triggerning mail if command 'rm' executed

[himacs]

Hi Admins,

Somebody did some nasty things and our server ended up in hung state,lost /var and /usr.

No OS backup,No tape drive,No OS cd..  Please dont ask why..?

There is no direct root disabled, all the people in this world using root to login to this server.

Since some application dependancy not able disable the direct root login.

Now i am trying to write a script , which trigger a mail if anybody runs 'rm' command.

Please help me to write the logic of the script.

Regards

himacs

[Patrick Wallek]

What do you want to happen when someone executes 'rm'?  Do you want to just send an e-mail or do you want it to actually delete the files?

[Patrick Wallek]

At its simplest form:

1) Move /usr/bin/rm to /usr/bin/rm.orig

2) Take the following script and make it /usr/bin/rm and make sure it is executable by all users (555 permissions).

# cat rm

#!/usr/bin/sh
RM=$@
echo "The following rm command was run: ${RM}" | mailx -s "rm command" user@domain.com

The thing to keep in mind is that if you patch you will need to check the 'rm' command to make sure your custom script has not been overwritten.

[himacs]

Hi Patrick,

Thanks for the response.

My requirement is , if anybody executes rm command i should get a mail, stating that user X ran rm from X ip.

I dont want to block users from executing rm command.

REgards

himacs

[himacs]

Patrik,

Thanks for the logic.

But if i move the rm binary, i cannot delete files right..?

Requirement is if anyone executes rm , mail should trigger.Let them delete files.But i should get notification .

Regatds

himacs

[Dennis Handly]

Do you really want to mail for each rm, instead of just logging it?

(Or are you worried that the logs will be removed too?  :-)

You could also enable auditing for unlink.

[Steven E. Protter]

You really have a problem with who has what powers on the system. User privileges are the problem.

You can scan the .sh_history files for rm and do an email with the mailx -s command.

Of course by then the damage will already be done.

Also note .sh_history file can be altered by the user.

A more effective response would be a security audit and going over who has what powers as part of an analysis of sudo privileges and such.

SEP
Lo Someach, but back.

[himacs]

Hi Admins,

Thanks for the comment.
Anyhow this server will be in production for next 2 more months.Let me introduce sude od rbac.

Thanks
himacs