I wrote a bash command to scan /var/log/auth.log for messages occurring on the current day indicating unauthorised access.  Currently it just fetches messages matching BREAK-IN and unauthorized.What other strings should I search for in /var/log/auth.log to keep tabs on unauthorized access?Here's the script for reference:cat /var/log/auth.log|grep $(date|awk '{print $2 $3}')|grep -E '(BREAK-IN|Invalid user|Failed|refused|su|Illegal)'EditHere's the amended command based on Justins suggestions and what I found through Googlegrep $(date|awk '{print $2 $3}') /var/log/auth.log|grep -E '(BREAK-IN|Invalid user|Failed|refused|su|Illegal)'
What strings should I look for in /var/log/auth.log?
command line;bash;ssh;authentication
You could look for Invalid user which is thrown when someone tries to logon with an account that does not exist.  It will also throw up Failed password when you enter in an invalid password.Also, you dont need to use cat to dump the file to grep.  Grep can already look at the file as its second option.  'Grep search-criteria /path/tp/file'