Reading an access log
First night watch at Bianchi Stationery. The office server keeps a record of who logs in (auth.log, in /var/log) and last night someone tried to force their way in. Read the log, work out who keeps failing again and again without ever getting in, and decode their report.
Lab 1 of 6 in the Blue Team / Defense path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 40 and 100 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Read the access log (auth.log) (50 XP)
- Filter the 'Failed' lines with grep (80 XP)
- Decode the report of the suspicious address (70 XP)
Topics: defense, log, grep.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.grep: finds the lines that contain a word, even across whole folders with -r. It is the main tool for analysing text and logs.base64: encodes and decodes Base64, the format that turns bytes into text. It protects nothing: it can be undone without a key.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
A log tells you who did what and when: the first defense is knowing how to read it. The 'Failed' and 'Invalid user' lines show the attempts that went wrong; a colleague who slips once and then gets in is normal, while an address that tries many different names and never gets in is running a dictionary attack. A single error is not an alarm, repetition is. Defense: read the logs every day (or have a tool alert you), keep failed attempts under watch and block the addresses that keep pushing.
Before and after this lab
To unlock it you must have solved:
- Reading in pieces (Linux Fundamentals, easy)
After this lab you can move on to:
- Who keeps pushing? (Blue Team / Defense, medium)
- Hardening SSH (Blue Team / Defense, medium)
The Blue Team / Defense path
Blue Team / Defense is the path of those who protect. You read access logs, count failed attempts to find out who is forcing a login, rebuild the timeline of an incident, compare an SSH configuration with the recommended one, shut down unnecessary services and handle incident response in four steps: detect, contain, clean up, document. The commands are the same as in the other paths, but used through the eyes of someone who must understand what happened and stop it from happening again.