Skip to content

Linux Check SSH Login Attempts To Server

Linux Check SSH Login Attempts To Server

For CentOS or RHEL distros, the login attempts are stored at /var/log/secure

For Ubuntu, the login attempts are stored at /var/log/auth.log

Sample Commands (based on CentOS)

To read the file, simply run the command cat /var/log/secure

If your ssh allows for normal password authentication, you can check for failed login attempts by running the command cat /var/log/secure | grep "Failed password"

If your ssh allows for key-based login, you can check for failed login attempts by running the command cat /var/log/secure | grep -i Invalid

 

 

 

Enjoyed the content ? Share it with your friends !
Published inWeb Server

Be First to Comment

Leave a Reply

Your email address will not be published.