/var/log/auth.log - extrait fictif du NAS pedagogique
====================================================

Oct 12 14:17:01 nas-pedago CRON[18402]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Oct 12 14:17:01 nas-pedago CRON[18402]: pam_unix(cron:session): session closed for user root
Oct 12 15:03:45 nas-pedago sshd[19021]: Accepted publickey for admin from 172.16.20.5 port 42812 ssh2: RSA SHA256:8sP3oVf2xM1L9lJ8bN5vC4kF2zR1xV5bM7zL9oP3xVw
Oct 12 15:03:45 nas-pedago sshd[19021]: pam_unix(sshd:session): session opened for user admin(uid=1000) by (uid=0)
Oct 12 15:04:12 nas-pedago sudo: admin : TTY=pts/0 ; PWD=/home/admin ; USER=root ; COMMAND=/usr/bin/apt update
Oct 12 15:04:18 nas-pedago sudo: pam_unix(sudo:session): session closed for user root
Oct 12 15:42:33 nas-pedago sshd[19021]: pam_unix(sshd:session): session closed for user admin
Oct 12 16:21:10 nas-pedago sshd[20145]: Connection closed by 172.16.20.12 port 51302 [preauth]
Oct 12 17:05:22 nas-pedago sshd[21004]: Accepted password for prof from 10.0.5.15 port 39420 ssh2
Oct 12 17:05:22 nas-pedago sshd[21004]: pam_unix(sshd:session): session opened for user prof(uid=1001) by (uid=0)
Oct 12 17:17:01 nas-pedago CRON[21300]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Oct 12 17:17:01 nas-pedago CRON[21300]: pam_unix(cron:session): session closed for user root
Oct 12 17:45:18 nas-pedago sshd[21004]: pam_unix(sshd:session): session closed for user prof
Oct 12 18:17:01 nas-pedago CRON[22102]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Oct 12 18:17:01 nas-pedago CRON[22102]: pam_unix(cron:session): session closed for user root
Oct 13 02:46:12 nas-pedago sshd[28401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.108.45  user=stagiaire
Oct 13 02:46:14 nas-pedago sshd[28401]: Failed password for stagiaire from 192.168.108.45 port 58210 ssh2
Oct 13 02:46:14 nas-pedago sshd[28401]: Connection closed by authenticating user stagiaire 192.168.108.45 port 58210 [preauth]
Oct 13 02:46:21 nas-pedago sshd[28405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.108.45  user=stagiaire
Oct 13 02:46:23 nas-pedago sshd[28405]: Failed password for stagiaire from 192.168.108.45 port 58214 ssh2
Oct 13 02:46:23 nas-pedago sshd[28405]: Connection closed by authenticating user stagiaire 192.168.108.45 port 58214 [preauth]
Oct 13 02:46:34 nas-pedago sshd[28412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.108.45  user=stagiaire
Oct 13 02:46:36 nas-pedago sshd[28412]: Failed password for stagiaire from 192.168.108.45 port 58222 ssh2
Oct 13 02:46:36 nas-pedago sshd[28412]: Connection closed by authenticating user stagiaire 192.168.108.45 port 58222 [preauth]
Oct 13 02:46:42 nas-pedago sshd[28420]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.108.45  user=stagiaire
Oct 13 02:46:44 nas-pedago sshd[28420]: Failed password for stagiaire from 192.168.108.45 port 58228 ssh2
Oct 13 02:46:44 nas-pedago sshd[28420]: Connection closed by authenticating user stagiaire 192.168.108.45 port 58228 [preauth]
Oct 13 02:46:51 nas-pedago sshd[28427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.108.45  user=stagiaire
Oct 13 02:46:53 nas-pedago sshd[28427]: Failed password for stagiaire from 192.168.108.45 port 58234 ssh2
Oct 13 02:46:53 nas-pedago sshd[28427]: Connection closed by authenticating user stagiaire 192.168.108.45 port 58234 [preauth]
Oct 13 02:47:05 nas-pedago sshd[28435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.108.45  user=stagiaire
Oct 13 02:47:07 nas-pedago sshd[28435]: Failed password for stagiaire from 192.168.108.45 port 58242 ssh2
Oct 13 02:47:07 nas-pedago sshd[28435]: Connection closed by authenticating user stagiaire 192.168.108.45 port 58242 [preauth]
Oct 13 02:47:19 nas-pedago sshd[28441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.108.45  user=stagiaire
Oct 13 02:47:22 nas-pedago sshd[28441]: Failed password for stagiaire from 192.168.108.45 port 58246 ssh2
Oct 13 02:47:22 nas-pedago sshd[28441]: Connection closed by authenticating user stagiaire 192.168.108.45 port 58246 [preauth]
Oct 13 02:47:31 nas-pedago sshd[28450]: Accepted password for stagiaire from 192.168.108.45 port 58252 ssh2
Oct 13 02:47:31 nas-pedago sshd[28450]: pam_unix(sshd:session): session opened for user stagiaire(uid=1002) by (uid=0)
Oct 13 02:47:31 nas-pedago systemd-logind[485]: New session 108 of user stagiaire.
Oct 13 02:48:05 nas-pedago su[28472]: FAILED SU (to root) stagiaire on pts/1
Oct 13 02:48:12 nas-pedago su[28475]: FAILED SU (to root) stagiaire on pts/1
Oct 13 02:48:29 nas-pedago sudo: pam_unix(sudo:auth): authentication failure; logname=stagiaire uid=1002 euid=0 tty=/dev/pts/1 ruser=stagiaire rhost= user=stagiaire
Oct 13 02:48:32 nas-pedago sudo: stagiaire : 1 incorrect password attempt ; TTY=pts/1 ; PWD=/home/stagiaire ; USER=root ; COMMAND=/usr/bin/id
Oct 13 02:51:03 nas-pedago sshd[28450]: Received disconnect from 192.168.108.45 port 58252:11: disconnected by user
Oct 13 02:51:03 nas-pedago sshd[28450]: Disconnected from user stagiaire 192.168.108.45 port 58252
Oct 13 02:51:03 nas-pedago sshd[28450]: pam_unix(sshd:session): session closed for user stagiaire
Oct 13 02:51:03 nas-pedago systemd-logind[485]: Removed session 108.
Oct 13 03:17:01 nas-pedago CRON[29112]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Oct 13 03:17:01 nas-pedago CRON[29112]: pam_unix(cron:session): session closed for user root