I spun up a fresh virtual private server yesterday and decided to check the authentication logs. What I saw made me pause. Every single minute, automated scripts from all over the world were trying to log in. They guessed common usernames like root, admin, test, and demo, running through endless password combinations.
To see this yourself, connect to your server and read /var/log/auth.log. You will spot lines containing "Invalid user" followed by random names, and "Failed password" for existing accounts. It looks alarming, but it is completely normal. Any machine connected to the public internet gets scanned and attacked within minutes of deployment. Seeing these lines does not mean you have been hacked. It just means your server is visible. Still, leaving the door unlocked is a bad idea.
You can filter these noise entries easily by running grep sshd /var/log/auth.log to focus only on SSH daemon activity. To stop the brute-force attempts from hammering your CPU, you should harden the server configuration. First, set up SSH key authentication and disable password login entirely for the root user. This stops automated bots instantly because they do not have your private key. Installing a tool like fail2ban will also help by automatically blocking IP addresses that fail multiple login attempts.
Before you touch any configuration files, heed one critical warning. Always make sure your SSH key actually works in a new terminal session before you disable passwords. If you turn off password authentication while your key is misconfigured, you will lock yourself out of the server completely and have to rely on the hosting provider's recovery console.
Securing infrastructure reminds me of how we manage other digital systems carefully, much like developers embedding safety rules into configuration files as outlined in the Codex of Weights, ensuring that proper boundaries are set from the start. Take ten minutes to set up your keys, lock down root access, and your logs will finally quiet down.
Written with AI assistance and reviewed by a human.
Top comments (0)