How to check failed login attempts?

To check failed login attempts in Linux, you can examine the authentication logs. Here are some common methods:

1. Using the grep Command on Log Files

Most Linux distributions log authentication attempts in the /var/log/auth.log or /var/log/secure file. You can use the grep command to filter for failed login attempts.

• For Debian-based systems (like Ubuntu):

  grep "Failed password" /var/log/auth.log

• For Red Hat-based systems (like CentOS):

  grep "Failed password" /var/log/secure

2. Using the lastb Command

The lastb command shows a list of failed login attempts. It reads from the /var/log/btmp file:

lastb

This command will display the usernames and the times of failed login attempts.

3. Using the faillog Command

The faillog command can be used to display failed login attempts for users:

faillog

This will show a summary of failed login attempts for each user.

Summary

• Use grep to search authentication logs for failed attempts.
• Use lastb to view failed login attempts.
• Use faillog for a summary of failed attempts per user.