LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-15-2015, 11:11 AM   #1
HardenedCriminal
Member
 
Registered: May 2015
Posts: 104

Rep: Reputation: Disabled
Stop tampering with my servers


I created this script that basically will email me whenever anyone installs a thumbdrive, external HD, etc. in one of the servers. But I can't get the thing to work it always emails BAD. I have copied from the screen or from the HD.txt file and neither work.

Thanks to all in advance.

=========================

lsblk -io KNAME,TYPE,SIZE,MODEL > HD.txt ## gets all HDs & partitions in system
sed -i -r 's/\s+//g' HD.txt ## removes whitespace
sed -i ':a;N;$!ba;s/\n/XX/g' HD.txt ## remove carriage returns and replaces with XX

# Edit HD.txt to insert in the value below
PARTITIONS1="KNAMETYPESIZEMNODEL?sdadisk149.1GST3160318AS?sda1part500M?sda2part27.5G?dm-0crypt27.5G?dm-1lvm25.5G?dm-2lvm2G?sr0rom1024MDVDCDH48C2S"
PARTITIONS2=$(cat HD.txt)

if [[ $PARTITIONS1 == $PARTITIONS2 ]]
then
echo "Good"
else
echo "BAD on `hostname`" |mail -s "BAD on `hostname`" root &
fi
 
Old 05-15-2015, 12:16 PM   #2
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 19,872
Blog Entries: 12

Rep: Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053
change the script so that it outputs the 2 variables, and compare them manually.
also i'm pretty sure you have to put doublequotes around them (and some other places in the script).
 
Old 05-15-2015, 12:30 PM   #3
HardenedCriminal
Member
 
Registered: May 2015
Posts: 104

Original Poster
Rep: Reputation: Disabled
Sorry but I really am not much of a programmer, can I bug you to show me? I tried the double quotes.. no luck.

This script works great on one liners in the first variable without the the need for SED. I have about 10 such like scripts that do mediocre jobs.

I am guessing there is something line return or such in missing; something my eyes can not see.

thanks for the help.

Is there an "almost equal" coding or this is "contained inside"?

butch
 
Old 05-15-2015, 12:49 PM   #4
HardenedCriminal
Member
 
Registered: May 2015
Posts: 104

Original Poster
Rep: Reputation: Disabled
SOLVED... typos on my part here is a debug version edit to your own taste.


lsblk -io KNAME,TYPE,SIZE,MODEL > HD.txt ## gets all HDs & partitions in system
sed -i -r 's/\s+//g' HD.txt ## removes whitespace
sed -i ':a;N;$!ba;s/\n/XX/g' HD.txt ## remove carriage returns and replaces with XX

# Edit HD.txt to insert in the value below
PARTITIONS1="KNAMETYPESIZEMODELXXsdadisk149.1GST3160318ASXXsda1part500MXXsda2part27.5GXXdm-0crypt27.5GXXdm-1lvm25.5GXXdm-2lvm2GXXsr0rom1024MDVDCDH48C2S"
PARTITIONS2=$(cat HD.txt)

if [[ $PARTITIONS2 == $PARTITIONS1 ]]
then
echo "Good"
else
echo $PARTITIONS1
echo $PARTITIONS2
echo "BAD on `hostname`" |mail -s "BAD on `hostname` `date`" root &
echo "put your coding in here to destroy (shred, wipe, etc) USB or HD or whatever someone is using in your server to steal your stuff. NOTE in GRUB if you are not on a server with a USB keyboard put in "nousb" at the end of the kernel line so no usb anything works."
fi

# rm HD.txt
 
Old 05-15-2015, 01:06 PM   #5
Habitual
LQ Veteran
 
Registered: Jan 2011
Location: Abingdon, VA
Distribution: Catalina
Posts: 9,374
Blog Entries: 37

Rep: Reputation: Disabled
users on a server...I can't get over that practice. I'm just sayin'...
 
Old 05-15-2015, 01:09 PM   #6
HardenedCriminal
Member
 
Registered: May 2015
Posts: 104

Original Poster
Rep: Reputation: Disabled
Not legit users, if you get the idea. I am sure you can adopt this for any workstation too.

I have often thought virtual Winblows in a Linux and no one leaves with company materials.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
find out binary file tampering dev102 Linux - Security 6 05-21-2012 04:24 AM
Physical tampering of a switch PlatinumX General 14 09-19-2010 12:20 PM
I want to disable logwatch on our RHEL servers to stop the logwatch mail svik Linux - Enterprise 10 08-27-2009 02:51 PM
How to set DNS servers? How to stop auto change of DNS servers? newtovanilla Linux - Newbie 1 10-29-2008 09:19 PM
LXer: SolutionBase: Stop spam on Linux e-mail servers with SpamAssassin LXer Syndicated Linux News 0 06-04-2007 05:16 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 11:44 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration