Python: Triage an SSH Auth Log

MediumDevOps15-25 min

The brief

Turn a raw SSH auth log into an incident summary with Python. Your input is /root/case/auth.log. Failed attempts look like Failed password for <user> from <ip> port ...; successful ones say Accepted password and must NOT be counted as failures.

Write a Python script (e.g. /root/case/report.py) using the re module that writes three plain-text files:

/root/case/fails.txt — total number of failed-password lines
/root/case/top_ip.txt — the source IP with the most failed attempts (one IP dominates)
/root/case/users.txt — number of distinct users named in the failed lines

The log varies per session. See /root/case/brief.txt.

What you'll do

Extract fields from log lines with a regular expression
Tally counts per key with a dict or collections.Counter
Find the maximum by count (the worst-offender IP)
Count distinct values and write results for a downstream step

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.