Anatomy of auth.log

What the log records

Every SSH login attempt and every sudo leaves a line in /srv/soc-data/linux/auth.log. The two lines you care about most:

• Failed password for <user> from <ip> — a rejected login
• Accepted password for <user> from <ip> — a successful one

A handful of failures is normal. Dozens in a row from one address, then an Accepted, is a brute-force attack that worked. Count the failures:

grep -c 'Failed password' /srv/soc-data/linux/auth.log

In the terminal

student@vulntech:~$ grep -c 'Failed password' /srv/soc-data/linux/auth.log
48

Now see who the attacker was aiming at — the usernames being guessed:

grep 'Failed password' /srv/soc-data/linux/auth.log | awk '{print $9}' | sort | uniq -c | sort -rn

In the terminal

student@vulntech:~$ grep 'Failed password' /srv/soc-data/linux/auth.log | awk '{print $9}' | sort | uniq -c | sort -rn
     21 invalid
      7 root
      7 postgres
      7 admin
      6 svc-backup

Tip: awk '{print $9}' prints the 9th whitespace-separated field of each line. Piping to sort | uniq -c | sort -rn gives you a ranked tally — the analyst's Swiss-army move for "which value shows up most?"