Linux · Bash

List Failed SSH Logins on Linux

Counts failed SSH password attempts in the last 24 hours by source IP. Use it to spot brute-force attacks.

Request a free demo →All scripts

Script Library

Live data

28scripts

Windows18
macOS5
Linux5

By category

Network3
Disk and storage4
Inventory4
Security9
Updates4
Maintenance4

Last reviewed: November 6, 2026

CODE

Script

failed-ssh-logins-linux.sh

#!/bin/bash
journalctl --since "24 hours ago" -u ssh -u sshd --no-pager 2>/dev/null |
  grep -E "Failed password|Invalid user" |
  grep -oE "from [0-9a-fA-F:.]+" | awk '{print $2}' |
  sort | uniq -c | sort -rn | head -20

Caution: Running a script is a sensitive action. Do not run code you have not read. A non-zero exit code shows as a failure in Moftgate output.

HOW IT WORKS

Run it on every device with Moftgate

01
Add the script
In the Moftgate console, open Scripts > New script and paste the code.
02
Select the OS
Select Linux as the target operating system.
03
Test it
Run it on one test device first and read the output.
04
Roll out
Send it to all targets by group, profile or tag. Each device result is recorded separately.