tendbotBrute-force attacks
Automated bots constantly try to log in to servers by guessing passwords, thousands of times a day. Most attempts fail, but they fill your logs, use up resources and only need to get lucky once.
- At a glance
- Group
- Security
- Tendbot
- Explains, you decide
- What it does
- Shows who’s knocking and how to lock the door.
- Approval
- You make the change
What you’ll notice
- Thousands of “Failed password” lines in the login logs
- Lots of failed logins to your site’s admin page
- The server or site feels slower than usual
- Warnings from your host about suspicious traffic
Why it usually happens
- Your server is reachable from the internet, like every server
- Password logins are allowed for SSH
- Common usernames like root or admin are in use
- Nothing limits how many times someone can try
Fix it yourself
How to fix it by hand
Comfortable with a terminal? Here’s what an experienced admin would do. Start with the read-only commands.
- 01
Count recent failed logins
Shows how many password guesses have failed.
sudo journalctl -u ssh --since today | grep -c "Failed password" - 02
See where they come from
Lists the addresses trying most often.
sudo journalctl -u ssh --since today | grep "Failed password" | grep -oE "from [0-9.]+" | sort | uniq -c | sort -rn | head - 03
Check how SSH logins are allowed
Look at passwordauthentication and permitrootlogin.
sudo sshd -T | grep -E "passwordauthentication|permitrootlogin" - 04
Consider a tool that blocks repeat guessers
Fail2ban temporarily blocks addresses that keep failing. Check whether it’s installed.
systemctl status fail2ban --no-pager
With Tendbot
How Tendbot helps
- Counts failed login attempts and shows where they come from, in plain English.
- Explains how serious it is and what would lock the door.
- Walks you through the changes step by step — SSH and firewall settings are yours to make.
- Scheduled checks tell you when attempts suddenly get worse.
FAQ
Brute-force attacks: common questions
Why are there so many failed logins on my server?
Bots scan the whole internet and try common passwords on every server they find. It’s normal, but it shows why strong settings matter.
How do I stop brute-force attacks?
Use SSH keys instead of passwords, turn off password logins for root, and consider a tool like fail2ban that blocks repeat guessers.
Private alpha · invites in small waves
Let Tendbot look after your server
Join the alpha with one email address. Early testers help shape Tendbot and keep the founding-member perks after launch.
- No card needed
- Leave any time