How do I only show the unique IP addresses in /var/log/auth.log ? I have a server getting hit constantly, and while I have set up fail2ban, the requests keep coming. So I started writing to ISPs to get the accounts shutdown, which might help a little, but there are so many attacks.... Anyway,
I used this command to sort the hits from today:
$grep -e 'ruser \| rhost' auth.log | grep -e 'Jun 9' | sort -k 14 | less
its thousands of attacks... or brute force attempts.
Heres some relivent lines from auth.log:
...
Jun 9 10:08:35 nan sshd[23397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53
Jun 9 10:08:51 nan sshd[23401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53
Jun 9 10:09:07 nan sshd[23428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53
Jun 9 10:01:59 nan sshd[23216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:02:52 nan sshd[23238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:03:08 nan sshd[23246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:03:40 nan sshd[23256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:04:14 nan sshd[23270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:04:31 nan sshd[23276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:05:23 nan sshd[23298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:05:55 nan sshd[23315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:06:49 nan sshd[23343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:07:47 nan sshd[23375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:08:02 nan sshd[23383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:09:47 nan sshd[23440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:10:02 nan sshd[23444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=root
Jun 9 10:09:27 nan sshd[23436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.109.161.53 user=sshd
Jun 9 05:27:00 nan sshd[20293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.134.44.86
....
I would like to make a list of the unique IP addresses in auth.log.
I tried using gawk -F: '{ print $14 }' auth.log | uniq -c
but I guess I'm doing something wrong. I just want a sorted list of IP addresses from today. how do I do that?