In this lesson, you will learn how to aggregate disparate system logs to identify distributed credential stuffing attacks that evade single-node detection.
The Problem: Distributed Brute Force
Traditional brute force detection often looks at a single IP address failing to authenticate multiple times on a single server. However, modern attackers use "credential stuffing," where they distribute thousands of login attempts across a fleet of servers, using different source IPs for each attempt. A single server might only see one or two failures from an attacker, appearing as normal background noise. To catch this, you must centralize your authentication logs.
The Solution: Centralized Correlation
By streaming logs from your Identity Servers and application nodes to a central aggregator (like an ELK stack or a dedicated logging server), you can perform temporal correlation. You aren't just looking for a failed password; you are looking for a unique pattern—such as the same username being targeted across multiple distinct hosts within a short timeframe, regardless of the source IP.
You can use journald or rsyslog to forward logs. Once the logs reach your central repository, you can query for anomalies using patterns like this:
# Conceptual query: Find usernames with failures across > 3 hosts in 5 minutes
index=auth_logs | search event=failed_password
| stats dc(host) as unique_hosts by user
| where unique_hosts > 3
Implementing Correlation
When auditing your PAM configurations and sssd logs, ensure your log format is consistent across all nodes. By ensuring that your centralized logs include the pam_unix or sssd module identifiers and the target username, you can build a pipeline that triggers an alert or an automated iptables block when a specific identity (user account) shows an abnormal failure rate across the fleet. This shifts the focus from "blocking a malicious IP" to "protecting a compromised identity."
This correlation layer acts as the intelligence needed to stop sophisticated actors who rotate their IP addresses to bypass standard rate-limiting tools like fail2ban.
Key Takeaway: By correlating authentication failure logs across your entire infrastructure, you can identify distributed credential stuffing attacks that target individual user accounts across multiple hosts.