If you are a web hosting administrator or a Linux security technician, you probably need to closely monitor ssh login activities, especially failed login attempts. Linux hasPluggable Authentication Modules (PAM) built-in, offering configurable authorization for Linux applications and services. You can use PAM to monitor failed ssh login attempts, and act on them (e.g., blocking user).

In this tutorial, I will show how to configure PAM to monitor failed ssh login attempts on CentOS. Depending on the CentOS version you are using, PAM configuration is slightly different.

Configure PAM on CentOS 5

To keep track of failed ssh logins on CentOS 5.*, you need to use a PAM module called pam_tally.so. For that, modify /etc/pam.d/system-auth as follows.

auth required pam_tally.so no_magic_root
account required pam_tally.so deny=3 no_magic_root lock_time=300

The above PAM configuration denies ssh access for a user if the user has failed to log in three times. The user becomes unblocked after 300 seconds.

Once PAM is configured, use a command called faillog to monitor the ssh login activity of a specific user (e.g., xmodulo):

Login       Failures Maximum Latest             On
xmodulo         2        0   04/23/13 14:12:53  192.168.1.5

To reset the counter of failures for a particular user (e.g., xmodulo):

Configure PAM on CentOS 6

To check failed ssh login attempts on CentOS 6.*, you need to use a PAM module called pam_tally2.so. To configure pam_tally2.so, modify /etc/pam.d/password-auth as below.

auth required pam_tally2.so deny=3 onerr=fail unlock_time=300
account required pam_tally2.so

This PAM configuration blocks ssh login for a particular user after three failed login attempts from the user. The user remains blocked for 300 seconds.

Once PAM is configured like above, use a command called pam_tally2 to monitor the ssh login activity of a particular user (e.g., xmodulo).

Login           Failures Latest failure     From
xmodulo             2    04/23/13 22:44:45  192.168.1.5

To unblock a particular user (e.g., xmodulo):