Linux Tips

Is someone trying to break into my server?

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #63:

Try: sudo grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -5

Info: This command searches /var/log/auth.log for failed SSH authentication attempts, extracts the source IP address with awk, counts occurrences with uniq -c, and sorts the results to show the most frequent offending IP addresses.

Examples:

  • $ sudo journalctl -u ssh | grep -i failed | wc -l  # Count SSH authentication failures
  • $ sudo lastb | head  # View recent failed login attempts
  • $ sudo fail2ban-client status sshd  # Check currently banned SSH IP addresses

Note: Repeated failed SSH logins can indicate brute-force activity, but failed attempts alone do not prove that someone successfully compromised the server. On systems using systemd-journald without traditional auth logs, use journalctl -u ssh to inspect SSH authentication events. Consider fail2ban to automatically block repeated brute-force attempts.




LinuxTeck.com 
linuxteck@ubuntu:~$ sudo grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -5
   4523 203.0.113.45
   2341 198.51.100.22
   1876 192.0.2.100
   1234 203.0.113.99
    892 198.51.100.87

linuxteck@ubuntu:~$

PREVIOUS ARTICLE Quick Linux Tip #62: Linux Check Thermal Throttling NEXT ARTICLE Quick Linux Tip #64: Write an ISO to USB on Linux
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.