Unit 8: Logs and the timeline · Lesson 2 of 8 · 16 min
Reading auth.log
How an SSH password attempt becomes a line in the log, and what the lines tell you.
mission
- You are
- You are reviewing SSH activity for 14 October.
- Situation
- SSH is open to the internet with passwords allowed. That invites guessing.
- Goal
- Measure the failed attempts and see which accounts were targeted.
- Hand in
- The number of failures and the most tried user names.
An SSH password attempt
Press play or step through.
One line of auth.log
Oct 14 16:05:36 root-lab sshd[5027]: Failed password for root from 203.0.113.77
- 1
Oct 14 16:05:36time - 2
sshd[5027]:program[pid] - 3
Failed passwordevent - 4
rootaccount - 5
203.0.113.77source
Count the failures
grep -c 'Failed password' auth.log 197 grep -c 'Invalid user' auth.log 93
you should see Invalid user means the name does not exist. Guessers try common names hoping one does.
Which names were tried
grep -oE 'Invalid user [a-z]+' auth.log | sort | uniq -c | sort -rn | head -n 3
26 Invalid user admin
15 Invalid user user
13 Invalid user ubuntu
defender tip Never create accounts called admin, user or ubuntu on internet-facing servers.
Sources and successes
grep 'Failed password' auth.log | grep -oE 'from [0-9.]+' | sort | uniq -c | sort -rn | head -n 3 150 from 198.51.100.23 46 from 203.0.113.77 1 from 192.0.2.10 grep -c Accepted auth.log 4
you should see One address made 150 of the failures. Only four logins succeeded.
defender tip Check every Accepted line against the people you expect. A password login among keys is worth a question.
What a defender takes away
- 1Each failed guess is one line with user and source.
- 2Invalid user means the name does not exist.
- 3Many failures prove an attempt, not a breach.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.