Display IP : Count of failed login attempts

sudo lastb | awk '{if ($3 ~ /([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}/)a[$3] = a[$3]+1} END {for (i in a){print i " : " a[i]}}' | sort -nk 3

The lastb command presents you with the history of failed login attempts (stored in /var/log/btmp). The reference file is read/write by root only by default. This can be quite an exhaustive list with lots of bots hammering away at your machine. Sometimes it is more important to see the scale of things, or in this case the volume of failed logins tied to each source IP. The awk statement determines if the 3rd element is an IP address, and if so increments the running count of failed login attempts associated with it. When done it prints the IP and count. The sort statement sorts numerically (-n) by column 3 (-k 3), so you can see the most aggressive sources of login attempts. Note that the ':' character is the 2nd column, and that the -n and -k can be combined to -nk. Please be aware that the btmp file will contain every instance of a failed login unless explicitly rolled over. It should be safe to delete/archive this file after you've processed it.

Sample Output

60.199.114.37 : 201
61.138.243.20 : 201
61.29.147.194 : 201
85.214.156.73 : 203
49.212.14.80 : 205
182.48.40.57 : 206
221.2.208.70 : 209
211.110.11.230 : 213
216.240.145.212 : 215
174.120.212.130 : 218
223.4.90.136 : 218
61.132.255.107 : 219
101.109.19.52 : 221
186.9.110.255 : 221
189.163.207.98 : 221
163.43.164.215 : 224
113.108.103.11 : 231
209.190.29.35 : 234
211.27.225.183 : 235
190.196.31.100 : 236
117.211.123.226 : 241
200.60.129.135 : 241
89.255.19.59 : 245
222.87.204.14 : 246
91.205.189.27 : 262
146.232.78.194 : 264
184.106.129.38 : 264
177.135.238.130 : 267
211.9.42.225 : 275
119.84.84.110 : 276
66.201.54.10 : 277
41.76.192.19 : 278
184.172.222.11 : 284
183.5.49.139 : 286
91.205.189.15 : 290
195.38.96.144 : 292
143.128.82.204 : 293
220.172.191.31 : 293
89.137.168.107 : 294
117.16.42.35 : 296
222.168.102.78 : 297
96.126.98.41 : 298
109.169.64.136 : 303
184.107.115.194 : 303

By: sgowie

2012-09-11 14:51:10

awk lastb sort sudo Security Linux sort awk login arch linux lastb

Submit An Alternative

What Others Think

rahimhh21 · 40 weeks and 2 days ago

Perfecthomepugs · 31 weeks and 2 days ago

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Similar Commands

display IP addresses with 5 or more unsuccessful login attempts today

Find brute force attempts on SSHd

Displays the attempted user name, ip address, and time of SSH failed logins on Debian machines

AIX : one liner to reset failed login count for 'aix user'

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

» all commands
» commands with 3 up-votes (commandlinefu3)
» commands with 10 up-votes (commandlinefu10)