A brute-force attack tries credential after credential until something works. Botnets run them continuously against every public server: SSH logins, mailbox passwords, WordPress admin pages.
Defence layers: keys instead of passwords for SSH, rate-limiting and login-failure blocking (LFD/fail2ban-style), and monitoring that distinguishes background noise from a genuine surge. The dangerous moment is not the noise — it is the day one weak password somewhere on the server finally matches.
Frequently asked questions
Hundreds of failed logins daily — should I panic?
No, that is the internet’s background noise. Watch for surges and for successful logins from unexpected addresses — those are the real alarms.
What single measure helps most against SSH brute force?
Key-only authentication. Combined with a firewall and a non-default port, password guessing becomes irrelevant.