Who's trying to break in to your Linux box?
Fun with pipes! Just a quick Bash snippet for getting a good look at who’s attempting to log in to your Linux or other standard GNU system:
#shell> lastb -w | sort | awk '{print $1, "\t", $3}' | uniq | less
Here’s a quick summary of what’s going on here:
lastb reads and echoes the contents of the failed login database, generally located at /var/log/btmp. The -w flag just ensures it doesn’t ellipse or otherwise cut-off the username field.
sort very simply sorts the output of lastb alphabetically.
This awk snippet prints the 1st and 3rd columns of the sorted lastb output, which are username and source address respectively, separating them with a tab for ease of reading.
uniq gets rid of any duplicate entries, but only if they are on adjacent lines. This is another reason we used sort earlier.
Finally, less is just a decent file reader. Feel free to replace with output redirection to a file.
And the output. IP addresses randomised to defend the privacy of my attackers:
123456 89.101.45.51
123 89.101.45.51
1 63.200.120.14
2014 63.200.120.14
2015 63.200.120.14
2 63.200.120.14
aaa 63.200.120.14
aaron 63.200.120.14
aa 63.200.120.14
abc123 17.252.186.40
abc123 42.22.165.211
abc123 mail2.example.website.ru
…plus your typical number of root, admin, test, oracle and mysql attempts. Can’t quite explain the xxxxxxxxxxxxxxxxxx attempt though.