Your first look at a break-in
You have just sat down at the desk. A login log is waiting for you at /home/student/case1/auth.log. Somebody tried lots of wrong passwords and then got in.
Your job: open the log, find the address the attacker logged in from, and write it down. That is real triage — find the first hard fact and record it.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
The log is at /home/student/case1/auth.log. Start with `grep 'Failed password'`.
`grep 'Accepted password' /home/student/case1/auth.log` shows the single successful login.
Solution explanation
That is the calm rhythm of triage: open the evidence, search for the key lines, pull out the first hard fact, and write it down. The failed logins showed someone guessing the password; the one Accepted password line showed they succeeded, from 198.51.100.23. Everything else you investigate will hang off that address.
Show solution
grep 'Failed password' /home/student/case1/auth.log
grep 'Accepted password' /home/student/case1/auth.log
echo 198.51.100.23 > /home/student/findings.txt