Each attempt to login to SSH server is tracked and recorded into a log file by the rsyslog daemon in Linux. The most basic mechanism to list all failed SSH logins attempts in Linux is a combination of displaying and filtering the log files.<\/p>\n
The most simple command to list all failed SSH logins is the one shown below.<\/p>\n
#grep “Failed password” \/var\/log\/auth.log<\/p>\n
Sample output.<\/p>\n
grep “Failed password” \/var\/log\/auth.log<\/p>\n
Sep 26 09:49:11 linuxforfreshers.com sshd[32138]: Failed password for ravi from 192.168.101.26 port 33325 ssh2<\/p>\n
Oct 2 23:04:25 linuxforfreshers.com sshd[25028]: Failed password for root from 192.168.101.211 port 55800 ssh2<\/p>\n
In order to display extra information about the failed SSH logins, issue the command as shown in the below example.<\/p>\n
#egrep “Failed|Failure” \/var\/log\/auth.log<\/p>\n
In CentOS or RHEL, the failed SSH sessions are recorded in \/var\/log\/secure file. Issue the above command against this log file to identify failed SSH logins.<\/p>\n
#egrep “Failed|Failure” \/var\/log\/secure<\/p>\n
Sample output<\/p>\n
Dec 29 16:11:01 localhost sshd[32526]: Failed password for root from 192.168.101.111 port 31729 ssh2<\/p>\n
Dec 29 16:11:04 localhost sshd[32526]: Failed password for root from 58.218.198.264 port 31729 ssh2<\/p>\n