How to retrieve IP addresses of possible ssh attackers?

Question

I've just cat /var/log/auth.log log and see, that there are many | grep "Failed password for" records.

However, there are two possible record types - for valid / invalid user. It complicates my attempts to | cut them.

I would like to see create a list (text file) with IP addresses of possible attackers and number of attempts for each IP address. Is there any easy way to create it?

Also, regarding only ssh: What all records of /var/log/auth.log should I consider when making list of possible attackers?

Example of my 'auth.log' with hidden numbers:

cat /var/log/auth.log | grep "Failed password for" | sed 's/[0-9]/1/g' | sort -u | tail

Result:

Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user ucpss from 111.11.111.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user vijay from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user webalizer from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user xapolicymgr from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user yarn from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user zookeeper from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user zt from 111.11.111.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for mysql from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for root from 111.11.111.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for root from 111.111.111.1 port 11111 ssh1

Answer 1

You could use something like this:

grep "Failed password for" /var/log/auth.log | grep -Po "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" \
| sort | uniq -c

It greps for the string Failed password for and extracts (-o) the ip address. It is sorted, and uniq counts the number of occurences.

The output would then look like this (with your example as input file):

  1 111.111.111.1
  3 111.11.111.111
  6 111.111.11.111

The last one in the output has tried 6 times.

Answer 2

It might be a bloated solution but i suggest you look at installing something like Fail2Ban

It is made for this kind of logging + adds the bonus of being able to add (temporary) rules in your firewall to block repeating offenders. Be sure to whitelist your own ip's though, i managed to lock myself out temporarily on a few occasions

Answer 3

This worked out real well for me. (IPs have been changed to protect the guilty)

$ awk '/Failed/ {x[$(NF-3)]++} END {for (i in x){printf "%3d %s\n", x[i], i}}' /var/log/auth.log | sort -nr
 65 10.0.0.1
 14 10.0.0.2
  4 10.0.0.3
  1 10.0.0.4

Answer 4

grep "Failed password for" /var/log/auth.log |
    awk -F"from" {'print $2'} |
    awk {'print $1'} |
    sort -u