Authentication and sudo logs - what gets recorded and how to read it

Authentication events are recorded in multiple places: PAM logs to syslog/journald, sudo logs separately, auditd records syscalls. Knowing where to look and how to correlate is the foundation of auth investigation.

Where auth events are logged

journald for authentication

sudo journalctl -t sshd -t sshd-session  # all sshd events
sudo journalctl -t sudo                  # all sudo events
sudo journalctl SYSLOG_FACILITY=10       # everything on authpriv
sudo journalctl _COMM=sudo               # by executable
sudo journalctl -g "Failed password"     # by message
sudo journalctl -p err                   # priority error or higher

/var/log/auth.log (Debian) or /var/log/secure (RHEL)

sudo tail -f /var/log/auth.log

# Successful login
"Accepted password for alice from 10.0.0.5 port 51234 ssh2"

# Failed login
"Failed password for invalid user admin from 10.0.0.5 port 51235 ssh2"

# Sudo use
"alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/apt update"

last and lastb

last                # recent logins from wtmp
lastb               # recent failed logins from btmp
last -F             # with full timestamps

sudo logs

By default, sudo logs to syslog (authpriv). For richer logs:

# /etc/sudoers.d/logging
Defaults log_input, log_output
Defaults iolog_dir=/var/log/sudo-io/%{user}

The I/O log captures the command’s stdin and stdout:

sudo ls /var/log/sudo-io/

Common patterns to look for

Brute force on SSH:

"Failed password for invalid user admin from 1.2.3.4 port 51234 ssh2"
"Failed password for invalid user admin from 1.2.3.4 port 51235 ssh2"
"Failed password for invalid user admin from 1.2.3.4 port 51236 ssh2"
... (many lines from the same IP)

Account enumeration:

"Invalid user admin from 1.2.3.4"
"Invalid user root from 1.2.3.4"
"Invalid user oracle from 1.2.3.4"

Privilege escalation:

"alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/bin/bash"

Failed sudo:

"alice : 3 incorrect password attempts ; TTY=pts/0"

Configuration changes:

"sudo:    alice : TTY=pts/0 ; PWD=/etc ; USER=root ; COMMAND=/usr/sbin/visudo"

Correlate across sources

For an incident:

1. last / lastb for login history.
2. journalctl -t sshd -t sshd-session for SSH events.
3. journalctl -t sudo for sudo events.
4. ausearch -ua <user> for audit events.
5. aureport --user for summary.

A single timestamp or PID ties events across sources.

Knowledge check