1

my /var/log/auth.log contains quite some lines such as

"reverse mapping checking getaddrinfo for 
 224.51.174.61.dial.wz.zj.dynamic.163data.com.cn [61.174.51.224] failed - 
 POSSIBLE BREAK-IN ATTEMPT!" 
"Failed password for root from 61.174.51.224 port 4227 ssh2"

"reverse mapping checking getaddrinfo for 
 187-101-166-232.dsl.telesp.net.br [187.101.166.232] failed - 
 POSSIBLE BREAK-IN ATTEMPT!"
"Invalid user Admin from 187.101.166.232"

These I can see that the hackers failed to break in.

But unfortunately I also see some logs such as

Successful su for xxxxxx (my username) by root

My dumb questions are:

  • From the auth.log, how can I tell that the "successful su" was by me, not by hackers who may have gained my login info?
  • How to filter the auth.log file so that it succinctly reports which user successfully logged in, for how long, and from where? The IP addresses were indeed in the auth.log file, but it is not easy to see if they actually succeeded in breaking in.
  • Is there a log file to check what the hackers did?

Thank you for any enlightenment.

2

1) from the auth.log, how can I tell that the "successful su" was by me, not by hackers who may have gained my login info?

That would break the meaning of log files. How should your system know if it is a hacker, that did a succesfull su?

2) How to filter the auth.log file so that it succinctly reports which user successfully logged in, for how long, and from where?

That's what the program last is for. It parses the files /var/log/wmtp and /var/log/utmp, that contain this information. See:

user@host:~$ last
root     pts/0        1.2.3.4      Fri Apr  4 07:59   still logged in
root     pts/5        1.2.3.4      Wed Apr  2 15:58 - 17:00  (01:02)
root     pts/0        1.2.3.4      Wed Apr  2 07:39 - 16:15  (08:36)
root     pts/0        1.2.3.4      Tue Apr  1 07:39 - 16:00  (08:20)

Additionally your can parse older wtmp and utmp files with the -f option: last -f /var/log/wtmp.1.

3) Is there a log file to check what the hackers did?

See question 1). When a hacker gains access to your system it IS a successful authentication. So the system does not know that it is a hacker. All you can do is searching in /var/log/* for traces.

  • Thank you very much Chaos. The "last -iFf /var/log/wtmp.1" is what I was looking for. This "last log" does not seem to show any login from other IPs. All logins were from local 0.0.0.0, does this mean no hacker broke in? – water stone Apr 4 '14 at 8:48
  • That cannot be said 100%. The wtmp utmp files could also be manipulated. My recommendation with servers that are accessble via internet with ssh (if it is nessecary) is use strong passwords and certificates for authentication. – chaos Apr 4 '14 at 9:06
  • Also a delay at ssh login would be preferable. You will get hundrets of connections at port 22 of bots trying to brute force your passwords. – chaos Apr 4 '14 at 9:07
  • Hi Chaos, thank you again. I only manage my own laptop, it surprised me that even a laptop can get so many hack tries (could be because I linked via dhcp and left it stay up for too many hours). Could you inform how to set the "ssh login delay"? Thank you. – water stone Apr 4 '14 at 19:22
  • Just found a discussion page that discusses "delayed ssh login", paste it here in case it may be helpful to others: unix.stackexchange.com/questions/105553/… – water stone Apr 4 '14 at 21:29
-1

You can simply analyze the file auth.log using:

 cat  /var/log/auth.log | grep "Successful"

for see successful attempts

The command above output all lines in /var/log/auth.log containing the word Successful, or you can change the expression, i.e. "Failed password" , to view the failed login attempts.

So now, you can check on the successful logins and see any different ip that its not yours.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.