See who’s poking your Linux box

If you’re using SSH and you have your ports wide open to the world, your best bet would be to install fail2ban. If you’re curious though as of whom is trying to get in by bruteforcing your SSH passwords, you might get a clear view with the following command:

grep “POSSIBLE BREAK-IN ATTEMPT” /var/log/auth.log

This will verbose a list detailing each break-in attempt that has been made, with the exact date, hour, minute and second of it. It will also display the point of origin of these attempts, in a fashion similar to this one:

Jul 21 13:54:35 brunner sshd[12144]: reverse mapping checking getaddrinfo for 66-195-150-176.static.twtelecom.net [66.195.150.176] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 21 13:54:38 brunner sshd[12146]: reverse mapping checking getaddrinfo for 66-195-150-176.static.twtelecom.net [66.195.150.176] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 21 13:54:42 brunner sshd[12152]: reverse mapping checking getaddrinfo for 66-195-150-176.static.twtelecom.net [66.195.150.176] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 21 13:54:45 brunner sshd[12155]: reverse mapping checking getaddrinfo for 66-195-150-176.static.twtelecom.net [66.195.150.176] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 21 13:54:49 brunner sshd[12163]: reverse mapping checking getaddrinfo for 66-195-150-176.static.twtelecom.net [66.195.150.176] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 21 13:54:52 brunner sshd[12165]: reverse mapping checking getaddrinfo for 66-195-150-176.static.twtelecom.net [66.195.150.176] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 21 13:54:56 brunner sshd[12171]: reverse mapping checking getaddrinfo for 66-195-150-176.static.twtelecom.net [66.195.150.176] failed - POSSIBLE BREAK-IN ATTEMPT!

Read more »