<![CDATA[The Secure Shell (SSH) service on Linux servers is frequently targeted by brute-force attacks. This study aims to outline the characteristics of authentication logs generated when the Debian 12 operating system faces such attacks. An experimental method was applied within a local network using a Debian 12 server as the target and Kali Linux as the attacker, with Hydra utilized as the tool to execute the attack. The experiments were conducted across three scenarios based on the volume of attack attempts: 10, 100, and 500 login attempts, while the Fail2Ban service was deactivated. Data analysis was performed quantitatively and descriptively, using Success Rate and Failed Login Rate metrics derived from records in journalctl and auth.log. The test results indicate that a higher attack volume corresponds to a larger amount of generated logs. In a scenario involving a success rate of 0.2%, only 1 password was accepted. The study also identified limitations in OpenSSH sessions (reaching the maximum authentication attempt limit), though Hydra was able to initiate new sessions automatically. Therefore, the system records detailed abnormalities without data loss, making it highly suitable as a primary foundation for server security audits]]>
Copyrights © 2026
