Labs · Cyber Security

Lab: Read Your Server's SSH Login Log with journalctl and grep, and Spot Failed Login Attempts

By Ravindra Bagale · Last updated: 8 October 2026

Suppose we are…

Suppose we have joined the HCLTech SOC (Security Operations Centre) as a trainee analyst. The client says: "Our Linux server feels slow; is someone attacking it?" Before any expensive tool, we read the SSH log, the record of every login attempt. On the internet, bots try usernames like admin, test and oracle all day. We learn to see them on our own server.

Goal of this lab

By the end you will have:

• Read SSH log lines and understood Failed password, Invalid user and Accepted publickey.
• A count of failed attempts per IP address, sorted from most to least.
• Confirmed that the only successful login is yours.

What you need (all free)

• Your own Linux server: a free-tier EC2 Amazon Linux 2023 instance (Lab 4) or an Ubuntu VM. For more log lines, a server that has been running for a few hours is best.
• 25–30 minutes.

Steps

1. SSH to your server. On Amazon Linux 2023 the SSH log is in the system journal. Show the last 30 SSH lines:

   sudo journalctl -u sshd --no-pager | tail -n 30
   

   On Ubuntu use sudo journalctl -u ssh --no-pager | tail -n 30 or sudo tail -n 30 /var/log/auth.log.

   👁 What you should see: lines with a date, the host name, sshd[1234]: and a message.

2. Find your own successful login:

   sudo journalctl -u sshd --no-pager | grep "Accepted"
   

   👁 What you should see: Accepted publickey for ec2-user from 49.36.12.80 port 51544 ssh2 with your home IP.

3. Find failed attempts. Two kinds matter: wrong password for a real user, and a username that does not exist:

   sudo journalctl -u sshd --no-pager | grep -E "Failed password|Invalid user"
   

   If your security group allows SSH only from My IP (Lab 4), you may see nothing. That is the point of My IP! To get practice lines, from your own laptop try once with a wrong user: ssh -i lab-key.pem wronguser@<server-ip> and run step 3 again.

4. Count failed attempts per IP. awk picks a column, sort | uniq -c counts, sort -rn sorts by count:

   sudo journalctl -u sshd --no-pager | grep "Invalid user" | grep -oE "from [0-9.]+" | awk '{print $2}' | sort | uniq -c | sort -rn | head
   

   👁 What you should see: lines like 3 49.36.12.80: the number of attempts and the IP. grep -oE "from [0-9.]+" cuts out only the words "from 49.36.12.80", and awk '{print $2}' keeps the second word, the IP.

5. List which usernames were tried:

   sudo journalctl -u sshd --no-pager | grep "Invalid user" | awk '{print $8}' | sort | uniq -c | sort -rn
   

6. Check that password login is switched off (Amazon Linux 2023 default):

   sudo sshd -T | grep -E "passwordauthentication|permitrootlogin"
   

   👁 What you should see: passwordauthentication no and permitrootlogin with no or prohibit-password. With these, password-guessing bots cannot succeed.

7. Look at only today's log, which is faster on a busy server: sudo journalctl -u sshd --since today --no-pager | grep -c "Invalid user" (-c prints only the count).

8. Write a 3-line note like a SOC analyst: number of failed attempts, top IP and usernames tried, and "only successful login: ec2-user from my IP".

Common mistakes

Self-check checklist

Try-at-home challenge

Make a one-line command that prints only the unique IPs that ever logged in successfully. If any IP is not yours, what are your first three actions?

sudo journalctl -u sshd --no-pager | grep "Accepted" | grep -oE "from [0-9.]+" | awk '{print $2}' | sort -u

Samjla ka? Failures knock, Accepted enters; grep, awk, sort and uniq tell the story. Aata pudhe jaauya: Chapter 7 installs a web server.