Detect Suspicious SSH Login Attempts with Python: A Practical Linux Security Project

Analyse Linux authentication logs, identify repeated failed logins, group suspicious IP addresses, and generate automated security reports.

How to Detect Suspicious SSH Login Attempts with Python and Generate Security Reports

Build a practical Linux security tool that analyses authentication logs, identifies repeated failed SSH login attempts, tracks suspicious IP addresses, and generates security reports automatically. A Linux server connected to the internet can receive hundreds of authentication attempts from unfamiliar IP addresses.

Some attackers try common usernames such as root, admin, or ubuntu. Others use automated tools to test different passwords against an SSH server.

The problem is that these attempts can easily disappear among thousands of normal system log entries.

You could inspect them manually using:

sudo journalctl -u sshd

Or search for failed authentication attempts using:

sudo grep "Failed password" /var/log/secure

On Ubuntu and Debian, the authentication log is commonly located at: