命令行查看
journalctl(适用于systemd系统):sudo journalctl -u sshd(查看SSH服务日志)--since "2025-01-01" 限制时间范围。sudo cat /var/log/auth.log | grep sshd(过滤SSH相关日志)sudo tail -f /var/log/auth.log | grep sshd。图形化工具
less 或 more 分页查看:sudo less /var/log/auth.log。常见日志类型
Accepted password for user from IP。Failed password for user from IP(可判断暴力破解)。Authentication refused: bad ownership(密钥权限异常)。Connection closed by IP(可能因防火墙或服务配置)。分析命令示例
sudo grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -nr | head -10。sudo awk '/sshd.*Accepted/ && $3 ~ /[0-9]{2}:[0-9]{2}/ {if ($3 >= "10:00" && $3 <= "11:00") print $0}' /var/log/auth.log。安全风险识别
ufw 或 iptables)。sshd_config 中的 AllowUsers 配置。~/.ssh/authorized_keys 文件权限(应为600)及密钥格式。logrotate 每周轮转压缩日志(文件名含 .1.gz 等后缀),可通过以下命令查看配置:cat /etc/logrotate.d/rsyslog | grep auth.log。sudo rm /var/log/auth.log.*.gz(谨慎操作,建议先备份)。参考来源: