cybersecurity · intermediate · ~15 min · safe pentest lab

Detect repeated failed logins

Scan a streaming text log for stateful patterns (windows / streaks).

Challenge

Find the longest burst of failed SSH logins for one user — the streak that brute-force detectors like fail2ban watch for.

Task

Implement int max_failed_attempts(const char *auth_log, const char *username) that returns the length of the longest run of consecutive failed login lines for username.

Input

  • auth_log: a NUL-terminated, multi-line auth-log string baked into the harness. A failure line contains Failed password for <user>; a success line contains Accepted password for <user>.
  • username: the user to track.

Output

Returns an int: the longest consecutive run of failures for that user. A success line resets the running streak to 0. Returns 0 if the user never fails.

Example

log: alice fails, fails, fails, accepted, fails
max_failed_attempts(log, "alice")   ->   3   (run before the success)
max_failed_attempts(log, "carol")   ->   0   (never appears)

Edge cases

  • A user that never appears returns 0.
  • A successful login resets the streak — only the longest run counts.
  • Lines for other users do not affect the tracked user's streak.

Rules

  • Operate only on the buffer the grader passes — no real /var/log access.

Input format

A NUL-terminated auth-log string auth_log and a username to track.

Output format

An int: the longest consecutive run of failed logins for that user (0 if none).

Constraints

Static buffer only — no real log-file access.

Starter code

#include <stdio.h>
#include <string.h>

int max_failed_attempts(const char *auth_log, const char *username) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.