What is the best way to set up logging SSH attempts with SSH public-key authentication and nftables? Also, what is the best way to test this?
I'd like to do this without installing a package that 'just takes care of it' because this is a learning exercise for me.
I've set up a fairly blank new system to test and learn networking concepts on. The system is running Arch Linux. nftables is up and running, and I'm able to log into this system with SSH public key auth. The test system is also using sshd.socket, for what it's worth.
However, I've noticed that one of the nftable rules doesn't seem to be logging out as expected:
log prefix "REJECTED" reject with icmpx type port-unreachable
This rule is at the bottom of the input chain in my nftables.conf, so all rejected input traffic should hit this (I think).
Perhaps I'm testing this wrongly, but when I run
journalctl -k | grep "REJECTED" I don't see any entries after attempting to log in through a different machine. I do however see an entry when a different machine with the correct key attempts to log in more than twice in one minute.
Also, I'll note I can see successfull SSH logins with this nftable rule (placed above the reject rule above):
tcp dport ssh limit rate 2/minute log prefix "SSH connection" accept
journalctl -k | grep "SSH" shows these connections as expected.