Ubuntu Security · 4.5

📊 System Logs & Audit

Ubuntu's equivalent of Windows Event Viewer⏱ ~3 min

Linux stores logs as text files in /var/log/. Unlike Windows Event Viewer (which has a GUI), you read Linux logs with cat, less, grep, and tail.

Key Log Files in Ubuntu

File	What It Logs	Competition Use
/var/log/auth.log	Authentication events: logins, sudo use, SSH attempts, user additions	Most important — find unauthorized access
/var/log/syslog	General operating system events	Service start/stop, kernel messages
/var/log/dpkg.log	Software installs, removals, updates	Find unauthorized package changes
/var/log/ufw.log	Firewall allow/block events	Active only after ufw is enabled
/var/log/btmp	Failed login attempts (view with: sudo lastb)	Detect brute-force targets

Reading Logs Effectively

bash

# View all of auth.log
sudo cat /var/log/auth.log
 
# View last 50 lines (most recent events)
sudo tail -50 /var/log/auth.log
 
# Follow log in real-time as events happen
sudo tail -f /var/log/auth.log
 
# Search for failed logins
sudo grep 'Failed password' /var/log/auth.log
 
# Search for sudo usage
sudo grep 'sudo' /var/log/auth.log
 
# Search for a specific user's activity
sudo grep 'alice' /var/log/auth.log

Setting Up auditd — Advanced Audit Logging

bash

# Install audit daemon
sudo apt install auditd
 
# Enable auditing
sudo auditctl -e 1
 
# Start audit service automatically at boot
sudo systemctl enable auditd
sudo systemctl start auditd
 
# View audit logs
sudo ausearch -m LOGIN    # Login events
sudo ausearch -m USER_CMD # sudo commands

Services — Modern Ubuntu (systemctl)

bash

# List all services and their status
systemctl list-units --type=service
 
# Check if a service is running
systemctl status ssh
 
# Stop a service
sudo systemctl stop apache2
 
# Disable (don't start at boot)
sudo systemctl disable apache2
 
# Enable (start at boot)
sudo systemctl enable ssh
 
# Common services to disable if not needed:
# telnet, rsh, rlogin, ftp, avahi-daemon, cups (if no printer)

💡 TipNote: The older Boot-Up Manager (bum) shown in some CyberPatriot materials is deprecated. Modern Ubuntu uses systemctl to manage services at boot. If bum is mentioned in an old guide, use systemctl enable/disable instead.

🧠Quick Checkfirst try = +5 XP

Which log file shows SSH logins and sudo usage on Ubuntu?

🎮 Practice what you learned

🏰

Password Fort

Build passwords that survive a brute-force siege

→🕵️

Log Analysis

Hunt attackers through real firewall & access logs

→

⭐ 0 XP🔥 0 days

Open the full interactive CyberPatriot Prep module →