Log Dejargonizer

OpenSSH · Event Accepted password

Accepted password: an SSH login succeeded

Someone signed in over SSH successfully. Routine on its own — but a success from an address that was failing moments earlier is the single most important line in an auth log, and it is the thing worth alerting on.

Also written as Accepted password forAccepted publickey forssh accepted password logsuccessful ssh login log

What it means for you

On a personal computer

Someone signed in to this machine over SSH. If it was not you and you have SSH open to the internet, that is serious.

For an analyst

The authentication method in the message is the field to read — 'publickey' and 'password' mean quite different things about your configuration. A successful password authentication on a server you believed was key-only is a configuration finding in its own right.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Aug 28 09:42:44 web-01 sshd[24901]: Accepted publickey for jbrooks from 192.0.2.44 port 51993 ssh2: RSA SHA256:0000000000000000000000000000000000000000000
Aug 28 09:42:44 web-01 sshd[24901]: pam_unix(sshd:session): session opened for user jbrooks(uid=1000) by (uid=0)

The fields that decide it

Everything else in the log line is context.

method
How the user authenticated.
  • publickeyKey-based authentication. What you want to see.
  • passwordPassword authentication, which means it is still enabled. Worth knowing about even when the login is legitimate.
  • keyboard-interactive/pamUsually multi-factor or a PAM-driven flow.
user
The account that signed in. root here deserves a second look on most systems.
source address
Where the connection came from.
key fingerprint
For key-based logins, the fingerprint of the key used. Recorded at higher log levels and useful for tying a session to a specific key.

Ordinary reasons this happens

Most of the time it is one of these.

  • Ordinary administrative access.
  • Automation, deployment tooling, and backup jobs connecting with keys.
  • Monitoring systems logging in to collect data.
  • Scheduled jobs on other hosts connecting over SSH.

When it is not ordinary

A guessed or stolen password used successfully.

What gives it awayA success from a source address that produced failed attempts shortly before.

ATT&CK T1110

Access with a stolen or added key.

What gives it awayA publickey login with a fingerprint that does not match any key you issued, or a login shortly after authorized_keys was modified.

ATT&CK T1098.004

Access from an unexpected location.

What gives it awayA successful login from a source address or country that account has never connected from.

ATT&CK T1078

What to do next

  1. Check whether failures preceded the success from the same address.
  2. Read the authentication method. A password login on a key-only server is a finding regardless of who it was.
  3. Check whether the source address is one the account normally uses.
  4. For key logins, verify the fingerprint against your issued keys, and check when authorized_keys was last modified.
  5. Look at what the session did afterwards — sudo entries and command history.
  6. For root logins, confirm direct root access is supposed to be permitted at all.

Queries to run

grep Accounts and source addresses by login count. Field positions vary by distribution — check against your own format. 
grep 'Accepted' /var/log/auth.log | awk '{print $9, $11}' | sort | uniq -c | sort -rn
grep Password logins specifically. On a server that should be key-only, this returning anything is the finding. 
grep 'Accepted password' /var/log/auth.log
splunk 
index=linux sourcetype=linux_secure "Accepted" | stats count by user src_ip | sort -count

Common questions

How do I see who has logged into a Linux server over SSH?

Search for 'Accepted' in /var/log/auth.log on Debian and Ubuntu, or /var/log/secure on Red Hat derivatives. On systemd hosts, `journalctl -u sshd | grep Accepted` works regardless of file layout. The `last` command gives a quicker summary of successful logins from the wtmp records.

What is the difference between 'Accepted publickey' and 'Accepted password'?

Publickey means the user authenticated with an SSH key; password means they typed a password. If you believe password authentication is disabled and you see 'Accepted password', it is not disabled — that is worth fixing regardless of whether the login was legitimate.

Should I be worried about a successful root login over SSH?

On most systems, yes — direct root login over SSH is usually disabled deliberately, with administrators signing in as themselves and escalating with sudo. A successful root login means either that policy is not in place or something bypassed it. Check the PermitRootLogin setting in sshd_config.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026