How does this script work in CentOS7?

Question

I found a command in a CentOS7 tutorial to get a small table of the number of the user that try connect via ssh:

|try|ip|user|

The

The code is the next:

zgrep -hi "Failed password for " /var/log/secure* | sed "s/invalid user //" | tr -s " " | awk '{print $11" "$9}' | sort | uniq -c | sort -rn | head -20

zgrep -hi "Failed password for " /var/log/secure* | 
sed "s/invalid user //" | 
tr -s " " | 
awk '{print $11" "$9}' | 
sort | 
uniq -c | 
sort -rn | 
head -20

I want to know how its work?

Answer 1

The first command searches your /var/log/secure log for failed login attempts

zgrep -hi "Failed password for " /var/log/secure*

will produce a result like this:

Aug  1 21:22:53 jbclamp001 sshd[40401]: Failed password for jbutryn from ip.ip.ip.ip port 55843 ssh2

the command:

sed "s/invalid user //"

Will search for the phrase "invalid user " and replace it with ""

the command:

tr -s " "

Will trim any extra blank characters from the string.

The command:

awk '{print $11" "$9}'

will then grab only column's 11 and 9 and print them (this is the IP address and username)

the command:

sort

will then sort all your results alphanumerically?

the command:

uniq -c

will remove any duplicate values

the command:

sort -rn

sorts the list in reverse numerical order?

the command:

head -20

will only show the top 20 values from your results.