SSH Failed Login Analysis

What This Means

Analyze SSH failed login events in Linux auth logs. Distinguish between typos, misconfigurations, and active attacks by understanding failed authentication patterns and their security implications.

Example Log

Mar  8 15:10:22 dbserver sshd[23456]: Failed password for jsmith from 10.0.5.142 port 49821 ssh2
Mar  8 15:10:25 dbserver sshd[23457]: Connection closed by authenticating user jsmith 10.0.5.142 port 49822 [preauth]
Mar  8 15:10:30 dbserver sshd[23458]: Failed publickey for jsmith from 10.0.5.142 port 49823 ssh2

Indicators of Suspicious Activity

• Failed password from internal IPs may indicate compromised credentials being tested
• "Connection closed by authenticating user" suggests key mismatch or client misconfiguration
• Failed publickey attempts from valid users indicate key rotation issues
• Failures for valid accounts from unusual source IPs (not their workstation)
• Authentication failures at unusual times for the user
• Mix of password and publickey failures from the same source

How to Investigate

1. Determine if the failure is from a known user vs unknown/invalid user
2. Check the source IP — internal or external, expected or unexpected
3. Review the authentication method (password vs publickey vs keyboard-interactive)
4. Check if the user recently changed their password or SSH key
5. Correlate with successful logins to establish the users normal pattern
6. If publickey failure, verify the users authorized_keys file is correct

Recommended Mitigations

• Implement centralized SSH key management to prevent key sprawl
• Set MaxAuthTries to 3 in sshd_config to limit per-connection attempts
• Enable detailed SSH logging (LogLevel VERBOSE) for forensic value
• Deploy a jump host / bastion server as the single SSH entry point
• Use SSH certificates instead of static keys for easier rotation
• Monitor and alert on failed SSH logins for service accounts

Related Log Types

Related Attack Patterns

Frequently Asked Questions