Lesson 2.17: Linux authentication and audit logs
On Linux servers, auth.log records SSH logins, sudo commands and account changes, and the audit daemon (auditd) records changes to files you choose to watch, with the original login user attached. Together they reconstruct what an intruder did. In the lab you investigate app01: a password-guessing run that finally succeeds, a root shell through sudo, a new user added to the sudo group, an SSH key planted in root's account and a cron file for persistence, and the configuration mistake that made it possible.
17 min
You will learn to
- Read SSH, sudo and account events in auth.log
- Recognise a successful brute-force attack
- Read auditd records and the auid field
- Find planted SSH keys and cron persistence
- Identify the root cause in sshd_config
Key terms
- auth.log
- Debian/Ubuntu's log for authentication: sshd logins, sudo, su, useradd, passwd.
- auditd
- The Linux audit daemon, which records watched files and system calls in /var/log/audit/audit.log.
- auid
- Audit user ID: the account that originally logged in, kept through sudo and su.
- authorized_keys
- The list of public keys allowed to log in to an account over SSH.
- Brute force
- Trying many passwords until one works.
← Security headers · All lessons · HMAC and message authentication →