Ravindra BagaleCourses & study guides Track your progress

Guides

How to Check Failed SSH Logins on Linux (journalctl)

By , Cyber Security trainer LinkedIn Published: Last updated:

On modern Linux, failed SSH attempts show up in the journal. Run sudo journalctl -u ssh -u sshd --since "24 hours ago" | grep -i "failed\|invalid" (unit name varies). Count noisy IPs, then block or rate-limit them. Prefer SSH keys and Fail2ban.

Quick answer

sudo journalctl -u ssh --since "24 hours ago" | grep -iE "failed|invalid|authentication failure" | tail
sudo lastb | head   # may need auth from btmp

Why watch failed SSH logins?

Public port 22 attracts bots. Most fails are noise. A sudden success from a new country is not. Tom in London and Sneha in Kolhapur both start Monday with a one-minute journal check.

What are you looking for?

Lines like Failed password, Invalid user, or authentication failure. Also Accepted publickey / Accepted password for successes.

How do I check step by step?

  1. Find the unit name: 
    systemctl list-units --type=service | grep -E 'ssh|sshd'
    sshd.service    loaded active running OpenSSH server daemon

    What it means: On this host the unit is sshd. On Ubuntu it is often ssh.

  2. List fails for 24 hours: 
    sudo journalctl -u sshd --since "24 hours ago" | grep -iE "Failed password|Invalid user" | tail -n 5
    Failed password for root from 203.0.113.50 port 53822 ssh2
Invalid user oracle from 198.51.100.9 port 41110 ssh2

    What it means: Bots tried root and a fake oracle user. Expected on an open SSH port.

  3. Top source IPs: 
    sudo journalctl -u sshd --since "24 hours ago" | grep -oE 'from [0-9.]+' | sort | uniq -c | sort -nr | head

    What it means: Shows which IPs knock most. Candidates for a firewall rich rule or Fail2ban.

  4. Recent successes: 
    sudo journalctl -u sshd --since "7 days ago" | grep -i "Accepted"

    What it means: Every Accepted line should be you or a known admin IP.

  5. Harden: disable password auth when keys work; install Fail2ban; limit CIDRs in the cloud security group.

Ravindra Bagale's Tip

Bots will knock forever. Do not panic at volume — panic at a successful login you did not make. Omar in Cairo pairs journal checks with Fail2ban and key-only SSH.

Quick quiz: check what you learned

  1. Where do modern Amazon Linux / Fedora systems store SSH auth failures?

    1. The systemd journal via journalctl
    2. Only on a public Twitter feed
    3. Inside the /etc/passwd password file
    4. In the server BIOS setup screens
    Show answer

    A. journalctl -u sshd shows SSH daemon messages.

  2. You see hundreds of failed root logins from one IP. Next step?

    1. Investigate immediately and rotate keys
    2. Ignore it and hope the bot stops
    3. Delete journald to hide the noise
    4. Open more ports to the public internet
    Show answer

    A. Block the IP, ensure key-only auth, consider fail2ban.

Learn it properly

This guide is the short path. These pages go deeper, with labs:

Frequently asked questions

How do I see failed SSH logins?

sudo journalctl -u ssh --since "today" | grep -i failed (use sshd on Amazon Linux).

What is lastb?

Shows bad login attempts from /var/log/btmp. Needs root.

Are thousands of fails normal on a public IP?

Common. Still restrict who can reach port 22.

What if I see a success from an unknown IP?

Treat it as an incident: rotate keys, check users, review auth logs.

Related guide?

Fail2ban SSH protection on this site.