Shulou(Shulou.com)06/02 Report--

For some reason, you may need to track new user creation information on Linux. At the same time, you may need to send details by email. This may be part of the audit goal, or the security team may want to monitor it for tracking purposes.

We can do this in other ways, as we described in the previous article.

A Bash script that sends mail when a new user account is created in the system

Linux has many open source monitors that can be used. But I don't think they have a way to track the process of creating new users and alert administrators when it happens.

So how can we do that?

We can write our own Bash scripts to achieve this goal. We have written many useful shell scripts in the past.

What does this script do?

This will back up / etc/passwd files twice a day (at the beginning and end of the day), which will enable you to get new user creation details on a specified date.

We need to add the following two cron tasks to copy the / etc/passwd file.

# crontab-e1 0 * cp / etc/passwd / opt/scripts/passwd-start-$ (date + "% Y-%m-%d") 59 23 * cp / etc/passwd / opt/scripts/passwd-end-$ (date + "% Y-%m-%d")

It uses the diff command to detect differences between files, and if it finds any differences from yesterday, the script sends new user details to the specified email.

We don't have to run this script often, because user creation doesn't happen very often. However, we plan to run this script once a day.

In this way, you can get a comprehensive report on the creation of new users.

Note: we used our email address to demonstrate in the script. Therefore, we require you to use your own email address.

# vi / optActionScriptsAccording to newSummerUserUserUserUserUserDetail.shrougbinUniple Basimv / opt/scripts/passwd-start-$ (date-- date='yesterday''+% Ymure% mmure% d') / opt/scripts/passwd-startmv / opt/scripts/passwd-end-$ (date-- date='yesterday''+% Ymuri% mmurf% d') / opt/scripts/passwd-enducount=$ (diff / opt/scripts/passwd-start / opt/scripts/passwd-end | grep ">" | cut-d ":"-f6 | cut-d "/"-f3 | wc-l) if [$ucount-gt 0] then SUBJECT= "ATTENTION: New User Account is created on server: `date-- date='yesterday''+% b% e'`" MESSAGE= "/ tmp/new-user-logs.txt" TO= "2daygeek@gil.m" echo "Hostname: `hostname`" > $MESSAGE echo-e "\ n" > > $MESSAGE echo "The New User Details are below." > $MESSAGE echo. "+-- +" > $MESSAGE diff / opt/scripts/passwd-start / opt/scripts/passwd-end | grep ">" | cut-d ":"-f6 | cut-d "/"-f3 > > $MESSAGE echo "+-+" > > $MESSAGE mail-s "$SUBJECT" $TO < $MESSAGE rm $MESSAGEfi

Add executable permissions to new-user-detail.sh.

$chmod + x / opt/scripts/new-user-detail.sh

Finally, add a cron task to do this. It runs at 7 o'clock every morning.

# crontab-e0 7 * / bin/bash / opt/scripts/new-user.sh

Note: you will receive an email reminder of yesterday's details at 7 o'clock every morning.

Output: the output is the same as the following output.

Https://www.51cto.com/it/news/2019/1223/17728.html

# cat / tmp/new-user-logs.txtHostname: CentOS.2daygeek.comThe New User Details are below.+--+tuser3+--+

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.