👮How to Monitor unauthorized SSH attempts on your server & get email Alert
Tags: webdev, beginners, tutorial, cloud
Published: 2022-02-21 08:22:02

## DAY 12 - 👮 Monitor unauthorized SSH attempts on your server. 
 ✅Connect with me on [Twitter](https://twitter.com/anuvindhs)
 🤝🏽Connect with me on [Linkedin](https://www.linkedin.com/in/anuvindhs)
🧑🏼‍🤝‍🧑🏻 Read more post on [dev.to](https://dev.to/anuvindhs) or  [iCTPro.co.nz](https://ictpro.co.nz)


![Image Cover](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1v8dzts1i31bapanf8v7.jpg)
[Tweet This Blog](https://link.anuvindh.com/twitter/DAY-12-SSH-attempts.html)  - [Read on GitHub](https://github.com/anuvindhs/100daysofcloud) - [Read On iCTPro.co.nz](https://ictpro.co.nz)

--------
PWN ing your server is one of the scariest thing , Monitor your server from unwanted SSH attempts.

Getting unauthorized access to your server is usually main motive for attacker, Monitoring the SSH attempts will help you to understand and take proper remediations before the server gets compromised. 

## 📋 Table of Contents
- Install CloudWatch log agent and Configure.
- Create Metric and Setup SNS Notification.
- Get alerts for unauthorized SSH access. 

------

## 👀 Install CloudWatch log agent and Configure.

### Step 1 Install CloudWatch log Agent
- [Follow this tutorial to do so](https://dev.to/aws-builders/hybrid-cloud-install-log-agent-to-monitor-your-server-via-cloudwatch-2flo)

### Step 2 Configure awslogs.conf
- Editing this file will help you to deliver custom logs to cloud watch

```bash
sudo nano /var/awslogs/etc/awslogs.conf 
```
- add this information, make sure you change to your Log group name . if you have followed [Step 1](https://dev.to/aws-builders/hybrid-cloud-install-log-agent-to-monitor-your-server-via-cloudwatch-2flo) tutorial , the name will be **Ec2-Log-Group**.

```text
[general]
state_file = /var/awslogs/state/agent-state  
 
[logstream1]
file = /var/log/auth.log
log_group_name = Ec2-Log-Group
log_stream_name = {instance_id}
datetime_format = %b %d %H:%M:%S
```
- restart the awslog service

```bash
sudo service awslogs restart
```
- Test SSH failed attempts

```bash
sudo tail -f /var/log/auth.log
```
Now if you try with a un-auth name or key , you will be able to see the attempt here.

![Image auth](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yih3fbsd2tbxqnqtb7no.png)

### Verify in CloudWatch log group

- Goto Cloudwatch Dashboard and go to your log group and select your Stream.
- Search for invalid user

![Image invalid user](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ziuxtb0w07xv7y7gd3ny.png)

### Create a metric filter for SNS
- when your verify , you can see an option for create metric filter

|Comments   |Screenshots/Action   |
| ------------ | ------------ |
|Create Metric Filter|![Image Filter](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6z40s78igjtpd7pcnwcx.png)|
|**Name** the filter and add **metric value** and click **Create**|![Image Metricname](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dibxgs91u4ztvsp1cd08.png)|
|Test the metric you have created , goto loggroup and click **Metric filters**|![Image metricfilterarea](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/73rsxi8jwbktghlwur8z.png)|
|select the filter and click **edit**, Now select your server and click **Test pattern**, if everything is good you can see your results|![Image testpattern](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p1r2opajt8f4c9lhl1ta.png)|
|Select the Same metric filter and then click **Create alarm** to create one|![Image alarm](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/34zd25b3add9we76v0cx.png)|
|Change the **period** to 1 min or less|![Image period](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u3lxq0yzqm8uibek6m0j.png)|
|add **Conditions** and click next|![Image Conditions](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ycgcjw3sxoghk7alq55g.png)|
|**Create SNS TOPIC** to deliver email alert, Click **Create topic** |![Image SNS](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i2i0qjcc2uafxpu5v9vf.png)|
|Name **Alarm name** and **Alarm description**|![Image alaramName](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d0xhk2o3enkhs6q2bfow.png)|
|Now Click **Next** and **Create alarm**|![Image alarm](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wbskjxd68brr58vuvsbx.png)|


## Lets Test for un-Authorized SSH Access.
- go to your mail and subscribe to the email that you have received.
- Now goto putty , enter a different user name and try accessing the server.
- if you check the alarm state you can see its changed to 🔴**In alarm**.
- Now check your registed email, You can see  

![Image SNS](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4d15s3xx0cdptzd77l6l.png)

**🎉Congratulations🎉** you have successfully configured your alert to monitor Failed SSH attempts.


{% user anuvindhs %}