服务器用户、密码变动检测脚本

#!/bin/bash#说明：#报警计数器位置：#dircount/fileint.txt，dircount/dirint.txt#脚本日志位置：#/tmp/diff.log#脚本主目录：#/tools/passwdmd5/#脚本使用：#初始化安装#./diff_user_passwd.sh install#解除报警，初始化部署#./diff_user_passwd.sh init#正常执行定时任务，或正常检测：#./diff_user_passwd.sh startget_ip()  {
#cmd_get_ip = "/sbin/ifconfig |grep 'inet addr'|awk -F\: '{print $2}'|awk '{print $1}' | grep -v '^127' | grep -v '192'"#cmd_get_ip = "ifconfig |grep 'inet addr'|awk -F\: '{print $2}'|awk '{print $1}' | grep -v '^127'"#return cmd_get_ip#cmd_get_ip=$(/sbin/ifconfig |grep 'inet 192.168.136'|awk -F ' ' '{print $2}'|awk '{print $1}')cmd_get_ip=$(/sbin/ifconfig |grep "192.168.1\." |awk -F ' ''{print $2}'|tr -d "地址:"|tr -d "addr:")echo$cmd_get_ip}
#生成md5文件目录filepath="/tools/passwdmd5"dirpath="/tools/dircount"#格式化日期输出date=`date +%Y-%m-%d@%H:%M:%S`#获取ipip=$(get_ip)#设定报警最大次数，并将此次异常后重置maxint=3#给循环次数初始化varint=0#邮件接收人receiver=你的收件箱
#查看变动if [ -f /tools/passwdmd5/passwd.bak -a-f /tools/passwdmd5/shadow.bak ];then
dfuser=`diff /etc/passwd /tools/passwdmd5/passwd.bak`dfpswd=`diff /etc/shadow /tools/passwdmd5/shadow.bak`elsedfuser=''dfpswd=''fi#新建部署exec_install() {
rm-fr$filepathmkdir-p$filepathrm-fr$dirpathmkdir-p$dirpathcp-f /etc/passwd $filepath/passwd.bak
cp-f /etc/shadow $filepath/shadow.bak
  md5sum /etc/passwd > $filepath/passwdmd5old.log
  md5sum /etc/shadow >> $filepath/passwdmd5old.log
}
#正常添加用户或修改密码后初始化exec_init() {
rm-fr$filepath/passwd.bak $filepath/shadow.bak $filepath/passwdmd5old.log
cp-f /etc/passwd $filepath/passwd.bak
cp-f /etc/shadow $filepath/shadow.bak
  md5sum /etc/passwd > $filepath/passwdmd5old.log
  md5sum /etc/shadow >> $filepath/passwdmd5old.log
echo0 > $dirpath/fileint.txt
}
#正常邮件报警users_alarm() {
echo-e"本机用户有异常!"\\n"用户变化："\\n$dfuser\\n"密码变化："\\n$dfpswd | mail -s$ip"服务器上用户有异常，请查看！"$receiver}
#重置邮件报警reset_alarm() {
echo-e"本机用户异常报警超过$maxint次，执行重置命令!"\\n"用户变化："\\n$dfuser\\n"密码变化："\\n$dfpswd | mail -s$ip"重置计划：部署已重置，请查看重置前用户异常情况！"$receiverecho0 > $dirpath/fileint.txt
}
#文件被删除报警file_alarm() {
echo-e"$filepath文件被删除报警!"\\n"用户变化："\\n$dfuser\\n"密码变化："\\n$dfpswd | mail -s$ip"$filepath文件可能被删除，请检查文件情况！"$receiver}
#目录被删除报警dir_alarm() {
echo-e"$filepath目录被删除报警!" | mail -s$ip"$filepath目录被删除，请检查目录情况！"$receiver}
#对比用户和密码函数diff_user_passwd() {
if [ -f$filepath/passwdmd5old.log -a-f$filepath/passwd.bak -a-f$filepath/shadow.bak ];then
  md5sum /etc/passwd > $filepath/passwdmd5new.log
  md5sum /etc/shadow >> $filepath/passwdmd5new.log
a=`diff -c $filepath/passwdmd5new.log $filepath/passwdmd5old.log`if [ "$a"="" ];then
if [ ! -d$dirpath ];then
mkdir-p$dirpathecho0 > $dirpath/fileint.txt
fiecho"==========================================" >> /tmp/diff.log
echo$date":用户正常。" >> /tmp/diff.log
echo"==========================================" >> /tmp/diff.log
elseecho"==========================================" >> /tmp/diff.log
echo$date":" >> /tmp/diff.log
echo"$a" >> /tmp/diff.log
echo"==========================================" >> /tmp/diff.log
#获取已执行次数if [ ! -d$dirpath ];then
mkdir-p$dirpathecho0 > $dirpath/fileint.txt
fiif [ ! -f$dirpath/fileint.txt ];then
echo0 > $dirpath/fileint.txt
fivarint=`cat $dirpath/fileint.txt`if [ $varint-lt$maxint ] ;then
#获取详细变动      users_alarm
      ((varint++))
echo$varint > $dirpath/fileint.txt
else#进行异常重置及报警      reset_alarm
if [ -f$filepath/passwd.bak -a-f$filepath/shadow.bak ];then
rm-rf$filepath/passwd.bak $filepath/shadow.bak
echo$date":已进行重置，删除passwd.bak，shadow.bak以及passwdmd5old.log三个文件!!!" >> /tmp/diff.log
        exec_init
        diff_user_passwd
else        exec_init
        diff_user_passwd
fififielse#获取已执行次数if [ ! -d$dirpath ];then
mkdir-p$dirpathecho0 > $dirpath/fileint.txt
fiif [ ! -f$dirpath/fileint.txt ];then
echo0 > $dirpath/fileint.txt
fivarint=`cat $dirpath/fileint.txt`if [ $varint-lt$maxint ] ;then
    file_alarm
    ((varint++))
echo$varint > $dirpath/fileint.txt
else    exec_init
    diff_user_passwd
fifi}
#开始执行脚本if [ "$1"="install" ];then
  exec_install
  diff_user_passwd
elif [ "$1"="start" ];then
if [ -d$filepath ];then
    diff_user_passwd
elseif [ ! -d$dirpath ];then
mkdir-p$dirpathecho0 > $dirpath/dirint.txt
fi#循环目录报警次数if [ ! -f$dirpath/dirint.txt ];then
echo0 > $dirpath/dirint.txt
fivarint=`cat $dirpath/dirint.txt`if [ $varint-lt$maxint ] ;then
        dir_alarm
        ((varint++))
echo$varint > $dirpath/dirint.txt
else        exec_install
        diff_user_passwd
fifielif [ "$1"="init" ];then
  exec_init
  diff_user_passwd
elseecho"您输入的参数有误，若是新部署请加参数install来部署或者start来启动"exit0fi