SSH servers (OpenSSH)

Any server with port 22 open gets thousands of password guesses a day. These recipes report the addresses behind them. If you run fail2ban, use the fail2ban integration instead; it is tidier.

Systemd distributions (Debian, Ubuntu, RHEL, Fedora, Arch)

Reports every address with five or more failed logins in the last hour:

journalctl _COMM=sshd --since "1 hour ago" | grep -oE 'Failed password for .* from [0-9a-fA-F.:]+' | awk '{print $NF}' | sort | uniq -c | awk '$1>=5{print $2}' | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=ssh,brute-force -d comment="sshd: repeated failed logins"

Systems with /var/log/auth.log or /var/log/secure

grep "Failed password" /var/log/auth.log | grep -oE 'from [0-9a-fA-F.:]+' | awk '{print $2}' | sort | uniq -c | awk '$1>=5{print $2}' | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=ssh,brute-force

On RHEL and derivatives the file is /var/log/secure.

Run it every hour

1. Save the command as /usr/local/bin/report-ssh, with #!/bin/sh and ISIPSAFE_KEY=sl_your_key_here at the top, and make it executable with chmod +x.
2. Add it to root's crontab (sudo crontab -e):

   0 * * * * /usr/local/bin/report-ssh

Overlapping runs are harmless: the same reporter can only report an address once every 15 minutes.

Also catch invalid users

Bots often try usernames that do not exist. Add -e 'Invalid user .* from' to the grep to catch those too.

Need a hand?

If something here does not work with your version of SSH servers (OpenSSH), or you have improved it, tell us. We update these pages with what people send.

SSH servers (OpenSSH) and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.