Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallA line such as Failed password is evidence of an authentication event, not proof that an attacker was present or that a login transaction ultimately failed. Read the complete sequence for the account, source, SSH process and session result, then corroborate it with login databases, faillock, journald and audit records.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Find the authentication records on this host
There is no universal Linux authentication-log pathname. Red Hat-family systems commonly write authentication-module messages to /var/log/secure when that logging configuration is enabled. Systems using systemd may keep the equivalent events in the journal instead of (or as well as) a text file. Start with the source actually configured on the server.
As an Amazon Associate I earn from qualifying purchases.
Read a text secure log without changing it
sudo grep -E 'sshd|sudo|su|login|pam_' /var/log/secureUse a copy or a read-only extraction when collecting evidence. Record the host name, the time zone used by the system, and when you made the copy. Timestamps that lose their original time zone are difficult to correlate with events from other systems. Keep the original line order and do not normalize away the daemon’s process ID, account spelling or source port.
Query the systemd journal
sudo journalctl -t sshd --since '24 hours ago'
sudo journalctl _COMM=sshd --since '24 hours ago'The first query filters on the journal tag; the second filters on the command name. Which one returns the useful records depends on how the service writes to journald. Keep the journal time window narrow enough to include the suspicious event and the surrounding authentication and session messages. If both a text file and journal exist, retain both views: formatting, retention and available fields can differ.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Read an SSH line as structured evidence
Consider this representative entry:
Oct 28 11:11:12 hostname sshd[13412]: Failed password for illegal user admin from 172.16.59.10 port 33762 ssh2Do not read it as a sentence alone. Break it into fields and compare those fields across nearby entries.
| Field | Value in the example | What it tells you |
|---|---|---|
| Timestamp | Oct 28 11:11:12 | When the daemon recorded the event, subject to the host’s clock and time zone. |
| Host | hostname | The machine that emitted the record. |
| Daemon and process | sshd[13412] |
The SSH service and process ID that handled this connection; the PID helps correlate adjacent lines. |
| Event wording | Failed password |
An authentication attempt using a password did not satisfy that particular check. |
| Account classification | illegal user admin |
At that point, sshd did not find admin as a valid local account. |
| Source address | 172.16.59.10 | The network address presented as the remote source; it is not an identity. |
| Source port | 33762 | The client-side TCP port for this connection. |
| Protocol | ssh2 |
The SSH protocol indicated by the daemon. |
Illegal user and invalid user describe the account name as checked by sshd; they do not identify the person or program behind the address. A shared gateway, proxy, NAT device or reused address can make one source appear to represent many clients. Compare the complete set of fields rather than attributing a person to an IP address.
Group events on more than the source IP
For a useful timeline, group entries by timestamp, username, source address and port, SSH authentication method, outcome, and sshd PID. IP-only grouping can combine unrelated users behind a NAT gateway or separate connections whose addresses were later reassigned. The PID and the short time window often show which messages belong to one transaction.
Preserve the exact username spelling, including whether the line says illegal user or names a valid account. A sequence that changes from invalid names to a real account is materially different from repeated typos for one known user. Likewise, a change from password attempts to public-key acceptance is an authentication-method change, not merely another password failure.
What a failed-password message does and does not prove
Repeated attempts from one source can indicate password guessing. Red Hat describes repeated attempts as potentially indicative of an attacker trying to guess an account password, particularly for a root account. That interpretation is a lead for investigation, not a conclusion about compromise.
A single Failed password line establishes only that one password check was recorded as unsuccessful. It does not prove that the source was malicious, that no later authentication method succeeded, or that the overall connection never opened a session. An administrator can mistype a password, an automated job can use an outdated credential, and a multi-provider PAM stack can produce an intermediate failure before another provider succeeds.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Look for the transaction’s end state
After a failure, inspect the same PID, account and nearby timestamps for a success record such as Accepted password or Accepted publickey, followed by a session-open message or other evidence that a session was created. A later session-close record helps define how long it lasted. If there is no success or session evidence, retain that absence as an observation rather than claiming certainty that the connection failed; logging configuration and retention affect what is available.
| Observed sequence | Careful interpretation |
|---|---|
One Failed password |
One password check failed; intent and final connection outcome remain unknown. |
| Repeated failures for one account | Password guessing, mistyped credentials or stale automation are all possible; inspect later records and lockout state. |
Failed password followed by Accepted password |
A later password attempt succeeded; determine whether a session opened and which account was used. |
Password failure followed by Accepted publickey |
A different method succeeded; do not describe the entire connection as unsuccessful. |
| Provider failure followed by provider success | One PAM module failed while another completed authentication; count the transaction only after reviewing the stack. |
Understand PAM messages before calling an attempt an attack
PAM can involve several modules. Their messages represent different stages and different causes, so a line containing pam_ needs its module name and stack context.
The local-provider false failure pattern
Red Hat documents a sequence for an IdM, AD or SSSD-backed user in which the local Unix provider reports a failure and the SSSD provider then reports success:
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=client1.example.com user=user22
pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=client1.example.com user=user22Here, the pam_unix message is an unsuccessful check by that provider, not the final result for the login. The subsequent pam_sss success shows that the external identity provider authenticated the user. Always read the surrounding sequence before counting a pam_unix(...:auth) line as a failed login.
Recommended Free Tools
Distinguish authentication from account policy
| Message family | Likely stage | Next evidence to inspect |
|---|---|---|
Failed password, Authentication failure, or pam_unix(...:auth) |
Authentication exchange | Username, method, source, PID and any later success or session-open record. |
pam_access(sshd:account): access denied |
Access-control policy | PAM access rules, host or origin restrictions, and applicable group policy. |
PAM: User account has expired |
Account state | Account-expiry data and, for directory users, the directory provider’s account status. |
pam_sss success or failure |
External identity provider | SSSD and directory-service logs for the same user and time window. |
A correct password can still be refused by an account rule or an expired account. Conversely, an authentication failure from one provider can be followed by success from another. Classify the message first; only then choose the next check. Treat an access denial as evidence about policy, not as proof that the password was incorrect.
Corroborate SSH text with independent records
No single log line is a complete account of a login. Use the host’s login databases and security controls to test whether a session was recorded and whether failed attempts accumulated.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Session history: last and lastlog
last -Fai | head -50
lastloglast reads the binary /var/log/wtmp database and displays current and previous login sessions. The -F option prints full login and logout times, while -a places the host address at the end and -i shows the numeric address when available. lastlog reads /var/log/lastlog and displays the last login for each user. These databases are session-history evidence; they do not replace the detailed SSH and PAM sequence.
The distinction matters when a daemon line is ambiguous: lastlog answers when a user last logged in, whereas last shows current and previous sessions. A missing entry in either database should be documented as missing evidence, not converted into a claim that no connection occurred.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Failed-attempt history: lastb and btmp
sudo lastb -Fai | head -50lastb reads the bad-login database, commonly called btmp. It can show failed-attempt time, account and source information when the distribution and PAM configuration are recording those events. Treat btmp as a separate evidence stream from sshd text; retention and permissions can differ.
Lockout state: faillock
sudo faillock --user USERNAMEpam_faillock stores failed attempts per user and can lock an account after a configured number of failures. Before interpreting a burst as an attack, record the configured threshold, counting interval and lockout duration. A lockout may reflect policy enforcement rather than a successful intrusion, and the exact command or configuration can vary by distribution.
Audit evidence
For higher-confidence review, inspect the audit records for USER_LOGIN. Red Hat identifies fields including addr, terminal and res=failed as useful failed-login evidence. Audit records can confirm a result even when the human-readable daemon messages are ambiguous, but they remain subject to the host’s audit configuration and retention.
A repeatable investigation workflow
- Preserve the starting point. Copy the relevant secure-log file or export the journal slice. Record the host, time zone, collection time and the command used. Do not rotate, truncate or delete logs while establishing the timeline.
- Define the time window. Include the suspicious line and enough preceding and following entries to capture retries, provider changes, acceptance, session opening and session closing.
- Collect every related identifier. Search for the username, source address, source port,
sshdPID and nearby timestamps. Includesudo,su,loginandpam_messages when they occur in the same window. - Classify each event. Mark it as password or other authentication, access policy, account expiry, external identity-provider activity, session open or session close. Do not put all PAM failures in one category.
- Determine the outcome. Look for
Accepted password,Accepted publickey, a provider success, a session-open record, and a corresponding session close. A failed check followed by a success is one transaction with multiple stages, not automatically multiple attacks. - Cross-check independent stores. Compare the window with
last,lastlog,lastb,faillockand auditUSER_LOGINrecords. Note disagreements and missing records instead of silently choosing the most alarming interpretation. - Assess the source in context. Decide whether the address belongs to an expected administrator, automation system, scanner, NAT gateway or an unknown network. The address identifies a network endpoint as observed by the server, not a person.
- Apply the host’s response procedure. Preserve the evidence before changing credentials, access rules or logging. If a successful unauthorized session is indicated, follow the organization’s incident-response process and protect the original copies for later review.
Patterns that commonly confuse investigations
Many attempts for an invalid account
A run of Failed password for illegal user entries can be consistent with account-name guessing. Check the time spacing, changing usernames, source addresses and whether any valid account was later accepted. Do not infer the attacker’s identity from the address, and do not treat every invalid-name attempt as proof that the server was compromised.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Many failures for a valid account
Repeated failures for a real username deserve attention because they can represent password guessing, a user repeatedly mistyping a password, or an automation system using stale credentials. Check for an eventual acceptance, the session history, and whether faillock recorded or enforced a lockout. The sequence, not the count alone, determines what happened.
One address with different users
Several usernames from one address may be a scanner, but they may also be multiple clients sharing a NAT or proxy. Compare source ports, timestamps, protocol details and the organization’s known gateways before assigning a common actor.
Authentication failure followed by access denial
An authentication check can succeed while an account or origin rule later denies access. If the sequence includes pam_access(sshd:account): access denied, investigate the configured access policy rather than resetting a password as the first response.
Authentication failure followed by external-provider success
The pam_unix-then-pam_sss sequence is the clearest example. Correlate the user, host and timestamps with SSSD and directory logs. Counting the first line as a failed login would overstate the number of unsuccessful transactions.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Failure followed by a real session
If a failed attempt is followed by an accepted method and a session-open record, investigate the session itself. Identify which method succeeded, which account was used, how long the session remained open, and what other audit or command records exist. The initial failure does not explain the later success.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes and how to avoid them
- Assuming every host uses
/var/log/secure. Check journald and the active logging configuration on systemd-based hosts. - Calling one line a compromise. Require a coherent timeline and corroboration before concluding that access was obtained.
- Counting PAM-provider failures as separate logins. Follow the complete stack for the same PID, user and time.
- Confusing authentication with authorization. Password validity, account expiry and
pam_accesspolicy are different decision points. - Using only IP addresses to group events. Include account, PID, port, method and timestamp because addresses can be shared or reassigned.
- Ignoring binary login databases.
last,lastlogandlastbprovide different views from the text daemon log. - Overlooking lockout configuration. Interpret
faillockcounts alongside the configured threshold and timer. - Changing the system before preserving evidence. Credential resets, log rotation and policy edits can remove context needed to reconstruct the event.
- Discarding the time zone. Events from the server, identity provider and audit subsystem can appear out of order if their original offsets are not retained.
- Treating a missing record as a negative. Retention, audit settings and provider configuration determine which events are available; absence narrows certainty but does not prove that nothing happened.
What a defensible conclusion looks like
A defensible review states exactly what the records establish: for example, that an SSH daemon recorded several password failures for a named account from a particular source address, that a later public-key acceptance opened a session, or that a local PAM provider failed before SSSD authenticated the user. It also states what remains unproven, such as the identity of the person using the source address or whether an absent session record means no session existed.
Use the narrowest claim supported by the combined evidence. “Password guessing is plausible” is different from “an account was compromised”; “the account policy denied access” is different from “the password was wrong.” Keeping those distinctions in the incident record makes the next response step—policy review, credential investigation, provider troubleshooting or incident handling—much more reliable.
Frequently Asked Questions
How do I tell whether someone is trying to break into my Linux server?
Look for repeated attempts in a short time window, especially changing usernames or repeated guesses against a privileged account, then correlate the same source, PID and method. Repetition can indicate password guessing, but confirm whether any attempt was accepted and whether a session opened before concluding that access was obtained.
Free tools Windows power users keep installed
One-click scans. No signup required.
What does “Failed password” in /var/log/secure mean?
It means one password check recorded by sshd did not satisfy that check. It does not by itself identify an attacker, prove the whole connection failed, or exclude a later successful method.
Is a pam_unix authentication failure always a failed login?
No. In an IdM, AD or SSSD configuration, pam_unix can report an authentication failure and pam_sss can immediately report success for the same user. Read the complete PAM sequence for the same PID and time window.
How can I confirm whether the login actually succeeded?
Search for Accepted password, Accepted publickey, a PAM-provider success and a session-open message. Then compare the time window with last, lastlog, journald, audit USER_LOGIN records and, where relevant, session-close evidence.
What is the difference between authentication failure and access denial?
Authentication concerns proving the credentials. Messages such as pam_access(sshd:account): access denied concern a rule or origin restriction, while User account has expired concerns account state. Investigate the matching policy or account data instead of assuming the password was wrong.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteCan I identify the attacker from the source IP?
No. The address is the network endpoint observed by the server. NAT gateways, proxies, shared networks and address reassignment can put multiple users behind one address, so retain the username, source port, timestamp, PID and authentication method as well.
What do lastb and faillock add?
lastb reads the bad-login database, commonly btmp, while faillock shows per-user failed-attempt state maintained by pam_faillock. They provide different evidence from sshd text, and both depend on the host’s configuration and retention.
The Bottom Line
Read Linux login alerts as a timeline, not isolated sentences: identify the source and process, distinguish authentication from policy decisions, find the final session result, and corroborate it with wtmp, btmp, faillock, journald and audit records. Report only what the combined evidence supports.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
