How can you confirm successful logins to SSH? It is simple: use the “last” utility from the root.
last -da
The command above will let you see the last successful logins and some vital information, as shown below. The information included helps see if an account was compromised and at what time so that you may take steps to tighten security on the box.
angels ftpd12345 Wed Jun 11 13:39 – 13:49 (00:10) c-11-22-33-44.hsd1.nj.sipylus.com