I was checking my server logs today and found there are quite a lot of ssh brute force attempts recently, I did a quick grep sudo grep ‘invalid’ /var/log/auth.log*|grep -v “;”|wc -l And returns 2595 . Looking further into this, turns out they are initialized by 43 unique IPs, 27 of them have more than 5 failure attempts.

Read the original:
Block brute force attacks with iptables