← All break/fix scenarios in Proxmox VE
Failed login attempts filling up /var/log/auth.log
Reported symptoms
- ●/var/log/auth.log grows rapidly (GB per day)
- ●journalctl shows hundreds of "Failed password" entries from random IPs
- ●ps aux shows sshd children consuming CPU
- ●The host is publicly reachable (cloud or forwarded port)
Evidence
- · grep "Invalid user" /var/log/auth.log | wc -l
- · lastb | head
- · ip -s link show <external-nic> shows high packet rate
Diagnosis and resolutionclick to reveal
Root cause
The host is being targeted by automated SSH brute-force attacks. This is normal for any internet-exposed SSH server. The issue is that the host is not mitigating the attacks (fail2ban, rate limiting, or non-root login).
Remediation
1. Immediate mitigation: - Install fail2ban: `apt install -y fail2ban` `systemctl enable --now fail2ban` - Default SSH jail blocks IPs with 5 failed attempts in 10 minutes 2. Long-term fixes: - Disable password SSH entirely (keys only) `sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config` - Move SSH off port 22 to reduce noise (optional; security through obscurity) - Allow SSH only from a VPN or bastion 3. Audit existing accounts: `cut -d: -f1,3 /etc/passwd | grep -v "1000:\|65534:"` (find non-system accounts) Disable unused accounts: `usermod -L <user>` 4. Verify the logs are still useful: `journalctl -u sshd --since "1 hour ago" | head -50`
Verification
- /var/log/auth.log stops growing rapidly (rate drops to near-zero) - fail2ban status shows banned IPs: `fail2ban-client status sshd` - Legitimate SSH key logins still work - No successful brute-force in the logs
Prevention
- Always use SSH keys, never passwords - Run fail2ban (or equivalent) on every internet-exposed host - Use a VPN or bastion for SSH access - Centralise logs to detect patterns across many hosts - Enable 2FA for human accounts