A Linux administrator suspects unauthorized users are attempting to log in to the Linux server remotely. Which of the following should the administrator check FIRST?

The correct answer is B. /var/log/secure. RedHat and CentOS based systems use this log file instead of /var/log/auth.log. It is mainly used to track the usage of authorization systems. It stores all security related messages including authentication failures. It also tracks sudo logins, SSH logins and other errors…

Security

Question

Options

A/var/log/messages
B/var/log/secure
C/var/log/dmesg
D/var/log/kern.log

How the community answered

(42 responses)

A
5% (2)
B
86% (36)
C
2% (1)
D
7% (3)

Explanation

RedHat and CentOS based systems use this log file instead of /var/log/auth.log. It is mainly used to track the usage of authorization systems. It stores all security related messages including authentication failures. It also tracks sudo logins, SSH logins and other errors logged by system security services

Topics

#/var/log/secure#authentication logs#SSH#unauthorized access

Community Discussion

No community discussion yet for this question.

Full XK0-004 Practice