practice task
Review Failed SSH Logins
A public VPS has SSH exposed and you need to see whether failed login attempts are normal background noise or focused guessing against real usernames.
Independent study support only. No affiliation, endorsement, exam dumps, or guaranteed exam results.
Try first
journalctl -u ssh --since today --no-pager | grep 'Failed password'Goal
Summarize recent failed SSH authentication attempts by source IP and username signal.
Expected output
Recent failed SSH login lines showing source IPs, target usernames, and timestamps. On some distributions the unit is sshd instead of ssh.
Teaches
Authentication review needs both the right service name and a time window. Failed attempts become more useful when grouped by IP or username.
Common mistake
Assuming no output means no attempts without checking whether the host uses ssh.service, sshd.service, /var/log/auth.log, or /var/log/secure.
command set
Commands to know
journalctl -u ssh --since today --no-pagerjournalctl -u sshd --since today --no-pagergrep 'Failed password' /var/log/auth.log
Related lessons
Watch this command run
Example output from a temporary Linux lab
Count Failed SSH Users
Review the related command card and compare your expected output with the command replay.
Watch command runShow Successful Logins and sudo
Review the related command card and compare your expected output with the command replay.
Watch command runnext practice
Disk Is Full: Prove Which Filesystem Is Out
A VPS starts returning write errors and an app cannot create new uploads. You need to decide whether the root filesystem, a mounted data volume, or inode exhaustion is the real problem before deleting anything.