sudo adduser student1
sudo adduser student2
sudo adduser adminuser

# Verify
getent passwd student1
getent passwd student2
getent passwd adminuser

sudo groupadd students
sudo groupadd admins

sudo usermod -aG students student1
sudo usermod -aG students student2
sudo usermod -aG admins adminuser

# Verify
getent group students
getent group admins
groups student1
groups adminuser

su - student1
cd /securedata

sudo grep "student1" /var/log/auth.log
sudo grep -i "denied" /var/log/syslog

sudo apt update
sudo apt install auditd -y

# Add a watch
sudo auditctl -w /securedata -p rwxa -k securedata_watch

# Verify rules
sudo auditctl -l

sudo grep "student1" /var/log/auth.log
sudo ausearch -k securedata_watch      # if auditd installed
sudo journalctl --since "2025-01-01 10:00" | grep student1
last student1
sudo tail -n 200 /var/log/syslog

sudo ufw deny from 192.168.100.10
sudo ufw status numbered

sudo chage -M 30 student1
sudo chage -M 30 student2

# Verify
sudo chage -l student1

1. Investigate logs: sudo grep "Failed password" /var/log/auth.log | tail -n 50.
2. Identify IP and frequency; check lastb for failed login history.
3. Temporarily block IP: sudo ufw deny from .
4. Install & configure fail2ban to auto-ban after repeated failures: sudo apt install fail2ban and create jail for ssh.
5. Check compromised accounts and enforce password reset.
6. Document incident in a report with timestamps and actions taken.

sudo grep "sudo" /var/log/auth.log | tail -n 100

sudo setfacl -m u:ictuser:rx /securedata/results/grades.txt
getfacl /securedata/results/grades.txt

1. Check file owner/group: ls -l /securedata.
2. Check file permissions: stat /securedata/file.txt.
3. Check ACLs: getfacl /securedata/file.txt.
4. Check group membership of student: groups student1.
5. Check directory parent permissions (execute bit on parent allows entering): ls -ld /securedata.
6. Check for symlinks that point to world-readable locations.
7. Check SELinux/AppArmor context (if used): sudo getenforce or aa-status.

sudo auditctl -w /securedata/file.txt -p rwxa -k file_watch
sudo ausearch -k file_watch --start recent
# or
sudo ausearch -f /securedata/file.txt

sudo deluser --remove-home username
# or with userdel
sudo userdel -r username

# Find sudo entries for student1
sudo grep "student1" /var/log/auth.log | grep sudo

# Show lines with timestamps
sudo awk '/sudo/ && /student1/ {print $0}' /var/log/auth.log

# Directly get relevant lines
sudo grep -n "sudo" /var/log/auth.log | grep student1

sudo apt install auditd -y
sudo auditctl -w /securedata -p rwxa -k securedata_watch

# after reproducing the event, extract related logs
sudo ausearch -k securedata_watch --raw > /tmp/securedata_audit_raw.log
sudo aureport -f > /tmp/securedata_audit_summary.log

# Provide files for evidence
ls -lh /tmp/securedata_audit_*.log

1. Search for copies: sudo find /home -name "filename" -type f -ls.
2. Check if a symlink exists: ls -l /home/student1.
3. Check process history or bash history: sudo cat /home/student1/.bash_history and sudo ausearch -u student1 if audit enabled.
4. Check if admin ran a command that copied file: check sudo logs (/var/log/auth.log).
5. Check backup scripts or cron jobs that may have copied files into home.

# As root or sudo
sudo mkdir /securedata
sudo chown adminuser:admins /securedata
sudo chmod 770 /securedata

# Create a file as admin
sudo -i -u adminuser bash -c 'echo "SECRET" > /securedata/file.txt; ls -l /securedata'

# Now switch to student
su - student1
cat /securedata/file.txt   # Expect: Permission denied

1. Strong password policy: expiry, complexity, reuse prevention (chage).
2. RBAC enforcement: assign minimum privileges via groups.
3. Audit logging: install auditd and monitor critical folders.
4. Automated banning: use fail2ban to block brute-force IPs.
5. Least privilege for sudo: restrict commands allowed in /etc/sudoers.d.
6. Incident response plan: documented steps to investigate, contain, and report incidents.

1. Immediate checks

   sudo grep "student1" /var/log/auth.log | grep "03:12"
   sudo ausearch -k securedata_watch --start "2025-01-02 03:10:00" --end "2025-01-02 03:15:00"
   sudo tail -n 200 /var/log/syslog | grep "03:12"
   last student1
   

   Look for exact timestamps, TTY, source IP (if SSH), and command attempted.
2. Block & contain If IP is external: sudo ufw deny from . If suspicious, lock account: sudo usermod -L student1.
3. Gather evidence Export logs and audit info:

   sudo grep "student1" /var/log/auth.log > /tmp/student1_auth_0312.log
   sudo ausearch -k securedata_watch --raw > /tmp/securedata_audit_0312.raw
   sudo cp /var/log/syslog /tmp/syslog_0312.log
   

4. Analyze Check whether it was interactive SSH or local session; check last and who. Inspect sudo lines to see if any privilege escalation happened.
5. Report Short incident report (example):

   Incident Report — Unauthorized Access Attempt
   User: student1
   Date/Time: 2025-01-02 03:12:21
   Event: Permission denied while attempting to read /securedata/exams/final.pdf
   Evidence: /tmp/student1_auth_0312.log, /tmp/securedata_audit_0312.raw
   Action Taken: Locked account (usermod -L), blocked IP  via ufw, enabled additional audit rules.
   Recommendation: Reset password, review other accounts, enable fail2ban, schedule meeting with student.
   

   Attach the exported logs and audit reports to the incident ticket.
6. Follow-up Review logs for previous similar behavior, check for exfiltration, verify integrity of files in /securedata, and restore normal account after investigation with a forced password reset and monitoring.