practice task

Review Failed SSH Logins

A public VPS has SSH exposed and you need to see whether failed login attempts are normal background noise or focused guessing against real usernames.

Independent study support only. No affiliation, endorsement, exam dumps, or guaranteed exam results.

Try first

journalctl -u ssh --since today --no-pager | grep 'Failed password'

Goal

Summarize recent failed SSH authentication attempts by source IP and username signal.

Expected output

Recent failed SSH login lines showing source IPs, target usernames, and timestamps. On some distributions the unit is sshd instead of ssh.

Teaches

Authentication review needs both the right service name and a time window. Failed attempts become more useful when grouped by IP or username.

Common mistake

Assuming no output means no attempts without checking whether the host uses ssh.service, sshd.service, /var/log/auth.log, or /var/log/secure.

check your answer

Answer key

What should your command prove?

Recent failed SSH login lines showing source IPs, target usernames, and timestamps. On some distributions the unit is sshd instead of ssh.

How to explain it

Authentication review needs both the right service name and a time window. Failed attempts become more useful when grouped by IP or username.

What to avoid

Assuming no output means no attempts without checking whether the host uses ssh.service, sshd.service, /var/log/auth.log, or /var/log/secure.

command set

Commands to know

journalctl -u ssh --since today --no-pager
journalctl -u sshd --since today --no-pager
grep 'Failed password' /var/log/auth.log

answer check

Compare expected output

Open these command examples to compare your answer against realistic output.

next practice

Disk Is Full: Prove Which Filesystem Is Out

A VPS starts returning write errors and an app cannot create new uploads. You need to decide whether the root filesystem, a mounted data volume, or inode exhaustion is the real problem before deleting anything.