Sshd logs

sshd secure shell daemon.

Logs: journalctl -u ssh or journalctl -u sshd

Dec 01 07:01:05 SERVER sshd[15647]: PAM service(sshd) ignoring max retries; 5 > 3 sshd[15647]: PAM service(sshd) ignoring max retries; 5 > 3
See: MaxAuthTries in sshd_config

Dec 11 09:29:36 SERVER sshd[5506]: Received disconnect from 103.217.11.10 port 43200:11: Bye Bye [preauth]

ssh.service: Found left-over process 30050 (sshd) in control group while starting unit. Ignoring.

Unable to negotiate with 55.xxx.455.45 port 30367: no matching cipher found. Their offer: aes256-cbc,[email protected],aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]

Unsuccessful authentication attempts

journalctl -r | egrep "Failed password for|Unable to negotiate with|maximum authentication attempts|Failed publickey for"

Invalid user USERNAME from 54.xxX.138.126 port 39980

error: maximum authentication attempts exceeded for root from 10.10.10.110 port 40314 ssh2 [preauth]

Jan 08 11:18:03 SERVER sshd[7429]: Failed password for invalid user USERNAME from 212.XXX.98.46 port 63474 ssh2

Jan 11 11:15:34 SERVER sshd[7024]: Failed password for USERNAME from 19x.118.XXX.62 port 41430 ssh2

Unable to negotiate with 55.xxx.455.45 port 30367: no matching cipher found. Their offer: aes256-cbc,[email protected],aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]

Example of failed login with verbose mode, see (sshd logs):
May 07 15:55:01 SERVER sshd[1870524]: Failed none for  USERNAME  from 23.33.xx.xx port 12616 ssh2
May 07 15:55:01 SERVER sshd[1870524]: Failed publickey for  USERNAME  from 23.33.xx.xx port 12616 ssh2: RSA SHA256:tAkCKfvCmOTpVeceSyAOy9Sjyp213hQ7RLTyKUaNw12
May 07 15:55:00 SERVER sshd[1870524]: Connection from 23.33.xx.xx port 12616 on 10.10.10.xx port 22 rdomain ""

Successful authentication attempts

journalctl -r | egrep "Accepted publickey for|Accepted password for"

sshd[17161]: Accepted publickey for USERNAME from

Accepted password for USERNAME from 95.14.XXX.214 port 52731 ssh2

ChrootDirectory related

May 05 14:01:41 SERVER_NAME sshd[1825292]: fatal: bad ownership or modes for chroot directory "/home/USERNAME

All components of the pathname must be root-owned directories that are not writable by any other user or group (Sftp configuration)

Connection closing, user not allowed

May 18 11:05:30 SERVER_NAME sshd[2427302]: error: kex_exchange_identification: Connection closed by remote host

Oct 12 09:03:39 SERVER_NAME sshd[2963]: User XXXX not allowed because account is locked

Mar 31 13:26:52 SERVER_NAME sshd[441]: User XXXX not allowed because shell /sbin/nologin does not exist'

Related terms

• /var/log/auth.log
• LogLevel
• ssh -vvv

See also

• sshd, sshd logs, sshd -t, sshd -T, sshd_config, sftp
• OpenSSH (changelog): /etc/ssh/sshd_config | /etc/ssh/ssh_config | ~/.ssh/ | openSSL | sshd logs | sftp | scp | authorized_keys | ssh-keygen | ssh-keyscan | ssh-add | ssh-agent | ssh | Ssh -O stop | ssh-copy-id | CheckHostIP | UseKeychain, OpenSSF, ~/.ssh/authorized_keys
• /var/log/auth.log
• systemd-journald: journalctl, /etc/systemd/journald.conf, journalctl logs, journalctl --list-boots, journalctl --disk-usage, journalctl -u kubelet, journalctl -u prometheus, journalctl --help
• PAM, libpam_cracklib, pam_tally2, /etc/pam.d/, /etc/pam.d/sshd, pam_oath, pam_sss, /etc/pam.d/login, pam_unix, pam_krb5
• Port knocking, fail2ban fwknop, DenyHosts
• Linux logging, Cisco IOS logging

https://man.cx/sshd(1)

https://serverfault.com/a/608976