How to Review Failed Login Attempts on Ubuntu or AlmaLinux
VPS Servers · Self-help guide
Reviewing failed login attempts helps you understand whether your VPS is receiving suspicious SSH traffic. On Ubuntu, run sudo grep "Failed password" /var/log/auth.log | tail -n 50. On AlmaLinux, run sudo grep "Failed password" /var/log/secure | tail -n 50. You can also use sudo lastb | head if the bad login database is enabled. A few failed attempts are common on public servers, but repeated attempts from many IP addresses may need stronger SSH security. Use strong passwords, SSH keys, and a firewall. Do not publish your SSH port or login details. If you suspect an account was accessed, change passwords and contact support immediately.