IT-230

Linux Administration

Exercise

Ranges and Quantifiers Exercise

Task

In this hands-on exercise, apply ranges and quantifiers to extract and count IP addresses, then match a directory and everything inside it.

Target host
servera
Privileges
sudo access to write and read authentication log entries

  1. Seed and verify failed-login entries

    The authentication log /var/log/secure is readable only by root. 

    ssh student@servera
sudo -i

    logger writes a message into the system log. Two of these repeat the same address on purpose so that the count at the end has something to show. 

    logger -p authpriv.info -t sshd "Failed password for root from 1.3.3.7"
logger -p authpriv.info -t sshd "Failed password for root from 1.3.3.7"
logger -p authpriv.info -t sshd "Failed password for student from 10.31.31.11"
logger -p authpriv.info -t sshd "Failed password for student from 203.230.113.245"
logger -p authpriv.info -t sshd "Failed password for student from 203.230.113.245"

    Confirm they arrived by reading the end of the log. 

    tail -n 5 /var/log/secure

  2. Extract and count the IP addresses

    Find the failed-password lines, then pull the addresses out of them. -o prints only the matched text instead of the whole line. 

    grep 'Failed password' /var/log/secure | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'

    Pipe the addresses into uniq -c to collapse adjacent duplicates and report how many times each appeared. 

    grep 'Failed password' /var/log/secure | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | uniq -c

    Leave the root shell before continuing.

    exit

  3. Create and match a sample directory tree

    Build a small tree with a website directory in it. 

    mkdir -p /tmp/demo_paths/website/css
touch /tmp/demo_paths/website/css/style.css
touch /tmp/demo_paths/website/index.html
sudo find /tmp

    Keep only the paths that are the website directory itself or something beneath it. 

    sudo find /tmp | grep -E '/website(/.*)?'

  4. Clean up

    Remove the directory tree you created.

    rm -rf /tmp/demo_paths
ls /tmp