Oct 10 06:25:01 webserver CRON[2841]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Oct 10 06:25:01 webserver CRON[2841]: pam_unix(cron:session): session closed for user root
Oct 10 07:00:01 webserver CRON[2903]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Oct 10 07:00:01 webserver CRON[2903]: pam_unix(cron:session): session closed for user root
Oct 10 07:15:22 webserver sshd[3011]: Accepted publickey for deploy from 172.16.0.5 port 52100 ssh2: RSA SHA256:nTh4K7pGz2HFxD9QLfWbUqR8mN5YjC3vA1xPwE6kS0o
Oct 10 07:15:22 webserver sshd[3011]: pam_unix(sshd:session): session opened for user deploy(uid=1001) by (uid=0)
Oct 10 07:15:45 webserver sudo:   deploy : TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/usr/bin/systemctl restart nginx
Oct 10 07:15:45 webserver sudo: pam_unix(sudo:session): session opened for user root(uid=0) by deploy(uid=1001)
Oct 10 07:15:46 webserver sudo: pam_unix(sudo:session): session closed for user root
Oct 10 07:16:02 webserver sshd[3011]: pam_unix(sshd:session): session closed for user deploy
Oct 10 08:00:01 webserver CRON[3145]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Oct 10 08:00:01 webserver CRON[3145]: pam_unix(cron:session): session closed for user root
Oct 10 09:12:33 webserver sshd[3412]: Invalid user test from 10.0.14.88 port 44120
Oct 10 09:12:33 webserver sshd[3412]: Failed password for invalid user test from 10.0.14.88 port 44120 ssh2
Oct 10 09:12:34 webserver sshd[3414]: Invalid user admin from 10.0.14.88 port 44122
Oct 10 09:12:34 webserver sshd[3414]: Failed password for invalid user admin from 10.0.14.88 port 44122 ssh2
Oct 10 09:12:35 webserver sshd[3416]: Failed password for root from 10.0.14.88 port 44124 ssh2
Oct 10 09:12:35 webserver sshd[3418]: Failed password for root from 10.0.14.88 port 44126 ssh2
Oct 10 09:12:36 webserver sshd[3420]: Failed password for root from 10.0.14.88 port 44128 ssh2
Oct 10 09:12:36 webserver sshd[3422]: Invalid user oracle from 10.0.14.88 port 44130
Oct 10 09:12:36 webserver sshd[3422]: Failed password for invalid user oracle from 10.0.14.88 port 44130 ssh2
Oct 10 09:12:37 webserver sshd[3424]: Invalid user postgres from 10.0.14.88 port 44132
Oct 10 09:12:37 webserver sshd[3424]: Failed password for invalid user postgres from 10.0.14.88 port 44132 ssh2
Oct 10 09:12:38 webserver sshd[3426]: Invalid user ubuntu from 10.0.14.88 port 44134
Oct 10 09:12:38 webserver sshd[3426]: Failed password for invalid user ubuntu from 10.0.14.88 port 44134 ssh2
Oct 10 09:13:01 webserver sshd[3430]: Failed password for root from 203.0.113.42 port 38210 ssh2
Oct 10 09:13:01 webserver sshd[3432]: Failed password for root from 203.0.113.42 port 38212 ssh2
Oct 10 09:13:02 webserver sshd[3434]: Failed password for root from 203.0.113.42 port 38214 ssh2
Oct 10 09:13:02 webserver sshd[3436]: Failed password for root from 198.51.100.17 port 51002 ssh2
Oct 10 09:13:03 webserver sshd[3438]: Failed password for root from 198.51.100.17 port 51004 ssh2
Oct 10 09:13:03 webserver sshd[3440]: Invalid user admin from 198.51.100.17 port 51006
Oct 10 09:13:03 webserver sshd[3440]: Failed password for invalid user admin from 198.51.100.17 port 51006 ssh2
Oct 10 09:13:04 webserver sshd[3442]: Invalid user ftpuser from 203.0.113.42 port 38220
Oct 10 09:13:04 webserver sshd[3442]: Failed password for invalid user ftpuser from 203.0.113.42 port 38220 ssh2
Oct 10 09:13:05 webserver sshd[3444]: Invalid user guest from 203.0.113.42 port 38222
Oct 10 09:13:05 webserver sshd[3444]: Failed password for invalid user guest from 203.0.113.42 port 38222 ssh2
Oct 10 09:30:01 webserver CRON[3501]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Oct 10 09:30:01 webserver CRON[3501]: pam_unix(cron:session): session closed for user root
Oct 10 10:42:15 webserver sshd[3688]: Accepted password for webapp from 10.0.14.88 port 48812 ssh2
Oct 10 10:42:15 webserver sshd[3688]: pam_unix(sshd:session): session opened for user webapp(uid=1002) by (uid=0)
Oct 10 10:42:22 webserver sudo:   webapp : TTY=pts/1 ; PWD=/home/webapp ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow
Oct 10 10:42:22 webserver sudo: pam_unix(sudo:session): session opened for user root(uid=0) by webapp(uid=1002)
Oct 10 10:42:22 webserver sudo: pam_unix(sudo:session): session closed for user root
Oct 10 10:43:01 webserver sudo:   webapp : TTY=pts/1 ; PWD=/home/webapp ; USER=root ; COMMAND=/usr/bin/apt install nmap
Oct 10 10:43:01 webserver sudo: pam_unix(sudo:session): session opened for user root(uid=0) by webapp(uid=1002)
Oct 10 10:43:08 webserver sudo: pam_unix(sudo:session): session closed for user root
Oct 10 10:44:33 webserver su[3720]: FAILED su for root by webapp
Oct 10 10:44:33 webserver su[3720]: pam_unix(su:auth): authentication failure; logname=webapp uid=1002 euid=0 tty=/dev/pts/1 ruser=webapp rhost=  user=root
Oct 10 10:44:41 webserver su[3725]: FAILED su for root by webapp
Oct 10 10:44:41 webserver su[3725]: pam_unix(su:auth): authentication failure; logname=webapp uid=1002 euid=0 tty=/dev/pts/1 ruser=webapp rhost=  user=root
Oct 10 10:45:12 webserver sudo:   webapp : TTY=pts/1 ; PWD=/home/webapp ; USER=root ; COMMAND=/usr/sbin/useradd -m -s /bin/bash -G sudo svc-backup
Oct 10 10:45:12 webserver sudo: pam_unix(sudo:session): session opened for user root(uid=0) by webapp(uid=1002)
Oct 10 10:45:12 webserver useradd[3740]: new group: name=svc-backup, GID=1003
Oct 10 10:45:12 webserver useradd[3740]: new user: name=svc-backup, UID=1003, GID=1003, home=/home/svc-backup, shell=/bin/bash, from=/dev/pts/1
Oct 10 10:45:12 webserver usermod[3745]: add 'svc-backup' to group 'sudo'
Oct 10 10:45:12 webserver sudo: pam_unix(sudo:session): session closed for user root
Oct 10 10:45:30 webserver sudo:   webapp : TTY=pts/1 ; PWD=/home/webapp ; USER=root ; COMMAND=/usr/bin/passwd svc-backup
Oct 10 10:45:30 webserver sudo: pam_unix(sudo:session): session opened for user root(uid=0) by webapp(uid=1002)
Oct 10 10:45:33 webserver passwd[3750]: pam_unix(passwd:chauthtok): password changed for svc-backup
Oct 10 10:45:33 webserver sudo: pam_unix(sudo:session): session closed for user root
Oct 10 10:46:01 webserver sshd[3688]: pam_unix(sshd:session): session closed for user webapp
Oct 10 11:00:01 webserver CRON[3812]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Oct 10 11:00:01 webserver CRON[3812]: pam_unix(cron:session): session closed for user root
Oct 10 11:02:44 webserver sshd[3855]: Accepted password for svc-backup from 10.0.14.88 port 49220 ssh2
Oct 10 11:02:44 webserver sshd[3855]: pam_unix(sshd:session): session opened for user svc-backup(uid=1003) by (uid=0)
Oct 10 11:03:01 webserver sudo: svc-backup : TTY=pts/2 ; PWD=/home/svc-backup ; USER=root ; COMMAND=/bin/bash
Oct 10 11:03:01 webserver sudo: pam_unix(sudo:session): session opened for user root(uid=0) by svc-backup(uid=1003)
