Last failed login: Fri May 1 23:31:22 CST 2021 from xxx on ssh:notty There were 187 failed login attempts since the last successful login.

In the morning, I noticed somebody wants to visit our host. They tried so many usernames and passwords.

I used a command to check the records of visit:

lastb -100

So many records displayed on the screen.

We can install fail2ban to protect our host.

For centos

yum install epel-release
yum install -y fail2ban
systemctl enable fail2ban

# check Fail2ban's status
fail2ban-client status   

# check Fail2ban's status of sshd
fail2ban-client status  sshd

# check Fai2ban's version
fail2ban-client version   

# check Fail2ban if run or not
fail2ban-client ping     

# start Fail2ban
fail2ban-client start   

# stop Fail2ban  
fail2ban-client stop  

# restart Fail2ban  
fail2ban-client restart

# open Fail2ban's log     
tail -f /var/log/fail2ban.log