Don't like ads? PRO users don't see any ads ;-)
Public Pastes
Guest

Untitled

By: a guest on Aug 30th, 2012  |  syntax: None  |  size: 1.52 KB  |  hits: 24  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1. /var/log/secure
  2. ===============
  3.  
  4.     # Accepted SSH logins
  5.     cat /var/log/secure* | grep 'Accepted' | awk '{print $1 " " $2 " " $3 " User: " $9 " " }'
  6.     cat /var/log/secure* | sort | grep 'Accepted' | awk '{print $1 " " $2 " " $3 " User: " $9 " IP:" $11 }'
  7.     # sudo
  8.     cat /var/log/secure* | grep 'session opened for user root' | awk '{print $1 " " $2 " " $3 " Sudo User: " $13 " " }'
  9.     # SSH login attempts from non-existing and unauthorized user accounts
  10.     cat /var/log/secure* | grep 'Invalid user'
  11.     # unauthorized ssh accounts
  12.     cat /var/log/secure* | grep 'invalid user'
  13.     # authorized SSH accounts with failed password
  14.     cat /var/log/secure* | grep -v invalid | grep 'Failed password'
  15.     # successful SSH logins by root
  16.     cat /var/log/secure* | grep 'Accepted password for root'
  17.     # unauthorized ssh accounts with failed password
  18.     cat /var/log/secure* | grep 'Failed password for invalid user'
  19.     # refused ssh login attempts
  20.     cat /var/log/secure* | grep 'refused'
  21.     # Password changes
  22.     cat /var/log/secure* | grep 'password changed'
  23.     # New users/groups created
  24.     cat /var/log/secure* | grep 'new group\|new user'
  25.     # Deleted users/groups
  26.     cat /var/log/secure* | grep ssh | grep 'deleted user\|removed group'
  27.     # Has the home folder changed for any user?
  28.     cat /var/log/secure | grep change | grep 'home from'
  29.     # all authentication failures
  30.     cat /var/log/secure | grep 'authentication failure'
  31.  
  32. References
  33. ==========
  34.  
  35. * http://vertito.blogspot.com/2007/08/ssh-log-parsing-and-monitoring.html
create a new version of this paste RAW Paste Data