# Linux Authentication Logs (lab)

> Investigate a Linux /var/log/auth.log to work out how a junior engineer's narrow, ticketed sudo grant became full root. Two suspicious threads share the log, but only one succeeded.

Canonical: https://codelivly.com/labs/linux-auth-logs

| | |
|---|---|
| Type | Investigation |
| Difficulty | Beginner |
| Points | 200 |
| Session length | 30 min |
| Completions | 11 |

Investigate a Linux /var/log/auth.log to work out how a junior engineer's narrow, ticketed sudo grant became full root. Two suspicious threads share the log, but only one succeeded.

## Objective

Learn to read sudo and PAM lines in auth.log field by field, telling a successful sudo from a refused one and both from a failed su. Recognise how a sudo grant on a single program can amount to full root via a shell escape.

## Tasks

1. Read the sudo policy before the log
2. Separate the two threads
3. Read the COMMAND= field to the end
4. Reconstruct the root session
5. Map to MITRE and report

## Related

- [All labs](https://codelivly.com/practice?type=lab)