Rocky I am not good at securing servers but here is the command that will tell you if you are under attack. It will list failed login attempts along with host/ip address:
Code:
grep -i 'authentication failure' /var/log/messages|awk '{ print $13 }' | cut -b7- | sort | uniq -c
O/P
Code:
10 xxx.vnsl.in
12 xxx.xxx.yyy.zzz
56 xxx.xxx.yyy.zzz