Here are command pipelines that extract information from the system authorization log file /var/log/auth.log on who is trying to attack the Course Linux Server (may require privileged read permission on the log files). The format of each line in this file is like this:
Jan 2 09:51:17 idallen-ubuntu sshd[28008]: Failed password for root from 50.46.204.2 port 33092 ssh2
Each line starts with the date, followed by some text. (Different log files may have different date formats.)
I worked through these pipe examples below in class this week.
Each of these commands below is one, long single command line, but to make the long lines easier to read in this document the long lines have been split into multiple lines by using a backslash at the end of a line to mean “continue this with the next line”. You can either type the lines with the backslashes at the end, as shown below, or else simply type one long line and omit the trailing backslashes:
- Find users with most failed passwords (since the log began):
- The userid field is the 9th blank-separated field on each of these lines in
/var/log/auth.log
- We need a numeric sort on the output of
uniq -c
fgrep 'Failed password' /var/log/auth.log \
| awk '{print $9}' | sort | uniq -c | sort -nr | head
- Failed passwords only in January:
- This log file uses the abbreviation
Jan for “January”. (Different log files may have different date formats.)
- Add a second
fgrep to further limit the lines to ones that contain the date string Jan followed by a blank:
fgrep 'Failed password' /var/log/auth.log \
| fgrep 'Jan ' \
| awk '{print $9}' | sort | uniq -c | sort -nr | head
- Failed passwords only in February:
- This log file uses the abbreviation
Feb for “February”.
- Just change
Jan to Feb in the search string:
fgrep 'Failed password' /var/log/auth.log \
| fgrep 'Feb ' \
| awk '{print $9}' | sort | uniq -c | sort -nr | head
- Connections refused only in February:
- Change
Failed password to refused connect in the search string.
- The IP address is the 10th field on each of these lines in
/var/log/auth.log:
Jan 2 02:18:27 idallen-ubuntu sshd[18078]: refused connect from 222.189.239.75 (222.189.239.75)
fgrep 'refused connect' /var/log/auth.log \
| fgrep 'Feb ' \
| awk '{print $10}' | sort | uniq -c | sort -nr | head
