Re: Basic Security for RedHat - good

[Alvin Oga <alvin.sec () Virtual Linux-Consulting com>]

hi ya jeff

> #!/bin/bash
> cp -pP /etc/shadow /root/passchk/shadow
> sdiff -s shadow shadow.old | cut -d ":" -f1 > out
> if [ -s out ]; then
>         /usr/bin/smtpclient -f passwdtest () server domain com -S
> mail.domain.com -s "account change" test you () domain com < out
>         fi
> mv shadow shadow.old

exactly... i've been doing that for almost a decade ..
but with just:

  for all important files
  do
        if [ diff /etc/shadow /secret-copy/etc/shadow ];
        then
           turn on the red flag and get to work to see 
           who/what/when/where/why/how things changed
        fi
  done

and similarly for all the other important files 

c ya
alvin