Home / Labs / Crack the Auth Log

Crack the Auth Log

The auth.log is massive from a sustained attack. Extract the signal from the noise.

Open this lab

Commands practised here

• grep 'Failed password' /var/log/auth.log | wc -lCounts total failed login attempts.
• grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rnRanks attacker IPs by attempt count.
• grep 'Accepted' /var/log/auth.logShows all successful logins.
• grep 'Accepted' /var/log/auth.log | awk '{print $11}' | sort -uLists unique IPs that got in.
• grep 'Failed password' /var/log/auth.log | awk '{print $9}' | sort | uniq -c | sort -rnShows which usernames were targeted most.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• What's Here?
• Crack the Brute Force