Reviewing authentication logs and limiting brute-force attacks

Review recent SSH events with:

journalctl -u ssh --since today
journalctl -u sshd --since today
last -a
lastb -a

Service names and the availability of lastb vary by distribution. Repeated failures are common on public addresses; focus on successful logins, unexpected users, new keys, and configuration changes.

Fail2ban can temporarily block repeated failures, but it must monitor the correct journal or log and the actual SSH port. Test its rules carefully and allow trusted administrative sources when appropriate. Public-key authentication, prompt updates, and a narrow firewall remain more important than banning scanners.

Knowledge Base

Reviewing authentication logs and limiting brute-force attacks

Please rate this article to help us improve our Knowledge Base.