Question

A security analyst is reviewing /var/log/auth.log on a Linux web server after an alert fired. The relevant entries show: a successful SSH login for the low-privilege account 'svc_deploy' from an internal jump host, followed 40 seconds later by repeated 'sudo: svc_deploy : command not allowed' messages, and then a single entry: 'sudo: pam_unix(sudo:session): session opened for user root by svc_deploy(uid=1004)'. Which conclusion is best supported by these log entries?

Accepted Answer

The svc_deploy account was used to attempt unauthorized commands and ultimately succeeded in escalating to a root session, indicating likely privilege escalation

Answer

The repeated failures prove the attacker never gained elevated access and the alert is a false positive

Answer

The entries indicate a brute-force attack against the SSH service that should be blocked at the firewall

Answer

The log shows normal automated deployment behavior and requires no further investigation