Display successful SSH brute force attempts from secure logs
by sudo on Apr.07, 2009, under Linux
for i in `grep "Failed password for invalid user" /var/log/secure | awk '{ print $13 }' | sort | uniq`; do grep $i /var/log/secure | grep "Accepted"; done
This is a work in progress.
Parses IPs from failed SSH attempts then runs it against the logs again for successful attempts.
