We will find the failed SSH login attempts using the grep and cat commands. First, be a root user. Type the sudo su command. Next, run the following command to fetch the failed attempts using the grep command:
# grep "Failed password" /var/log/auth.log
You can do this using the cat command also. Run the following command:
# cat /var/log/auth.log | grep "Failed password"
You can block the particular IP address that has failed SSH login attempt using tcp-wrapper. Navigate to the /etc directory. Look for the hosts.deny file, add the following line in the file, and save the file:
sshd: 192.168.0.1/255.255.255.0
