$ Linux One Liners
Back to commands

Cybersecurity Triage

Read-only, sensitive output

Count Failed SSH Login IPs

You need to rank source IPs from failed SSH login attempts.

Command

sed -n 's/.*Failed password .* from \([0-9.]*\) port.*/\1/p' logs/auth.log | sort | uniq -c | sort -nr

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not block IPs from this output alone without considering NATs, allowlists, and policy.

Expected output

A count-sorted list of source IP addresses from failed SSH attempts.

System impact

Read-only, sensitive output. Nothing changes. The command extracts source IPs and counts repeats.

Recovery / rollback: no state is changed.

When to use it

Use when deciding whether one source is causing most SSH noise.

When not to use it

Do not block IPs from this output alone without considering NATs, allowlists, and policy.

next steps

Related commands

Cybersecurity Triage Sensitive output

Count Failed SSH Login Users

Failed SSH attempts are noisy; grouping users makes the pattern readable.

sed -n 's/.*Failed password for \(invalid user \)\?\([^ ]*\) from .*/\2/p' logs/auth.log | sort | uniq -c | sort -nr
Cybersecurity Triage Sensitive output

Summarize SSH Auth Outcomes

SSH logs get easier to read once accepted and failed methods are counted.

awk '/sshd/ && /Accepted/ {print "accepted", $7} /sshd/ && /Failed password/ {print "failed", "password"} /sshd/ && /Failed publickey/ {print "failed", "publickey"}' logs/auth.log | sort | uniq -c | sort -nr
Cybersecurity Triage Sensitive output

Show Failed SSH Public-Key Users

A failed public-key attempt often points to stale keys or the wrong account.

awk '/Failed publickey/ {print $9, $11}' logs/auth.log | sort | uniq -c | sort -nr
Cybersecurity Triage Sensitive output

Summarize SSH Authorized Key Types

Key inventory gets more useful when old key types stand out.

find /home -path '*/.ssh/authorized_keys' -exec awk '{print $1}' {} + 2>/dev/null | sort | uniq -c | sort -nr
Cybersecurity Triage Read-only

Find the IPs Creating the Most 4xx Noise

One address can turn a normal access log into a wall of failed requests.

awk '$9 ~ /^4/ {count[$1]++} END {for (ip in count) print count[ip], ip}' /var/log/nginx/access.log | sort -nr | head
Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

  • LPIC-1 style command-line practice
  • LFCS style performance-task practice
  • Linux+ style troubleshooting review

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.