failed SSH logins recorded

I see an alert which says

5614 failed SSH logins recorded

Should I take any measures?

You should be able to view the logs at /vay/log/secure

Have you changed the default SSH port, turned off Password Authentication (or at least restricted it to trusted ips) or changed to only allowed Public Key Authentication?

Exactly. SSH brute force attempts are rampant and ongoing. You probably don't think about it but now it's being surfaced to your attention with the alert. I expect it, even on an alternate port so I'm not overly concerned about it. The only real concern is being on a common port and getting DoSed just by the sheer script kiddie hack attempts!

A really good idea: install the maxmind GeoIP and use xt_geoip or whatever in your firewall rules/CSF to only allow ssh/2087 port logins from your own country. Adjust the firewall a littlebit with /etc/csf/csfpost.sh.

This blocks many malignant computers...

use

Code: [Select]

last | head -n 20 to view the last 20 succesfull logins.