Login or Register to Ask a Question and Join Our Community


Cybersecurity

Failed SSHD Login Attempts (15,000 per day) - Is that a lot compared to your server?

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums Cybersecurity Failed SSHD Login Attempts (15,000 per day) - Is that a lot compared to your server?
# 1  
Old 09-26-2019
Failed SSHD Login Attempts (15,000 per day) - Is that a lot compared to your server?
The purpose of this thread is for everyone to follow the same methodology so we can create a future table, for the benefit of all, that shows how many failed login attempts (hacking) per day per server (and per minute) are happening.

This is not a thread on writing scripts or creating different methods to get the same data; nor it this a thread on how to prevent brute force logins; This thread has a a very simple (not elegant, not interesting) method that everyone can follow and by using the same very simple method, the results will be easy to compare, apples to apples, as follows:

Code:
lastb | wc -l
330466

lastb | head -1
root     ssh:notty    222.186.180.19   Thu Sep 26 00:50 - 00:50  (00:00)

lastb | tail -1
btmp begins Wed Sep  4 06:52:54 2019

Days Total (approx): 22

Code:
330466 / 22 = 15K ssh login attempts which failed each day, or about 10.4 per minute.

Is that a lot compared to your server?

Please post back your results using the same method:

Code:

lastb | head -1

lastb | tail -1

Then take the totals days by comparing the dates in the head and tail, and divide that (the days) into the total number from the lastb | wc -l command and post back (just like I did above)

Thanks.

PS: If all replies use the same method, it will be easy to compare the results in a table or chart later. Please do not use any other method than the very simple one above.

Thanks!

If we get enough replies, I will do a video on the results later.
# 2  
Old 09-26-2019
Here is another ubuntu server on the net:

Code:
ubuntu2:~# lastb | wc -l; lastb | head -1 ; lastb | tail -1
364528
tomcat   ssh:notty    134.175.151.40   Thu Sep 26 05:13 - 05:13  (00:00)
btmp begins Sun Sep  1 06:25:30 2019

Results:

Code:
364528 / 25 = 14,581 per day or 10.1 failed login attempts per minute.

# 3  
Old 09-26-2019
Ubuntu 3:

Code:
root@localhost:~# lastb | wc -l; lastb | head -1 ; lastb | tail -1
351459
root     ssh:notty    111.198.54.173   Thu Sep 26 10:17 - 10:17  (00:00)
btmp begins Sun Sep  1 06:25:10 2019

Code:
351459 / 25 = 14,038 per day or 9.7 failed login attempts per minute.

# 4  
Old 09-26-2019
So, far this is pretty interesting.

Three different public servers on the Internet (in the US) with the following "failed login attempts per minute" (FLA/m) or maybe (FLAPM):
  • 10.4
  • 10.1
  • 9.7

That's fairly interesting how three distinct public servers on the net are converging close to 10 FLA/m or 10 FLAPM.

Anyone else care to follow the same methodology so we can compare for the benefit of all readers?
# 5  
Old 09-26-2019
Difficult to follow precisely without lastb, but grepping 'authentication failure' in log files, one of my servers has 66,000 failed logins since Sep 22, which is awfully close to your 15,000 a day. Another's log files are too short to be useful for this...
This User Gave Thanks to Corona688 For This Post:
Neo
# 6  
Old 09-26-2019
Thanks Corona688,

Yes, I find it interesting that when we check for different servers with public Internet access, the number of failed ssh login attempts per minute (FLAPM) converges toward ten per minute.

This is why I think it would be useful to document this using, at least on Linux at the beginning, the same method, which is the simple lastb method I posted, since all major Linux systems use lastb to parse and display the auth log for failed login attempts.

If we use the same methodology, the numbers have more meaning, and if it turns out that there is some convergence to, for example, 10 FLAPM, then it would be interesting to try to understand why.
# 7  
Old 09-27-2019
@Neo: Thanks for rephrasing and clarifying your request!

Here's a script which calculates the FLAPM value:

Code:
#!/bin/bash

exit_with_message() { echo "$*" ; exit 1 ;}

type lastb >/dev/null 2>&1  || exit_with_message "error: no lastb"
type awk   >/dev/null 2>&1  || exit_with_message "error: no awk"

evaluate() {
   awk '

        function epoch(date,d) { "date -d \""date"\" +%s" | getline d; return d; }

        $10 != ""       { mydate=$4" "$5" "$6" "$7;count++; }
        NR==1           { last=epoch(mydate); }

        END { printf "%9.4f FLAPM\n",count/((last-epoch(mydate))/60)}
        '
}

lastb | evaluate

Here are some results for servers I manage, which provide services within the internet, partly with fail2ban and changed ssh ports in place:

Code:
  0.07 FLAPM
  0.07 FLAPM
  0.10 FLAPM
  0.10 FLAPM
  0.10 FLAPM
  0.11 FLAPM
  0.11 FLAPM
  0.11 FLAPM
  0.12 FLAPM
  0.20 FLAPM
  0.88 FLAPM
  1.12 FLAPM
  1.27 FLAPM
  1.36 FLAPM
  1.61 FLAPM
  1.74 FLAPM
  1.79 FLAPM
  1.92 FLAPM
  1.94 FLAPM
  2.88 FLAPM
  2.95 FLAPM
  3.20 FLAPM
  3.22 FLAPM
  3.35 FLAPM
  3.51 FLAPM
  3.53 FLAPM
  3.62 FLAPM
  3.63 FLAPM
  4.12 FLAPM
  4.75 FLAPM
  4.78 FLAPM
  4.82 FLAPM
  4.92 FLAPM
  4.96 FLAPM
  4.99 FLAPM
  5.07 FLAPM
  5.29 FLAPM
  5.29 FLAPM
  5.35 FLAPM
  5.44 FLAPM
  5.46 FLAPM
  5.54 FLAPM
  5.56 FLAPM
  5.62 FLAPM
  5.79 FLAPM
  5.80 FLAPM
  5.82 FLAPM
  5.85 FLAPM
  5.86 FLAPM
  5.86 FLAPM
  5.91 FLAPM
  6.01 FLAPM
  6.04 FLAPM
  6.25 FLAPM
  6.34 FLAPM
  6.92 FLAPM
  7.54 FLAPM
  8.72 FLAPM
  9.20 FLAPM
 11.01 FLAPM
 11.93 FLAPM
 12.57 FLAPM
 12.90 FLAPM
 13.08 FLAPM
 13.09 FLAPM
 13.35 FLAPM
 13.52 FLAPM
 14.09 FLAPM
 14.58 FLAPM
 14.76 FLAPM
 14.78 FLAPM
 14.80 FLAPM
 15.18 FLAPM
 16.97 FLAPM
 17.18 FLAPM
 17.22 FLAPM
 20.70 FLAPM
 23.57 FLAPM
 40.46 FLAPM

Last edited by stomp; 09-27-2019 at 12:51 PM..
These 2 Users Gave Thanks to stomp For This Post:
jim mcnamara Neo
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. Solaris

Solaris logs - Tracking failed attempts from my host

Hey all I'm having a big problem here. Someone is attempting an SSH to a destination host on which an account resides and locking the account. I'm trying to determine who is performing the SSH attempts from my host. For instance they're logged in as their standard account but then (I'm assuming)... (13 Replies)
Discussion started by: MaindotC
13 Replies

2. UNIX for Dummies Questions & Answers

TCP failed connection attempts from netstat -s

Dear experts, I am seeing a lot of TCP failed connection attempts from "netstat -s" on one of our servers. How can I pin point what connection failed and what are the ports involved? Any tools/commands I can dig in deeper to diag. what went wrong on these "failed connection attempts"? ... (2 Replies)
Discussion started by: cache51
2 Replies

3. Shell Programming and Scripting

Shell script in tracking both the passed and failed login in a unix server

Can you help me in providing the following output or a quite similar to this from a shell script ? *** Logins Summary Information ***** ---------------------------------- Failed Login Attempts for Invalid Accounts Date Time IP-ADD Account ... (0 Replies)
Discussion started by: linuxgeek
0 Replies

4. AIX

Invalid login attempts

How can I see the number of invalid login attempts of a user? Thanks, (9 Replies)
Discussion started by: agasamapetilon
9 Replies

5. Solaris

Number of login attempts on solaris 10

Hi, I want to sent number of login attempts ,so that after that much attempts user account should be locked on solaris 10 (2 Replies)
Discussion started by: manoj.solaris
2 Replies

6. AIX

ftp check for failed attempts

Hi, I have created the below ftp script to put files over to our capacity server, the check at the end works if ftp fails to run however if the script cannot login or the transfer itself failed there is no warnings. Does anyone know the syntax to trap the erorr codes or to put a check within... (3 Replies)
Discussion started by: chlawren
3 Replies

7. AIX

Denying IPaddress for Multiple Failed Login Attempts

Hi. I would like to be able to deny IP address for too many failed login attemps (either from ssh, sftp, ftp, etc). The system I wish this to work on is an AIX 5.1 system. I'm new to AIX but I'm a linux user. There is a program for linux called fail2ban which reads from the log files and see if... (1 Reply)
Discussion started by: metzgerh
1 Replies

8. Solaris

invalid login attempts...

I am wondering if solaris captures id's associated w/invalid login attempts? when I try to login as "test1" several (3-5) times, I do not find any userID info under "/var/adm" files: utmpx wtmpx messages lastlog Is there another location/log I should be checking? Is it necessary for... (6 Replies)
Discussion started by: mr_manny
6 Replies

9. UNIX for Advanced & Expert Users

Maximum 3 login attempts

Hi, I notice in my Sun Solaris 8 sparc workstation, if I failed my login in the 5th time, I will be closed the connection from the host. I want to make 3 times. That is, if user fails to login with 3 attempts, he will be closed the connection. How to do it? Of course I am the admin of the... (2 Replies)
Discussion started by: champion
2 Replies
Login or Register to Ask a Question