How do I get Linux to notify me about failed login attempts?

Question

I have seen it before when you log into a Linux box wrong, when you do successfully log on, it notifies you that someone attempted to log on as you and didn't succeed. What do I need to do to make this happen on my box here?

Answer 1

For SSH in particular, you’ll probably need to make sure logging is enabled in /etc/ssh/sshd_config.

Otherwise, it’s a vague question that depends on how you want to be alerted and the details of your system and its configuration, even how they log in. You could just tail a log file: tail -f /var/log/messages is common or journalctl -f on some Linux systems. One thread of solutions for email alerts is on ServerFault.

On most modern GNU/Linux systems this should get you a digest of every failed attempt with SSH or TTY over the past hour:

journalctl --since="$(date -d -1hours +\%F\ \%H):00:00" --until="$(date +\%F\ \%H):00:00" | grep -iE "Failed (pass|log)"

Actually, that covers the last hour to the current hour. You could crontab a process to retrieve that every hour and email it to you.

Entries would look like:

Mar 21 06:16:23 yourhostname sshd[29477]: Failed password for root from 103.41.125.20 port 35243 ssh2
Mar 21 06:16:33 yourhostname login[317]: FAILED LOGIN 1 FROM tty4 FOR bolwerk, Authentication failure
Mar 21 06:22:29 yourhostname sshd[29695]: Failed password for invalid user poo from ::1 port 60139 ssh2

Here’s a script you can put in crontab to gather that:

#!/bin/sh

# gather journal information in time frame
export CRUFT=$(journalctl --since="$(date -d -1hours +\%F\ \%H):00:00" --until="$(date +\%F\ \%H):00:00" | grep -iE "Failed (pass|log)")

#email settings
export EMAILFROM="From: Security Alert <[e-mail]>"
export EMAILSUBJECT="Subject: Failed login Summaries from $(date -d -1hours +\%H):00 to $(date +\%H):00"
export EMAILALERTTO="[e-mail]"

if [ "x$CRUFT" != "x" ]; then
        echo -e "$EMAILFROM\n$EMAILSUBJECT\n\nFailed logins:\n$CRUFT" | ssmtp "$EMAILALERTTO"
fi

It assumes you want to send out the last hour’s failed attempts every hour. Also assumes you have journalctl, probably requires a GNU userland (most distrobs have that).

To make it work, you will need to configure SSMTP properly. Here is a link that talks about doing that with gmail. Read up on security for SSMTP too; configuring wrong expose your password, if you have a shared system. You may want to include this line in the ssmtp.conf configuration:

FromLineOverride=yes

It will make a digest of failed login events over the past hour and email them to you. On a public network with the standard port, people/bots are constantly trying to brute force insecure boxes. It’s not much of a threat if you set your passwords correctly, etc…

If I might make a general suggestion, successful logins might be more interesting. On a public network with the standard port, people/bots are constantly trying to brute force insecure boxes. It’s not much of a threat if you set your passwords correctly, etc… But putting an alert script of some sort in /etc/profile to catch any successful login would probably be a cinch.

Notes: Here is CentOS documention on journalctl; should be similar on many other GNU/Linux OSes. Other examples of subtracting from date command, depending how you want to time reports.