♜ AUTH MONITOR

PROJECT SNAPSHOT

PROJECT OVERVIEW

Auth Monitor is the authentication visibility layer of The Citadel. It focuses on observing SSH login activity, failed authentication attempts, successful remote sessions, and Fail2Ban activity from the Ubuntu host.

This project lays the groundwork for Sentinel, the future detection and alerting module inside The Citadel platform.

CURRENT CAPABILITIES

• SSH authentication events are logged through auth.log and journald.
• Successful remote login events can be reviewed from the Linux host.
• Failed SSH password attempts are visible in authentication logs.
• Fail2Ban monitors SSH authentication failures through the sshd jail.
• Fail2Ban has detected failed login attempts and banned offending source IPs.
• Authentication monitoring scripts exist for future dashboard integration.

OBSERVED SECURITY EVENTS

COMMAND AREAS PRACTICED

SECURITY VALUE

Authentication monitoring provides visibility into access attempts against the Linux host. This helps identify failed logins, validate successful remote administration, and confirm that Fail2Ban is responding to repeated authentication failures.

ROLE IN THE CITADEL

Auth Monitor is the bridge between the Linux Hardening Lab and Sentinel. It turns raw authentication logs into security evidence and prepares the platform for future alerting, event review, and suspicious activity detection.

NEXT OBJECTIVES

• Surface successful SSH login counts in the Operations Dashboard.
• Surface failed SSH login counts in the Operations Dashboard.
• Add latest authentication event visibility to status.json.
• Integrate Fail2Ban ban counts into the dashboard.
• Create Sentinel alerting logic for suspicious authentication behavior.