Read the scenario first
Each lab starts with a situation, the way a ticket or an exam question does. Work out what is being asked before you type anything.
Free tool · No sign-up needed
Linux Log Analysis Lab: Find an SSH Brute-Force Attack
Work through an SSH log with grep, sort and uniq: count the failed logins, find the attacker, see what they got into, then contain it.
Last updated
Linux command line · Intermediate · About 15 minutes
The scenario
The monitoring system raised an alert overnight: a burst of failed SSH logins on web01. You’re the analyst on shift. The log is /var/log/auth.log.
Find out how big the attack was, where it came from and whether it worked. Then contain it: lock the account that was used and block the attacker’s address.
A practice Ubuntu terminal that runs in your browser. It understands real commands, and nothing you type can break anything.
Your tasks
0 of 5 doneCount the failed password attempts in /var/log/auth.log. (not done yet)
Find the address that made the most failed attempts. (not done yet)
Check whether that address ever signed in successfully, and with which account. (not done yet)
Lock the compromised account. (not done yet)
Block the attacker’s address and allow SSH for everyone else, with the block first in the list. Then turn the firewall on. (not done yet)
student@web01Practice terminal · simulated
Practice terminal: real commands on a simulated Ubuntu server. Type help to see what it knows.
Take it further in OpenpassAI
More labs for the certification you’re studying
OpenpassAI’s Hands-on Labs put you in a Linux or Windows terminal for the certification you’re studying, in guided, hint-only and timed modes.
About this lab
What you’ll practice, and where it’s tested
What you’ll practice
- Counting matching lines with grep -c
- Pulling a column out with awk and ranking it with sort and uniq -c
- Telling failed logins from successful ones
- Locking an account
- Blocking an address, with the rule in the right order
Exams it helps with
- CompTIA CySA+Domain: Security Operations
- CompTIA Security+Domain: Security Operations
- CompTIA Linux+Domain: Troubleshooting
Walkthrough
One way to complete the lab, with the reason for each step. Try it yourself first.
Show the worked solution
- 1Count the failed attempts.
grep -c "Failed password" /var/log/auth.log - 2Rank the addresses they came from.
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr - 3See whether the top address got in: it did, as backup.
grep "Accepted" /var/log/auth.log | grep 203.0.113.45 - 4Lock that account.
sudo passwd -l backup - 5Block the address first.
sudo ufw deny from 203.0.113.45 - 6Then allow SSH for everyone else.
sudo ufw allow 22/tcp - 7Turn the firewall on.
sudo ufw enable
Guide
How to get the most from a lab
Type the commands yourself
Typing a command, getting it wrong and fixing it is what makes it stick. Use the hints when you’re stuck, not before.
Check the walkthrough afterwards
Every lab has a worked solution with the reason for each step. Read it even when you finished: there is often a shorter way.
Do it again from memory
Reset the lab a day later and do it without hints. If you can, you know it. If you can’t, you’ve found what to study.
More free tools
All free toolsFree Hands-On Labs
14 free labs in your browser: Linux and Windows command line, firewall rules and SOHO router setup, checked as you go.
Open the toolFree Performance-Based Questions
Free performance-based questions for 19 CompTIA exams: firewall rules, network diagrams, command-line tasks and drag-and-drop.
Open the toolFree Practice Tests
Free practice tests for 261 popular certification exams, with explanations and a score by exam domain.
Open the tool
FAQs
Got Questions? We’ve Got Answers.
Find quick answers or contact our support team.
Is this a real Linux machine?
No. It’s a practice terminal that runs in your browser. It understands the real commands the lab needs, and many more, and it answers the way an Ubuntu server would. It isn’t a full operating system: nothing is installed, and nothing you type can break anything.
Which commands does the practice terminal understand?
The everyday ones: ls, cd, cat, grep, awk, sed, sort, uniq, find, chmod, chown, useradd, usermod, passwd, systemctl, journalctl, ip, ping, dig, ss and ufw, with pipes, redirects and sudo. Type help in the terminal for the full list. Text editors and package installs aren’t included.
Which exams does this lab help with?
It practices skills from CompTIA CySA+ (Security Operations), CompTIA Security+ (Security Operations) and CompTIA Linux+ (Troubleshooting).
Do I need an account?
No. The labs run in your browser and nothing is saved. Sign up only if you want OpenpassAI’s full labs and progress tracking.
