shellcheck fixup
This commit is contained in:
@@ -9,7 +9,7 @@ if [[ "$EUID" -ne "0" ]]; then
|
||||
fi;
|
||||
|
||||
# base folder
|
||||
BASE_FOLDER=$(dirname $(readlink -f $0))"/";
|
||||
BASE_FOLDER=$(dirname "$(readlink -f "$0")")"/";
|
||||
# auth log file
|
||||
AUTH_LOG="${BASE_FOLDER}/../auth-log/user_auth.log";
|
||||
if [ ! -f "${AUTH_LOG}" ]; then
|
||||
@@ -22,13 +22,19 @@ RUN_FULL_LOG=0;
|
||||
# option parsing
|
||||
while getopts ":fd" opt; do
|
||||
case "${opt}" in
|
||||
f|full)
|
||||
f) # full
|
||||
echo "[!!!] Run through all log files to collect data";
|
||||
RUN_FULL_LOG=1;
|
||||
;;
|
||||
d|deubg)
|
||||
d) # deubg
|
||||
DEBUG=1;
|
||||
;;
|
||||
\?)
|
||||
echo "";
|
||||
echo "-f Collect all log data again";
|
||||
echo "-d Debug output";
|
||||
exit 1;
|
||||
;;
|
||||
esac;
|
||||
done;
|
||||
|
||||
@@ -37,8 +43,8 @@ function prD()
|
||||
message="${1}";
|
||||
debug=${2:-0};
|
||||
lb_off=${3:-0};
|
||||
if [ ${debug} -eq 1 ]; then
|
||||
if [ ${lb_off} -eq 1 ]; then
|
||||
if [ "${debug}" -eq 1 ]; then
|
||||
if [ "${lb_off}" -eq 1 ]; then
|
||||
echo -n "${message}";
|
||||
else
|
||||
echo "${message}";
|
||||
@@ -72,25 +78,26 @@ function parseLog()
|
||||
# $(printf "USER: %-20s: %19s" "${auth_user}" "${auth_date}")
|
||||
# prD "USER: $auth_user | DATE: $auth_date" ${debug} 1;
|
||||
printf -v msg "Source: %-10s | Year: %4s | Last auth user: %-20s: %19s" "${logger}" "${start_year}" "${auth_user}" "${auth_date}"
|
||||
prD "${msg}" ${debug} 1;
|
||||
prD "${msg}" "${debug}" 1;
|
||||
# find auth user in current auth file
|
||||
# if not there attach, else replace date only
|
||||
found=$(grep "${auth_user};" "${auth_log}");
|
||||
if [ -z "${found}" ]; then
|
||||
prD " | Write new" ${debug};
|
||||
prD " | Write new" "${debug}";
|
||||
echo "${auth_user};${auth_date}" >> "${auth_log}";
|
||||
else
|
||||
prD " | Replace old" ${debug};
|
||||
prD " | Replace old" "${debug}";
|
||||
sed -i "s/${auth_user};.*$/${auth_user};${auth_date}/" "${auth_log}";
|
||||
fi;
|
||||
}
|
||||
|
||||
printf -v msg "Run date: %s %s" $(date +"%F %T")
|
||||
printf -v msg "Run date: %s" "$(date +"%F %T")"
|
||||
prD "${msg}" ${DEBUG};
|
||||
|
||||
# Collector script for login information via journalctl
|
||||
# if no systemd installed, try to get info from /var/log/secure or /var/log/auth.log
|
||||
readonly init_version=$(/proc/1/exe --version | head -n 1);
|
||||
init_version=$(/proc/1/exe --version | head -n 1);
|
||||
readonly init_version;
|
||||
if [ -z "${init_version##*systemd*}" ]; then
|
||||
LOG_TARGET="systemd";
|
||||
# for journalctl
|
||||
@@ -103,8 +110,8 @@ if [ -z "${init_version##*systemd*}" ]; then
|
||||
fi;
|
||||
# READ as other format so we get the YEAR -o short-iso
|
||||
START_YEAR=$(date +%Y -d "1 day ago");
|
||||
journalctl -u systemd-logind --no-pager -o short-iso ${OPT_START_DATE} ${OPT_END_DATE} | grep ": New session" |
|
||||
while read line; do
|
||||
journalctl -u systemd-logind --no-pager -o short-iso "${OPT_START_DATE}" "${OPT_END_DATE}" | grep ": New session" |
|
||||
while read -r line; do
|
||||
# # Nov 21 14:15:46 we.are.hostname.com systemd-logind[1865]: New session 12345 of user some^user.
|
||||
# date: 5 chars
|
||||
# time: 8 chars
|
||||
@@ -120,11 +127,11 @@ else
|
||||
# for secure/auth log
|
||||
if [ $RUN_FULL_LOG -eq 1 ]; then
|
||||
# we loop over EACH file and get the DATE so we can have the correct YEAR
|
||||
for sfile in $(ls -1 /var/log/secure*bz2); do
|
||||
for sfile in /var/log/secure*bz2; do
|
||||
tz=$(stat -c %Z "${sfile}");
|
||||
START_YEAR=$(date +%Y -d @${tz});
|
||||
START_YEAR=$(date +%Y -d @"${tz}");
|
||||
bunzip2 -ck "${sfile}" | grep ": session opened for user" | grep " by (uid=0)" |
|
||||
while read line; do
|
||||
while read -r line; do
|
||||
parseLog "${line}" "${AUTH_LOG}" "${START_YEAR}" "${LOG_TARGET}" ${DEBUG};
|
||||
done;
|
||||
done;
|
||||
@@ -132,8 +139,8 @@ else
|
||||
START_DATE="sshd"
|
||||
fi;
|
||||
START_YEAR=$(date +%Y -d "1 day ago");
|
||||
cat /var/log/secure | grep "${START_DATE}" | grep ": session opened for user" | grep " by (uid=0)" |
|
||||
while read line; do
|
||||
grep "${START_DATE}" "/var/log/secure" | grep ": session opened for user" | grep " by (uid=0)" |
|
||||
while read -r line; do
|
||||
parseLog "${line}" "${AUTH_LOG}" "${START_YEAR}" "${LOG_TARGET}" ${DEBUG};
|
||||
done;
|
||||
fi;
|
||||
|
||||
Reference in New Issue
Block a user