Development · Tip
Check SSH Brute-Force Login Attempts
Terminal commands to count and monitor failed SSH logins on Linux
This tip provides quick Linux shell commands to inspect authentication logs for unauthorized access attempts. Running grep on the system auth log tallies failed password attempts, while tail lets administrators watch incoming connection attempts in real time.
How it works
Run the following command to count failed password attempts in your authentication logs:
grep "Failed password" /var/log/auth.log | wc -l
To monitor incoming login attempts in real time, run:
tail -f /var/log/auth.log
What it's for
- Count the total number of failed SSH login attempts on a Linux VPS
- Monitor live authentication logs to detect brute-force attacks as they happen
- Verify whether additional server hardening tools like Fail2ban are needed
Key points
- Run grep "Failed password" /var/log/auth.log | wc -l to count failed password attempts
- Run tail -f /var/log/auth.log to stream authentication log events in real time
- Works natively on standard Debian and Ubuntu systems without extra software
Pricing
Free
Details
- Type
- Tip
- Category
- Development
- Topic
- Server Security
- Open source
- Yes
- Platforms
- Linux, Command line
- For
- Linux system administrators and VPS owners
- Tags
- linux, ssh, sysadmin, security, bash, terminal
Why it was saved
- @brusnicadev: Quickly inspects how many unauthorized login and brute-force attempts targeted your public server in recent logs.
Related
Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data.
SSH tarpit written in Go with built-in Prometheus metrics and Grafana support
Log-monitoring daemon that dynamically blocks IP addresses causing repeated authentication failures.
Quick commands to detect and block SSH brute-force attacks on Linux
Mobile and cross-platform IDE with terminal, browser devtools, and AI agents.
Agentic development platform and IDE for running autonomous coding agents.
Updated