If you have an Ubuntu Linux server exposed to the public internet, it is almost certainly being scanned and attacked by automated bots attempting to guess your SSH password. This type of brute-force attack is incredibly common.
While installing security software like Fail2Ban is the best way to stop these attacks, it is highly recommended that you occasionally check your system logs to see how frequently your server is being targeted, and which usernames the attackers are trying to guess.
How to Use the lastb Command
The easiest way to view failed login attempts is using the built-in lastb command. This command reads the /var/log/btmp file, which specifically records every single bad login attempt on the system.
Because viewing security logs requires administrative privileges, you must use sudo:
- Log into your Ubuntu server via SSH.
- Type the following command and press Enter:
sudo lastb
The terminal will instantly output a list of failed login attempts. The list is organised into columns, showing you the exact username the attacker tried to guess (e.g., “root” or “admin”), the terminal line (usually ssh:notty), the IP address the attack came from, and the exact date and time.
How to Limit the Output
If your server has been online for a while, running lastb by itself might flood your screen with thousands of lines of text. You can use modifiers to make the output more manageable.
To view only the most recent 20 failed attempts, use the -n flag:
sudo lastb -n 20
To view failed attempts for a specific username (like “root”):
sudo lastb root
Alternative: Searching the Auth Log
The lastb command is excellent for a quick summary, but if you want the deep, technical details of the SSH handshake failure, you can search the raw authentication log using the grep command:
sudo grep "Failed password" /var/log/auth.log
This command will extract and print every single line from the authentication log where a password was rejected, providing a highly detailed audit trail of the attacks against your system.