DE

↑ ↓ select, Enter open, Esc close

Show successful SSH logins from the journal

harmless rootSSHdebian, ubuntu
Adjust the values, the command updates live
root@server
journalctl -u ssh --since "7 days ago" --no-pager | grep 'Accepted'

Filters the SSH service messages for successful logins. Each line shows the time, method (publickey or password), user and source IP, plus the fingerprint for key logins. Useful for checking who had access and when after a suspected incident.

Note: If rsyslog is installed as well, the same entries are in /var/log/auth.log. The journal only goes back as far as it is retained.

Also searched as

  • who logged in via ssh
  • show successful ssh logins
  • ssh login history journalctl

Related one-liners

All in SSH

Show commands run with sudo from the journal

#journalctl _COMM=sudo --since "7 days ago" --no-pager | grep 'COMMAND='
harmlessSecurity

Show recent server logins with IP address

$last -i | head -30
harmlessSecurity

Copy your public SSH key to a server

$ssh-copy-id -i ~/.ssh/id_ed25519_server.pub -p 22 webuser@server.example.com
cautionSSH

Count IP addresses blocked by ufw

#journalctl -k --since "today" --no-pager | grep 'UFW BLOCK' | grep -o 'SRC=[^ ]*' | sort | uniq -c | sort -rn | head -20
harmlessFirewall

Find processes killed by the OOM killer

#journalctl -k --no-pager | grep -iE "out of memory|oom-kill|killed process"
harmlessProcesses

Find world-writable files and directories

$find /var/www/vhosts -xdev -perm -0002 ! -type l -ls 2>/dev/null
harmlessSecurity

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.