Let's say I have this entry in my Linux audit.log:

type=USER_AUTH msg=audit(1357702397.903:2747564): user pid=15121 uid=0
auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="test" 
exe="/usr/sbin/sshd" hostname= addr= terminal=ssh 

Does this mean that someone has authenticated via SSH using username and password, or with their private key? Is there a way to tell?

migrated from security.stackexchange.com Oct 16 '18 at 22:54

This question came from our site for information security professionals.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy