Lab — First Python Script

The mechanism is three bindings and a loop. needle = "Failed password" is a str. path is a pathlib Path under your home lab, not a cwd-relative guess. with path.open("r", encoding="utf-8") as f: for line in f: if needle in line: print(line.strip()). "in" on two strings is substring search: it does not parse SSHD grammar; it does not need regex. strip() drops the trailing newline so your terminal is not double-spaced. If you slurp with read().splitlines() on a 20-line lab file, it still works; keep the for-line form anyway so the muscle matches bigger files later.

Why a file instead of the sample_lines list from Lesson 2? Because defenders inherit text from disk. Creating the log yourself is the ethics control: you know every line is fictional, you know it holds no customer data, you can chmod 600 without locking a system file. Copying a real auth log from a server you administer at work can still be a policy violation — leave work data at work. The lab log includes both failures and one success so you can see the filter drop the Accepted line. If all four lines printed, your needle is wrong or the if is missing.

Three Failed password lines and one Accepted password line are enough to prove the filter. Users root and admin are common bait in fiction; they are not an invitation to attack a live box. Source 10.0.0.5 repeating twice sets up the optional count challenge: same string, two lines, still not a geolocation OSINT hunt. 203.0.113.10 is from TEST-NET-3 (RFC 5737) — a documentation prefix, not a host you ping “to see.” After writing the file, chmod 600 so other local accounts cannot read even fictional failures. On Windows without chmod, use WSL or Git Bash, or restrict the file to your user. Do not chmod 777 to “make Python work.” Permission denied on a 600 file you own usually means you are a different user — fix the owner, do not world-read secrets.

How you create the log does not matter as much as where it lives. A shell here-doc, Path.write_text, or Notepad saved into the lab folder are all fine if the bytes are the four fictional lines and the path is $HOME/cyberlium-lab/sample_auth.log. What fails is grabbing “a real log from the internet” or from a SIEM export so the lab feels grown-up. Real logs contain other people’s names, source IPs, and sometimes secrets. This course uses fiction so you can share a screenshot of output without leaking a workplace. If you already have a log from YOUR own homelab VM that you own end-to-end, you may substitute it privately — still chmod 600, still never gist it, still never add scan steps against those IPs.

Work top to bottom in the code block. If python is missing, use python3. If the script prints zero lines, check the needle spelling and that you saved the log in the same lab directory the Path expects — Path.home() / "cyberlium-lab" / "sample_auth.log", not “wherever the IDE’s working directory is.” If it prints four lines, the if needle in line guard is missing. The optional challenge is a second accumulator: failures_from = 0, if "10.0.0.5" in line and needle in line: increment. Do not then nmap that address. Do not look it up on Shodan. It is a string in a file you wrote.

find_failed.py should import pathlib, refuse to run if the log is missing (SystemExit with the expected path), and avoid a cwd-relative open("sample_auth.log") that silently reads a different file when you launch from the IDE. Print matches as you go so you can see the hunter work; a final count line starting with # is a comment to humans, not more log data. Keep live passwords out of the file even as “examples.” A fictional Failed password line does not need a real hash or a real passphrase. If you add extra lines for practice, keep them fictional and keep the needle test honest — do not force all lines to match just to see output.

mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"

cat > sample_auth.log << 'EOF'
sshd: Failed password for root from 10.0.0.5 port 51234
sshd: Accepted password for alice from 10.0.0.9 port 51111
sshd: Failed password for admin from 10.0.0.5 port 51235
sshd: Failed password for root from 203.0.113.10 port 44022
EOF

chmod 600 sample_auth.log

cat > find_failed.py << 'EOF'
from pathlib import Path

lab = Path.home() / "cyberlium-lab"
path = lab / "sample_auth.log"
needle = "Failed password"

if not path.is_file():
    raise SystemExit(f"missing {path} — create the fictional log first")

hits = 0
from_10 = 0
with path.open("r", encoding="utf-8") as f:
    for line in f:
        if needle in line:
            print(line.strip())
            hits += 1
            if "10.0.0.5" in line:
                from_10 += 1

print(f"# matched {hits} line(s); optional 10.0.0.5 count={from_10}")
# NEVER: path = Path("/var/log/auth.log") or Path("/etc/shadow")
# NEVER: socket.connect to IPs in the log
# NEVER: paste live passwords into sample_auth.log
EOF

python find_failed.py || python3 find_failed.py
chmod 600 find_failed.py sample_auth.log

You ran the hunter pattern on a log you authored: context manager, utf-8, substring filter, locked files. Three fictional failures printed; the accept did not. The optional IP count was string tally, not reconnaissance. Next — Quiz — Python Basics — ten APPLY items on why Python, types and loops, files, this lab, and the ethics line before Module 2 opens Socket Programming on localhost.