Linux / UNIX SSHD: Find Out All Failed Login Attempts

by nixCraft on January 2, 2005 · 6 comments· Last updated April 3, 2010

Sshd (OpenSSH Server) which replace older rlogin and rsh / telnet, and provide secure encrypted communications between two untrusted hosts over an insecure network.However, OpenSSH is open to various password guessing attacks. Use the following commands to find out all failed login attempts:

a) Use the grep command to find out authentication failure message from /var/log/secure file.

b) Use the awk and cut command to print IPs/hostname.

c) Use the sort command to sort data.

d) Use the uniq command to print total failed login attempts.

Procedure

1) Login as the root user

2) Type the following command at shell prompt:

 grep "authentication failure" /var/log/secure | awk '{ print $13 }' | cut -b7-  | sort | uniq -c

Output:

 1 216.12.193.35
 2 DEVssh
 2 hack.baddomain.net
 ...
 ..

You should follow me on twitter here or grab rss feed to keep track of new changes.

Featured Articles:

{ 6 comments… read them below or add one }

1 Asim December 27, 2006 at 1:27 am: command does not work i’ve tried it in FC5
Reply
2 Ash December 28, 2006 at 6:18 pm: I got this among valid addresses:
1 ev/tty2
1 y2
Because sometimes log includes “1 more authentication failure” or “2 more authentication failures” instead of “authentication failure”.
I recommend not to rely on field # 13 and use some more sophisticated command with pattern matching like:
grep “authentication failure” /var/log/messages | sed -n -e “s/.*rhost=\([^ ]*\).*/\1/p” | sort | uniq -c
or similar. A.
Reply
3 Ash December 29, 2006 at 8:52 am: sed -n -e “/sshd/s/.*Invalid user \(.*\) from \([^ ]*\).*/\2/p” /var/log/messages | sort | uniq -c
gives interesting results too. Thanks for nice “sort + uniq -c” hint.
Nice site, handy and useful articles… great. Ctrl+D.
Reply
4 DM July 6, 2008 at 10:28 pm: Is it good if there is no authentication failure message?
hehehehe
Just secured my server and it all stopped. I use to get a few per hour.
nice!
see google secure centos server.
Reply
5 kashyap January 7, 2010 at 2:42 pm: guys how abt in ubuntu 9.10 i dont see any thing in /var/log/messages nor in syslog
in the sshd_config it just says under logging
SyslogFacility AUTH
LogLevel INFO
Reply
6 Rony January 31, 2010 at 12:06 am: Can I get some basic commands to work on Domino server using Linux.
Reply