Authpriv on sshd

/etc/ssh/sshd_config
SyslogFacility AUTHPRIV
LogLevel INFO
/etc/rsyslog.conf
# The authpriv file has restricted access.
authpriv.*    /var/log/secure 
# systemctl restart sshd

Check log with fingerprint of publickey

# Fingerprint of specified public key file
CLIENT # ssh-keygen -lf ~/.ssh/id_rsa.pub
3072 SHA256:00112233.... john@kisti (RSA)
SERVER # tail -f /var/log/secure
May 14 11:34:49 MY_SERVER sshd[398224]: Accepted publickey for john from 192.168.121.83 port 55946 ssh2: RSA SHA256:00112233....


  • 레이블 없음