Linux SSH authentication — auth.log / secure

Source and collection

Often /var/log/auth.log on Debian-family systems or /var/log/secure on RHEL-family systems; journald may be the primary store.

Check sshd LogLevel and SyslogFacility plus rsyslog/journald routing and permissions.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: ff1a23c6f2a42ac96b679ccc6de8e2bcd814e2e4c378478d944072d92b8c8f40

Feb 21 21:54:44 localhost sshd[3402]: Accepted publickey for vagrant from 10.0.2.2 port 63673 ssh2: RSA 39:33:99:e9:a0:dc:f2:33:a3:e5:72:3b:7c:3a:56:84

Structure and field interpretation

sshd[pid]

Daemon process identifier.

Accepted publickey

Authentication outcome and method.

from / port

Remote peer as observed by sshd.

Investigation uses

• Correlate failed and accepted logins by account and remote address.
• Join the sshd PID and session time to sudo, audit and process records.

Validation boundaries

Traditional syslog timestamps lack year and timezone. An accepted authentication method does not establish the subsequent commands.

This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Related sources

• Windows Security 4624 — Successful logon
• Windows Security 4625 — Failed logon
• Windows Security 4740 — Account locked out
• Windows Security 4776 — NTLM credential validation
• Linux sudo audit messages
• Linux Audit syscall

Ecosystem connections

• Telemetry Library — ATT&CK data components
• Detection Rules — candidate detection content
• Threat hunting — from intelligence to validated defense
• Practical security learning paths
• AdversaryGraph — evidence-led investigation

References

• sshd(8) - OpenBSD manual pages

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.