Another log and another question — this time you build the pattern yourself.
Overnight someone was trying passwords against SSH. A firewall rule needs a list of the addresses that made failed login attempts: just the addresses, each one once. The SSH server recorded those attempts in auth.log as Failed password lines. Successful logins and dropped connections are there too, from other addresses, but they do not belong on the list.
Collect the failed login addresses
In ~/grep-lab, write to bad-ips.txt the addresses that made failed password login attempts according to auth.log — one address per line, no repeats.
Goals · 0 of 2
- Write only addresses to bad-ips.txt, one per line not done yet
- Collect the failed login addresses without repeats not done yet