21

I've just cat /var/log/auth.log log and see, that there are many | grep "Failed password for" records.

However, there are two possible record types - for valid / invalid user. It complicates my attempts to | cut them.

I would like to see create a list (text file) with IP addresses of possible attackers and number of attempts for each IP address. Is there any easy way to create it?

Also, regarding only ssh: What all records of /var/log/auth.log should I consider when making list of possible attackers?

Example of my 'auth.log' with hidden numbers:

cat /var/log/auth.log | grep "Failed password for" | sed 's/[0-9]/1/g' | sort -u | tail

Result:

Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user ucpss from 111.11.111.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user vijay from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user webalizer from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user xapolicymgr from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user yarn from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user zookeeper from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user zt from 111.11.111.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for mysql from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for root from 111.11.111.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for root from 111.111.111.1 port 11111 ssh1
1
  • I suggest you create ssh keys, install them up on your server and disable passwords entirely in your server sshd config file /etc/ssh/sshd_config ... lookup settings PasswordAuthentication no and PermitRootLogin without-password ... then all such password attempts will be thwarted before ever entering the auth.log ... Commented Dec 14, 2019 at 0:33

4 Answers 4

26

You could use something like this:

grep "Failed password for" /var/log/auth.log | grep -Po "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" \
| sort | uniq -c

It greps for the string Failed password for and extracts (-o) the ip address. It is sorted, and uniq counts the number of occurences.

The output would then look like this (with your example as input file):

  1 111.111.111.1
  3 111.11.111.111
  6 111.111.11.111

The last one in the output has tried 6 times.

5
  • this is the best answer @chaos - added to my box of useful oneliners - thanks!
    – Jake
    Commented Mar 18, 2015 at 9:56
  • Great solution. I didn't know that grep can extract regex matches, not just filter lines. I've just added | sort -n to the chain.
    – kravemir
    Commented Mar 18, 2015 at 10:42
  • 1
    Good answer - multiple greps are usually a sign to use sed. sed -nr '/Failed/{s/.*([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/;p}' replaces both greps.
    – orion
    Commented Mar 18, 2015 at 10:57
  • 2
    @orion true but imagine that the first grep can also be zgrep "Failed" /var/log/auth.log* to also search trough the compressed log archives, what sed cannot.
    – chaos
    Commented Mar 18, 2015 at 11:02
  • 1
    What about IPv6? Commented Apr 14, 2016 at 16:31
7

It might be a bloated solution but i suggest you look at installing something like Fail2Ban

It is made for this kind of logging + adds the bonus of being able to add (temporary) rules in your firewall to block repeating offenders. Be sure to whitelist your own ip's though, i managed to lock myself out temporarily on a few occasions

3
  • 1
    Well, nice commentary, but not a answer to the question. It's more like suggestion that could remove the need of question, but I don't need a daemon to monitor my files. I've got my reasons why do I need to make that list as text file just by scripts. :)
    – kravemir
    Commented Mar 18, 2015 at 13:11
  • I agree with @Miro, had you not mentioned it here I'd have added it in a comment.
    – SailorCire
    Commented Mar 18, 2015 at 15:35
  • @Miro, you're right, not an answer to the question itself, it just came to mind as a convenient tool for this kind of logging.
    – Jake
    Commented Mar 19, 2015 at 15:27
0

This worked out real well for me. (IPs have been changed to protect the guilty)

$ awk '/Failed/ {x[$(NF-3)]++} END {for (i in x){printf "%3d %s\n", x[i], i}}' /var/log/auth.log | sort -nr
 65 10.0.0.1
 14 10.0.0.2
  4 10.0.0.3
  1 10.0.0.4
0
grep "Failed password for" /var/log/auth.log |
    awk -F"from" {'print $2'} |
    awk {'print $1'} |
    sort -u
3
  • The result is password - not working. It doesn't even cover different entry types, awk print column is alternative to the cut, not the solution.
    – kravemir
    Commented Mar 18, 2015 at 8:56
  • It works for me either with sample above ou real /var/log/auth.log
    – Archemar
    Commented Mar 18, 2015 at 9:31
  • Well, it didn't work before the edit - when the comment had been made. Now it works correctly. However, it misses uniq -c as in the best answer.
    – kravemir
    Commented Mar 18, 2015 at 10:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .