I've just cat /var/log/auth.log log and see, that there are many | grep "Failed password for" records.

However, there are two possible record types - for valid / invalid user. It complicates my attempts to | cut them.

I would like to see create a list (text file) with IP addresses of possible attackers and number of attempts for each IP address. Is there any easy way to create it?

Also, regarding only ssh: What all records of /var/log/auth.log should I consider when making list of possible attackers?

Example of my 'auth.log' with hidden numbers:

cat /var/log/auth.log | grep "Failed password for" | sed 's/[0-9]/1/g' | sort -u | tail

Result:

Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user ucpss from 111.11.111.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user vijay from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user webalizer from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user xapolicymgr from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user yarn from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user zookeeper from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for invalid user zt from 111.11.111.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for mysql from 111.111.11.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for root from 111.11.111.111 port 11111 ssh1
Mar 11 11:11:11 vm11111 sshd[111]: Failed password for root from 111.111.111.1 port 11111 ssh1
up vote 19 down vote accepted

You could use something like this:

grep "Failed password for" /var/log/auth.log | grep -Po "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" \
| sort | uniq -c

It greps for the string Failed password for and extracts (-o) the ip address. It is sorted, and uniq counts the number of occurences.

The output would then look like this (with your example as input file):

  1 111.111.111.1
  3 111.11.111.111
  6 111.111.11.111

The last one in the output has tried 6 times.

  • this is the best answer @chaos - added to my box of useful oneliners - thanks! – Jake Mar 18 '15 at 9:56
  • Great solution. I didn't know that grep can extract regex matches, not just filter lines. I've just added | sort -n to the chain. – kravemir Mar 18 '15 at 10:42
  • 1
    Good answer - multiple greps are usually a sign to use sed. sed -nr '/Failed/{s/.*([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/;p}' replaces both greps. – orion Mar 18 '15 at 10:57
  • 1
    @orion true but imagine that the first grep can also be zgrep "Failed" /var/log/auth.log* to also search trough the compressed log archives, what sed cannot. – chaos Mar 18 '15 at 11:02
  • 1
    What about IPv6? – Ortomala Lokni Apr 14 '16 at 16:31

It might be a bloated solution but i suggest you look at installing something like Fail2Ban

It is made for this kind of logging + adds the bonus of being able to add (temporary) rules in your firewall to block repeating offenders. Be sure to whitelist your own ip's though, i managed to lock myself out temporarily on a few occasions

  • Well, nice commentary, but not a answer to the question. It's more like suggestion that could remove the need of question, but I don't need a daemon to monitor my files. I've got my reasons why do I need to make that list as text file just by scripts. :) – kravemir Mar 18 '15 at 13:11
  • I agree with @Miro, had you not mentioned it here I'd have added it in a comment. – SailorCire Mar 18 '15 at 15:35
  • @Miro, you're right, not an answer to the question itself, it just came to mind as a convenient tool for this kind of logging. – Jake Mar 19 '15 at 15:27

cat /var/log/auth.log |grep "Failed password for"|awk -F"from" {'print $2'}| awk {'print $1'}|sort -u

  • The result is password - not working. It doesn't even cover different entry types, awk print column is alternative to the cut, not the solution. – kravemir Mar 18 '15 at 8:56
  • It works for me either with sample above ou real /var/log/auth.log – Archemar Mar 18 '15 at 9:31
  • Well, it didn't work before the edit - when the comment had been made. Now it works correctly. However, it misses uniq -c as in the best answer. – kravemir Mar 18 '15 at 10:39

This worked out real well for me. (IPs have been changed to protect the guilty)

$ awk '/Failed/ {x[$(NF-3)]++} END {for (i in x){printf "%3d %s\n", x[i], i}}' /var/log/auth.log | sort -nr
 65 10.0.0.1
 14 10.0.0.2
  4 10.0.0.3
  1 10.0.0.4

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.