Logging pubkey failed logins

[Marcin Maciejewicz]

Hi,

On my C819G router I have switched from standard user/password ssh login to pubkey, but now my "sh login failed" list doesn't update on failed attempts. Is there any other way to see who's trying to get into my router?

Regards
Marcin Maciejewicz

[balaji.bandi]

how is your Logging configured ?

check you get any output using :

ip ssh logging event

also refer below thread - see that can help you :

https://community.cisco.com/t5/network-access-control/how-to-log-success-and-failed-login-attempt-details-to-router/td-p/1424821

[Georg Pauwen]

Hello,

when you configure:

819(config)#login on-failure log

and then do a:

819#sh log | include LOGIN_FAILED

do you get any output, that is, does the login failure generate a syslog at all ?

[Marcin Maciejewicz]

Yes, I do have entries in my log, but after some tests I've noticed that they appear only after I provide wrong private key. If none is provided and connection is automaticly closed then I don't have any trace in the log.

[Marcin Maciejewicz]

OK, I've checked carefully my syslog and I see failed attempts under SSH-5-SSH2_CLOSE events. Not elegant way, but if there's no way to force them to show under "sh login f" then it'll have to suffice.