Display IP : Count of failed login attempts

sudo lastb | awk '{if ($3 ~ /([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}/)a[$3] = a[$3]+1} END {for (i in a){print i " : " a[i]}}' | sort -nk 3
The lastb command presents you with the history of failed login attempts (stored in /var/log/btmp). The reference file is read/write by root only by default. This can be quite an exhaustive list with lots of bots hammering away at your machine. Sometimes it is more important to see the scale of things, or in this case the volume of failed logins tied to each source IP. The awk statement determines if the 3rd element is an IP address, and if so increments the running count of failed login attempts associated with it. When done it prints the IP and count. The sort statement sorts numerically (-n) by column 3 (-k 3), so you can see the most aggressive sources of login attempts. Note that the ':' character is the 2nd column, and that the -n and -k can be combined to -nk. Please be aware that the btmp file will contain every instance of a failed login unless explicitly rolled over. It should be safe to delete/archive this file after you've processed it.
Sample Output
60.199.114.37 : 201
61.138.243.20 : 201
61.29.147.194 : 201
85.214.156.73 : 203
49.212.14.80 : 205
182.48.40.57 : 206
221.2.208.70 : 209
211.110.11.230 : 213
216.240.145.212 : 215
174.120.212.130 : 218
223.4.90.136 : 218
61.132.255.107 : 219
101.109.19.52 : 221
186.9.110.255 : 221
189.163.207.98 : 221
163.43.164.215 : 224
113.108.103.11 : 231
209.190.29.35 : 234
211.27.225.183 : 235
190.196.31.100 : 236
117.211.123.226 : 241
200.60.129.135 : 241
89.255.19.59 : 245
222.87.204.14 : 246
91.205.189.27 : 262
146.232.78.194 : 264
184.106.129.38 : 264
177.135.238.130 : 267
211.9.42.225 : 275
119.84.84.110 : 276
66.201.54.10 : 277
41.76.192.19 : 278
184.172.222.11 : 284
183.5.49.139 : 286
91.205.189.15 : 290
195.38.96.144 : 292
143.128.82.204 : 293
220.172.191.31 : 293
89.137.168.107 : 294
117.16.42.35 : 296
222.168.102.78 : 297
96.126.98.41 : 298
109.169.64.136 : 303
184.107.115.194 : 303

These Might Interest You

  • Searches the /var/log/secure log file for Failed and/or invalid user log in attempts. Show Sample Output


    8
    cat /var/log/secure | grep sshd | grep Failed | sed 's/invalid//' | sed 's/user//' | awk '{print $11}' | sort | uniq -c | sort -n
    empulse · 2009-03-30 15:48:24 7
  • A variation of a script I found on this site and then slimmed down to just use awk. It displays all users who have attempted to login to the box and failed using SSH. Pipe it to the sort command to see which usernames have the most failed logins. Show Sample Output


    10
    awk '/sshd/ && /Failed/ {gsub(/invalid user/,""); printf "%-12s %-16s %s-%s-%s\n", $9, $11, $1, $2, $3}' /var/log/auth.log
    frailotis · 2009-04-16 00:56:23 0
  • Show the number of failed tries of login per account. If the user does not exist it is marked with *. Show Sample Output


    23
    sudo zcat /var/log/auth.log.*.gz | awk '/Failed password/&&!/for invalid user/{a[$9]++}/Failed password for invalid user/{a["*" $11]++}END{for (i in a) printf "%6s\t%s\n", a[i], i|"sort -n"}'
    point_to_null · 2009-03-21 06:41:59 2
  • AIX user administration whithout smitty


    0
    chsec -f /etc/security/lastlog -a "unsuccessful_login_count=0" -s 'aix user'
    snaguber · 2010-03-12 09:28:36 0

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands



Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: