Failed, failed, failed, in
lastb shows failed logins and last shows sessions. Use both on hr-app-01 to find the account that was guessed, where the guesses came from, and how long the session lasted.
Briefing
hr-app-01’s auth.log rotated before anyone looked, but the binary login records survived: /var/log/btmp for failures and /var/log/wtmp for sessions.
lastb reads failures, newest first. last reads sessions, also newest first, with the duration in brackets.
hr-app-01 · SSH brute force
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.