I just typed a wrong password for login to ssh @ root.
I went to
/var/log/faillog
But the file is empty ( tho its filesize is: 32 Byte )
Ok in auth.log is spammed this:
reverse mapping checking getaddrinfo for dinamic-tigo186-180-143-166.tigo.com.co [186.180.143.166] failed - POSSIBLE BREAK-IN ATTEMPT!
Feb 21 03:44:22 ns3xxxx9 sshd[7497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.180.143.166 user=root
What's that?
Best Answer
You can (by default) check for these failures in /var/log/auth.log