A Linux administrator suspects unauthorized users are attempting to log in to the Linux server remotely. Which of the following should the administrator check FIRST?

The correct answer is B. /var/log/secure. RedHat and CentOS based systems use this log file instead of /var/log/auth.log. It is mainly used to track the usage of authorization systems. It stores all security related messages including authentication failures. It also tracks sudo logins, SSH logins and other errors…

Security

Question

Options

A/var/log/messages
B/var/log/secure
C/var/log/dmesg
D/var/log/kern.log

How the community answered

(19 responses)

A
5% (1)
B
89% (17)
C
5% (1)

Explanation

RedHat and CentOS based systems use this log file instead of /var/log/auth.log. It is mainly used to track the usage of authorization systems. It stores all security related messages including authentication failures. It also tracks sudo logins, SSH logins and other errors logged by system security services

Topics

#Linux logging#Security logs#Authentication logs#Remote access security

Community Discussion

No community discussion yet for this question.

Full XK0-005 Practice