I meant the log for the SSH server, on the machine you are trying to connect to, not the nx log. On the SSH server, run
grep sshd /var/log/messages Here it is: Nov 29 11:07:18 tiger kernel: audit: type=1109 audit(1448795238.479:333395): pid=12140 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:bad_ident grantors=? acct="?" exe="/usr/sbin/sshd" hostname=192.168.62.40 addr=192.168.62.40 terminal=ssh res=failed' Nov 29 11:07:18 tiger audit: CRYPTO_KEY_USER pid=12140 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=server fp=SHA256:c8:65:0c:ad:44:4d:7e:a3:b7:1b:2a:34:5f:a6:a9:61:16:26:21:8d:20:de:80:27:ce:50:dc:6c:ed:8d:c9:f8 direction=? spid=12140 suid=0 exe="/usr/sbin/sshd" hostname=? addr=192.168.62.40 terminal=? res=success' Nov 29 11:07:18 tiger audit: CRYPTO_KEY_USER pid=12140 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=server fp=SHA256:59:9f:43:66:77:9e:77:a7:66:77:71:0c:8c:0c:aa:28:61:b4:69:be:ec:77:ed:46:7f:eb:3f:eb:e7:b0:de:7e direction=? spid=12140 suid=0 exe="/usr/sbin/sshd" hostname=? addr=192.168.62.40 terminal=? res=success' Nov 29 11:07:18 tiger audit: CRYPTO_KEY_USER pid=12140 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=server fp=SHA256:b9:48:9f:4f:b7:bd:63:39:b5:49:e9:41:89:0b:64:b2:6a:6a:6d:03:2e:b1:ae:49:9d:9f:89:18:02:28:b3:8c direction=? spid=12140 suid=0 exe="/usr/sbin/sshd" hostname=? addr=192.168.62.40 terminal=? res=success' Nov 29 11:07:18 tiger audit: CRYPTO_KEY_USER pid=12140 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=server fp=SHA256:3a:ae:49:b7:b1:94:f6:b3:a4:88:62:45:b3:36:5d:1f:46:9d:c9:9d:e2:a7:1b:23:94:c2:f9:1b:a4:0e:46:99 direction=? spid=12140 suid=0 exe="/usr/sbin/sshd" hostname=? addr=192.168.62.40 terminal=? res=success' Nov 29 11:07:18 tiger audit: USER_LOGIN pid=12140 uid=0 auid=4294967295 ses=4294967295 msg='op=login acct="nx" exe="/usr/sbin/sshd" hostname=? addr=192.168.62.40 terminal=ssh res=failed' [root@tiger ~]# -- Neil Bothwick Why is the word abbreviation so long?
