[Autogenerated] Hello and a really big and warm welcome to
this presentation from Plurals site.
My name is Andrew Mallard and I'm going to be your instructor helping guide
you through the module filtering data from log files.
Hm What do we mean by that?
Well, we I'll be taking a look at how we can read data from log files.
We'll see that on modern Linux distributions.
We have the journal C T L command.
So we need to be less concerned about which log it is in.
And we've also got inbuilt filtering commands in journal C T L.
We'll see how we can view our root SSH login attempts.
We can see how we can filter on invalid users,
users that don't exist on our system and we can list unique
occurrences of those IP addresses connecting to our system,
perhaps maliciously,
we can use those IP addresses in a list that we can block with a firewall.
So we're going to make this really practical and hopefully you're
going to be able to carry this out on your own system.
Now, of course, we can use arc,
but there is also proprietary log filtering tools that we could go and purchase.
Now, of course,
they may be able to do a lot more and they may be able to
get you up and running more quickly.
But those tools are going to cost you money using arc.
We can get the data that we need without paying for that proprietary software.
So that has to be an advantage to you and to your organization.
You're also learning a lot more about your system in
building up your own arc filtering tools.
Now, for these demonstrations, I'm using a public Aws Ubuntu system.
You can continue using your own local system.
But we want to show how public systems are vulnerable
to people trying to access via SSH, I've set up my Ubuntu system,
but at the time of recording, this will have only been up for just over one day.
And it's always surprising how quickly these public systems attract attention.
The first off,
we're going to take a look at our journal log and I say
our most modern Linux distributions, we're going to find this.
This gives me a unified tool to read from any of my log files.
And I've got a certain amount of filtering inbuilt into it.
So here we're looking at the mine as U option where we're
filtering on the SSH server unit file,
a nice feature as well is that we can use grip from inside of journal C T L.
So here I've added in the option minus G to look for the
string failed password for invalid user.
We can also then go through and look at failed password four root from.
Now, I would emphasize I would never allow root to log on via SSH.
So I'm less concerned about the route attempts.
However, they will be IP addresses that I possibly want to block from my system,
an invalid user.
We've got to be a little bit careful for two.
You might have misspelled your own user name and then
that's going to be an invalid user.
But once we know we've got good data, we can work with that data.
Now, we can continue using journal C T L but using arc,
we can combine these searches together.
So if I've got an SSH simple dot org file,
we can run our first search looking for an invalid user.
The IP address is going to be in field 13.
So we can print that and we can close that main block.
I can open up another search looking failed password for root from
and then we can go through and print field 11.
It would be this field that had the IP address for root users.
We can close off that block.
And then of course,
I can go through and just pipe the output through to AK
referencing my SSH simple arc file.
So I'm going to get a list of IP addresses and those IP addresses I
could keep very simple by piping through to source minus U to ensure
I've got a unique list of IP S now,
I think it's time that we found a command line and
started looking at some of this, don't you?