-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Bash Cookbook
By :

In this recipe, we will learn about finding the failed SSH attempts and blocking those IP addresses. To find failed attempts, we will use grep
as well as cat
commands. The login attempts to the SSH Server are tracked and recorded into the rsyslog
daemon.
Besides having a Terminal open, we need to remember a few concepts:
grep
and cat
commandsgrep
is installedWe will find the failed SSH login attempts using the grep
and cat
commands. First, be a root user. Type the sudo su
command. Next, run the following command to fetch the failed attempts using the grep
command:
# grep "Failed password" /var/log/auth.log
You can do this using the cat
command also. Run the following command:
# cat /var/log/auth.log | grep "Failed password"
You can block the particular IP address that has failed SSH login attempt using tcp-wrapper. Navigate to the /etc
directory. Look for the hosts.deny
file, add the following...