Failed SSH logins (7 days)
medium on-server
What it inspects
The systemd journal for sshd over the last 7 days: `journalctl _COMM=sshd --since '7 days ago'`, counting lines that match `Failed password` or `Invalid user`. 1 to 49 passes, 50 to 499 warns, 500 or more fails. A count of 0 is reported as skipped (grep -c exits non-zero when nothing matches), not as a pass. It needs root and systemd-journald; systems that log only to /var/log/auth.log are skipped.
Why it matters
Any server with SSH on the internet is probed continuously, so some failures are normal. A high volume means attackers are spending time guessing credentials, and one persistent source can eventually succeed against a weak password. Automatic banning of repeat offenders keeps the noise down and makes real attacks easier to spot.
How to verify
sudo journalctl _COMM=sshd --since '7 days ago' --no-pager | grep -cE 'Failed password|Invalid user'How to fix
Install fail2ban with the sshd jail so repeat offenders are banned, then look at where the failures come from. The count covers a rolling 7 days, so it falls gradually rather than at once.
Install fail2ban and enable the sshd jail
Debian / Ubuntu
# If sshd listens on a port other than 22, also add: port = <that port> under [sshd] below.
apt-get install -y fail2ban python3-systemd
install -m 0644 /dev/stdin /etc/fail2ban/jail.d/umbermark-sshd.local <<'EOF'
[DEFAULT]
# Add your own admin IP(s) here so you cannot ban yourself, e.g. ignoreip = 127.0.0.1/8 ::1 203.0.113.7
ignoreip = 127.0.0.1/8 ::1
[sshd]
enabled = true
backend = systemd
EOF
systemctl enable fail2ban
systemctl restart fail2ban
# The server needs a moment to open its socket after a restart; wait for it (at most about 15 seconds).
for _ in $(seq 1 15); do fail2ban-client ping >/dev/null 2>&1 && break; sleep 1; done
fail2ban-client status sshd
RHEL / Rocky / Alma / Fedora
# epel-release exists on Rocky/Alma/CentOS Stream; on RHEL itself enable EPEL first (see the Fedora EPEL docs).
# If sshd listens on a port other than 22, also add: port = <that port> under [sshd] below.
. /etc/os-release; [ "$ID" = fedora ] || dnf install -y epel-release
dnf install -y fail2ban python3-systemd
install -m 0644 /dev/stdin /etc/fail2ban/jail.d/umbermark-sshd.local <<'EOF'
[DEFAULT]
# Add your own admin IP(s) here so you cannot ban yourself, e.g. ignoreip = 127.0.0.1/8 ::1 203.0.113.7
ignoreip = 127.0.0.1/8 ::1
[sshd]
enabled = true
backend = systemd
EOF
systemctl enable fail2ban
systemctl restart fail2ban
# The server needs a moment to open its socket after a restart; wait for it (at most about 15 seconds).
for _ in $(seq 1 15); do fail2ban-client ping >/dev/null 2>&1 && break; sleep 1; done
fail2ban-client status sshd
- Look at who is failing and narrow exposure
1 more step in the Fix Pack. See pricing