A Failed password line in a Linux authentication log proves that an authentication attempt produced a failure at that point in the conversation. It does not by itself prove that an attacker was present, that the complete login transaction failed, or that an account was compromised. To reach a defensible conclusion, identify the host’s actual log source, parse the SSH record, read the surrounding PAM messages, find any later success or session-open event, and corroborate the result with login databases, lockout state, journald, and audit records.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Red Hat-family systems commonly write these events to /var/log/secure. Systems using systemd may keep equivalent records only in the journal, which you inspect with journalctl. The examples below are read-only starting points; use the source configured on the host and preserve its original timestamps and timezone.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Find the authentication log your host actually uses
Do not assume that every Linux server has a populated /var/log/secure. In applicable Red Hat configurations, authentication modules report there. On many systemd installations, the same events are stored in journald and are queried with journalctl. Rotation, forwarding, and local policy can also mean that older records are in compressed files or on a central log system.
Check the traditional file
Begin with a read-only search for the services and PAM components that matter:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
sudo grep -E 'sshd|sudo|su|login|pam_' /var/log/secureIf the file does not exist, is empty, or stops before the period you need, that is a logging configuration question—not evidence that no login occurred. Check the journal or your configured log collector.
Query the systemd journal
sudo journalctl -t sshd --since '24 hours ago'
sudo journalctl _COMM=sshd --since '24 hours ago'-t sshd filters by the syslog identifier; _COMM=sshd filters by the process command name. The two views can differ, so use the one that returns records on your host. Add a precise start and end time when preserving evidence, and note the journal’s timezone.
Preserve context before filtering
Export a time-bounded slice before reducing it to a few matching lines. Keep the original host name, clock or timezone, collection time, and source (file, journal, or forwarded system). A filtered result is useful for analysis, but the unmodified slice is what lets another investigator verify ordering and related events.
Read an SSH record as structured evidence
Consider this representative entry:
Oct 28 11:11:12 hostname sshd[13412]: Failed password for illegal user admin from 172.16.59.10 port 33762 ssh2Read it from left to right rather than treating the whole sentence as a verdict.
| Part | What it tells you | What it does not tell you |
|---|---|---|
| Timestamp | When the host recorded the event, including the displayed month, day, and time. | It does not establish the remote person’s local time or eliminate clock skew. |
| Hostname | Which machine emitted the record. | It does not identify the person using the source address. |
sshd[13412] |
The SSH daemon and process ID; use the PID to follow nearby records from the same transaction. | A PID alone is not a user identity and may be reused later. |
Failed password |
The password method produced a failure at that stage. | It does not prove the final PAM result, a completed login failure, or compromise. |
illegal user admin |
The name was not a valid local account when sshd checked it. |
It does not identify the attacker or prove that the name was never valid in an external identity provider. |
from 172.16.59.10 |
The source address observed by this host. | An address can represent NAT, a proxy, a shared system, a scanner, or a reused allocation. |
port 33762 |
The source TCP port for that connection. | It is not a durable identity; a new attempt normally uses a different ephemeral port. |
ssh2 |
The SSH protocol version reported by the client. | It does not indicate whether authentication later succeeded. |
Invalid-user wording
illegal user and invalid user indicate that the account name was not valid at the point sshd performed its check. Repeated attempts for names such as admin can be consistent with automated guessing, but the wording describes account lookup, not a person. A valid account name followed by repeated Failed password records is also only evidence of attempts until a later success or session record appears.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Compare more than the source address
When grouping events, compare the complete set of useful axes:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Chronological order and the time gap between records.
- Username, including whether it was marked invalid.
- Source address and source port.
- Authentication method, such as password or public key.
- The SSH process ID when available.
- Whether a session opened and how it ended.
Grouping only by IP can mislead when several administrators share a gateway, when a reverse proxy is involved, or when an address is translated or reassigned.
What repeated failures can—and cannot—show
Many failures from one source in a short period are consistent with password guessing. Red Hat describes repeated attempts as potentially indicative of an attacker trying to guess a password, especially for a privileged account. That is a useful triage signal, not a proof of attribution or compromise.
Signals that raise concern
- Attempts continue at a regular or high rate rather than matching a known administrator’s normal behavior.
- The source tries many account names, especially names that are not valid on the host.
- A valid privileged account is targeted repeatedly.
- Failures are followed by an
Accepted password,Accepted publickey, session-open event, or other success record that you cannot explain. - The source is not an expected administrator, automation host, identity gateway, or monitoring system.
Signals that require a different explanation
- A single mistyped password creates one failure but no further activity.
- An approved identity-provider login produces a local
pam_unixfailure followed immediately by an external-provider success. - An authentication succeeds but an account-policy check denies access because the account is expired or restricted.
- A shared NAT address produces attempts from several unrelated users.
Use the complete transaction and the surrounding records to distinguish these cases.
Why one pam_unix failure can be misleading
PAM can call several authentication providers in sequence. A local provider may report a failure even though a later provider succeeds. Red Hat documents this pattern for an IdM, AD, or SSSD-backed account:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=client1.example.com user=user22
pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=client1.example.com user=user22In this sequence, the local pam_unix message is not the final outcome. The SSSD provider succeeds for the same user and remote host. Counting every pam_unix failure as a separate failed login would overstate the event.
Follow the short time window
- Locate the first record for the username, source, or SSH PID.
- Read all entries immediately before and after it, not just lines matching
Failed. - Look for another provider, such as
pam_sss, and record whether it reports success or failure. - Continue through the SSH result and session-open records before classifying the transaction.
Correlate on as many fields as the host supplies: PID, username, remote host or address, and timestamps. Do not infer success or failure from one module’s message in isolation.
Separate authentication from account policy
A correct password does not guarantee access. PAM can authenticate a user and then deny the account because of an access rule, expiration, or another policy. Treat these message families as different investigative branches.
| Message family | Likely stage | Next check |
|---|---|---|
Failed password, Authentication failure, or pam_unix(...:auth) |
Authentication exchange | Check the method, user, source, provider sequence, and later SSH result. |
pam_access(sshd:account): access denied |
Account or origin policy | Inspect PAM access rules, groups, host restrictions, and the source context. |
PAM: User account has expired |
Account state | Inspect local or directory-provider expiry data and the account’s administrative status. |
pam_sss success or failure |
External identity provider | Correlate SSSD and directory-service logs with the SSH transaction. |
Calling every denial a bad password leads to the wrong remediation. An expired account needs an account-state decision; an access-rule denial needs policy review; an external-provider event needs identity-service correlation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallConfirm whether a session actually succeeded
The strongest interpretation comes from several independent records. Use SSH/PAM messages to understand the transaction, then compare them with session history, failed-login databases, lockout state, journald, and audit records.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Session history with last and lastlog
Red Hat documents that last reads /var/log/wtmp, while lastlog reads /var/log/lastlog. These files are binary databases, not ordinary text logs.
last -Fai | head -50
lastloglast displays current and previous login sessions with fuller timing information. The lastlog command displays each user’s last login, rather than every session. A matching session record supports the conclusion that a login reached the session stage, but the absence of a record can reflect retention, configuration, or a session type that did not update the database.
Failed-login history with lastb
sudo lastb -Fai | head -50lastb reads the bad-login database, commonly called btmp. Treat it as failed-attempt evidence and compare its time, account, and source with the detailed SSH/PAM sequence. It does not replace those records and may be unavailable or differently configured on some distributions.
Per-user lockout state with faillock
sudo faillock --user USERNAMEpam_faillock stores failed attempts per user and can lock an account after a configured threshold. Before interpreting a burst, record the configured failure threshold, reset behavior, and lockout timer. A lockout may explain why later attempts fail even when the password is correct; it does not by itself identify the original source.
Audit evidence
For higher-confidence review, inspect Linux audit records. Red Hat identifies USER_LOGIN records as useful failed-login evidence, including fields such as addr, terminal, and res=failed. Match the audit timestamp, address, user, and result to the SSH and PAM records. Audit configuration and retention vary, so absence of a matching record is not automatically proof that no attempt occurred.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
A repeatable investigation workflow
Use this sequence whenever a suspicious login alert arrives. It is designed to preserve evidence first, classify the event accurately, and avoid overreacting to a single line.
- Record the scope. Write down the host, hostname, timezone, collection time, affected account, suspected source, and the period under review.
- Preserve the source. Copy the relevant file or export a bounded journal slice before rotating, deleting, or rewriting logs. Keep an unfiltered copy and note how it was collected.
- Locate every relevant entry. Search for the account, source address, SSH PID, and nearby timestamps. Include
sshd,pam_*,sudo,su, and session messages where applicable. - Classify each message. Mark it as password or other authentication, access policy, expiry, external identity, session open, or session close. Do not collapse these categories into one “failed login” count.
- Reconstruct the transaction. Follow the sequence from connection and method selection through provider responses, the final SSH result, and any session-open record.
- Check independent evidence. Compare with
last,lastlog,lastb,faillock, journald, and auditUSER_LOGINrecords as available. - Assess expected activity. Determine whether the source is an approved administrator, automation system, identity gateway, NAT address, scanner, or unknown network. The log gives an observed address, not a person’s identity.
- Escalate on outcome, not volume alone. A confirmed unexpected session, privilege use, or successful authentication deserves incident-response handling. Repeated failures without a success still merit defensive review, but they are a different finding.
- Preserve before remediation. Follow the host’s incident-response procedure before changing passwords, deleting accounts, blocking addresses, or clearing lockout state, because those actions can alter evidence.
Worked interpretations
Many invalid-user attempts from one address
You see repeated entries for different names, each marked invalid user or illegal user, with changing source ports and no later success or session-open record. This is consistent with automated account guessing or scanning. Record the interval, names, source, and count, then check whether any valid account was targeted and whether lockout controls reacted. Do not claim that the source address identifies a person.
Valid account, repeated password failures, no session
A real account receives several Failed password entries, followed by no Accepted event and no matching session in last. Classify this as unsuccessful authentication based on the available evidence, while checking for a policy denial or external-provider message that explains the sequence. If the account is privileged or the source is unknown, preserve the window and follow local response procedures.
Local PAM failure followed by SSSD success
The same username, source, and SSH transaction show pam_unix(...:auth): authentication failure and then pam_sss(...:auth): authentication success. The first line is a provider-level result, not the final login verdict. Continue to the SSH acceptance and session records, and correlate with SSSD or directory logs.
Correct credentials but access denied
An authentication success is followed by pam_access(sshd:account): access denied or an account-expired message. This is an authorization or account-state denial, not evidence that the password was guessed incorrectly. Review the relevant access rule, group membership, origin restriction, or expiry data.
Common analytical mistakes
- Treating
Failed passwordas proof of compromise. It records a failed stage of authentication; it does not establish that anyone entered the account. - Counting PAM modules instead of transactions. One SSH attempt can generate several provider messages, including a local failure and an external success.
- Equating “invalid user” with attacker identity. It describes account lookup, while the source address can be shared or translated.
- Ignoring account policy. Expiry and access rules can deny a correctly authenticated user.
- Using only one data source. Text logs, wtmp, btmp, faillock, journald, and audit records answer different questions and have different retention behavior.
- Grouping only by IP. Shared gateways and address reuse can combine unrelated users or separate one user’s activity.
- Discarding timestamps or timezone information. Without them, records from multiple hosts or collectors can appear out of order.
- Changing the system before preserving evidence. Password resets, lockout resets, and log rotation can remove the context needed to determine what happened.
What to record in an investigation note
A concise evidence record should let another administrator reproduce your conclusion:
Recommended Free Tools
- Host name, distribution or relevant authentication configuration, and timezone.
- Exact log source:
/var/log/secure, journald, forwarded collector, or another configured destination. - Collection interval and the unfiltered file or journal export.
- SSH PID, username, account-validity classification, source address, source port, and authentication method.
- Every provider result, including
pam_unix,pam_sss,pam_access, and expiry messages where present. - Any
Accepted, session-open, session-close, or equivalent success record. - Results from
last,lastlog,lastb,faillock, journald, and audit searches, including when a source was unavailable. - Whether the source was expected, shared, translated, or unknown, and what local response procedure was followed.
Quick command reference
| Purpose | Command | Evidence supplied |
|---|---|---|
| Search the traditional authentication log | sudo grep -E 'sshd|sudo|su|login|pam_' /var/log/secure |
Matching text records, if this file is configured and retained. |
| Read SSH events from journald | sudo journalctl -t sshd --since '24 hours ago' |
Journal records tagged sshd for the selected period. |
| Read by process name | sudo journalctl _COMM=sshd --since '24 hours ago' |
Journal records emitted by the sshd command name. |
| Review recent sessions | last -Fai | head -50 |
wtmp-based session history with full time and address details where available. |
| Review failed-login database | sudo lastb -Fai | head -50 |
btmp-based bad-attempt history where configured. |
| Display each user’s last login | lastlog |
lastlog-based last-login state. |
| Inspect per-user lockout attempts | sudo faillock --user USERNAME |
pam_faillock state for the named user, if configured. |
Command availability, file paths, PAM stacks, and retention policies vary by distribution. Use the output as evidence in context, not as a universal guarantee about what happened.
The Bottom Line
Read suspicious Linux login entries as a sequence, not a single alarm. Identify the configured log source, parse the SSH fields, distinguish authentication from account policy, follow all PAM providers, and confirm the final outcome with session, failed-login, lockout, journal, and audit evidence. Only then decide whether you are looking at routine error, automated guessing, policy denial, or an unexpected successful login.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
