Monitoring user logins to find intruders
Logfiles can be used to gather details about the state of the system. Here is an interesting scripting problem statement:
We have a system connected to the Internet with SSH enabled. Many attackers are trying to log in to the system, and we need to design an intrusion detection system by writing a shell script. Intruders are defined as users who are trying to log in with multiple attempts for more than two minutes and whose attempts are all failing. Such users are to be detected, and a report should be generated with the following details:
User account to which a login is attempted
Number of attempts
IP address of the attacker
Host mapping for the IP address
Time for which login attempts were performed
Getting ready
We can write a shell script that scans through the logfiles and gather the required information from them. For dealing with SSH login failures, it is useful to know that the user authentication session log is written to the logfile /var/log/auth...
