Handle the whole incident
This is the real thing. An alert fired on this machine. The log at /home/student/incident/auth.log shows the break-in, and the attacker left a backdoor account and an auto-start service behind.
Work the four steps: find the attacker's address and backdoor account, contain and remove the account and the service, and report what you found in /home/student/report.txt.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Find: get the IP from `auth.log`, and the backdoor account from the UID-0 check.
Remove: `sudo userdel -f svc-mon`, then delete `evilcron.service` and its link.
Report: put BOTH the IP and the account name into /home/student/report.txt.
Solution explanation
You ran a full response. Find: the log gave you the attacker's address 198.51.100.77, and the UID-0 check exposed the backdoor account svc-mon. Contain & remove: deleting svc-mon cut off their login, and removing evilcron.service (with its boot link) killed their way back in. Report: you wrote the address and account into report.txt so the team has a record. Find, Contain, Remove, Report — that is incident response, and you just did the whole loop yourself.
Show solution
grep 'Accepted password' /home/student/incident/auth.log
awk -F: '$3 == 0 {print $1}' /etc/passwd
sudo userdel -f svc-mon
sudo rm /etc/systemd/system/evilcron.service /etc/systemd/system/multi-user.target.wants/evilcron.service
sudo systemctl daemon-reload
echo 'attacker 198.51.100.77 logged in over SSH and added backdoor svc-mon (UID 0) plus evilcron.service; removed the account and the service' > /home/student/report.txt