security.d/chk_logs

Sun, 17 Feb 2013 19:49:24 +0100

author
Michiel Broek <mbroek@mbse.eu>
date
Sun, 17 Feb 2013 19:49:24 +0100
changeset 15
c4a1470ab59d
parent 14
59e07bba67cc
child 17
65656789da08
permissions
-rw-r--r--

Logs check's only yesterdays events, better mailbox check

#!/bin/bash
#
#############################################################################
# Copyright (C) 2005-2013
#   
# Michiel Broek               <mbse at mbse.eu>
# the Netherlands
#
# This file is part of SlackSecCheckScripts.
#
# This package is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2, or (at your option) any
# later version.
#
# SlackSecCheckScripts is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# General Public License for more details.
# 
# You should have received a copy of the GNU General Public License
# along with MBSE BBS; see the file COPYING.  If not, write to the Free
# Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
#############################################################################


PATH=/sbin:/usr/sbin:/bin:/usr/bin

umask 077
TZ=UTC; export TZ
LANG=C; export LANG

SECUREDIR=`mktemp -d /tmp/_securedir.XXXXXX` || exit 1

trap "/bin/rm -rf $SECUREDIR ; exit 0" EXIT INT QUIT PIPE

if ! cd "$SECUREDIR"; then
        echo "Can not cd to $SECUREDIR".
        exit 1
fi

TMP2=secure1.$$
OUTPUT=secure4.$$
YESTER=$(date '+%b %d' -d yesterday)

grep -e ' useradd\[' /var/log/secure | grep -e "${YESTER}" > $TMP2
grep -e ' userdel\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2
grep -e ' usermod\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2
grep -e ' groupadd\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2
grep -e ' groupdel\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2
grep -e ' groupmod\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2
grep -e ' passwd\[' /var/log/secure | grep -e "${YESTER}" >> $TMP2
grep -e ' sudo:' /var/log/messages | grep -e "${YESTER}" >> $TMP2

cat $TMP2 | sort > $OUTPUT

if [ -s $OUTPUT ] ; then
    printf "\nImportant logfile entries:\n"
    column $OUTPUT
fi

mercurial