Linux Check SSH Login Attempts To Server
For CentOS or RHEL distros, the login attempts are stored at /var/log/secure
For Ubuntu, the login attempts are stored at /var/log/auth.log
Sample Commands (based on CentOS)
To read the file, simply run the command cat /var/log/secure
If your ssh allows for normal password authentication, you can check for failed login attempts by running the command cat /var/log/secure | grep "Failed password"
If your ssh allows for key-based login, you can check for failed login attempts by running the command cat /var/log/secure | grep -i Invalid
Be First to Comment