@ruben — following up from question the other day — here is what I see on machines where I’ve been auditing user events for logins (pardon formatting) — we’re using SSH keys/no passwords on user account (password is empty, PAM policy is that if password is empty, you can’t login using a password as authentication mechanism, you have to use SSH key). Pardon the bad formatting — but first set is on a box that has ssh “open” to the internet (it won’t accept a password, but firewall still lets people try) where remote actors are trying passwords and/or brute forcing — logs basically look like this all day long.

pid		message				type	path
48336	op=PAM:bad_ident	1109	/usr/sbin/sshd
48336	op=login			1112	/usr/sbin/sshd
48341	op=PAM:bad_ident	1109	/usr/sbin/sshd
48341	op=login			1112	/usr/sbin/sshd
23166	op=PAM:bad_ident	1109	/usr/sbin/sshd
23166	op=login			1112	/usr/sbin/sshd
48349	op=maxtries		1100	/usr/sbin/sshd
48349	op=PAM:bad_ident	1109	/usr/sbin/sshd
48349	op=login			1112	/usr/sbin/sshd
48354	op=PAM:bad_ident	1109	/usr/sbin/sshd
48354	op=login			1112	/usr/sbin/sshd
23197	op=PAM:bad_ident	1109	/usr/sbin/sshd
23197	op=login			1112	/usr/sbin/sshd
23225	op=PAM:bad_ident	1109	/usr/sbin/sshd
23225	op=login			1112	/usr/sbin/sshd
23232	op=PAM:bad_ident	1109	/usr/sbin/sshd
23232	op=login			1112	/usr/sbin/sshd
48422	op=PAM:bad_ident	1109	/usr/sbin/sshd
48422	op=login			1112	/usr/sbin/sshd

whereas this is a successful cert based login:

pid		message				type	path			terminal
15538	op=pubkey_auth		1100	/usr/sbin/sshd	?
15538	op=key				1100	/usr/sbin/sshd	?
15538	op=PAM:accounting	1101	/usr/sbin/sshd	ssh
15538	op=success			1100	/usr/sbin/sshd	ssh
15538	op=PAM:setcred		1103	/usr/sbin/sshd	ssh
15538	op=PAM:session_open	1105	/usr/sbin/sshd	ssh
15541	op=PAM:setcred		1103	/usr/sbin/sshd	ssh
15538	op=login			1112	/usr/sbin/sshd	/dev/pts/0
15538	op=login			1105	/usr/sbin/sshd	/dev/pts/0

those are both on Centos — I can check on some other types of linux OS as well.