topic Re: Free script Again in Operating System - HP-UX

Free script Again

Paula J Frazer-Campbell — Fri, 16 Aug 2002 07:33:27 GMT

Hi

Got more than one root level user or other system dependant upon the root password.

A little script to monitor root password for a change :-

All donations to 07/11 fund.

#!/bin/ksh
##################################################
# Monitor of changes to root login
# PJFC 2001
##################################################
# Check carried out against $a as defined below
# 'a' Should be whole of current root entry in /etc/passwd
# Copy and paste it on the line below.
a=root:bbtu9S2dwAMWM:0:3:AVRO:/:/sbin/sh
##################################################
# Get current root entry line from passwd
# Use grep ???v to exclude other users like rootaw
b=`cat /etc/passwd | grep -v gdr | grep -v rootaw | grep root | awk '{print $1}'`
##################################################
# Check for new file by comparing dates
if [[ $a != $b ]]
then
##################################################
# If root entry has changed then warn
# Mail to desktop
mailx -s "WARNING - WARNING N0 Root login has changed " paula@avro.co.uk # Mail to phone
mailx -s "WARNING - WARNING N0 Root login has changed " 07956610410@one2one.net fi

Paula

Re: Free script Again

Paula J Frazer-Campbell — Fri, 16 Aug 2002 07:35:03 GMT

The bit:-

WARNING - WARNING N0 Root login has changed

N0 (N Zero is a server name)

paula

Re: Free script Again

BFA6 — Fri, 16 Aug 2002 08:14:39 GMT

Looks good, need to start monitoring this here.

Thanks,

Hilary

Re: Free script Again

Justo Exposito — Fri, 16 Aug 2002 08:23:24 GMT

Hi Paula,

Good work!

Only one improvement, try with this in order to solve the problem with users like rootaw:
# Get current root entry line from passwd
# Use grep ???v to exclude other users like rootaw
b=`cat /etc/passwd | grep "^root:" | awk '{print $1}'`

Regards,

Justo.

Re: Free script Again

Justo Exposito — Fri, 16 Aug 2002 08:29:52 GMT

Hi Paula,

I am studying your script and if you only want to check the password and not all the line you can check only the second field in the passwd file with this:
#!/bin/ksh
##################################################
# Monitor of changes to root login
# PJFC 2001
##################################################
# Check carried out against $a as defined below
# 'a' Should be whole of current root entry in /etc/passwd
# Copy and paste it on the line below.
a=bbtu9S2dwAMWM
##################################################
# Get current root entry line from passwd
# Use grep ???v to exclude other users like rootaw
b=`cat /etc/passwd | grep "^root:" | cut -d":" -f2`
##################################################
# Check for new file by comparing dates
if [[ $a != $b ]]
then
##################################################
# If root entry has changed then warn
# Mail to desktop
mailx -s "WARNING - WARNING N0 Root login has changed " paula@avro.co.uk # Mail to phone
mailx -s "WARNING - WARNING N0 Root login has changed " 07956610410@one2one.net fi

Regards,

Justo.

Re: Free script Again

Chris Wilshaw — Fri, 16 Aug 2002 08:33:32 GMT

A suggestion, and a problem

suggestion: rather than having the root entry line in the file, create another file eg:

/etc/r_pw

with read only access for root, then use

a=`cat /etc/r_pw`

This way, you can have a standard script for use on a number of systems, rather than having to hard code the entry on every one that you run.

problem: it won't work on a trusted system

Re: Free script Again

Paula J Frazer-Campbell — Fri, 16 Aug 2002 09:03:48 GMT

Hi Guys/Gals

Yes of couse there are other ways to do/enance somthing.

The script works in its current state.

I was giving away the concept.

Do what you wish with it.

;^)

Paula

Re: Free script Again

Justo Exposito — Fri, 16 Aug 2002 09:13:12 GMT

Hi Paula,

Sorry, yep the script works fine.

Only ideas;-(

Regards,

Justo.

Re: Free script Again

Paula J Frazer-Campbell — Fri, 16 Aug 2002 09:27:10 GMT

Hi Justo

I was not upset, I just thought I would clarify why I placed the idea on the forum.

All comments/enhancements are most welcome.

I am not a scripting GURU but normally I can find a way to do what I want.

;^)

Paula

Re: Free script Again

Pete Randall — Fri, 16 Aug 2002 09:38:39 GMT

Paula,

How about a simple ThankYou with no whining:

Thankyou!

Pete

Re: Free script Again

Paula J Frazer-Campbell — Fri, 16 Aug 2002 09:46:06 GMT

Hi Pete

I was not at all upset / whining, no was I having a go at anyone.

As I said I was giving the concept away and I am most receptive to suggestions.

;^)

Paula

Re: Free script Again

Justo Exposito — Fri, 16 Aug 2002 09:47:10 GMT

Hi Paula,

As Pete tell you, THANK YOU.

Cheers,

Justo.

Re: Free script Again

Justo Exposito — Fri, 16 Aug 2002 09:51:04 GMT

Hi Again,

Another sugestion...

Use the command crypt in order to encrypt your old passwd.

Regards,

Justo.

Re: Free script Again

H.Merijn Brand (procura — Fri, 16 Aug 2002 09:52:36 GMT

I was just enjoying this thread to see what the reactions would be. *DO* people actually use this: Yes, What would they change? Many ideas pop up after reading it.

What would happen if /etc/passwd looks like:

xoot:bbtu9S2dwAMWM:0:3:AVRO:/:/sbin/sh
root:bbtu9S2dwAMWM:1:3:AVRO:/:/sbin/sh

Would it make a system unusable? Or can we just continue as xoot?

FWIW I'm not the one to try out :)

Some thought about general efficiency

*WHY* do people use 'cat file | filter' instead of 'filter < file' ?

It's just an extra unneeded process

b=`grep '^root:.*:0:' /etc/passwd`

just another ??? 0.01 (which will probably just disappear soon)

Re: Free script Again

Paula J Frazer-Campbell — Fri, 16 Aug 2002 09:56:30 GMT

Hi Justo

Not with you on the cript bit.

Do you meaan cript the a=

Paula

Re: Free script Again

Pete Randall — Fri, 16 Aug 2002 10:00:56 GMT

Paula,

I know you weren't upset - I was just "not looking a gift horse in the mouth".

Pete

Re: Free script Again

Paula J Frazer-Campbell — Fri, 16 Aug 2002 10:04:37 GMT

Hi

What a wonderful expression:-

"not looking a gift horse in the mouth"

Derives from the days before automotive transport, and the way you can tell the age/ condition of a horse was by looking in its mouth - so if anyone gave you a horse as a gift it was very inpolite to look in its mouth.

TGIF

Paula

Re: Free script Again

Paula J Frazer-Campbell — Fri, 16 Aug 2002 10:15:55 GMT

Hi

Enhancement to pull password from root entry using above suggestions.

b= `grep '^root:.*:0:' /etc/passwd | cut -d":" -f2`

Thanks guys

Re: Free script Again

Justo Exposito — Fri, 16 Aug 2002 10:33:19 GMT

Hi Paula,

No, I just thinking to use the Chris recomendations about to put the old password in a file, then use the rights and the crypt in order to put in a safe place.

In Spanish:

"not looking a gift horse in the mouth"
"A caballo regalado no le mires el diente"

;^D

Regards,

Justo.

Re: Free script Again

Pete Randall — Fri, 16 Aug 2002 10:48:28 GMT

Specifically you would check the number/condition of the horse's teeth, I believe.

Pete