How to know which IPs have been connected by SSH

I want to leave another really useful tip. Thanks to accumulating I know it, and it is precisely what I say in the title: How to know which IPs have been connected by SSH to our computer.

Our Linux systems save data, information, logs of practically everything, and looking for how I could easily read the specific logs of something, I found a post de accumulating, the first of su Blog By the way, I want to congratulate you on such a good start 😉

Well, to the point 😀

The logs are saved in / var / log / and there, those of us who use Debian-type distros or derivatives, we have the file auth.log, which, as its name suggests, saves the authentication, making a simple cat (listing the content of it) and specifying that it only show us the accepted connections, we will get what we want.

The line would be:

cat /var/log/auth* | grep Accepted

In my case it shows the following:

There we can see the date of the connection, the user and the IP from where they connected, as well as some other details.

But, we can filter a little more ... I leave you the same command, with some parameters of awk :

sudo cat /var/log/auth* | grep Accepted | awk '{print $1 " " $2 "\t" $3 "\t" $11 "\t" $9 }'

It would look like this:

As you can see, everything is a little cleaner.

In other types of distos, if they do not find any file similar to auth.log, try with secure *

And this has been everything, thank once again accumulating by the original article.

Well, nothing more to add 😉

regards