Find out who's trying to break into your box

**Rob** · 11-09-2011, 11:49 AM

The /var/log/btmp file shows you failed logins. you can use last to read it:

Code:

last -f /var/log/btmp

or simply just use lastb

Code:

lastb

Then spice it up a little bit ...

Show the top 10 IPs with failed logins (first column is failed # of tries, then 2nd column is the IP)

Code:

lastb | awk '{print $3}' | sort | uniq -c | sort -rn | head -10

Show the top 10 usernames with failed logins

Code:

lastb | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

**gcawood** · 11-09-2011, 02:05 PM

by default:
`last` uses /var/log/wtmp (shows a list of users who logged in)
`lastb` uses /var/log/btmp (shows bag login attempts)

**MustangV10** · 11-11-2011, 03:10 PM

That's quite interesting I think..CSF/WHM notifies me of failed login attempts already though.

**DaReaper** · 05-02-2012, 09:15 AM

Quite impressive terminal code there! Two months ago i noticed through my Kloxo's lxguard logs, i noticed around 200+ login failed attempts from different IP's. I could have never thought that a host not advertised a lot would attract so much intrusion.

Glad there are stuff to detect these and block them out.

**scotty** · 05-07-2012, 10:51 AM

Yeah its important to check for bad logins, you may look and think, oh well at least they are not getting in, but it could easily be a DDoS. Linux logs are just awesome,

**DaReaper** · 05-07-2012, 11:20 AM

Originally Posted by scotty

Yeah its important to check for bad logins, you may look and think, oh well at least they are not getting in, but it could easily be a DDoS. Linux logs are just awesome,

I had a question in mind when you mentioned about DDoS. Do Dos deflators really works that well when it comes to such situations? There could be different kind of attacks. I've noticed that HTTP attacks from few IP's are much easier to stop than TCP.

**Darwin** · 05-08-2012, 08:58 AM

Originally Posted by DaReaper

I had a question in mind when you mentioned about DDoS. Do Dos deflators really works that well when it comes to such situations? There could be different kind of attacks. I've noticed that HTTP attacks from few IP's are much easier to stop than TCP.

It would depend on the size of attack - I have been on the other end of such a DDoS which was huge, the deflators did not hold firm. Anyhow since I have had no such problems. So they could be working.

Thread: Find out who's trying to break into your box

Thread Tools

Display