Skip to content
Linux Log Parser

Posts tagged: #ssh

← Back to all posts
auth.log and secure Forensics: SSH, sudo and su
Read /var/log/auth.log and /var/log/secure in an investigation: SSH brute force and logins, sudo and su root shells, password and account changes, time formats.
linux-forensicsauth-logsshsudo
Linux Intrusion Investigation: A Log Walkthrough
A worked Linux log investigation on a synthetic jump host: SSH password guessing, a login from a new IP, sudo -i, cron and systemd persistence, log tampering.
linux-forensicscase-studysshauditd