Linux Check SSH Login Attempts To Server
For
CentOS or RHEL distros
, the login attempts are stored at
/var/log/secure
For
Ubuntu, the login attempts are stored at
/var/log/auth.log
Sample Commands (based on CentOS)
To read the file, simply run the command
cat /var/log/secure
If your ssh allows for normal password authentication, you can check for failed login attempts by running the command
cat /var/log/secure | grep "Failed password"
If your ssh allows for key-based login, you can check for failed login attempts by running the command
cat /var/log/secure | grep -i Invalid
Be First to Comment