How to Detect Suspicious Login Attempts on Linux

Security monitoring is a vital continuous responsibility for server administrators. Automated botnets constantly scan public IPv4 addresses trying to brute-force SSH logins using dictionary lists of common usernames and passwords.

In this guide, we show you how to inspect system authentication logs, detect suspicious login patterns, and audit user access on your RivinCloud Linux VPS.

1. Where Authentication Logs Are Kept

Linux distributions log authentication attempts in dedicated locations:

• Debian / Ubuntu: /var/log/auth.log
• RHEL / CentOS / AlmaLinux: /var/log/secure
• Systemd Journal: journalctl -u sshd
• Failed Login Binary Database: /var/log/btmp (read via lastb)
• Successful Login Binary Database: /var/log/wtmp (read via last)

2. Auditing Authentication History

A. Checking Failed Login Attempts with lastb

The lastb utility parses /var/log/btmp to display a clean report of every failed login attempt:

sudo lastb -n 20

B. Checking Successful Logins with last

To verify that no unauthorized remote user has successfully logged in:

last -n 20

3. Searching Logs for Brute-Force Activity

Use journalctl or grep to inspect detailed SSH daemon logs:

Search for Failed Password Attempts

sudo journalctl -u sshd | grep "Failed password" | tail -n 25

Identify Top Attacker IP Addresses

Run this one-liner to group and count failed SSH login attempts by remote IP address:

sudo journalctl -u sshd | grep "Failed password" | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head -n 10

Command of the Day: sudo lastb

The lastb command reads /var/log/btmp to present a reverse-chronological log of bad login attempts.

Syntax

sudo lastb [options]

Practical Example

sudo lastb -n 15

Sample Output

root     ssh:notty    198.51.100.45    Mon Sep 28 14:15 - 14:15  (00:00)
admin    ssh:notty    198.51.100.45    Mon Sep 28 14:15 - 14:15  (00:00)
user     ssh:notty    203.0.113.88     Mon Sep 28 14:12 - 14:12  (00:00)

Explanation

This output reveals multiple failed login attempts for usernames root, admin, and user originating from IP addresses 198.51.100.45 and 203.0.113.88.

4. How to Remediate and Block Attackers

If you detect active brute-force activity:

1. Ban the Attacker IP immediately in UFW:

   sudo ufw insert 1 deny from 198.51.100.45
   

2. Install Fail2Ban: Automatically monitor logs and ban IPs after 3 failed attempts:

   sudo apt install fail2ban -y
   

3. Disable Password Authentication: Force key-only SSH logins in /etc/ssh/sshd_config:

   PasswordAuthentication no
   

Common Mistakes

• Clearing log files manually with rm: Removing /var/log/auth.log or /var/log/btmp directly can prevent system daemons from writing future log entries due to missing file ownership. Truncate instead: sudo > /var/log/btmp.
• Ignoring root login warnings: Leaving PermitRootLogin yes enabled in SSH config while using password authentication.

Troubleshooting

• lastb: /var/log/btmp: No such file or directory: Create the file with correct permissions:

  sudo touch /var/log/btmp
  sudo chown root:utmp /var/log/btmp
  sudo chmod 660 /var/log/btmp
  

Best Practices

• Periodically audit last and lastb output.
• Enforce SSH key authentication and install Fail2Ban for automated active defense.

Frequently Asked Questions

Is it normal to see thousands of failed SSH logins?

Yes. Automated internet bots scan public IP ranges 24/7 trying common credentials. As long as password authentication is disabled and SSH keys are enforced, these failed attempts pose zero threat.

Conclusion

Auditing authentication logs with lastb and journalctl gives you total visibility into access attempts on your Linux server. Secure your RivinCloud VPS today!