Missions / Read the log

Mission 3 of 6

Read the log

Here is part of a server's login log. Someone tried many accounts, then got in.

2026-11-02 09:14:01 sshd: Accepted password for maria from 198.51.100.23
2026-11-02 09:15:44 sshd: Failed password for root from 203.0.113.45
2026-11-02 09:15:46 sshd: Failed password for root from 203.0.113.45
2026-11-02 09:15:47 sshd: Failed password for admin from 203.0.113.45
2026-11-02 09:15:49 sshd: Failed password for admin from 203.0.113.45
2026-11-02 09:16:02 sshd: Failed password for ravi from 192.0.2.77
2026-11-02 09:16:03 sshd: Failed password for test from 203.0.113.45
2026-11-02 09:16:05 sshd: Failed password for oracle from 203.0.113.45
2026-11-02 09:16:30 sshd: Accepted password for ravi from 192.0.2.77
2026-11-02 09:17:12 sshd: Failed password for deploy from 203.0.113.45
2026-11-02 09:17:15 sshd: Accepted password for deploy from 203.0.113.45

Which IP address was attacking, and finally got in?

The lesson: Many failures from one address, then a success, is the shape of a password-guessing attack. The fix: block repeated failures, use keys or two-step sign-in, and change the deploy password.
All missionsNext mission: Spot the hole