Brute-force attack
Automatically trying many username and password combinations against a login service until one works. SSH and web admin panels are the most common brute-force targets on small servers.
Why it still works in 2026
Brute-force attacks succeed against servers that allow unlimited login attempts with no delay or lockout, and against accounts still using default, weak or reused passwords. Automated tools can attempt thousands of combinations per minute against an unprotected login service.
The layered defense that actually stops it
No single control fully solves this. Key-based authentication removes passwords as a target, rate limiting through fail2ban slows down and bans repeat offenders, and disabling root login removes the single most commonly targeted account.
Frequently asked questions
Are brute-force attacks usually targeted at a specific server?
Rarely. Most are automated scans running continuously against every IP address on the internet, not a deliberate attempt against one particular business.
Does a complex password fully solve this?
It helps, but key-based authentication removes the risk entirely, since there is no password to guess in the first place.
How can I tell if my server is under a brute-force attempt right now?
Check the authentication log, usually /var/log/auth.log or /var/log/secure, for a high volume of failed login attempts from one or a small number of IP addresses in a short window.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab