DEV Community

Faruk
Faruk

Posted on • Originally published at Medium

How to Automatically Lock Out SSH Brute-Force Attacks on Ubuntu and Red Hat | by Faruk Ahmed | Jun, 2025

#ssh #red #brute #force

Member-only story

How to Automatically Lock Out SSH Brute-Force Attacks on Ubuntu and Red Hat

--

Share

Intro:

If your Linux server is exposed to the internet, it’s being scanned. SSH brute-force attempts are among the most common — attackers trying thousands of usernames and passwords in seconds. You might not see it… until it works.

In this blog, I’ll show you how to detect, throttle, and block brute-force SSH attacks using real-time tools built into Ubuntu and Red Hat-based systems.

1. Check If You’re Already Under Attack

Use this command to see recent failed SSH logins:

# Ubuntusudo grep "Failed password" /var/log/auth.log
Enter fullscreen mode Exit fullscreen mode 
# Red Hatsudo grep "Failed password" /var/log/secure
Enter fullscreen mode Exit fullscreen mode

Look for:

  • Multiple failures from the same IP
  • Login attempts to non-existent users

2. Enable Rate Limiting with Fail2Ban

✅ Install Fail2Ban:

# Ubuntusudo apt install fail2ban
Enter fullscreen mode Exit fullscreen mode 
# Red Hatsudo yum install epel-releasesudo yum install fail2ban
Enter fullscreen mode Exit fullscreen mode

✅ Enable SSH protection:

Edit the jail config:

sudo nano…
Enter fullscreen mode Exit fullscreen mode

👉 Read Full Blog on Medium Here

Top comments (0)