BBS水木清华站∶精华区

发信人: twist (胖胖鼠  ~努力减肥中), 信区: Unix
标  题: UNIX TIP: MONITORING ROOT IN THE PASSWORD FILE
发信站: BBS 水木清华站 (Wed Aug 25 07:19:16 1999)

MONITORING ROOT IN THE PASSWORD FILE

One of the popularly known method of breaking into a Unix host
is by inserting a uid value 0 in the /etc/passwd file which could
be done in many ways including backdoors for later accesses .

The script below displays warning messages on the console if
such changes a detacted. Simply place the script in the crontab
and run as frequent as you wish.

------------------------------CUT HERE-----------------------------------------

for id in `awk 'FS=":" {if(($3 == 0 && $1 != "root" )) print $1}' /etc/passwd`
do
cat << the_end >/dev/console

+----------------------------------------------------------------
|
|       `date "+Detacted On Date :%D Time :%r"`
|       Break-in ALERT! Login ID `echo ${id}` has uid 0
|
+----------------------------------------------------------------

the_end
done
------------------------------CUT HERE-----------------------------------------

--
   ______           _          __
/_  __/_      __  (_)  _____ / /_     好  好  学  习
  / /  | | /| / / / /  / ___// __/       天  天  减  肥
/ /   | |/ |/ / / /  (__  )/ /_
/_/    |__/|__/ /_/  /____/ \__/          俺一直在努力......


※ 来源:·BBS 水木清华站 bbs.net.tsinghua.edu.cn·[FROM: 162.105.138.50]