1. Overview For this assignment the student will write a basic BASH script. The script will be used to inspect a log file. 2. Script Requirements The script may be against a specific log file, or have...

2 answer below »
I just need the bash script done by tomorrow by 2pm so that I can write the report for the script. I need all of the code commented so that I can do the report. I am sorry this is such short notice but I tried doing it myself with no luck


1. Overview For this assignment the student will write a basic BASH script.  The script will be used to inspect a log file.   2. Script Requirements The script may be against a specific log file, or have the log file name determined by the command line.  The student may determine which log file(s) or log file types to use as long as the log file contains at least 20 entries. Note:  Many log files are available in /var/sys/log or /var/log. The script will iterate through the log file and determine some useful information based on what it finds in the log file. The student may determine particular information to pull from the log file.  Examples: How many times did user X log in during a certain amount of time? List the errors or failed attempts at an action. Show new applications that were installed during a certain time frame.     3. Process The bash script needs to be built and tested using appropriate log files. Submit a report following the standard format (Report Format.docx) , along with a copy of the script. With the script completed and tested, discuss how the script could be used by a security professional to aid in spotting, researching, or analyzing a potential security issue.   4. References The following sources are useful in developing BASH scripts: Garrels, Machtelt. Bash Guide for Beginners. 2008. http://tldp.org/LDP/Bash-Beginners-Guide/html/Bash-Beginners-Guide.html#sect_01_02 Chadwick, Ryan. Ryans Tutorials: Bash Scripting Tutorial. https://ryanstutorials.net/bash-scripting-tutorial/ Banas, Derek.  Shell Scripting Tutorial. YouTube. 2016. Shell Scripting Tutorial Nemeth, Evi et al. Unix and Linux System Administration Handbook, 4th Ed.  Prentis Hall Upper Saddle River, NJ. 2011. Finally, type:  man bash at the command prompt on any Linux/Unix system for the manual page of bash.   Scripting Best Practices When run with inappropriate arguments, scripts should print a usage message and exit.  The same message could be printed with a –help argument. Validate inputs and sanity check derived values. Return an appropriate exit code: zero for success and nonzero for failure. Use appropriate naming conventions for variables, scripts, and routines. User variable names that reflect the values they store. Start every script with a comment block that tells what the script does and what parameters it takes.  Include your name and the date.  If the script requires non-standard tools, libraries, or modules to be installed, list those as well. Comment at a useful level.  More complexity requires more comments.
Answered 2 days AfterFeb 03, 2021

Answer To: 1. Overview For this assignment the student will write a basic BASH script. The script will be used...

Sandeep Kumar answered on Feb 05 2021
152 Votes
#!/bin/bash
#
# analyze and summarize auth.logs
tmpfile=`mktemp`
(
############################################################
#
# first conca
t all auth logs
#
############################################################
cat /var/log/auth.log /var/log/auth.log.1
zcat /var/log/auth.log*.gz
) \
| \
(
############################################################
#
# then drop everything we're not interested in
#
############################################################
# drop:
#
# Apr 15 18:49:39 myserver sshd[3363]: Address 74.3.165.7 maps to annoyed.marketwisedeals.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
grep -v "but this does not map back to the address"
) \
| \
(
# drop:
#
# Apr 29 06:47:01 myserver CRON[12381]: pam_unix(cron:session): session opened for user root by (uid=0)
# Apr 29 06:47:01 myserver CRON[12381]: pam_unix(cron:session): session closed for user root
grep -v "cron:session"
) \
| \
(
# only take last line:
#
# Apr 29 06:25:03 myserver sshd[11547]: Invalid user aida from 174.143.253.29
# Apr 29 06:25:03 myserver sshd[11547]: pam_unix(sshd:auth): check pass; user unknown
# Apr 29 06:25:03 myserver sshd[11547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174-143-253-29.static.cloud-ips.com
# Apr 29 06:25:05 myserver sshd[11547]: Failed password for invalid user aida from 174.143.253.29 port 43198 ssh2
grep -v ": Invalid user " \
| grep -v ":...
SOLUTION.PDF

Answer To This Question Is Available To Download

Related Questions & Answers

More Questions »

Submit New Assignment

Copy and Paste Your Assignment Here