victor/CursoCiberseguridad
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

several files added

Browse Source
This commit is contained in:
Victor Gracia Enguita
2025-06-16 12:31:41 +02:00
parent a83f018806
commit 7f3d462b02
3 changed files with 198 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
AnalisisDigitalForense/Practica5/dpkg.txt → AnalisisDigitalForense/Practica5/dpkg.log
View File

161
AnalisisDigitalForense/Practica5/journal_ssh.log Normal file
View File

@ -0,0 +1,161 @@
May 27 10:08:06 Fedora useradd[4108]: new user: name=sshd, UID=113, GID=65534, home=/run/sshd, shell=/usr/sbin/nologin, from=none
May 27 10:08:07 Fedora sshd[4170]: Server listening on 0.0.0.0 port 22.
May 27 10:08:07 Fedora sshd[4170]: Server listening on :: port 22.
May 27 10:10:02 Fedora sshd[4170]: Received signal 15; terminating.
May 27 10:10:02 Fedora sshd[4233]: Server listening on 0.0.0.0 port 22.
May 27 21:45:20 Fedora sshd[4694]: Received disconnect from 10.0.2.7 port 53712:11: Bye Bye [preauth]
May 27 21:45:20 Fedora sshd[4694]: Disconnected from authenticating user darthvader 10.0.2.7 port 53712 [preauth]
May 27 21:45:20 Fedora sshd[4233]: error: beginning MaxStartups throttling
May 27 21:45:20 Fedora sshd[4233]: drop connection #10 from [10.0.2.7]:53840 on [10.0.2.20]:22 past MaxStartups
May 27 21:45:20 Fedora sshd[4707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:20 Fedora sshd[4699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:22 Fedora sshd[4707]: Failed password for darthvader from 10.0.2.7 port 53868 ssh2
May 27 21:45:22 Fedora sshd[4701]: Failed password for darthvader from 10.0.2.7 port 53794 ssh2
May 27 21:45:22 Fedora sshd[4696]: Failed password for darthvader from 10.0.2.7 port 53726 ssh2
May 27 21:45:22 Fedora sshd[4704]: Failed password for darthvader from 10.0.2.7 port 53820 ssh2
May 27 21:45:22 Fedora sshd[4703]: Failed password for darthvader from 10.0.2.7 port 53808 ssh2
May 27 21:45:22 Fedora sshd[4702]: Failed password for darthvader from 10.0.2.7 port 53798 ssh2
May 27 21:45:22 Fedora sshd[4706]: Failed password for darthvader from 10.0.2.7 port 53854 ssh2
May 27 21:45:22 Fedora sshd[4698]: Failed password for darthvader from 10.0.2.7 port 53756 ssh2
May 27 21:45:22 Fedora sshd[4705]: Failed password for darthvader from 10.0.2.7 port 53824 ssh2
May 27 21:45:22 Fedora sshd[4708]: Failed password for darthvader from 10.0.2.7 port 53882 ssh2
May 27 21:45:22 Fedora sshd[4700]: Failed password for darthvader from 10.0.2.7 port 53788 ssh2
May 27 21:45:22 Fedora sshd[4699]: Failed password for darthvader from 10.0.2.7 port 53772 ssh2
May 27 21:45:22 Fedora sshd[4697]: Failed password for darthvader from 10.0.2.7 port 53740 ssh2
May 27 21:45:25 Fedora sshd[4701]: Failed password for darthvader from 10.0.2.7 port 53794 ssh2
May 27 21:45:25 Fedora sshd[4706]: Failed password for darthvader from 10.0.2.7 port 53854 ssh2
May 27 21:45:25 Fedora sshd[4697]: Failed password for darthvader from 10.0.2.7 port 53740 ssh2
May 27 21:45:25 Fedora sshd[4700]: Failed password for darthvader from 10.0.2.7 port 53788 ssh2
May 27 21:45:25 Fedora sshd[4705]: Failed password for darthvader from 10.0.2.7 port 53824 ssh2
May 27 21:45:25 Fedora sshd[4696]: Failed password for darthvader from 10.0.2.7 port 53726 ssh2
May 27 21:45:25 Fedora sshd[4707]: Failed password for darthvader from 10.0.2.7 port 53868 ssh2
May 27 21:45:25 Fedora sshd[4698]: Failed password for darthvader from 10.0.2.7 port 53756 ssh2
May 27 21:45:25 Fedora sshd[4704]: Failed password for darthvader from 10.0.2.7 port 53820 ssh2
May 27 21:45:25 Fedora sshd[4703]: Failed password for darthvader from 10.0.2.7 port 53808 ssh2
May 27 21:45:25 Fedora sshd[4699]: Failed password for darthvader from 10.0.2.7 port 53772 ssh2
May 27 21:45:25 Fedora sshd[4702]: Failed password for darthvader from 10.0.2.7 port 53798 ssh2
May 27 21:45:25 Fedora sshd[4708]: Failed password for darthvader from 10.0.2.7 port 53882 ssh2
May 27 21:45:29 Fedora sshd[4707]: Failed password for darthvader from 10.0.2.7 port 53868 ssh2
May 27 21:45:29 Fedora sshd[4706]: Failed password for darthvader from 10.0.2.7 port 53854 ssh2
May 27 21:45:29 Fedora sshd[4708]: Failed password for darthvader from 10.0.2.7 port 53882 ssh2
May 27 21:45:29 Fedora sshd[4701]: Failed password for darthvader from 10.0.2.7 port 53794 ssh2
May 27 21:45:29 Fedora sshd[4698]: Failed password for darthvader from 10.0.2.7 port 53756 ssh2
May 27 21:45:29 Fedora sshd[4697]: Failed password for darthvader from 10.0.2.7 port 53740 ssh2
May 27 21:45:29 Fedora sshd[4699]: Failed password for darthvader from 10.0.2.7 port 53772 ssh2
May 27 21:45:29 Fedora sshd[4700]: Failed password for darthvader from 10.0.2.7 port 53788 ssh2
May 27 21:45:29 Fedora sshd[4703]: Failed password for darthvader from 10.0.2.7 port 53808 ssh2
May 27 21:45:29 Fedora sshd[4704]: Failed password for darthvader from 10.0.2.7 port 53820 ssh2
May 27 21:45:29 Fedora sshd[4702]: Failed password for darthvader from 10.0.2.7 port 53798 ssh2
May 27 21:45:29 Fedora sshd[4696]: Failed password for darthvader from 10.0.2.7 port 53726 ssh2
May 27 21:45:29 Fedora sshd[4705]: Failed password for darthvader from 10.0.2.7 port 53824 ssh2
May 27 21:45:29 Fedora sshd[4701]: Connection closed by authenticating user darthvader 10.0.2.7 port 53794 [preauth]
May 27 21:45:29 Fedora sshd[4701]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:29 Fedora sshd[4703]: Connection closed by authenticating user darthvader 10.0.2.7 port 53808 [preauth]
May 27 21:45:29 Fedora sshd[4703]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:29 Fedora sshd[4696]: Connection closed by authenticating user darthvader 10.0.2.7 port 53726 [preauth]
May 27 21:45:29 Fedora sshd[4696]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:29 Fedora sshd[4704]: Connection closed by authenticating user darthvader 10.0.2.7 port 53820 [preauth]
May 27 21:45:29 Fedora sshd[4704]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:29 Fedora sshd[4700]: Connection closed by authenticating user darthvader 10.0.2.7 port 53788 [preauth]
May 27 21:45:29 Fedora sshd[4700]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:29 Fedora sshd[4702]: Connection closed by authenticating user darthvader 10.0.2.7 port 53798 [preauth]
May 27 21:45:29 Fedora sshd[4702]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:29 Fedora sshd[4705]: Connection closed by authenticating user darthvader 10.0.2.7 port 53824 [preauth]
May 27 21:45:29 Fedora sshd[4705]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:29 Fedora sshd[4706]: Accepted password for darthvader from 10.0.2.7 port 53854 ssh2
May 27 21:45:29 Fedora sshd[4706]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 21:45:29 Fedora sshd[4706]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 21:45:29 Fedora sshd[4706]: pam_unix(sshd:session): session closed for user darthvader
May 27 21:45:31 Fedora sshd[4707]: Failed password for darthvader from 10.0.2.7 port 53868 ssh2
May 27 21:45:31 Fedora sshd[4697]: Failed password for darthvader from 10.0.2.7 port 53740 ssh2
May 27 21:45:31 Fedora sshd[4708]: Failed password for darthvader from 10.0.2.7 port 53882 ssh2
May 27 21:45:31 Fedora sshd[4698]: Failed password for darthvader from 10.0.2.7 port 53756 ssh2
May 27 21:45:31 Fedora sshd[4699]: Failed password for darthvader from 10.0.2.7 port 53772 ssh2
May 27 21:45:31 Fedora sshd[4707]: Connection closed by authenticating user darthvader 10.0.2.7 port 53868 [preauth]
May 27 21:45:31 Fedora sshd[4707]: PAM 3 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:31 Fedora sshd[4707]: PAM service(sshd) ignoring max retries; 4 > 3
May 27 21:45:31 Fedora sshd[4699]: Connection closed by authenticating user darthvader 10.0.2.7 port 53772 [preauth]
May 27 21:45:31 Fedora sshd[4699]: PAM 3 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:31 Fedora sshd[4699]: PAM service(sshd) ignoring max retries; 4 > 3
May 27 21:45:31 Fedora sshd[4708]: Connection closed by authenticating user darthvader 10.0.2.7 port 53882 [preauth]
May 27 21:45:31 Fedora sshd[4708]: PAM 3 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:31 Fedora sshd[4708]: PAM service(sshd) ignoring max retries; 4 > 3
May 27 21:45:31 Fedora sshd[4697]: Connection closed by authenticating user darthvader 10.0.2.7 port 53740 [preauth]
May 27 21:45:31 Fedora sshd[4697]: PAM 3 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:31 Fedora sshd[4697]: PAM service(sshd) ignoring max retries; 4 > 3
May 27 21:45:31 Fedora sshd[4698]: Connection closed by authenticating user darthvader 10.0.2.7 port 53756 [preauth]
May 27 21:45:31 Fedora sshd[4698]: PAM 3 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.7 user=darthvader
May 27 21:45:31 Fedora sshd[4698]: PAM service(sshd) ignoring max retries; 4 > 3
May 27 21:47:07 Fedora sshd[4233]: exited MaxStartups throttling after 00:01:47, 3 connections dropped
May 27 21:47:07 Fedora sshd[4752]: Connection closed by 10.0.2.7 port 47314 [preauth]
May 27 21:47:23 Fedora sshd[4754]: Accepted password for darthvader from 10.0.2.7 port 48840 ssh2
May 27 21:47:23 Fedora sshd[4754]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 21:47:23 Fedora sshd[4754]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 21:47:23 Fedora sshd[4754]: pam_unix(sshd:session): session closed for user darthvader
May 27 21:47:31 Fedora sshd[4792]: Accepted password for darthvader from 10.0.2.7 port 50060 ssh2
May 27 21:47:31 Fedora sshd[4792]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 21:47:31 Fedora sshd[4792]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 21:48:39 Fedora sshd[4792]: pam_unix(sshd:session): session closed for user darthvader
May 27 21:48:46 Fedora sshd[4869]: Connection closed by authenticating user darthvader 10.0.2.7 port 35288 [preauth]
May 27 21:49:27 Fedora sshd[4880]: Accepted password for darthvader from 10.0.2.7 port 54382 ssh2
May 27 21:49:27 Fedora sshd[4880]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 21:49:28 Fedora sshd[4880]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 21:50:20 Fedora sshd[4925]: Accepted password for darthvader from 10.0.2.7 port 58628 ssh2
May 27 21:50:20 Fedora sshd[4925]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 21:50:20 Fedora sshd[4925]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 21:50:20 Fedora sshd[4925]: pam_unix(sshd:session): session closed for user darthvader
May 27 21:50:54 Fedora sshd[4880]: pam_unix(sshd:session): session closed for user darthvader
May 27 21:50:58 Fedora sshd[4992]: Connection closed by authenticating user darthvader 10.0.2.7 port 48034 [preauth]
May 27 21:51:02 Fedora sshd[5003]: Accepted publickey for darthvader from 10.0.2.7 port 39816 ssh2: RSA SHA256:0pEMvK6OUB20ZQrF6yUNCLcCOpnfT3huBWSxVMYBCCc
May 27 21:51:02 Fedora sshd[5003]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 21:51:02 Fedora sshd[5003]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 21:54:57 Fedora sshd[5039]: Accepted password for darthvader from 10.0.2.7 port 52516 ssh2
May 27 21:54:57 Fedora sshd[5039]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 21:54:57 Fedora sshd[5039]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 21:54:57 Fedora sshd[5039]: pam_unix(sshd:session): session closed for user darthvader
May 27 21:57:06 Fedora sshd[5003]: pam_unix(sshd:session): session closed for user darthvader
May 27 21:57:06 Fedora sshd[4233]: Received signal 15; terminating.
May 27 21:57:49 Fedora sshd[592]: Server listening on 0.0.0.0 port 22.
May 27 21:59:34 Fedora sshd[2429]: Accepted password for darthvader from 10.0.2.7 port 33246 ssh2
May 27 21:59:34 Fedora sshd[2429]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 21:59:34 Fedora sshd[2429]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 21:59:34 Fedora sshd[2429]: pam_unix(sshd:session): session closed for user darthvader
May 27 21:59:47 Fedora sshd[2462]: Accepted password for darthvader from 10.0.2.7 port 42908 ssh2
May 27 21:59:47 Fedora sshd[2462]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 21:59:47 Fedora sshd[2462]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 22:00:56 Fedora sshd[2462]: pam_unix(sshd:session): session closed for user darthvader
May 27 22:00:56 Fedora sshd[2462]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
May 27 22:00:56 Fedora sshd[592]: Received signal 15; terminating.
May 27 22:02:01 Fedora sshd[594]: Server listening on 0.0.0.0 port 22.
May 27 22:02:58 Fedora sshd[2199]: Accepted password for darthvader from 10.0.2.7 port 38514 ssh2
May 27 22:02:58 Fedora sshd[2199]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 22:02:58 Fedora sshd[2199]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 22:05:36 Fedora sshd[2199]: pam_unix(sshd:session): session closed for user darthvader
May 27 22:05:36 Fedora sshd[594]: Received signal 15; terminating.
May 27 22:05:47 Fedora sshd[591]: Server listening on 0.0.0.0 port 22.
May 27 22:06:20 Fedora sshd[1075]: Accepted publickey for darthvader from 10.0.2.7 port 47464 ssh2: RSA SHA256:0pEMvK6OUB20ZQrF6yUNCLcCOpnfT3huBWSxVMYBCCc
May 27 22:06:20 Fedora sshd[1075]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 22:06:20 Fedora sshd[1075]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 22:09:55 Fedora sshd[1075]: pam_unix(sshd:session): session closed for user darthvader
May 27 22:10:05 Fedora sshd[1294]: Accepted password for games from 10.0.2.7 port 45656 ssh2
May 27 22:10:05 Fedora sshd[1294]: pam_unix(sshd:session): session opened for user games(uid=5) by (uid=0)
May 27 22:10:05 Fedora sshd[1294]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 22:10:13 Fedora sshd[1351]: Received disconnect from 10.0.2.7 port 45656:11: disconnected by user
May 27 22:10:13 Fedora sshd[1351]: Disconnected from user games 10.0.2.7 port 45656
May 27 22:10:13 Fedora sshd[1294]: pam_unix(sshd:session): session closed for user games
May 27 22:10:40 Fedora sshd[1468]: Accepted publickey for darthvader from 10.0.2.7 port 32880 ssh2: RSA SHA256:0pEMvK6OUB20ZQrF6yUNCLcCOpnfT3huBWSxVMYBCCc
May 27 22:10:40 Fedora sshd[1468]: pam_unix(sshd:session): session opened for user darthvader(uid=1000) by (uid=0)
May 27 22:10:40 Fedora sshd[1468]: pam_env(sshd:session): deprecated reading of user environment enabled
May 27 22:21:19 Fedora sshd[1468]: pam_unix(sshd:session): session closed for user darthvader
May 27 22:21:31 Fedora sshd[591]: Received signal 15; terminating.