{"id":2075,"date":"2025-04-09T12:23:24","date_gmt":"2025-04-09T09:23:24","guid":{"rendered":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/"},"modified":"2025-04-09T12:23:24","modified_gmt":"2025-04-09T09:23:24","slug":"analyzing-root-login-attempts-on-linux-servers","status":"publish","type":"post","link":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/","title":{"rendered":"Analyzing Root Login Attempts on Linux Servers"},"content":{"rendered":"


\n<\/p>\n

In an era where cybersecurity threats are on the rise, system administrators must be vigilant about unauthorized access attempts to their Linux servers, particularly those targeting the root account. The root user has unrestricted access to the system, making it a primary target for attackers. In this article, we will delve into how to analyze root login attempts on Linux servers effectively, ensuring that you can take proactive measures to secure your systems.<\/p>\n

<\/p>\n

Understanding the Importance of Monitoring Root Login Attempts<\/h2>\n

<\/p>\n

The root account is the most powerful user in Linux, and as such, it is often the primary target for potential attackers. Monitoring root login attempts can help you:<\/p>\n

<\/p>\n

    <\/p>\n
  1. Detect Unauthorized Access<\/strong>: Quickly catch any unauthorized access attempts.<\/li>\n

    <\/p>\n

  2. Identify Attack Patterns<\/strong>: Help recognize patterns that could indicate a brute-force attack or other malicious activity.<\/li>\n

    <\/p>\n

  3. Strengthen Security Policies<\/strong>: Assess the effectiveness of current security policies and make informed decisions to enhance server security.<\/li>\n

    \n<\/ol>\n

    <\/p>\n

    Tools for Monitoring Login Attempts<\/h2>\n

    <\/p>\n

    1. Using \/var\/log\/auth.log<\/code> and \/var\/log\/secure<\/code><\/strong><\/h3>\n

    <\/p>\n

    Most Linux distributions log authentication attempts in the \/var\/log\/auth.log<\/code> file (Debian-based systems) or \/var\/log\/secure<\/code> (Red Hat-based systems). You can use command-line utilities like grep<\/code> to filter root login attempts.<\/p>\n

    <\/p>\n

    # For Debian-based systems
    \ngrep 'root' \/var\/log\/auth.log
    \n
    \n# For Red Hat-based systems
    \ngrep 'root' \/var\/log\/secure<\/code><\/pre>\n
    <\/p>\n
    2. Using last<\/code> Command<\/strong><\/h3>\n
    <\/p>\n
    The last<\/code> command displays a list of last logged-in users, which can be useful for spotting root login activity.<\/p>\n
    <\/p>\n
    last -a | grep 'root'<\/code><\/pre>\n
    <\/p>\n
    3. Using fail2ban<\/code><\/strong><\/h3>\n
    <\/p>\n
    fail2ban<\/code> is a tool that scans log files for specific patterns and bans IPs that show malicious signs, such as too many password failures. It can be configured to monitor root login attempts specifically.<\/p>\n
    <\/p>\n
    sudo apt install fail2ban<\/code><\/pre>\n
    <\/p>\n
    In the jail.local<\/code> file, you can enable the SSH jail and configure it to ban IP addresses with excessive failed attempts to log in as root.<\/p>\n
    <\/p>\n
    4. Using auditd<\/code><\/strong><\/h3>\n
    <\/p>\n
    auditd<\/code> is the Linux Auditing System, which can provide detailed logs on login attempts. You can configure it to record access to the root account.<\/p>\n
    <\/p>\n
      <\/p>\n
    1. \n
      Install auditd<\/code>:<\/p>\n
      <\/p>\n
      sudo apt install auditd<\/code><\/pre>\n
      \n<\/li>\n
      <\/p>\n
    2. \n
      Configure audit rules:
      \nEdit \/etc\/audit\/rules.d\/audit.rules<\/code> to add a rule for tracking root access:<\/p>\n
      <\/p>\n
      -w \/etc\/shadow -p w -k password_changes<\/code><\/pre>\n
      \n<\/li>\n
      <\/p>\n
    3. Restart the audit daemon:\n
      sudo service auditd restart<\/code><\/pre>\n<\/li>\n
      \n<\/ol>\n
      <\/p>\n
      5. Analyzing with journalctl<\/code><\/strong><\/h3>\n
      <\/p>\n
      On systems using systemd<\/code>, journalctl<\/code> can be a powerful tool to analyze login events.<\/p>\n
      <\/p>\n
      journalctl _SYSTEMD_UNIT=sshd.service | grep 'root'<\/code><\/pre>\n
      <\/p>\n
      This command will give you logs specifically related to SSH access attempts for the root user.<\/p>\n
      <\/p>\n
      Best Practices for Securing Root Access<\/h2>\n
      <\/p>\n
        <\/p>\n
      1. \n
        Disable Root Login via SSH<\/strong>: Modify the configuration file \/etc\/ssh\/sshd_config<\/code> to prevent root login.<\/p>\n
        <\/p>\n
        PermitRootLogin no<\/code><\/pre>\n
        \n<\/li>\n
        <\/p>\n
      2. \n
        Use SSH Key Authentication<\/strong>: Implement key-based authentication instead of passwords for an additional layer of security.<\/p>\n
        \n<\/li>\n
        <\/p>\n
      3. \n
        Implement Strong Password Policies<\/strong>: Ensure that strong, complex passwords are enforced if password authentication must be used.<\/p>\n
        \n<\/li>\n
        <\/p>\n
      4. \n
        Regular Log Review<\/strong>: Conduct weekly or monthly reviews of login attempts to spot unusual patterns timely.<\/p>\n
        \n<\/li>\n
        <\/p>\n
      5. \n
        Use Two-Factor Authentication (2FA)<\/strong>: Adding 2FA provides an extra layer of security even if a password is compromised.<\/p>\n
        \n<\/li>\n
        <\/p>\n
      6. Limit SSH Access by IP<\/strong>: If possible, restrict SSH access to trusted IP addresses for administrative tasks.<\/li>\n
        \n<\/ol>\n
        <\/p>\n
        Conclusion<\/h2>\n
        <\/p>\n
        Monitoring root login attempts on your Linux servers is crucial for maintaining the security of your systems. By utilizing the right tools and implementing best practices, you can enhance your server’s security posture and greatly diminish the risks associated with unauthorized access. Ensure your logs are monitored regularly, and adjust your security measures as necessary to adapt to evolving threats. <\/p>\n
        <\/p>\n
        Stay secure, and make sure your systems are not the easy target an attacker is looking for!<\/p>\n
        <\/p>\n
        \n
        <\/p>\n
        This article serves to enlighten system administrators on how to observe, analyze, and respond to root login attempts effectively. By following the practices and using the tools outlined, you’ll be better equipped to protect your Linux servers against unauthorized access. For more insights on Linux security, stay tuned to WafaTech Blog!<\/p>\n\n","protected":false},"excerpt":{"rendered":"
        In an era where cybersecurity threats are on the rise, system administrators must be vigilant about unauthorized access attempts to their Linux servers, particularly those targeting the root account. The root user has unrestricted access to the system, making it a primary target for attackers. In this article, we will delve into how to analyze […]<\/p>\n","protected":false},"author":2,"featured_media":2076,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[22],"tags":[1269,1116,265,269,268,302],"class_list":["post-2075","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-security","tag-analyzing","tag-attempts","tag-linux","tag-login","tag-root","tag-servers","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\nAnalyzing Root Login Attempts on Linux Servers - WafaTech Blogs<\/title>\n<meta name=\"description\" content=\"Analyzing Root Login Attempts on Linux Servers %\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Analyzing Root Login Attempts on Linux Servers\" \/>\n<meta property=\"og:description\" content=\"Analyzing Root Login Attempts on Linux Servers %\" \/>\n<meta property=\"og:url\" content=\"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/\" \/>\n<meta property=\"og:site_name\" content=\"WafaTech Blogs\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/people\/WafaTech\/61560546351289\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-09T09:23:24+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/wafatech.sa\/blog\/wp-content\/uploads\/2024\/06\/logo_big.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"2221\" \/>\n\t<meta property=\"og:image:height\" content=\"482\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"WafaTech SA\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@wafatech_sa\" \/>\n<meta name=\"twitter:site\" content=\"@wafatech_sa\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"WafaTech SA\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/\"},\"author\":{\"name\":\"WafaTech SA\",\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/#\\\/schema\\\/person\\\/1a5761fc0feb63ab59d295d7c2648f06\"},\"headline\":\"Analyzing Root Login Attempts on Linux Servers\",\"datePublished\":\"2025-04-09T09:23:24+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/\"},\"wordCount\":580,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Analyzing-Root-Login-Attempts-on-Linux-Servers.png\",\"keywords\":[\"Analyzing\",\"Attempts\",\"Linux\",\"Login\",\"Root\",\"Servers\"],\"articleSection\":[\"Linux Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/\",\"url\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/\",\"name\":\"Analyzing Root Login Attempts on Linux Servers - WafaTech Blogs\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Analyzing-Root-Login-Attempts-on-Linux-Servers.png\",\"datePublished\":\"2025-04-09T09:23:24+00:00\",\"description\":\"Analyzing Root Login Attempts on Linux Servers %\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Analyzing-Root-Login-Attempts-on-Linux-Servers.png\",\"contentUrl\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Analyzing-Root-Login-Attempts-on-Linux-Servers.png\",\"width\":1024,\"height\":1024,\"caption\":\"linux server monitoring root login attempts\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/linux\\\/linux-security\\\/analyzing-root-login-attempts-on-linux-servers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Analyzing Root Login Attempts on Linux Servers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/\",\"name\":\"WafaTech Blogs\",\"description\":\"Smart Technologies\",\"publisher\":{\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/#organization\"},\"alternateName\":\"WafaTech\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/#organization\",\"name\":\"WafaTech Blogs\",\"alternateName\":\"WafaTech\",\"url\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/logo_big.webp\",\"contentUrl\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/logo_big.webp\",\"width\":2221,\"height\":482,\"caption\":\"WafaTech Blogs\"},\"image\":{\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/people\\\/WafaTech\\\/61560546351289\\\/\",\"https:\\\/\\\/x.com\\\/wafatech_sa\",\"https:\\\/\\\/www.youtube.com\\\/@wafatech-sa\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/wafatech\\\/\"],\"description\":\"WafaTech, a leading Saudi IT services provider, specializes in cloud solutions, connectivity, and ICT services. Offering secure cloud infrastructure, high-speed internet, and ICT solutions like hosting, backup, and disaster recovery, WafaTech operates a Tier 3 data center at KAUST with ISO certifications. Regulated by CST, the company is committed to innovation, security, and customer satisfaction, empowering businesses in the digital age.\",\"email\":\"sales@wafatech.sa\",\"legalName\":\"Al-Wafa Al-Dhakia For Information Technology LLC\",\"foundingDate\":\"2013-01-08\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":\"11\",\"maxValue\":\"50\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/#\\\/schema\\\/person\\\/1a5761fc0feb63ab59d295d7c2648f06\",\"name\":\"WafaTech SA\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde877f001a2e0497276edc0684d3ba2a416c0de8caeb8e785076a1b1b932b3a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde877f001a2e0497276edc0684d3ba2a416c0de8caeb8e785076a1b1b932b3a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde877f001a2e0497276edc0684d3ba2a416c0de8caeb8e785076a1b1b932b3a?s=96&d=mm&r=g\",\"caption\":\"WafaTech SA\"},\"url\":\"https:\\\/\\\/wafatech.sa\\\/blog\\\/author\\\/omer-yaseen\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Analyzing Root Login Attempts on Linux Servers - WafaTech Blogs","description":"Analyzing Root Login Attempts on Linux Servers %","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/","og_locale":"en_US","og_type":"article","og_title":"Analyzing Root Login Attempts on Linux Servers","og_description":"Analyzing Root Login Attempts on Linux Servers %","og_url":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/","og_site_name":"WafaTech Blogs","article_publisher":"https:\/\/www.facebook.com\/people\/WafaTech\/61560546351289\/","article_published_time":"2025-04-09T09:23:24+00:00","og_image":[{"width":2221,"height":482,"url":"https:\/\/wafatech.sa\/blog\/wp-content\/uploads\/2024\/06\/logo_big.webp","type":"image\/webp"}],"author":"WafaTech SA","twitter_card":"summary_large_image","twitter_creator":"@wafatech_sa","twitter_site":"@wafatech_sa","twitter_misc":{"Written by":"WafaTech SA","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/#article","isPartOf":{"@id":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/"},"author":{"name":"WafaTech SA","@id":"https:\/\/wafatech.sa\/blog\/#\/schema\/person\/1a5761fc0feb63ab59d295d7c2648f06"},"headline":"Analyzing Root Login Attempts on Linux Servers","datePublished":"2025-04-09T09:23:24+00:00","mainEntityOfPage":{"@id":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/"},"wordCount":580,"commentCount":0,"publisher":{"@id":"https:\/\/wafatech.sa\/blog\/#organization"},"image":{"@id":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/wafatech.sa\/blog\/wp-content\/uploads\/2025\/04\/Analyzing-Root-Login-Attempts-on-Linux-Servers.png","keywords":["Analyzing","Attempts","Linux","Login","Root","Servers"],"articleSection":["Linux Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/","url":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/","name":"Analyzing Root Login Attempts on Linux Servers - WafaTech Blogs","isPartOf":{"@id":"https:\/\/wafatech.sa\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/#primaryimage"},"image":{"@id":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/wafatech.sa\/blog\/wp-content\/uploads\/2025\/04\/Analyzing-Root-Login-Attempts-on-Linux-Servers.png","datePublished":"2025-04-09T09:23:24+00:00","description":"Analyzing Root Login Attempts on Linux Servers %","breadcrumb":{"@id":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/#primaryimage","url":"https:\/\/wafatech.sa\/blog\/wp-content\/uploads\/2025\/04\/Analyzing-Root-Login-Attempts-on-Linux-Servers.png","contentUrl":"https:\/\/wafatech.sa\/blog\/wp-content\/uploads\/2025\/04\/Analyzing-Root-Login-Attempts-on-Linux-Servers.png","width":1024,"height":1024,"caption":"linux server monitoring root login attempts"},{"@type":"BreadcrumbList","@id":"https:\/\/wafatech.sa\/blog\/linux\/linux-security\/analyzing-root-login-attempts-on-linux-servers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/wafatech.sa\/blog\/"},{"@type":"ListItem","position":2,"name":"Analyzing Root Login Attempts on Linux Servers"}]},{"@type":"WebSite","@id":"https:\/\/wafatech.sa\/blog\/#website","url":"https:\/\/wafatech.sa\/blog\/","name":"WafaTech Blogs","description":"Smart Technologies","publisher":{"@id":"https:\/\/wafatech.sa\/blog\/#organization"},"alternateName":"WafaTech","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/wafatech.sa\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/wafatech.sa\/blog\/#organization","name":"WafaTech Blogs","alternateName":"WafaTech","url":"https:\/\/wafatech.sa\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/wafatech.sa\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/wafatech.sa\/blog\/wp-content\/uploads\/2024\/06\/logo_big.webp","contentUrl":"https:\/\/wafatech.sa\/blog\/wp-content\/uploads\/2024\/06\/logo_big.webp","width":2221,"height":482,"caption":"WafaTech Blogs"},"image":{"@id":"https:\/\/wafatech.sa\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/people\/WafaTech\/61560546351289\/","https:\/\/x.com\/wafatech_sa","https:\/\/www.youtube.com\/@wafatech-sa","https:\/\/www.linkedin.com\/company\/wafatech\/"],"description":"WafaTech, a leading Saudi IT services provider, specializes in cloud solutions, connectivity, and ICT services. Offering secure cloud infrastructure, high-speed internet, and ICT solutions like hosting, backup, and disaster recovery, WafaTech operates a Tier 3 data center at KAUST with ISO certifications. Regulated by CST, the company is committed to innovation, security, and customer satisfaction, empowering businesses in the digital age.","email":"sales@wafatech.sa","legalName":"Al-Wafa Al-Dhakia For Information Technology LLC","foundingDate":"2013-01-08","numberOfEmployees":{"@type":"QuantitativeValue","minValue":"11","maxValue":"50"}},{"@type":"Person","@id":"https:\/\/wafatech.sa\/blog\/#\/schema\/person\/1a5761fc0feb63ab59d295d7c2648f06","name":"WafaTech SA","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/fde877f001a2e0497276edc0684d3ba2a416c0de8caeb8e785076a1b1b932b3a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/fde877f001a2e0497276edc0684d3ba2a416c0de8caeb8e785076a1b1b932b3a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fde877f001a2e0497276edc0684d3ba2a416c0de8caeb8e785076a1b1b932b3a?s=96&d=mm&r=g","caption":"WafaTech SA"},"url":"https:\/\/wafatech.sa\/blog\/author\/omer-yaseen\/"}]}},"jetpack_featured_media_url":"https:\/\/wafatech.sa\/blog\/wp-content\/uploads\/2025\/04\/Analyzing-Root-Login-Attempts-on-Linux-Servers.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wafatech.sa\/blog\/wp-json\/wp\/v2\/posts\/2075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wafatech.sa\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wafatech.sa\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wafatech.sa\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/wafatech.sa\/blog\/wp-json\/wp\/v2\/comments?post=2075"}],"version-history":[{"count":0,"href":"https:\/\/wafatech.sa\/blog\/wp-json\/wp\/v2\/posts\/2075\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wafatech.sa\/blog\/wp-json\/wp\/v2\/media\/2076"}],"wp:attachment":[{"href":"https:\/\/wafatech.sa\/blog\/wp-json\/wp\/v2\/media?parent=2075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wafatech.sa\/blog\/wp-json\/wp\/v2\/categories?post=2075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wafatech.sa\/blog\/wp-json\/wp\/v2\/tags?post=2075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}