Review SSH authentication logs on Linux
Generate your own successful and failed SSH logins between two practice VMs, then find and summarise them with journalctl and grep.
Environment
Two VMs on your host-only practice network (from the earlier labs).
Before you start
- Read Log Data (p.317) and Host Operating System Logs (p.318).
You will
- Locate SSH authentication events
- Count and summarise them
- Recognise the fields an analyst uses
Steps
-
1
From VM 2, SSH into VM 1 successfully, then log out.
-
2
SSH again and mistype your own password twice before cancelling.
-
3
On VM 1, view recent SSH events:
sudo journalctl -u ssh --since "10 min ago"(orsudo tail -n 50 /var/log/auth.log). -
4
Pull out the failures:
sudo journalctl -u ssh --since today | grep -i "failed password". -
5
Summarise by source address:
sudo journalctl -u ssh --since today | grep -i "failed password" | grep -oE "from [0-9.]+" | sort | uniq -c. -
6
Note the timestamp, user, source IP and port for one event: these are the fields an analyst correlates with other logs.
Check your understanding
- ?Which part of the key-based SSH setup (earlier lab) makes password-guessing attempts useless?
- ?Why is accurate time (NTP) on every server important when correlating logs?
- ?What would a sudden spike in failures from one address suggest?