Noisy Neighbor

Read Linux server logs, spot an SSH brute-force attack, and confirm the account that fell.

Scenario

Cobalt Media runs a small fleet of hosting boxes. Overnight, web01 lit up the alerting dashboard with a wall of SSH authentication noise, and the on-call analyst grabbed two logs before going back to bed: the SSH auth log and the Apache access log for the same window.

Your incident report has to answer three plain questions: who hammered the box, which account finally let them in, and at what time. Everything you need is in those two files.