I have an Ubuntu Linux server that is web facing. Because of this I get a fair number of brute force SSH attempts (who doesn't). I'd like to display the last N failed login attempts at my login prompt. I've worked out the simple script:

grep "Failed" /var/log/auth.log | tail -5

but what I need to know is where do I put this line of script? Is there somewhere to put it that's shell agnostic?

6 Answers 6


There are a couple of packages that you can use to help with brute force attacks.

  1. Denyhosts
  2. Fail2ban

To collect logs and send you a report you can use logwatch. It can send a summary of failed logons as well.

To answer your original question you can put your script in "/etc/profile.d/yourscript.sh" and it should be executed on login.

You might also consider setting up the arno-iptables-firewall package.

  • or, just add it to the bottom of your .profile, if you only want to do it for a single user.
    – Cian
    Jul 11, 2009 at 21:17
  • fail2ban is good to use. I've set on my latest vps my firewall to limit the number of ssh connections from a single ip within a time frame. So ufw limit ssh this means if someone tries to brute force ssh they have to slow down the attempt if not the firewall will ban them for a bit. Jul 12, 2009 at 14:05
  • +1 and thanks for fail2ban, using that in addition to my script now.
    – C. Ross
    Jan 30, 2010 at 17:48

It's really shell dependent. For bash, you should put it in .bash_login file.

Regarding brute force atack prevention, aside from what's already been sugested for blacklisting the attacker's IP, I usually tell sshd to listen on a nonstandard port and disable the password authentication. Of course, that might not always be possible, but it sure is effective.

  • your .profile should be sourced by almost every modern shell.
    – Cian
    Jul 11, 2009 at 23:18
  • +1 - the only response that I think answers the question :)
    – GNUix
    Jul 12, 2009 at 4:44

Put everything in /etc/profile.

It will run everything in /etc/profile before going to your shell startup file.

  • 2
    I'm not familiar with Ubuntu, so I might be wrong, but wouldn't be better to create a script in the /etc/profile.d directory? Jul 12, 2009 at 1:50
  • I use Fedora Linux and in my /etc/profile file, there is a loop that runs everything in the /etc/profile.d directory. You should check if your /etc/profile will process everything in this directory, otherwise you will have to declare directly in the file. Jul 12, 2009 at 15:01
  • I used this for a while, but after adding non-admin users, it causes errors on their login, so I needed to move it somewhere local to my user.
    – C. Ross
    Jan 30, 2010 at 16:18

What I finally ended up doing was creating a .profile.d directory in my home directory, and copying the execution loop from /etc/profile to my $HOME/.profile. I then placed my displayAttacks.sh script into my $HOME/.profile.d directory (as well as my other init scripts).

The addition to .profile follows.

if [ -d "${HOME}/.profile.d" ]; then
  for i in ${HOME}/.profile.d/*.sh; do
    if [ -r "$i" ]; then
      . "$i"
  unset i

There is a perl script, SSHBlock that can be used against brute forcing SSH.
It follows a frequent attempt from an IP address and slows down their attempts.


You have some issues in there. First, any non-root user should not be able to read the auth log file. If you are logging in as root, don't do it anymore :)

Second, use a proper tool for that. I like OSSEC's approach to email me for every X number of failed logins within a period of time. It also blocks the ip automatically, reducing the chance of a brute-force attack succeeding.

  • I'm not root, but I am in the admin group, which allows access.
    – C. Ross
    Jan 30, 2010 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.