Cybersecurity Triage
Read-only, sensitive outputShow Failed SSH Public-Key Users
You need to extract users and source IPs from failed SSH public-key attempts.
Command
awk '/Failed publickey/ {print $9, $11}' logs/auth.log | sort | uniq -c | sort -nrBefore you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not rotate or remove keys based on this count alone; inspect key fingerprints and account ownership first.
Expected output
Counted failed public-key attempts grouped by username and source IP.
System impact
Read-only, sensitive output. Nothing changes. The command reads auth.log and counts failed public-key attempts by user and source IP.
Recovery / rollback: no state is changed.
When to use it
Use when a key-based SSH login fails and you need to separate stale-key failures from password guessing.
When not to use it
Do not rotate or remove keys based on this count alone; inspect key fingerprints and account ownership first.
next steps
Related commands
Summarize SSH Auth Outcomes
SSH logs get easier to read once accepted and failed methods are counted.
awk '/sshd/ && /Accepted/ {print "accepted", $7} /sshd/ && /Failed password/ {print "failed", "password"} /sshd/ && /Failed publickey/ {print "failed", "publickey"}' logs/auth.log | sort | uniq -c | sort -nr
Count Failed SSH Login IPs
The loudest SSH source is usually visible with one count.
sed -n 's/.*Failed password .* from \([0-9.]*\) port.*/\1/p' logs/auth.log | sort | uniq -c | sort -nr
Count Failed SSH Login Users
Failed SSH attempts are noisy; grouping users makes the pattern readable.
sed -n 's/.*Failed password for \(invalid user \)\?\([^ ]*\) from .*/\2/p' logs/auth.log | sort | uniq -c | sort -nr
List Accepted SSH Login Sources
Successful SSH logins are the access events worth anchoring first.
awk '/Accepted publickey/ {print $1, $2, $3, $9, $11}' logs/auth.log
Spot Unusual HTTP Methods in Access Logs
Most site traffic is boring. The weird methods are worth a look.
awk '$6 !~ /^"(GET|POST|HEAD|OPTIONS)$/ {print $1, $6, $7, $9}' /var/log/nginx/access.log | sort | uniq -c | sort -nr
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.