Who Was On the Server?

Reconstruct who accessed a server during an incident window.

A intermediate Linux challenge worth 10 points. Solve it hands-on in a real Linux environment in your browser - no local setup, no fake shells.

The Challenge

The security team reports suspicious activity between 14:00 and 18:00 yesterday. Produce a full access timeline from system logs.

Your tasks:

• Use last -F to list all sessions from the past 48 hours
• Use lastlog to find last login times for every account
• Use journalctl -u ssh --since "yesterday" to find failed attempts
• Write all sessions and failed attempt count to /tmp/access_report.txt
• Run check to validate