List IPs/encounters or hostnames of invalid/accepted logins to sshd.

list-sshd-logins.txt

### invalid logins

# journalctl (last 7 days)
journalctl --since -7d | grep 'sshd.*Invalid' | awk '{ print $10 }' | sort | uniq -c
journalctl --since -7d | grep 'sshd.*Invalid' | awk '{ print $10 }' | sort | uniq | xargs -n1 dig +short -x

# /var/log/auth.log
cat /var/log/auth.log | grep 'sshd.*Invalid' | awk '{ print $10 }' | sort | uniq -c
cat /var/log/auth.log | grep 'sshd.*Invalid' | awk '{ print $10 }' | sort | uniq | xargs -n1 dig +short -x

### accepted logins

# journalctl (last 7 days)
journalctl --since -7d | grep 'sshd.*Accepted' | awk '{ print $11 }' | sort | uniq -c
journalctl --since -7d | grep 'sshd.*Accepted' | awk '{ print $11 }' | sort | uniq | xargs -n1 dig +short -x

# /var/log/auth.log
cat /var/log/auth.log | grep 'sshd.*Accepted' | awk '{ print $11 }' | sort | uniq -c
cat /var/log/auth.log | grep 'sshd.*Accepted' | awk '{ print $11 }' | sort | uniq | xargs -n1 dig +short -x