What you will do
When a server is broken into, the people who answer it are called incident responders, and most of their work is reading logs: the lines a machine writes about what it did, and when. You will look at the logs and files copied from one server that was attacked last night. You will look at what is there and how big it is. You will not solve the case: that is the lab's own task.
Before you start
Note
Press Start the lab on the bar at the top of this lesson. This lab is a whole Ubuntu machine of your own, so it takes a little longer to come up than a container. Each Run button below types its command into the machine's terminal, one after another. If one says the machine is still starting, wait a few seconds and press it again. To watch them, or to type your own, press Open terminal on the bar.
1. See what you have
The evidence is in the folder case, in your home folder. It was copied from the attacked server with the same layout. find case -type f lists every file in it: eight, among them the SSH log, the web server's log, the accounts file, two crontabs (the lists of jobs that run on a timer) and two files of keys.
find case -type fShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
2. How much is there?
wc -l counts lines. The SSH log, auth.log, has 1366 and the web server's access.log has 552. Nobody reads that many one by one. An incident responder searches them, and the lab's README says how.
wc -l case/var/log/auth.log case/var/log/nginx/access.logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
3. Read a few lines of the SSH log
Each line is a time, the machine's name, the program that wrote it and what happened. These five lines are failed attempts to sign in over SSH, each try written twice, as an Invalid user line and then a Failed password line, with the address it came from and the user name that was tried.
head -n 5 case/var/log/auth.logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
4. Count the failed passwords
grep prints the lines that contain some words, and -c counts them instead. There are 333 failed passwords in the day. Which of them matter is for you to work out in the lab: a count alone does not say who got in.
grep -c "Failed password" case/var/log/auth.logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Now do the lab
Tip
You have seen the evidence and how to search it. Finding the attacker is this lab's task: open README.md in your home folder with cat README.md in the terminal. It says what to find and how to write it in answers.txt, and gives none of the answers.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. This lesson is worked in a VM lab: each student has an Ubuntu machine of their own holding the same case, and a Run types into its terminal and shows what it printed. The lab itself has a check that marks the written answers and names the first wrong one. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.