Home / Labs / Correlate the Login Log

Correlate the Login Log

Auth log exported from the host. Count the failures, find who they came from, and work out whether the attack actually got in. The last line of a brute force is usually the one that matters.

Open this lab

Commands practised here

• grep -c "Failed password" auth.logHow many failed attempts.
• grep "from" auth.log | awk '{print $10}'Pull the source IP column out of each line.
• grep "Accepted password" auth.logOnly the logins that worked.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Baseline the Host
• Suspicious Accounts