0

I wanted to write a script to monitor the /root/.bashrc file and have it either notify me when this happens or prevents the change from happening without some kind of authentication.

How would I go about doing that? I have never written a script for something like this. If you need me to tell you a specific language that I would use, it would either be Python 2 or bash. Would there be an easier way of going about this?

8
  • what does "moniter" mean?
    – Camden
    Jul 24, 2017 at 20:59
  • Watching the file for changes Jul 24, 2017 at 20:59
  • Hmmm. That will be difficult... anyone that can change /root/.bashrc can will know how to avoid getting logged ;-)
    – Rinzwind
    Jul 24, 2017 at 21:02
  • Is it really that easy to prevent being monitored? Jul 24, 2017 at 21:03
  • 1
    Oh and to warn about changes, including what is changed: diff {copy_of_file} {new file} >> /var/log/bash.diff. edit: that file can only be changed by the admin ... and the admin is the one that can stop anything you did to log it
    – Rinzwind
    Jul 24, 2017 at 21:03

2 Answers 2

0

Pyinotify, simple approach

Since you asked for Python among potential variations on solutions, there is Python's pyinotify module. I'm personally using Python 3. The solution can be as simple as python3 -m pyinotify <FILE> or you can write a full-blown script if necessary.

Here's an example in action:

enter image description here

Script

One possibility of a custom script can be done via modifying the tutorial provided on official GitHub repository for pyinotify. Since you're only concerned with modifications to the file, I implemented the script only for that, but it can be altered to include other events.

#!/usr/bin/env python3
import pyinotify
import sys

class EventHandler(pyinotify.ProcessEvent):
    def process_IN_MODIFY(self, event):
        print("File",sys.argv[1]," was modified:",event.pathname)

wm = pyinotify.WatchManager()
mask = pyinotify.IN_MODIFY
handler = EventHandler()
notifier = pyinotify.Notifier(wm, handler)
wdd = wm.add_watch(sys.argv, mask, rec=True)
notifier.loop()

And here is a small test:

enter image description here

Taking it further

In either case, all you need to do is to launch the command with root privileges via /etc/rc.local or via cron, and that's it. Output can be sent to either some sort of log file, or send a notification to admin user. Personally, I'd launch two commands - one with root privileges that writes to a log file, and another one that watches log file for changes and sends a GUI notification to the user. Possibilities are endless here, so use your imagination.

Looking for changes can be done via keeping backup of the file (maybe taken at the start of the script), and once the file is modified - run diff or via Python script itself via difflib. You can also incorporate checking md5 or sha256 hashsums into the equation, but those aren't very useful except for knowing that file was altered. Another issue is that running a notifier script doesn't prevent changes that may have occurred while system was off-line, i.e. if somebody booted live USB or took out your hard-drive and connected to their machine, and only then modified the file. This can be mitigated by encrypting the hard drive. That also means that you probably should check for changes as soon as the script starts up.

As far as figuring out who altered the file, you could consider correlating date of modification and date of users logging in as root/sudo. Of course, I have to warn: this is a somewhat hopeless task. A rogue user with root abilities can alter logs and erase that user's presence, leaving little to no indication of who it may have been. Users who acquired root powers can even alter your script. In conclusion, the best security to avoid having your sensitive file modified is to prevent anyone being able to open that file in the first place.

5
  • Oh man that was a lot. Thank you for answering my question and giving me several options in doing it. The reason I asked this question is because I have been working on a mini project. It is where, say someone did hack root and found out its password, I have set something inside of the root/.bashrc file that will cause the whole system to shutdown immediately after someone logs in as root. But because if someone knew the password to the root/.bashrc file, they could change what I set up. But I wouldn't know if they turned it off. So I needed something to watch the file to look for changes. Jul 25, 2017 at 0:24
  • Not sure how that relates to the conversation/answer but that is the whole reason I chose to ask this question. Jul 25, 2017 at 0:25
  • @HunterT. I'd suggest disabling root account entirely or at least disable interactive login for it. It's typical for blackhats to brute force root account. A sudo account is less obvious. Also, if you are using ssh, deny root logins via ssh. I have a question on my profile somewhere about that, but i am on phone so finding it is a bit time consuming for me right now Jul 25, 2017 at 1:14
  • I do keep it disabled. I only do that type of stuff on a virtual image of Ubuntu Linux. On my Mac, I keep root disabled. And I have heard about black hats brute forcing root account. Don't people even set up bots that are programmed to do that? Jul 25, 2017 at 1:21
  • Yup. I used to have server on Digital Ocean. Logs were full of failed attempts to login as root. All automatic dictionary attacks Jul 25, 2017 at 1:21
0

This might work: sudo inotifywatch -r /root/.bashrc

For more information see the man page.

3
  • 1
    Likely to work yes. But "sudo" is not needed. This should be done as "root" and from cron.
    – Rinzwind
    Jul 24, 2017 at 21:05
  • I just changed my question a little. What will this commend to when it notices a change in the file? Jul 24, 2017 at 21:07
  • it will tell you what happened after you ctrl-C it
    – Camden
    Jul 24, 2017 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.