Sun, 17 Feb 2013 19:49:24 +0100
Logs check's only yesterdays events, better mailbox check
5 | 1 | #!/bin/bash |
2 | # | |
3 | ############################################################################# | |
15
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
4 | # Copyright (C) 2005-2013 |
5 | 5 | # |
15
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
6 | # Michiel Broek <mbse at mbse.eu> |
5 | 7 | # the Netherlands |
8 | # | |
14
59e07bba67cc
Fixed spelling error, updated address
Michiel Broek <mbse@mbse.eu>
parents:
5
diff
changeset
|
9 | # This file is part of SlackSecCheckScripts. |
5 | 10 | # |
11 | # This package is free software; you can redistribute it and/or modify it | |
12 | # under the terms of the GNU General Public License as published by the | |
13 | # Free Software Foundation; either version 2, or (at your option) any | |
14 | # later version. | |
15 | # | |
14
59e07bba67cc
Fixed spelling error, updated address
Michiel Broek <mbse@mbse.eu>
parents:
5
diff
changeset
|
16 | # SlackSecCheckScripts is distributed in the hope that it will be useful, but |
5 | 17 | # WITHOUT ANY WARRANTY; without even the implied warranty of |
18 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
19 | # General Public License for more details. | |
20 | # | |
21 | # You should have received a copy of the GNU General Public License | |
22 | # along with MBSE BBS; see the file COPYING. If not, write to the Free | |
23 | # Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. | |
24 | ############################################################################# | |
25 | ||
26 | ||
27 | PATH=/sbin:/usr/sbin:/bin:/usr/bin | |
28 | ||
29 | umask 077 | |
30 | TZ=UTC; export TZ | |
31 | LANG=C; export LANG | |
32 | ||
33 | SECUREDIR=`mktemp -d /tmp/_securedir.XXXXXX` || exit 1 | |
34 | ||
35 | trap "/bin/rm -rf $SECUREDIR ; exit 0" EXIT INT QUIT PIPE | |
36 | ||
37 | if ! cd "$SECUREDIR"; then | |
38 | echo "Can not cd to $SECUREDIR". | |
39 | exit 1 | |
40 | fi | |
41 | ||
42 | TMP2=secure1.$$ | |
43 | OUTPUT=secure4.$$ | |
15
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
44 | YESTER=$(date '+%b %d' -d yesterday) |
5 | 45 | |
15
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
46 | grep -e ' useradd\[' /var/log/secure | grep -e "${YESTER}" > $TMP2 |
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
47 | grep -e ' userdel\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2 |
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
48 | grep -e ' usermod\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2 |
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
49 | grep -e ' groupadd\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2 |
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
50 | grep -e ' groupdel\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2 |
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
51 | grep -e ' groupmod\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2 |
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
52 | grep -e ' passwd\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2 |
c4a1470ab59d
Logs check's only yesterdays events, better mailbox check
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
53 | grep -e ' sudo:' /var/log/messages | grep -e "${YESTER}" >> $TMP2 |
5 | 54 | |
55 | cat $TMP2 | sort > $OUTPUT | |
56 | ||
57 | if [ -s $OUTPUT ] ; then | |
58 | printf "\nImportant logfile entries:\n" | |
59 | column $OUTPUT | |
60 | fi | |
61 | ||
62 |