2026 Linux Admin create and investigate a new Linux user, analyze system activity using journalctl
In this video, you create and investigate a new Linux user, analyze SSH and system activity using journalctl, and then switch into that user to set up SSH key-based authentication.
I dig into Linux user accounts, logging, and SSH security. I create a new user called trouble, explore where that account shows up in system files, then use journalctl to dig through logs for SSH activity and other events. After that, I switch into the trouble account and set up SSH key-based authentication.
Here’s what I do in this session:
Create a new user (trouble) with useradd and verify the account details in /etc/passwd, /etc/group, and /etc/shadow using grep
Use journalctl to:
Follow logs in real time with journalctl -f
View logs for the current boot with journalctl -b
Filter by unit and tag with journalctl -u sshd and journalctl -t sshd
Focus on authentication-related messages and count invalid SSH login attempts with journalctl -t sshd | grep "Invalid user" | wc -l
View kernel messages with journalctl -k and inspect recent history with --since "1 hour ago"
Inspect /var/log to see where traditional logs are stored
Log in as the trouble user, generate an SSH key pair with ssh-keygen, move the public key into authorized_keys, and test passwordless SSH to localhost
This lab maps directly to common certification and real-world admin topics, including:
CompTIA Linux+: User and group management, logging and monitoring with journalctl, SSH basics, and troubleshooting authentication
LPIC-1 / LFCS: System logging, journal analysis, and secure remote access with SSH keys
Security-focused learning (Security+, blue team, etc.): Investigating failed SSH logins, understanding authorized_keys, and spotting potential brute-force attempts
[ec2-user@ip-172-31-27-46 ~]$ history
1 clear
2 sudo useradd trouble
3 sudo grep trouble /etc/*
4 clear
5 sudo grep trouble /etc/pa*
6 sudo grep trouble /etc/sh*
7 sudo grep trouble /etc/gr*
8 sudo passwd trouble
9 sudo grep trouble /etc/shadow
10 sudo grep trouble /etc/passwd
11 sudo su - trouble
12 journal-ctl -f
13 journalctl -f
14 sudo journalctl -f
15 sudo journalctl -b
16 sudo journalctl -u sshd
17 sudo journalctl -t sshd
18 sudo journalctl -p authpriv.warning
19 sudo journalctl -t sshd
20 sudo journalctl -t sshd | grep "Invalid user" | wc -l
21 sudo journalctl --since "1 hour ago"
22 sudo journalctl -k
23 sudo ls -ltrah /var/log
24 history
[ec2-user@ip-172-31-27-46 ~]$ sudo su - trouble
Last login: Sat Jan 17 01:19:15 UTC 2026 from 127.0.0.1 on pts/2
[trouble@ip-172-31-27-46 ~]$ history
1 exit
2 ls -ltrah
3 ssh-keygen
4 ls -ltrah
5 cd .ssh
6 ls -ltrah
7 mv id_rsa.pub authorized_keys
8 ssh localhost
9 ls -ltrah
10 cat authorized_keys
11 wc -l authorized_keys
12 exit
13 history
#Linux #SysAdmin #journalctl #SSH #Logs #LinuxPlus #LFCS #LPIC1 #Security