Command Line Archives • Page 43 of 77 • Linux Tips

Show Failed SSH Login Attempts

Today’s article is pretty straightforward, I’m going to show you how to show failed SSH login attempts. It should be a pretty short article, as I’m just going to show you two ways for a couple of system types. This is Linux, so there are certainly more ways to go about it, but I’ll show you a couple of them.

Yes, I’ve written about SSH a great deal. It is, in my opinion, one of the greatest remote administration tools ever conceived. But, attackers know this and any public-facing computer, with an IP address that can be reached externally, will be subject to port scanning and intrusion attempts.

I’ve written some SSH security articles, but one of the best things you can do is change the port that SSH uses. This will stop a bunch of malicious intrusion attempts. However, smart hackers will quickly scan for open ports with automated tools. Some of them will inevitably find your SSH port.

These people will then try to login. Securing your SSH is pretty important. I’ve written a few articles, so here’s a search of SSH-related articles previously published. Feel free to browse them at your leisure. I really need to do an article about Fail2Ban, but I haven’t gotten that far yet. One of these days!

So, like I said, you can show failed SSH login attempts. One of the things you can do with this information is scan for commonalities. You can also check to see if the hackers are using a username that already exists. If they’re using a username that already exists, it could be coincidental or it could mean they already have some insider information.

Well then, let’s jump into the article…

Show Failed SSH Login Attempts:

Like oh so many of my articles, and this one involving SSH, you’re going to want an open terminal for this. If you don’t know how to open the terminal, you can do so with your keyboard – just press CTRL + ALT + T and your default terminal should open.

By the way, if you’re this far into the article and don’t know what SSH, it’s ‘secure shell’ and a way to remotely connect to another computer. Basically, you login to a remote computer and then you’re using the remote computer’s terminal. However, you can do so with graphics, you just need to forward x11.

So, it’s a pretty useful tool. I use SSH often, even in my own home. What? It’s faster than walking to another room, and I often test things remotely. SSH makes perfect sense for this sort of stuff.

With your terminal freshly open and properly logged into the remote computer, you can show failed SSH login attempts pretty easily. Like I said, I’ll show you a couple of ways. The first is pretty universal and should work with all but a couple distros:

grep "Failed password" /var/log/auth.log

1	grep "Failed password" /var/log/auth.log

RHEL and CentOS (Fedora too? I have not tested.) may store the data elsewhere, so you can try this command to show failed SSH login attempts:

grep "Failed" /var/log/secure

1	grep "Failed" /var/log/secure

If you have failed SSH login attempts, one of those two commands should show you them. If the first doesn’t work, and you know you have failed attempts, try the second one. The logs are usually stored (as far as I know) in either of those two locations.

Closure:

See? It’s a nice and short article today, just like I said it would be. This time around, we’ve learned how to show failed SSH login attempts. Even if you’re using Fail2Ban and mandating certificate login, it’s always good to check to see what the bad guys are up to.

Thanks for reading! If you want to help, or if the site has helped you, you can donate, register to help, write an article, or buy inexpensive hosting to start your own site. If you scroll down, you can sign up for the newsletter, vote for the article, and comment.

Check System Information With uname

In today’s article, we’re going to show you how to check system information with uname. This is a pretty handy command to have in your toolbox, and it’s really simple to use.

Once again, I’ll probably not cover every option, but only show you the commands I think you’ll find most useful. This should be both quick and easy enough for anyone to understand. Even a rank beginner should be able to follow along.

If you’ve ever asked a question on a forum, you may have been asked to show the output of the ‘uname -a‘ command. That’s a fine generic command to run, but you don’t have to output all that information. This could come in handy when you’re scripting and only need some of the information.

We’ll be using the uname command, as you might have guessed. According to the man page, the command defines itself as:

uname – print system information

That’s a pretty accurate definition and, sure enough, matches the headline and the introductory paragraph. Like I said, we’ll be collecting system information with uname. There’s not much more to it, so let’s just jump into the article.

Check System Information with uname:

This article requires an open terminal, like many other articles on this site. If you don’t know how to open the terminal, you can do so with your keyboard – just press CTRL + ALT + T and your default terminal should open.

In it’s basic usage, the uname command can be run without any modifiers at all. To do so, simply type the following to get the system’s name:

uname

uname

The output of that will almost certainly just say ‘Linux’. Handy!

Ah, but the uname command can do so much more. Want to know if you’re using 32 or 64 bit, the architecture? Easy enough, just use:

uname -m

uname -m

Would you like to use uname to check your kernel version? Try this command:

uname -v

uname -v

If you want to know your kernel release, that is the specific release you’re using at the moment, you need the -r flag. Try this:

uname -r

uname -r

Want to know the name of the network? Amazingly enough, that would require you using the -n flag. So it looks like:

uname -n

uname -n

Finally, as I mentioned in the intro, there’s the granddaddy of uname commands, which will output all the information you really need. Sure enough, it’s accomplished with the -a flag:

uname -a

uname -a

As you can see, the flags mostly make sense for this command. Because of this, they should be easy to remember when you need to recall system information with the uname command. To see the complete manual, use the man uname command.

Closure:

Well, that’s yet another article. I hope you liked reading it as much as I enjoy typing these silly things out. It’s probably time to do a meta article soon – as I’m really itching to do so. There have been some pretty good changes. So, that’ll be a fun article to write and I may do so soon.

Some Useful Ways To Use The Touch Command In Linux

In today’s article, we’re going to learn some useful ways to use the touch command. It’s not a complete listing of options, it’s just the commands that I think you’re most likely to find useful when using said touch command. This won’t be all that difficult to process, even for a new Linux user.

It pains me to not give this a witty, clickbait title. Though, it does remind me of a story. I think I’ll share it…

So, I was on the Interstate. At the time, my weekend was partially filled up by playing in a Top-40 band. That explains why I had pop radio on the FM radio we all used back then. I was driving along and on came this song for the first time, or at least my first time hearing it.

Yes, the Divinyls song, I Touch Myself. I laughed so hard that I had to pull off to the breakdown lane. I didn’t even notice the cop pull up until he flashed his lights and used his cruiser’s bullhorn thing to tell me that it was an emergency lane and to move on. He didn’t even check if I had an emergency, he just told me to move on. Maybe he too was listening to pop radio at the time?

So, I just want you to know how hard it was for me to *not* use a ‘witty’ article title. You’re welcome. As I often say, I’m pretty much just a giant 5 year old.

Anyhow, like I said in the beginning, this is going to be some useful ways to use the touch command in Linux. Read on!

The Touch Command:

The touch command is a terminal only thing, so you’ll need an open terminal to follow this article. If you don’t know how to open the terminal, you can do so with your keyboard – just press CTRL + ALT + T and your default terminal should open.

As I said, this isn’t going to be a complete listing of touch commands, it’s just the most useful – or those I think you’ll find the most useful. If you want a complete list, just run man touch in your terminal and all shall be revealed.

So, you’re mostly going to use the touch command to create files. You can create files with touch by using the following:

touch <file_name>

1	touch <file_name>

Or create multiple files with:

touch <file_name> <file_name> <file_name>

1	touch <file_name> <file_name> <file_name>

I suspect many of you know about that, but there’s more to touch! Quite a bit more, actually. It’s a handy commend for other things, like mucking about with timestamps.

Want to create a file – but not make the file if the filename already exists (handy for scripting)? You can do that. The command would be:

touch -c <file_name>

1	touch -c <file_name>

Want to change a file’s modification and access time? You can do that with the -a flag, which will change both to the current date and time:

touch -a <file_name>

1	touch -a <file_name>

If you want to change just the modification time, use the -m flag.

Now, you can also specify a specific access and modification time, so that you’re not just setting it to the current date and time. It’s not too complicated. It looks like this:

touch -t YYMMDDHHMM.SS <file_name>

1	touch -t YYMMDDHHMM.SS <file_name>

That’s YEAR, MONTH, DAY, HOUR, MINUTE, and SECOND. So, a fairly universal time and date format, something you may know from other commands.

You can also just tell touch to use the timestamp from another file. That’s done with:

touch -r <file_1> <file_2>

1	touch -r <file_1> <file_2>

In the above case, the command will set the timestamp of <file_1> to that of <file_2>. Pretty handy, huh?

Again, there’s more to the touch command. To learn more, just type man touch into your terminal and you’ll see the various other options. These are just a few of the options that I’ve used, those that I think are the most useful. It’s a great way to expose newer users to some of the nifty terminal commands available in their Linux systems.

Closure:

And there you have it. You now have an article that helps you learn how to use the touch command in Linux. It’s a handy command and it does more than just make files. We’ve actually used the touch command in exercises before, so it’s nice to see what other options are available. Also, as tempting as it was, I didn’t use any puns or innuendo in the article. You’re welcome!

How To: Check For Bad Sectors On Your Disks

Today, we’re going to examine one way to check for bad sectors on your disks. Once again, it won’t be a particularly taxing article, but it’s something everyone should know how to do. This being Linux, I’m sure there are alternative tools.

Hard drives, from spinning platter to solid-state, are divided into sectors. Sometimes, these sectors go bad. The disk’s software manages this to some extent, and actually has more space available than listed so that it can make up for bad sectors as time passes.

But, you still get bad sectors. It’s just the nature of the game, and no disk drive is immune to this. All you can do is accept them and, in some cases, repair them.

See, there are two types of bad sectors. The first is a hard bad sector, which is hardware related and can’t be fixed. The second is a soft bad sector, which is a software issue and it can be fixed. I’ll someday write an article about how to fix soft bad sectors, but I won’t bother getting into that today.

With all that in mind, the tool we’ll be using is appropriately named ‘badblocks’, which describes itself thus:

badblocks – search a device for bad blocks

Badblocks has a variety of uses, so you can always get a head start on this article by reading the man page.

man badblocks

1	man badblocks

So, with that already covered, let’s just jump into the article.

Check For Bad Sectors:

With your terminal now open, you should probably identify your drives with the following command:

sudo fdisk -l

1	sudo fdisk -l

The output of this may look a bit like this:

You can see your drive’s identification with the output of fdisk -l.

As you can see, it’s listed as /dev/<device_ID> and that’s the information you want to hold onto.

Sometimes, it’s a lot more complicated, and will look something like this:

As you can see, they’re all start with ‘dev/sd*‘ and end up as /dev/<device_ID>. The system I ran badblocks on is quite a bit more complicated than the output from the laptop I used in the first instance.

Now, you want to scan your individual device to check the for bad sectors. That’s actually just a simple command. You can use:

sudo badblocks -v /dev/<device_ID>

1	sudo badblocks -v /dev/<device_ID>

The -v ensures the output is verbose and sent to the screen. You can also write that data to a text file for reference. To do that, you just use a command similar to this:

sudo badblocks -v /dev/<device_ID> > badblocks.txt

1	sudo badblocks -v /dev/<device_ID> > badblocks.txt

Then, you’ll have a badblock.txt file you can refer to, showing you information about any bad blocks. I wanted to show you the output from a disk with bad blocks, but I don’t appear to have any to show you. I tried quite a few, but it was a no-go. Ah well… You’ll figure it out easily enough. It’s not even a little hard to check for bad sectors!

Closure:

Yup… You have another article. This time you learned how to check for bad sectors, a pretty handy tool – especially if you’re finding corrupt files on your disks. If you are facing corrupt files, this would be the first step I’d suggest taking.

Anyhow, the show does go on and you got a new article. I am more or less feeling just fine now, just some lethargy and not a whole lot of energy. Sweet!

How To: Check Disk Usage With ‘df’

In today’s article, we’re going to do exactly what the title suggests; we’re going to check disk usage with ‘df’. This means we’ll be checking disk usage in the terminal. Seeing as ‘df’ is included with every distro on the planet (I’m pretty sure) it means this won’t be all that complicated.

I am still a bit under the weather, but the show must go on! I’ve gone this long without missing a publication date, so I might just as well keep the streak up.

As the title suggests, we’ll be using ‘df’ to check disk usage. This will already be installed as one of the default tools, so you won’t need to install it. That’ll save some time! If you’re curious, the ‘df’ tool describes itself as:

df – report file system disk space usage

If you want to get a head start, you can check the help page. To do that, you’ll want to run:

dh --help

dh --help

If you’re like to check the version, the command is:

df --version

1	df --version

So, with that in mind, let’s just jump into the article.

Check Disk Usage With ‘df’:

Obviously, this is yet another article where we’re learning about doing things in the terminal. That means you’ll need an open terminal. If you don’t know how to open the terminal, you can do so with your keyboard – just press CTRL + ALT + T and your default terminal should open.

With your terminal now open, you can just run the command by itself:

df

In some cases, it will throw an error and not be able to read everything. That’s usually easily resolved. Just run the command as a privileged user. So that would look like:

sudo df

sudo df

Now, you can use that output to do a bunch of math, or just pay attention to the percentages. Or, if you’re wanting, you can use the -h flag and get the output in human-readable format. That looks like:

sudo df -h

1	sudo df -h

The output of which might look a little something like this:

the output of sudo df -h — See? No errors and it is nice and readable! You can’t go wrong with that!

As you can see in the picture, I’m only using less than half of my available disk space. I don’t need to worry about running out of space any time soon, but if it gets low I can always check disk usage with ‘df’. Also, it doesn’t matter what directory you’re in when you run the command. As you can see, it runs just fine while in the Downloads directory.

I also wrote an article about using GUI methods to visualize disk space usage. You might prefer one of those methods, but you can always just use the terminal to check disk space.

Closure:

It seemed like a good idea to do a quick article tonight. I’m watching IMSA’s last race of the season and feeling poorly, so hopefully I get some sleep at a reasonable hour. Still, as I mentioned, the show must go on. The site has had a new article every other day for quite a while. I might as well keep up the schedule.