Run grep denied /var/log/auth.log.
grep denied /var/log/auth.log
Mission 297
Capstone suspicious login
Review auth evidence, SSH policy, firewall state, and notes.
Capstone labsgrepjournalctlufwtee
Lesson 297 of 360
0/360 lessons
0/17 missions
Capstone labs · 8 minutes
New learnerrank
0XP
0%complete
learner@clairos:/home/learner $
Unix ops lab: type a command, press Enter
Instructions
8 minutes
Click any instruction for the command details, the why, and the common mistake to avoid.
Run journalctl -u ssh -n 2.
journalctl -u ssh -n 2
Run ufw status verbose.
ufw status verbose
Run printf suspicious-login-reviewed | tee lab/login-review.txt.
printf suspicious-login-reviewed | tee lab/login-review.txt
Save progress
Keep learning across sessions.
Create a free account to sync completed lessons, XP, streaks, course status, and your next lesson across sessions.
Checking account status...
Progress sync is idle.
0XP
New learnerrank
0day streak
0best streak
0daily streak
0lessons
0courses
0missions
0tasks
Noverified
Progress sync stores completion IDs, scores, streaks, badges, and game settings. Terminal contents, editor snippets, lab scratch, email, and real names are never published on leaderboards or share cards.
Lesson support
What to notice while you play.
Review auth evidence, SSH policy, firewall state, and notes.
Run the commands in order and compare the outputs.
Junior operators build confidence by gathering evidence before changing systems.
- Skipping the inspection step.
- Assuming one command tells the whole story.
Reference
Commands in this lesson.
grep [-i] <text> <file>
Find literal text inside a file.
tee <file>
Write piped text to a lab file and keep it on screen.
journalctl -u <service>
Read simulated service journal entries.
ufw status
Inspect simulated firewall rules.