What is the best way to set up logging SSH attempts with SSH public-key authentication and nftables? Also, what is the best way to test this?

I'd like to do this without installing a package that 'just takes care of it' because this is a learning exercise for me.


I've set up a fairly blank new system to test and learn networking concepts on. The system is running Arch Linux. nftables is up and running, and I'm able to log into this system with SSH public key auth. The test system is also using sshd.socket, for what it's worth.

However, I've noticed that one of the nftable rules doesn't seem to be logging out as expected:

log prefix "REJECTED" reject with icmpx type port-unreachable

This rule is at the bottom of the input chain in my nftables.conf, so all rejected input traffic should hit this (I think).

Perhaps I'm testing this wrongly, but when I run journalctl -k | grep "REJECTED" I don't see any entries after attempting to log in through a different machine. I do however see an entry when a different machine with the correct key attempts to log in more than twice in one minute.

Also, I'll note I can see successfull SSH logins with this nftable rule (placed above the reject rule above):

tcp dport ssh limit rate 2/minute log prefix "SSH connection" accept

Running journalctl -k | grep "SSH" shows these connections as expected.

closed as primarily opinion-based by G-Man, Stephen Rauch, Jeff Schaller, Archemar, Thomas Dickey Nov 26 '17 at 21:06

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.


You can't determine (nor log) on network layer on which TCP connection login failed nor with what method. SSH daemon determines when a login fails and logs it, after which it either allows a re-try or closes the connection (usually after a certain amount of failed attempts).

Failed login attempts are stored in auth log in /var/log/auth.log. There you can find log entries for both failed and successful logins.

On network layer you can log new connections to SSH daemon. The following example is directly from nftables wiki documentation:

tcp dport 22 ct state new log prefix \"New SSH connection: \" accept

Not the answer you're looking for? Browse other questions tagged or ask your own question.