I have several remote systems connecting to my server via SSH to establish tunnels.

They authenticate using a public key, their user is locked and their shell is set to /usr/sbin/nologin

It all works fine except with this setup the output from last username is empty for those accounts.

Is there a workaround to get last login info for those? I need the IP and connection time.

Thank you for reading.


You could use awk on /var/log/secure or /var/log/auth.log (depending on the distro).

On my CentOS 7 I get the following when I log in remotely:

Dec  8 21:58:20 <server hostname> sshd[8387]: Accepted publickey for gareth from port 58392 ssh2: RSA 55:89:f9:20:db:c6:e0:6f:ff:d4:a7

The above was for interactive login but a similar entry was created for sftp login.


awk '/sshd.*Accepted/ {print $1,$2,$3,$9,$11}' /var/log/secure

should give you:

Dec 8 21:58:20 gareth
| improve this answer | |
  • Sorry, took a while for me to get back to this, but your suggestion works! Thank you. – TCZ8 Jan 7 '15 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.