[Autogenerated] Yes, it's demo time and a demo.
We can go through and learn a little bit about journal C T L
looking at how we can print our SSH activity.
Now,
remember I'm on a public system and that will have been up for just over a day.
So I should have a reasonable amount of activity using the option minus G.
We're able to search for our text strings within our output of journal C T
L and we'll also look at how we can filter using arc.
So come on, let's find that command line.
Hey, and look at this our pixel playground.
Oh, but it's a little bit different.
Yes, it is.
This is an Ubuntu system running in Aws because I want to be
able to demonstrate if we've had our system up and we can see
we've had it up for one day,
two hours and 49 minutes how vulnerable we are to
people trying to log in over ssh, we're able to see this using journal C T L.
So our combined logging mechanism that we have with
system D based machines and minus,
you will allow me to search for service units and here,
we're looking at SSH now already on here at the beginning of the log,
there are many invalid users.
So user names that don't exist on the system.
Now, this may not be malicious, but when we look at things like answerable,
well, that's not a misspelled name, Postgres,
that's not a misspelled name.
These are not myself trying to log on but just misspelling the user name,
we can go through and drill down with journal C T L
and add in the minus G for grip.
And we can then look for a regular expression or in our case,
just a string, failed password for an invalid user.
And putting a space after our user also means that our
search is just that little bit more accurate.
So we can see then how many attempts have been made.
There are literally hundreds here after our 24 hours of running.
Now, of course, as I say,
we have to be careful that if we've logged on and misspelled our user name,
our IP address is going to be included,
but I guarantee you the way the system has been running,
I haven't misspelled my log in name, but be careful on your own systems.
We can also go through and run a separate search for
failed password for the root user.
Now,
I would never advocate having the root user available for login over SSH
because it's going to be a known account on your system.
So it's definitely going to be a target.
But look at this,
all of the IP addresses that are trying to log on
to my system as the user route.
And this most certainly is not from my own system,
my own client system, but look how much is there.
And I'll say this system has been running for something like 26 maybe 27 hours.
So we want to be able to ideally prevent these IP addresses.
But you can see using journal C T L by itself is OK.
But we have to run two separate searches.
So combining our searches together in org can be really useful.
We can start off with a simple arc file co this is really going to be simple.
Believe me, once we go in, we know if we want, we can have the sang.
Remember,
this is optional but does give a little bit more
documentation about what is going on.
And then as we go through,
we can put our first string that we want to search for.
So our failed password, four invalid user.
So these are the users that don't exist on our system.
Again,
I can have a space after user and closer off my string that I'm searching for.
I can open up my first domain block that relates to this search
and we can go through and say that it will be field 13 the 13th
field that has the IP address.
Now this is just a space separated file and it is just a
matter of counting up the field numbers.
There's nothing clever here again,
we can go through and do our second search now.
So combining it all into the single org file,
failed password for root from or I can leave the from out and
then we can go through and print dollar 11,
we can close off the main block and this is all.
So we've got our two lines that we're searching for and then whether
or not we want to print out the 13th or 11th field,
we can go through and save the change.
But now everything is stored that we need within this file.
We can print it out just to make sure you can see how simple this arc file is,
but I can go back now and run my journal C T L command and
pipe it to arc referencing this file.
And we're going to be then carrying out the two searches
together and giving us a combined result.
So come on, let's go through and look at our general C T L ID.
Don't need the minus G for GREP.
Now, I can just pipe the output through to AK referencing our simple arc file.
And now we've just got a list of IP addresses.
And of course,
these will have many IP addresses we can see from
their ending output that are the same.
So we might choose to go through then and pipe the output to salt
sort minus you will give me unique entries.
So now we're only looking at IP addresses being listed once.
So this gives me a great list very, very quickly.
And if we do out of interest, just count,
word count minus L,
we've got 100 and 22 IP addresses that probably
need to be blocked from my system.
Now, I can use source independently, but we can also use modules inside of arc.
So I don't need to rely on other programs so we can have a
single arc file that does all of the work for us.
And that's what we're going to be looking at building up to.