Find Out All Failed SSHD Login Attempts on Linux / Unix

Sshd (OpenSSH Server) which replace older rlogin and rsh /telnet, and provide secure encrypted communications between two untrusted hosts over an insecure network. However, OpenSSH is open to many password guessing and cracking attacks. Use the following commands to find out all failed SSHD login attempts in Linux or Unix-like systems.

All failed ssh login attempts logged and saved in the server. One can use cat command or awk command or grep command to display IP address and other information associated such attempts.

How to find all failed SSHD login Attempts in Linux

1. Use the grep command to find out authentication failure message from /var/log/secure or /var/log/auth.log file
2. Run the awk and cut command to print IPs/hostname
3. One can execute the sort command to sort data
4. Use the uniq command to print total failed sshd login attempts in Linux or Unix

Procedure

1) Login as the root user

2) Type the following command at shell prompt:

 grep "authentication failure" /var/log/secure | awk '{ print $13 }' | cut -b7-  | sort | uniq -c

Output:

 1 216.12.193.35
 2 DEVssh
 2 hack.baddomain.net
 ...
 ..

Conclusion