Monitoring user logins to find intruders

Log files can be used to gather details about the state of the system and attacks on the system.

Suppose we have a system connected to the Internet with SSH enabled. Many attackers are trying to log in to the system. We need to design an intrusion detection system to identify users who fail their login attempts. Such attempts may be of a hacker using a dictionary attack. The script should generate a report with the following details:

• User that failed to log in
• Number of attempts
• IP address of the attacker
• Host mapping for the IP address
• Time when login attempts occurred

Getting ready

A shell script can scan the log files and gather the required information. Login details are recorded in /var/log/auth.log or /var/log/secure. The script scans the log file for failed login attempts and analyzes the data. It uses the host command to map the host from the IP address.

How to do it...

The intrusion detection script resembles this:

#!/bin/bash
#Filename: intruder_detect...