- [Man] Hi, and welcome to the next video of Section 8,
Monitoring User Logins to Find Intruders.
In the previous video,
we learned about logging with Syslog.
In this video, we'll learn about how to monitor user logins
to find intruders.
Log files can be used to gather details
about the state of the system.
Here is an interesting scripting problem statement.
We have our system connected to the internet,
where this is h-enabled.
Many attackers are trying to log into the system,
and we need to design an intrusion detection system
by writing a shell script.
Intruders are defined as users who are trying to log in
with multiple attempts for more than two minutes,
and whose attempts are all failing.
Such users are to be detected,
and a report should be generated with the following details.
User account to which a login is attempted,
number of attempts,
IP address of the attacker,
host mapping for the IP address,
time for which the login attempts were performed.
We can write a shell script
that scans through the log files,
and gathers the required information from them.
For dealing with SSH login failures,
it's useful to know that the user authentication session log
is written to the log file, varlogauth.log.
The script should scan the log file to detect
the failure login attempts,
and perform different checks on the log to infer the data.
We can use the host command to find out the host mapping
from the IP address.
Let's write the intruder detection script
that can generate a report to intruders
by using non-authentication log file as follows.
A sample output is as follows;
in the intruder_detect.sh script,
we use the auth log file as input.
We can either provide a log file as input to the script,
by using a command line argument to the script,
or by default, it reads the varlogauth.log file.
We need to log details about login attempts
for valid usernames only.
When a login attempt for an invalid username occurs,
a log similar to "failed password for invalid user bob
from 203.83.248.32 port 7016 sh2,"
is logged to auth.log.
Hence, we need to exclude all lines in the log file
having the word, "invalid."
Though grep command with the invert option, -v,
is used to remove all logs corresponding to invalid users.
The next step is to find out the list of users
for which login attempts occurred and failed.
The SSH will log lines, similar to the highlighted part,
for a failed password.
Hence, we should find all the lines
with words "failed password."
Next, all the unique IP addresses are to be found out
for extracting all the log lines
according to each IP address.
The list of IP addresses is extracted
by using a regular expression for the IP address
and the egrep command.
A for loop is used to iterate through the IP address,
and the corresponding log lines are found using grep,
and are written to a temporary file.
The sixth word from the last word
in the log file is the username,
for example, "bob1."
The awk command is used to extract the sixth word
from the last word,
NF returns the column number of the last word,
therefore, NF-5 gives the column number of the sixth word
from the last word.
We use sort and uniq commands to produce
a list of users without duplication.
Now, we should collect the failed login log-lines,
containing the name of each user.
A for loop is used to read the lines
corresponding to each user,
and then the lines are written to a temporary file.
The first 16 characters in each of the log-lines
is the timestamp.
The cut command is used to extract the timestamp.
Once we have all the timestamps
for failed login attempts for a user,
we should take the difference in time
between the first attempt and the last attempt.
The first log-line corresponds to the first attempt,
and the last log-line corresponds to the last attempt.
We've used head -1 to extract the first line,
and tail -1 to extract the last line.
Now we have a timestamp for, first, tstart,
and last, tends, in string.Format.
Using the date command, we can convert the date
in string representation,
to a total seconds in Unix epochs time.
The variables start and end has the time in seconds,
corresponding to a start and end timestamps
in the date string.
Now, take the difference between them,
and check whether it exceeds two minutes, 120 seconds.
Thus, a particular user is termed as an intruder,
and the corresponding log entry with details
are to be produced as a log.
IP addresses can be extracted from the log,
by using a regular expression for the IP address
and the egrep command.
The number of attempts is the number of log-lines
for the user.
The number of lines can be found out using the wc command.
The host-name mapping can be extracted from the output
of the host command,
by running with the IP address as the argument.
The time-range can be printed
using the timestamp, re-extracted.
Finally, the temporary files using the script, are removed.
The previous script is aimed only illustrating a model
for scanning the log,
and producing a report from it.
It has tried to make the script smaller,
and simpler to leave out the complexity.
Hence, it has a few bugs.
You can improve the script by using a better logic.
Awesome, we have successfully learned
about monitoring user logins to find intruders.
In the next video,
we'll learn about Remote Disk Usage Health Monitor.