Log Grep: Name the Attacker

A Linux server has written 800 lines to its sign-in log (auth.log) today. Most are routine: staff signing in with keys from the office network, scheduled jobs and the odd mistyped password. Some addresses have been trying user names that do not exist, and one has been guessing the password of a real account. You need to find the one that is really attacking, not merely noisy.

The log viewer lets you filter with plain text or a regular expression, and it lists the busiest addresses in the lines that match. Start with the broad picture, then narrow it. Which addresses fail most often? Which user names do they try? Which failures end in a success? Noise is not the same as harm: many failed guesses are a warning, but the address that matters is the one that got in.

Pick the address that you conclude is the attacker and submit it as proof. The server checks it against the generated log and returns the flag if you are right.

The log is generated per instance from invented data. The skill you are practising is the one behind every real triage: filter, count, compare and decide.