than relying on blocks alone.
- Prefer carefully managed public/private keys or multi-factor authentication where your environment supports them. Verify ownership and storage of private keys, and review authorized keys periodically.
- Review which accounts are permitted to use SSH and remove stale access through your normal change process.
- Ensure log retention covers the period needed for investigations, including rotated authentication logs and wtmp history.
- Keep Fail2Ban thresholds and firewall actions documented so another operator can understand why an address was blocked.
- If an accepted session cannot be explained, treat the account and its keys as potentially exposed and follow your organization’s incident-response procedure before making destructive changes.
Public-key authentication uses cryptography, but it is only as trustworthy as the private-key handling and the server-side authorization list. A key-based setup does not remove the need to investigate unexpected accepted sessions.
Free tools Windows power users keep installed
One-click scans. No signup required.
9. Common interpretation mistakes
“Every failed line is an intrusion.”
Internet-facing SSH services are routinely scanned. Classify activity by repetition, usernames, timing, source grouping and any accepted follow-up instead of treating one rejected attempt as a breach.
“There is no /var/log/auth.log, so there are no SSH events.”
The systemd journal may be the authoritative store. Query the existing ssh or sshd unit and confirm retention before drawing conclusions.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
“An Accepted line proves an attacker got in.”
It proves that the server accepted credentials for an account. Compare the source, method, key ownership, maintenance schedule and resulting session activity before deciding whether access was unauthorized.
“A reverse-DNS name identifies the attacker.”
DNS can be missing, stale or inconsistent in both directions. Preserve and analyze the numeric source address, and use DNS only as contextual information.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →“Password-failure counts cover every attack.”
They do not. Public-key, keyboard-interactive, GSSAPI and host-based authentication produce different records. Inspect accepted methods and the surrounding session data.
“A Fail2Ban ban means the host is safe.”
The ban is a rate-control action. It neither proves attacker identity nor compensates for weak authentication, stolen keys or an already accepted session.
10. Choose the right observation and response tool
| Approach | Data source | Detection scope | Historical depth | Response | Main limitation |
|---|---|---|---|---|---|
| Traditional log plus grep | Distribution-configured authentication file and rotated copies | Whatever patterns you search, such as failed passwords, invalid users and accepted events | Depends on file rotation and retention | Visibility only | Paths and message fields differ; ad-hoc parsing can select the wrong column. |
journalctl |
systemd journal, filtered by SSH unit and time | All retained messages for the selected unit, including non-password methods | Depends on journal retention | Visibility and live following | Service-unit names and retention policies vary. |
last |
wtmp login/logout accounting | Stored login sessions | Depends on wtmp rotation | Historical validation | Not a complete failed-SSH record and not a substitute for sshd logs. |
| Fail2Ban SSH jail | Configured log file or journal backend | Filter-defined authentication failures and thresholds | Matches within configured findtime; longer history remains in the source logs |
Firewall block for configured bantime |
Can miss unrecognized formats, create false positives or leave weak authentication exposed. |
11. A compact investigation checklist
- Identify whether the host uses a traditional authentication log, the systemd journal, or both.
- Confirm the correct
sshorsshdunit and define an explicit time range. - Preserve unfiltered records before running grep, awk or other transformations.
- For each event, capture time, daemon, result, account, source IP, source port and pre-authentication status.
- Group failures by source and username, but do not call them a compromise without an accepted-session correlation.
- Search for every configured authentication method, not only password failures.
- For accepted events, correlate sessions, sudo activity, key changes and
last -aioutput. - Record Fail2Ban’s filter, backend,
findtime,maxretry,bantime, allowlist and action. - Use public-key management and multi-factor authentication to improve authentication strength; do not depend on bans alone.
What a defensible conclusion looks like
A precise report separates observation from inference: “Between 02:10 and 02:14 UTC, the SSH service logged 47 rejected password attempts against 11 usernames from one IP address” is an observation. “The pattern is consistent with automated probing” is a reasoned classification. “The host was compromised” requires additional evidence, such as an unexplained accepted event followed by session or privilege activity. Keeping those statements distinct makes the response more accurate and easier to audit.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
