How to View Failed SSH Login Attempts in Linux using the lastb Command

Detecting Brute-Force Attacks

If your Linux server has port 22 (SSH) exposed to the public internet, it is guaranteed that automated botnets will continuously attempt to brute-force your passwords. They will try thousands of combinations like root/password123 or admin/admin every single hour.

While tools like Fail2Ban should be used to automatically block these attackers, system administrators must still regularly audit their logs to understand the scale of the attacks and identify which usernames the hackers are specifically targeting.

To view a clean, organized list of every failed login attempt, you can use the native lastb command.

Using the lastb Command

The lastb command reads the binary log file located at /var/log/btmp (bad temporary). Because this file contains sensitive security data (including passwords accidentally typed into the username field), you must execute the command as root or via sudo.

sudo lastb

The output will look something like this:

root     ssh:notty    192.168.1.100    Mon Oct 24 14:32 - 14:32  (00:00)
admin    ssh:notty    203.0.113.55     Mon Oct 24 14:31 - 14:31  (00:00)
oracle   ssh:notty    203.0.113.55     Mon Oct 24 14:30 - 14:30  (00:00)

The terminal will display the targeted username, the protocol used (usually SSH), the exact IP address of the attacker, and the timestamp of the failed attempt.

Limiting the Output

If your server has been online for months, the btmp file might contain tens of thousands of failed attempts. Running lastb will flood your terminal screen.

To view only the 20 most recent failed login attempts, append the -n flag:

sudo lastb -n 20

Isolating Specific Attack Vectors

You can combine lastb with standard UNIX text processing tools like grep and awk to extract highly specific threat intelligence.

To see how many times a specific IP address attempted to log in:

sudo lastb | grep "203.0.113.55" | wc -l

To generate a list of the most frequently targeted usernames:

sudo lastb | awk '{print $1}' | sort | uniq -c | sort -nr | head -n 10

This command extracts just the username column, counts the occurrences, sorts them numerically, and prints the top 10. If you notice that an obscure username like deploy_bot is being heavily targeted, it means the attackers have inside knowledge of your infrastructure, and you must rotate your SSH keys immediately.