Pipes: Linux's secret superpower
It's plumbing, but for data. No wrench required.
One Linux command is useful. Five commands joined with pipes can answer questions that would take an hour in a spreadsheet. Today's question: who has been trying to log in to my server?
🧰 What you need
- A Linux machine with SSH running (any Ubuntu server, or the old laptop lab)
Let's build it
Your first pipe
ls /usr/bin | wc -l| sends the output of one command into the next. Here: list every program, then count the lines. That's how many programs you have installed.
Make some evidence
From another computer, try to SSH in with a user that doesn't exist, three or four times:
ssh nobody@your-server-ipSearch the logs
sudo journalctl -u ssh --since today | grep -i "invalid user"journalctl reads the system logs; grep keeps only the lines that match.
On some systems the service is called sshd: use -u sshd instead.
Count the knocks
sudo journalctl -u ssh --since today | grep -i "invalid user" | wc -lFind the top suspects
sudo journalctl -u ssh --since today \
| grep -oiE "invalid user [^ ]+" \
| sort | uniq -c | sort -rn | headgrep -o keeps just the matching part, sort | uniq -c counts duplicates, sort -rn puts the biggest first, and head shows the top ten.
✅ How you know it worked
The last command shows a small leaderboard like 4 Invalid user nobody. On a server exposed to the internet, this list is long, and a little bit terrifying.
💥 Break it on purpose
Remove one piece at a time from the end of the chain and run it again. Watch how each command changes the output. That's the best way to understand any pipeline you find online before you trust it.
🧠 What's really going on
Linux follows a simple rule: each program does one thing well, and reads and writes plain text. Pipes connect one program's output directly to the next program's input, so small tools snap together like LEGO. It's a 50-year-old idea, and it's still one of the most powerful things in computing.
← Back to all Linux labs · Stuck? Email me