When a Linux system is compromised, the narrative of the intrusion is almost always captured within the system logs. To the untrained eye, these logs are just lines of text, but for a security professional, they are the primary tool for reconstruction. As the source material suggests, the story is in the logs; you just have to read it.

Here is a detailed breakdown of the steps to trace an intruder’s path through a Linux system.

1. Identifying the “Brute Force” Pattern

The first indicator of a breach often appears in the login records. An attacker rarely gets a password right on the first try. Instead, they use automated scripts to try thousands of combinations.

• What to look for: Look for a “wall of failures”—a long, dense sequence of failed login attempts coming from a single source.
• The “Smoking Gun”: The most critical moment is when that long string of failures is suddenly followed by one successful login. This transition indicates that the brute force attack was successful and the attacker has gained access.
• Example: In a file like /var/log/auth.log (common in Debian/Ubuntu) or /var/log/secure (common in RHEL/CentOS), you might see 500 “authentication failure” entries followed by a “session opened for user root.” (Note: specific log paths are common Linux standards and not explicitly mentioned in the source).

2. Investigating User Activity and Escalation

Once an attacker is inside, their next goals are usually persistence (making sure they can get back in) and privilege escalation (getting higher levels of access, like ‘root’).

• New Users: Check the logs for the creation of new user accounts that shouldn’t be there. Attackers often create a “backdoor” account to bypass the need for future brute-forcing.
• Sudo Usage: Monitor “sudo” usage closely. Look for commands being run with administrative privileges by users who typically don’t have that authority.
• Example: If a standard web-service user suddenly executes sudo useradd, it is a major red flag indicating the attacker is attempting to solidify their control.

3. Tracing the Attacker’s Path

Once you have identified a successful unauthorized login, you will have the attacker’s source IP address. This address is the key to unlocking the full story.

• The Power of ‘Grep’: You should “grep” (a command-line utility for searching plain-text data) that specific IP address across every single log file on the system.
• Contextual Mapping: By searching the IP across all logs, you can see every action the attacker took. You can see which files they accessed, what web queries they made, and if they attempted to move to other machines on your network.
• Example Command: A security admin might run a command like grep "192.168.1.100" /var/log/* to see every mention of the intruder’s address across the entire log directory (Note: this specific command is a standard Linux example provided for context).

Summary

The logs provide a chronological record of an intruder’s journey from their first failed attempt to their final actions on the system. By systematically identifying successful logins after failures, auditing user changes, and tracing the source IP across the entire system, you can effectively map out the scope of a breach and begin the recovery process.