What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Thousands of failed SSH logins usually indicate automated internet scanning and password guessing against an exposed service. They are a warning to investigate and harden the server, not proof that an attacker got in. First preserve and review authentication evidence, then establish a tested key-based access path, restrict accounts, add a second factor where practical, and use rate limiting as a supporting control.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What thousands of failed SSH attempts actually tell you
Internet-facing SSH services are continuously discovered by automated scanners. Bots try common usernames and passwords, often from many addresses, and repeat the process against any host that answers on an exposed SSH port. Ubuntu’s SSH guidance describes this pattern as attackers looking for SSH servers and trying passwords at random.
As an Amazon Associate I earn from qualifying purchases.
The count by itself cannot tell you whether the server was breached. There is no authoritative universal number at which failed attempts become proof of compromise, and no reliable server-wide breach probability that can be inferred from the count alone. Treat the activity as evidence of probing. The question that matters is whether any authentication succeeded and whether the host shows post-login changes.
Source addresses also need context. An address may belong to a proxy, a compromised machine, a cloud service, or shared infrastructure rather than the person operating the attack. Blocking one address can reduce noise while leaving the underlying exposure unchanged.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Preserve evidence before changing access
Do not immediately delete logs, rotate every setting, or install a blocking tool before checking what happened. Record the investigation window and preserve copies according to your organisation’s incident-response policy. On Ubuntu, OpenSSH events commonly appear in /var/log/auth.log and in the systemd journal.
- Write down the scope. Note the first and last event times, the server’s public addresses, exposed SSH listeners, usernames being tried, source addresses, and authentication methods shown in the logs.
- Watch the SSH journal live. Run
sudo journalctl -fu ssh.servicein a separate administrative session. This follows new SSH service entries while you test changes. - Review a fixed time range. For example,
sudo journalctl -u ssh.service --since "24 hours ago"limits the review to a defined period. Also inspect the relevant portion of/var/log/auth.logwhen that file is present. - Separate failures from successes. Group events by username and source, then identify successful authentication records, not just “Failed password” lines. Check both password and public-key methods.
- Preserve the original records. Export or copy logs before applying bans or retention changes. Keep timestamps and the server’s time zone with the copies.
Grouping helps you see patterns, but it is not attribution. A large list of addresses does not prove that each address is a separate human attacker.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How to decide whether the server may be compromised
An unexpected successful SSH login changes the response. Assume the host may be compromised until you can account for the session and its changes. A failed-login storm without a success still warrants hardening, but it does not establish that an intruder obtained access.
Check successful access and current sessions
- Review every successful SSH event in the same time window, including the username, source address, method, and session duration.
- List current sessions and compare them with administrators who were expected to be online.
- Review privilege use, especially unexpected
sudoactivity and changes to administrative groups.
Audit identities and persistence
- Look for newly created users, changed shells, altered group membership, and unexpected password or account changes.
- Inspect every relevant user’s
~/.ssh/authorized_keys. An unfamiliar key can provide access even after a password is locked. - Review user shell startup files, cron jobs, and systemd services or timers for persistence.
- Check package-installation and update records for changes that do not match your maintenance work.
Look for activity outside SSH
- Investigate unusual outbound connections, new listening services, unexpected processes, and unexplained resource use.
- Preserve volatile and persistent evidence where your incident-response process requires it; avoid “cleaning” files before they are collected.
If the evidence points to unauthorised access, isolate the machine as your response plan permits, preserve logs, rotate credentials and keys from a clean system, and involve the organisation’s incident-response personnel. Removing one suspicious key or killing one process is not a complete recovery.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Harden SSH without locking yourself out
Remote authentication changes can lock out the only administrator. Before editing SSH configuration, confirm that you have console, out-of-band, hypervisor, or provider recovery access, or keep a second tested administrative session open. Make one change at a time and retain a rollback path.
1. Establish and test a public-key login
Ubuntu recommends Ed25519 keys. On a trusted administrator workstation, create one with:
ssh-keygen -t ed25519Install the public key for the intended account using the documented workflow:
ssh-copy-id user@serverOpen a new terminal and authenticate with that key before changing any password setting. Test the exact account, host name, network path, and privilege escalation you will need during an outage. Red Hat specifically advises proving key-based login works before disabling password authentication on a remote system.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Disable password authentication only after the key works
When every required administrator has a tested key path, set PasswordAuthentication no in the effective SSH server configuration where that policy fits your operations. Some environments still need a controlled password fallback for break-glass accounts; document that exception rather than disabling access blindly.
Ubuntu’s Community Help Wiki summarizes the rationale: “If you’ll always be able to log in to your computer with an SSH key, you should disable password authentication altogether.” The operational requirement is the first clause: make sure the key path is dependable before removing the fallback.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →3. Reduce high-impact entry points
- Disable direct root SSH login where administrators can use named accounts and controlled privilege escalation.
- Limit SSH access to an approved administrative group with
AllowGroups. Confirm all required accounts belong to that group before reloading the service. - Remove stale accounts and keys. Locking a password does not revoke a previously installed public key, so inspect and remove unauthorised entries in
authorized_keys.
4. Add a second factor when the stack supports it
A supported U2F/FIDO hardware security key can add a second factor to key-based SSH authentication. Ubuntu Server documentation describes two-factor authentication as an additional layer on top of key-based authentication. Confirm that your SSH version, PAM or authentication stack, account-recovery process, and hardware-token enrollment procedure all support the design before requiring it for every administrator. Keep a documented emergency path that does not depend on a single lost token.
5. Validate before reloading
Check the configuration syntax with sshd -t and keep the existing session open while testing a new connection. Only after the test succeeds should you reload or restart the SSH service. If the test connection fails, revert the last change through the still-open session or console rather than repeatedly guessing at settings.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use Fail2Ban as a supplementary rate limit
Fail2Ban watches authentication logs, matches failed-login patterns, and invokes firewall actions to ban and later unban addresses. Its Ubuntu manpage describes a set of server and client programs that monitor log files and issue ban or unban commands. This can reduce repeated noise and slow password guessing, but it does not replace strong authentication.
The same manpage states: “Fail2Ban is able to reduce the rate of incorrect authentications attempts however it cannot eliminate the risk that weak authentication presents.” Keep that limitation visible in your design.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTest the filter before enabling a jail
Use the installed fail2ban-regex utility against the real log source. Test the SSH filter with the applicable /var/log/auth.log file or systemd journal and confirm that legitimate and failed records are classified as expected. A filter that matches nothing provides no protection; one that matches too broadly can ban legitimate users.
Tune the controls deliberately
findtime: the observation window in which failures are counted.maxretry: the number of matched failures allowed in that window.- Ban duration: how long a source remains blocked; choose a period that reduces abuse without creating an unmanageable help-desk burden.
- Trusted addresses: exempt stable administrative or identity-provider addresses only when you are certain they cannot be abused.
- Log backend and firewall action: match the jail to the distribution’s actual journal or file source and to the firewall stack that is active on the host.
Keep a console or recovery route available. Test an ordinary administrator login from an approved network after enabling the jail, and verify that unban behavior works. Never assume a rule written for one firewall implementation will behave identically on another.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Choosing the right combination of controls
No single measure addresses every failure mode. Compare controls by the properties that affect both security and operations.
| Control | Authentication strength | What it prevents or detects | Operational trade-off | Coverage |
|---|---|---|---|---|
| Password-only SSH | Lowest of these options; vulnerable to guessing and reused credentials | Provides basic access but does not reduce automated guessing | Easy to deploy, but requires password policy, reset, and monitoring work | SSH accounts using passwords |
| Public-key SSH | Stronger than password-only when private keys are protected | Reduces successful password guessing | Requires key issuance, storage, rotation, revocation, and recovery procedures | SSH accounts configured for keys |
| Key plus U2F/FIDO factor | Stronger than a key alone when the second factor is enforced correctly | Reduces the impact of stolen passwords or keys | Requires compatible SSH/PAM components, token enrollment, and a lost-token process | SSH deployments that support the factor |
| Fail2Ban | Does not strengthen credentials | Detects repeated failures and rate-limits sources with firewall bans | Needs filter, backend, threshold, allowlist, and firewall testing; can lock out administrators | Services and logs covered by configured jails |
| Central logging and alerting | Does not authenticate users | Improves detection, investigation, and response time | Requires retention, access controls, and an owner for alerts | All services that forward usable events |
For most internet-facing administrative hosts, a sensible progression is tested public-key access, removal of unnecessary root and user access, an optional hardware-backed second factor, central log review, and Fail2Ban or an equivalent rate limit as defense in depth.
Common mistakes and recovery paths
Disabling passwords before testing keys
Symptom: every new SSH connection fails after a configuration change. Recovery: use the still-open session or console, restore the prior setting, validate with sshd -t, and test a fresh connection before trying again.
Banning the administrator
Symptom: a legitimate address is blocked after a few mistyped commands or a shared gateway is banned. Recovery: use console or out-of-band access to remove the temporary ban, correct the trusted-address policy, and lower the chance of shared-address lockouts without weakening authentication.
Relying on password locking to remove a key
Symptom: an account is marked locked, yet access continues through a key. Recovery: inspect and remove unauthorised entries from that account’s authorized_keys, then review all other accounts and persistence locations.
Assuming Fail2Ban proves the host is safe
Symptom: failed-login counts fall, but the server still permits weak credentials or an attacker’s existing session. Recovery: treat the ban as a rate limit, not a compromise assessment; complete the successful-login and account-change review and enforce stronger authentication.
Changing many settings at once
Symptom: you cannot identify which change caused a lockout or service failure. Recovery: restore the last known-good configuration, then apply and test one controlled change at a time with a rollback plan.
Quick Recap
A practical response sequence
- Preserve the relevant authentication logs and define the time window.
- Confirm whether any SSH authentication succeeded and whether unexpected sessions or account changes exist.
- If compromise is plausible, follow the incident-response process before normal hardening work.
- Confirm console or recovery access and keep a tested administrative session available.
- Create and test Ed25519 key access for every required administrator.
- Disable password authentication, restrict root and permitted groups, and add a supported second factor where appropriate.
- Validate with
sshd -t, test a new connection, and reload only after the test passes. - Deploy and test Fail2Ban against the actual log backend, then tune thresholds, trusted addresses, ban duration, and firewall actions.
- Continue monitoring successful logins, key changes, privilege activity, persistence locations, and outbound connections.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
