Autor Wątek: Ulepszanie skryptu. (Przeczytany 5772 razy)

1709 · « **dnia:** 2018-11-18, 14:00:42 »

Zrobilem sobie taki skrypt side (Simple Intrusion Detection Environment)
( na własne potrzeby )

#!/bin/bash

# Name: side
# Version: 2
# Licence: GPLv3


error1(){
echo "$@" ; exit 1
}

# Check if sha256sum is installed
[ "$(sha256sum --version)" ] || error1 "--> You need install sha256sum"


#=============={
side_verify() {
echo "--> Verify base with local hash"
sha256sum -c dat/hash.base.org.sum || error1 "--> Error: Verify hash.base.org FAILED"
sha256sum -c dat/perm.base.org.sum || error1 "--> Error: Verify perm.base.org FAILED"


ADDITIONAL_VERIFICATION_HASH_V1()
{
#### YOU NEED CHECK THIS AND ADAPT TO YOUR OWN NEEDS
echo "=========={"
echo "--> Verify base with on-line hash"
## tr -d '\r' will remove "CRLF line terminators"
curl -v --silent https://pastebin.com/paste_own_link --stderr - | grep " dat/hash.base.org" | sed -e 's/<[^>]*.//g' | tr -d '\r' \
| sha256sum --check || error1 "--> Error: Verify hash.base.org FAILED"
curl -v --silent https://pastebin.com/paste_own_link --stderr - | grep " dat/perm.base.org" | sed -e 's/<[^>]*.//g' | tr -d '\r' \
| sha256sum --check || error1 "--> Error: Verify perm.base.org FAILED"
echo "==========}"
}

ADDITIONAL_VERIFICATION_HASH_V2()
{
echo "=========={"
echo "--> Paste hash of hash.base.org to verify and click Enter key:"
read -p "hash.base.org=" HASH_OF_HASH
echo "$HASH_OF_HASH" | sha256sum --check || error1 "--> Error: Verify hash.base.org FAILED"

echo "--> Paste hash of perm.base.org to verify and click Enter key:"
read -p "perm.base.org=" HASH_OF_PERM
echo "$HASH_OF_PERM" | sha256sum --check || error1 "--> Error: Verify perm.base.org FAILED"
echo "==========}"
}

#### Remove " # " to active below function.
# ADDITIONAL_VERIFICATION_HASH_V1
# ADDITIONAL_VERIFICATION_HASH_V2
}
#==============}


#========================={
side_create() {
mkdir -p ./dat
[ -e dat/hash.base ] && rm dat/hash.base
[ -e dat/perm.base ] && rm dat/perm.base

#### YOU NEED CHECK AND ADAPT TO YOUR OWN NEEDS
FIND_IN="/"

#### YOU NEED CHECK AND ADAPT TO YOUR OWN NEEDS
#### "-print" is for "-prune", which is to skip the indicated directories,
#### be careful with edit option "prune", because first used "prune" sometimes may not work,
#### working example from "man find": find . -path ./src/emacs -prune -o -print.
find "$FIND_IN" \
\
-path '/cdrom' -prune -o  \
-path '/dev' -prune -o  \
-path '/home' -prune -o  \
-path '/media' -prune -o  \
-path '/mnt' -prune -o  \
-path '/proc' -prune -o  \
-path '/run' -prune -o \
-path '/sys' -prune -o  \
-path '/tmp' -prune -o  \
-path '/var' -prune -o  \
 \
-type f  -exec sha256sum {} + | tee -a dat/hash.base

while IFS= read -r LINE1
do
    ls -l "$LINE1" | tee -a dat/perm.base
done <<< "$(cut -d" " -f3- dat/hash.base)"
}
#=========================}


#========================={
side_move() {
mv dat/hash.base dat/hash.base.org
mv dat/perm.base dat/perm.base.org

echo "=========={"
echo "OPTIONAL:"
echo "--> You can sent hash files to inaccessible place,"
echo " for example on paste.bin, manualy"
echo "and add links to this script or paste hash, during verification:"
sha256sum dat/hash.base.org > dat/hash.base.org.sum
sha256sum dat/perm.base.org > dat/perm.base.org.sum
cat dat/hash.base.org.sum
cat dat/perm.base.org.sum
echo "==========}"
}
#=========================}


#========================================================================================={
case $1 in
	"--first.init"|"-f")
		side_create
		side_move
	;;
	"--check"|"-c")
		side_verify
		side_create
		echo "######################################################"
		echo "    "
		echo "--> Changed files:"
		echo "    "
		diff dat/hash.base dat/hash.base.org
		diff dat/perm.base dat/perm.base.org
	;;
	"--help"|"-h") 
		echo "--first.init		Option to create base of checksums."
		echo "--check			Option to verify files with base."
        echo " "
		echo "This software is used to verify changes in the system."
        echo " "
		echo "WARNING: "
		echo "Because the length of the checksum is constant,"
		echo "regardless of the size of the file,"
		echo "with bigger file, exist higher risk "
		echo "of building the same checksum for the changed file."
	;;
	*)
		echo "	Error: unknown option"		
		echo "	Try use: $0 --help"
		exit
	;;
esac
#=========================================================================================}

Czy mozna jeszcze jakos go ulepszyc ?

1. Skrypt bedzie uruchamiany jako root,
wiec nie jestem pewien czy zmienna np. FIND_IN moze byc tak zapisana.
2. Chcialem zeby skrypt byl bardziej przejrzysty,
np. zapisanie sciezek ( "/proc/*" "/home/*" ) do pliku konfiguracyjnego ale komenda find obraza sie na moje zmienne
i tablica nie chce nic zapisac w sobie w petli while.
3. Skrypt narazie nie potrafi wyslac hash przez curl, trzeba wkleic recznie, a fpaste czy czegos podobnego nie mam i narazie nie bede kompilował.

Edytowane
Przydalaby sie aplikacja na telefon do skanowania i weryfikowania hashy na telefonie

Dzieki temu nie musialbym zapisywac hashy w sieci.

Edytowane
- A moze by fragment z linkami zmienic w ten sposob ?

Aktualności:

Linux.pl »

Nowe posty

Autor Wątek: Ulepszanie skryptu. (Przeczytany 5772 razy)