I'd like to see if somebody has been trying to log-in by brute-force into my Ubuntu 12.04 server over SSH. How can I see if such activities have been taking place?
All login attempts are logged to
1. Filter for brute-force interactive SSH logins
Open a terminal, and type the below; if it's longer than 1 page you will be able to scroll up and down; type
2. Look for failed connections (i.e. no login attempted, could be a port scanner, etc.):
Use this command:
How to reduce failed/brute-force login attempts
I would argue that monitoring logs is a weak solution especially if you have a weak password on an account. Brute attempts often try at least hundreds of keys per minute. Even if you have a cron job set to email you of brute attempts, it could be hours before you get to your server.
If you have a public-facing SSH server, you need a solution that kicks in long before you can be hacked.
I would strongly recommend
Getting protection from it is as simple as
By default as soon as somebody has three failed attempts, their IP gets a five minute ban. That sort of delay essentially halts a SSH brute force attempt but it's not going to ruin your day if you forget your password (but you should be using keys anyway!)