## SSH Authentication Logs

The most attacked service on the internet.

### /var/log/auth.log (or secure)
If you open a Linux server to the internet on Port 22, you will see this 5 seconds later:

*   **Failed Password**:
    `Invalid user admin from 192.168.1.5`
    `Failed password for invalid user admin from 192.168.1.5 port 22 ssh2`
    *   This is a Dictionary Attack (Brute Force).

*   **Successful Login**:
    `Accepted password for root from 192.168.1.5 port 22 ssh2`
    `pam_unix(sshd:session): session opened for user root`
    *   **Alert**: If you see this from a strange IP -> **Immediate Incident**.

### Public Key Auth (The Secure Way)
`Accepted publickey for root from 1.2.3.4...`
*   This means they used an SSH Key file (`id_rsa`), not a password.
*   It is much harder to brute force.