How to see SSH failed connection attempts to the server in Linux

When setting up a public policy server, it is common for several entities to decide to violate your security and privacy. So seeing the failed connection attempts will allow you to inspect and run an analysis on it.

This service is offered by Secure Shell, also known as SSH. A level of protection within the Linux operating system, which encrypts data transmission.

This protocol acts as an intermediary, protecting the connection between client and server. Prevent third parties from intercepting the exchange of information.

As for administrators who associate the benefits of SSH with their server, it allows them to remotely connect to it. Which can be configured according to the user's wishes to increase security.

If you are interested in installing and learning how to use Secure Shell to see failed connection attempts within your server, you should know that Linux has very simple commands that allow you to do this.

So you just need to keep reading and taking note, preventing any entity from continuing to attempt to invade the server you manage.

How to install Secure Shell to view failed server connection attempts?

One of the great benefits of getting administrator permission for operating systems like Linux is the management of full authorship of computer settings and utilities.

Likewise, you can also run the necessary commands (as this system is managed through them) to install and perform the tasks that are essential for you.

Sometimes the protection protocol Secure Shell is built into some computers that run on this operating system. While others remain obsolete and have not yet acquired it.

So if you don't have SSH in your tools and you have acquired administrator permissions, you have to open the "Terminal" window to execute the commands.

In order to install it, you need to write the code corresponding to the version of Linux you use. For example, in Ubuntu you have to write " sudo apt install openssh-server ". Once done, you just have to wait for the procedure to finish automatically.

SSH commands to view failed connection attempts on the server

 

As mentioned above, the variability of commands related to requesting connections via Secure Shell (such as restarting a web server, for example) varies also to depending on the version of the operating system that has been installed.

Ubuntu

There are several encodings to view failed connections that have been made on your server. However, the most used and the one that shows the simplest information is " grep »Password failed« /var/log/auth.log ".

By pressing the "Enter" key, an indefinite list of failed connection attempts that have been made since SSH was established to secure the server will be displayed on the screen.

This list contains information about the IP address of the equipment, the username used to log in and the port used during the attempt.

For more information, you can enter the command " egrep ”Failed | Failure “/var/log/auth.log ". This allows the user to get more complete details on the subject.

RHEL or CentOS

In the case of versions such as CentOS or RHEL, the Secure Shell security information is stored in the " / var / log / secure ". This address also keeps a log of failed connection attempts made within the server, which can be viewed with the command " egrep” Failed | Failure “/var/log/secure "Within the" Terminal ".

As in Ubuntu, this list contains data about the user used to make the connection, the port number and the IP address of the computer.

Once these orders are executed, you will be able to carry out an analysis of the types of invasions you have received to date on your server. There are several entities that can try to establish a connection, which can be bots or people, which is established based on the pattern performed to enter.

After evaluating these aspects, you finally know what to block and which aspects to reinforce. For prevent another attempt to invade the privacy and security of your server.