ThreatGuard

What is an SSH brute-force attack (and is your server under one)?

By Naitik Nayyar, Founder of ThreatGuard · 7 November 2026 · 5 min read

Put a Linux server on the internet and within minutes something starts trying to log in to it. That's an SSH brute-force attack: automated programs guessing usernames and passwords, over and over, hoping one works. Here's what they are, how to tell if your server is under one, and why it matters even when every guess fails.

Why your server, and why so fast?

It isn't personal. Bots scan the entire IPv4 internet for port 22 continuously — it takes them minutes, not days. Any address that answers gets added to a list, and thousands of infected machines start working through it. A brand-new server with nothing on it gets attacked just as much as a busy one.

The common kinds

  • Dictionary attacks — one IP tries common passwords (123456, password, admin) against common usernames (root, admin, ubuntu).
  • Credential stuffing — username and password pairs leaked from other breaches, on the bet that people reuse passwords.
  • Password spraying — one or two passwords tried against many usernames, slowly, to stay under the limits that would trigger a block.
  • Distributed attacks — a botnet spreads the guesses over hundreds of IPs, each trying only a few times, so no single address looks suspicious.

How to tell if it's happening to you

Count the failed logins SSH has recorded (on RHEL-family systems, use /var/log/secure):

sudo grep -c "Failed password\|Invalid user" /var/log/auth.log

Hundreds or thousands is normal for a public server. The usernames tried tell you it's bots — accounts that don't exist on your system:

sudo grep -oP 'Invalid user \K\S+' /var/log/auth.log | sort | uniq -c | sort -rn | head

Other signs:

  • Many sshd processes while only you are logged in (pgrep -c sshd).
  • Log lines like drop connection ... past MaxStartups — SSH is turning connections away because too many are arriving at once.
  • Higher CPU load or slow logins with no change in your own traffic.

This guide has more commands for reading the log, including the IPs trying hardest.

If every guess fails, why does it matter?

  • One weak password is enough. A forgotten test account or a default password on a new user can be found in hours.
  • A break-in is expensive. Compromised servers are used to mine cryptocurrency, send spam, attack other servers, or hold your data for ransom — and your provider may suspend you for it.
  • It costs you anyway. Thousands of attempts burn CPU, fill logs, and bury the one login line you would want to notice.

How to stop it

  1. Use SSH keys and turn off password logins. Guessing becomes pointless. This single change stops brute force from ever succeeding.
  2. Turn off direct root login (PermitRootLogin no) — root is the most guessed username.
  3. Block IPs that keep trying. It cuts the noise and the load. See how to block an IP address.
  4. Watch successful logins. A login from an IP that was failing a minute earlier is the one line that matters most.

The full walkthrough, with the exact commands, is in how to stop SSH brute-force attacks on Ubuntu.

Seeing it all in one place

ThreatGuard was built for exactly this. It shows every SSH login attempt across your servers live — which IPs, from which countries and networks, trying which usernames — recognises spraying, credential stuffing and botnets that rotate IPs, and blocks attackers at the firewall automatically. It also emails you when a serious attack starts.

More guides