Ravi Sir's Cyber Security Cards › Interview Cards
Scenario: Sahyadri Traders Pune EC2 shows thousands of failed SSH attempts. What do you do?
Scenario: Sahyadri Traders Pune EC2 shows thousands of failed SSH attempts. What do you do? Treat it as an active brute-force attack on SSH. Check if any login succeeded in /var/log/secure. Restrict the security group to known IPs. Confirm password login is off (key-only). Add fail2ban. “First I che
Read card text
What this card says
Short answer
Treat it as an active brute-force attack on SSH.
Steps
Check if any login succeeded in /var/log/secure.
Restrict the security group to known IPs. Confirm password login is off (key-only). Add fail2ban.
Say it in the interview
“First I check for a successful login after the failures, then I lock the security group to known IPs and confirm key-only SSH.”
Why it matters
Thousands of failures are normal. A success after them is the real emergency.
Learn more in the lesson: 46.10 Scenario Round — Sahyadri / Raja-Rani