SSH brute-force attacks: how to detect and block them

Open the authentication log of any server exposed to the Internet and you will see the same thing: hundreds, often thousands of SSH login attempts per day, with usernames like root, admin, ubuntu, test or oracle.

This is a brute-force attack: bots try username and password combinations hoping to hit the right one.

How to see the attempts on your server

On Debian and Ubuntu with systemd:

sudo journalctl -u ssh --since "24 hours ago" | grep -E "Failed password|Invalid user" | wc -l

To list the most active IP addresses:

sudo journalctl -u ssh --since "24 hours ago" \
  | grep -oE "from ([0-9]{1,3}\.){3}[0-9]{1,3}" | sort | uniq -c | sort -rn | head

A few dozen attempts is the normal background noise of the Internet. If the same address shows up hundreds of times, or if attempts target accounts that really exist on your server, the attack is more targeted.

Why it is dangerous even with strong passwords

• One weak account is enough: a forgotten test account, a user created by a contractor, a reused password.
• Leaked credentials: bots test combinations taken from real data breaches.
• Load: thousands of connections consume resources and bury important events in the logs.

The four measures that are enough

1. Forbid passwords

In /etc/ssh/sshd_config:

PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

With key-only authentication, brute force becomes pointless: there is no password left to guess. Check that your key works before restarting the service, in a second open session.

2. Forbid root

PermitRootLogin no

Bots target root first. Log in with a named account, then use sudo.

3. Ban automatically

A banning tool reads logs continuously and blocks at the firewall any address that fails several times in a short period. A good configuration:

• 5 failures in 10 minutes: ban for 10 minutes to 1 hour;
• repeat offenders: an address banned several times in a day is banned for several days;
• allowlist: your own fixed addresses, so you never lock yourself out.

4. Limit exposure

If your team connects from known addresses, open SSH only to them at the firewall. Otherwise, a non-standard port reduces log noise, without being protection in itself.

Monitor over time

The measures above block the attack. Monitoring tells you whether something changed:

• the number of attempts suddenly increases;
• attempts now target your real usernames;
• a successful login appears from an unusual country;
• a new key appears in an authorized_keys file.

These signals deserve an alert. The rest can be summarized in a daily report.

Frequently asked questions

Is changing the SSH port enough?

No. It reduces automated attempts, but a port scan finds the new port in seconds. It is a complement, not protection.

Can automatic banning lock me out?

Yes, if you fail several times. Add your fixed addresses to the allowlist and keep a fallback access (your provider's console).

How many attempts per day is normal?

There is no standard: it depends on how exposed your IP address is. What matters is the day-to-day trend and the presence of recurring addresses.

FondateurMode installs automatic IP banning on SSH and tells you every day how many attacks were blocked, where they came from and which ones keep coming back. 14-day free trial.