Does something like security intrusion reporting tool exist in Linux? Something that would report (after logging in) security/system change things like that:
Failed Login Attempts:
jsmith from 1.2.3.4 against example-host performed 37 times
Account changes:
New user: name=c0rt3z uid=1050
...
P.S.: sorry if this is duplicate, i don't know how is this type of things in Linux named
It's hard to answer your question because it's so general. There exist many security features in Linux, some of which are provided by the base operating system and others by standalone applications. The specifics of these vary between distributions so without knowing what Linux distribution you are using it is hard to make concrete suggestions.
I highly recommend you start with your distribution's security guide or general documentation.
A few ideas to get you started:
auth.log: authenication information is logged here~/.bash_history).The simplest way I can think of, which avoids getting to grips with serious auditing tools, is to just install logwatch.
You can then receive daily emails listing (among many useful bits of information) a summary of failed login attempts, along with newly created users and groups.
I think what you're looking for is Samhain. It will monitor your system for changes and notify you, but it's a bit more proactive than just whenever you happen to log in.
I used to use Osiris for this kind of thing, but it hasn't been updated in years.
By the way, this kind of security auditing is called Host Integrity Monitoring.
There are numerous ways you could protect your server against a 'brute-force' attack. Some of these methods are more difficult to implement but in the long term can give you better security.
If you want a real simple solution you could implement Fail2Ban. For something more advanced you can implement the same basic functionality by using iptables hashlimits.
You could also disable password based authentication in sshd, move it to a non-standard port, or setup a proper firewall.
Because this question really falls down a rabbit hole that has created an entire industry I'd suggest you look at a security guide for your linux distribution. The Ubuntu guide is a good start.
No one mentioned OSSEC.
Some examples:
FTP server:
Received From: (x) 192.168.4.x->/var/log/secure
Rule: 11210 fired (level 10) -> "Multiple failed login attempts."
Portion of the log(s):
Jul 23 22:52:50 x proftpd[5243]: x.localdomain (::ffff:x.x.x.x[::ffff:x.x.x.x]) - Maximum login attempts (3) exceeded, connection refused
SSH server:
Sep 17 12:38:00 x sshd[6995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x user=y
and web server:
Received From: x->/var/log/httpd/error_log
Rule: 30109 fired (level 9) -> "Attempt to login using a non-existent user."
Portion of the log(s):
[Fri Dec 03 23:27:59 2010] [error] [client x] user mBGq7XfBP7ZPs not found: /
