SSH brute force attacks on Linux servers
An address that failed to log in over SSH repeatedly within a short window, and that the agent then blocked on the server's own firewall. One address trying many passwords, or many usernames, counts as the one attack it is; the count of distinct addresses is given beside it.
The observatory is not answering just now. The numbers are rebuilt every hour; try again shortly.
What a block for this reason means
An address that failed to log in over SSH repeatedly within a short window, and that the agent then blocked on the server's own firewall. One address trying many passwords, or many usernames, counts as the one attack it is; the count of distinct addresses is given beside it.
Why it happens to every server
Password guessing against SSH is the most common thing a reachable Linux server receives, and it needs nothing from the attacker but a list of addresses and a list of passwords. It is not aimed at the server; it is aimed at port 22.
What to do about it
Keys instead of passwords, or at least no password login for root; fail2ban or an equivalent so a guessing address is cut off; and a port that is not reachable from everywhere if the server does not need it to be. The free assessment checks the first two.
How to read these figures
- Blocks, not attempts. An attack SecAI did not block is not counted, so these are floors.
- A small fleet. A handful of servers. The number of servers is next to every figure because it is part of what the figure means.
- No addresses, countries or ports. The address is used to count distinct sources and then dropped; the rest is not recorded on a block.
How this data is collected and what is left out · All categories
Also published: Web scanning and probing, WordPress abuse, Floods and connection exhaustion.
Free to reuse with credit (CC BY 4.0). Cite as: SecAI Threat Observatory, SSH password guessing, https://secai.techsteps.ae/threats/ssh-brute-force. The same counts are in the JSON at https://secai.techsteps.ae/api/public/threats, rebuilt hourly.
Questions
Not enough of it on the servers SecAI monitors to publish a figure: a category is published only once it has been seen on several servers with enough events to be anonymous.
One block: an address the agent blocked on a customer's server for this reason, and confirmed it had blocked. Distinct addresses are counted separately, because one address can be blocked many times.
No. The published tables hold counts by day and category. The attacker's address is used to count distinct sources and then discarded; no customer address, hostname or server identifier is stored or served, and a day or category seen on too few servers is withheld.
Is your server in this already?
The free assessment reads how your server is set up and tells you what an attacker would find, in about a minute, without changing anything.