Tell the story in order
Two logs are waiting in /home/student/case5/: a login log (auth.log) and a web log (web.log). They are from the same break-in.
Work out the attacker's address and the exact time they logged in, then write a short timeline so the next analyst can follow the story.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Get the address and time from the `Accepted password` line in `auth.log`.
Then look for the same address in `web.log` to see what they did next.
Solution explanation
You pulled the two facts that anchor the whole case — the address 203.0.113.45 and the login time 09:14:07 — then lined the events up: failed guesses, a successful login, and a visit to /admin moments later. That short, ordered story is exactly what a timeline is for: anyone can read it and understand what happened without digging through raw logs again.
Show solution
grep 'Accepted password' /home/student/case5/auth.log
grep 203.0.113.45 /home/student/case5/web.log
echo '09:13:50 failed logins, 09:14:07 login from 203.0.113.45, 09:14:40 GET /admin' > /home/student/timeline.txt