Current File : //lib64/nagios/plugins/nccustom/check_unauthorized_user.sh
#!/bin/bash
#
# Shell script for tracking unauthorized system users and their logins.
# The script checks if unauthorized system users with enabled shell are presented on the system.
# By comparing with authorized users.
# The authorized users can have or don't have SSH access allowed.
# SSH access controls by flags: ssh_allowed and ssh_denied in authorized users list file.
# The script includes several main checks:
# 1) Check for any user other than root with UID=0.
# 2) Check for unauthorized system users with enabled shell.
# 3) Check for recent logins of unauthorized system users with enabled shell.
# In case something is found script creates lock file, logs a message and exits with code 2.
# The lock file needed for avoiding self-resolved cases.
# Presence of the lock file doesn't skip the main checks.
# Bash strict mode.
set -uo pipefail
# Declare and assign global variables.
# Authorized users associative array.
declare -A AUTHORIZED_USERS
# Get the directory where the script is located.
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &> /dev/null && pwd)"
# Path to authorized users list file in the script's directory.
AUTHORIZED_USERS_FILE="${SCRIPT_DIR}/authorized_users.list"
# Auth log.
AUTH_LOG="/var/log/secure"
# cPanel users list.
CPANEL_USERS_LIST=""
# Shell patterns to exclude during the check.
EXCLUDED_SHELL_PATTERNS="(/[s]?bin/(false|nologin|halt|shutdown|sync)|/usr/local/cpanel/bin/noshell)"
# Determine a lock file.
LOCK_FILE="/var/lock/check_unauthorized_user.lock"
# Determine a log file.
LOG_FILE="/var/log/check_unauthorized_user.log"
# Set the PATH
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
# Systems users array.
SYSTEM_USERS=()
# System users with enabled shell array.
SYSTEM_USERS_WITH_ENABLED_SHELL=()
#######################################
# Logs a message with a timestamp.
# Globals:
# LOG_FILE - The file where the logs will be appended.
# Arguments:
# message - The message to be logged.
# no_log - Optional, if provided, the message will be printed without timestamp and not logged to log file.
# Outputs:
# Writes message to stdout or stdout and file.
#######################################
logger() {
# Retrieve the message to be logged from the first argument.
local message="${1}"
# Retrieve the optional 'no_log' argument, if provided.
local no_log="${2:-}"
# Check if 'no_log' is set (not empty).
if [[ -n "${no_log}" ]]; then
# Print the message to stdout without a timestamp.
echo "${message}"
else
# Check if the log file exists and is writable.
if [[ ! -w "${LOG_FILE}" ]]; then
echo "ERROR! Log file '${LOG_FILE}' does not exist or is not writable."
echo "HINT: Log file '${LOG_FILE}' should have the following permissions: 600, owner nrpe:nrpe (CloudLinux/AlmaLinux)."
exit 3
fi
# Generate a timestamp in the format: Month Day HH:MM:SS ±hhmm.
local timestamp
timestamp=$(date +"%b %d %H:%M:%S %z")
# Append the message with the timestamp to the log file.
echo "[${timestamp}] ${message}" >> "${LOG_FILE}"
fi
}
#######################################
# Check for the existence of a lock file and create it if it does not exist.
# Globals:
# LOCK_FILE
# LOG_FILE
# Arguments:
# None
# Returns:
# Exits with code 2 if the lock file exists.
#######################################
set_lock() {
# Check if the lock file exists.
if [[ -f "$LOCK_FILE" ]]; then
logger "CRITICAL! ${LOCK_FILE} exists. Investigation needed." "no_log"
logger "HINT: Check ${LOG_FILE} for details." "no_log"
exit 2
else
# If the lock file does not exist, create it.
touch "$LOCK_FILE"
logger "Lock file was created: ${LOCK_FILE}"
fi
}
#######################################
# Get the timestamp from a certain number of minutes ago
# Globals:
# None
# Arguments:
# Minutes ago (default: 30 minutes ago)
# Returns:
# Timestamp string representing a specific time in the past.
#######################################
get_minutes_ago_timestamp() {
# Retrieve the number of minutes ago from the first argument; default to 30 if not provided.
local minutes_ago=${1:-30}
# Use the `date` command to get the timestamp for the specified number of minutes ago.
# Format the output as: Month Day HH:MM:SS.
date --date="${minutes_ago} minutes ago" "+%b %e %H:%M:%S"
}
#######################################
# Get the user's shell based on the username.
# Globals:
# None
# Arguments:
# User to check.
# Returns:
# User shell, 3 on error.
#######################################
get_user_shell() {
local username="$1"
# Check if the username is provided (not empty).
if [[ -z "$username" ]]; then
# Log an error message and exit with code 3 if username is not provided.
logger "ERROR! Username is not provided" "no_log"
exit 3
fi
# Get the login shell for the user by querying the passwd database.
# `getent passwd "$username"` retrieves the user entry.
# `cut -d: -f7` extracts the 7th field (the shell) from the entry.
local user_shell
user_shell=$(getent passwd "$username" | cut -d: -f7)
echo "$user_shell"
}
#######################################
# Get the user's uid based on the username.
# Globals:
# None
# Arguments:
# User to check.
# Returns:
# User uid, 3 on error.
#######################################
get_user_uid() {
local username="$1"
# Check if the username is provided (not empty).
if [[ -z "$username" ]]; then
# Log an error message and exit with code 3 if username is not provided.
logger "ERROR! Username is not provided." "no_log"
exit 3
fi
# Get the uid for the user by querying the passwd database.
# `getent passwd "$username"` retrieves the user entry.
# `cut -d: -f3` extracts the 7th field (the user uid) from the entry.
local user_uid
user_uid=$(getent passwd "${username}" | cut -d: -f3)
echo "$user_uid"
}
#######################################
# Get any user other than root with UID=0.
# Globals:
# None
# Arguments:
# None
# Returns:
# Total amount of non-root users with UID=0, exit with code 2.
#######################################
# New function to check
get_users_with_uid0() {
local -i uid0_users_count=0
local uid0_users_details=""
# Loop through each line of the passwd file, splitting by colon.
while IFS=: read -r username _ uid _; do
# Check if the UID is 0 and the username is not root.
if [[ "${uid}" -eq 0 && "${username}" != "root" ]]; then
# Log a critical message if a non-root user with UID=0 is found.
logger "CRITICAL! Non-root user ${username} has UID=0"
# Increment the counter for users with UID=0.
(( uid0_users_count += 1 ))
# Append the user details.
uid0_users_details+="${username}, "
fi
done < <(getent passwd) # Use getent to read the passwd database.
# If any non-root users with UID=0 were found.
if [[ "${uid0_users_count}" -gt 0 ]]; then
# Invoke function to set lock file.
set_lock
# Remove trailing comma and space.
uid0_users_details="${uid0_users_details%, }"
# Log a critical message with the list of non-root users with UID=0.
logger "CRITICAL! Non-root users with UID=0 found (${uid0_users_count}): ${uid0_users_details}" "no_log"
# Exit with code 2 to indicate that any non-root users with UID=0 were found.
exit 2
fi
}
#######################################
# Get list of cPanel users from WHM API
# Globals:
# CPANEL_USERS_LIST
# Arguments:
# None
# Returns:
# cPanel users list.
#######################################
get_cpanel_users() {
# Get cPanel users using WHM API call and format the output.
CPANEL_USERS_LIST=$(whmapi1 --output=jsonpretty listaccts | jq '.data.acct[].user' | tr -d "\"" | sort)
}
#######################################
# Get list of system users excluding cPanel users
# Globals:
# CPANEL_USERS_LIST
# SYSTEM_USERS
# Arguments:
# None
# Returns:
# System users list.
#######################################
get_system_users() {
# Read each username from the list of system users.
while read -r username; do
# Check if the username is not present in the cPanel users list.
# `grep -q "^${username}$"` searches for an exact match of the username.
# `<<< "${CPANEL_USERS_LIST}"` provides the cPanel users list as input.
if ! grep -q "^${username}$" <<< "${CPANEL_USERS_LIST}"; then
# Add the username to the SYSTEM_USERS array if not in the cPanel users list.
SYSTEM_USERS+=("${username}")
fi
done < <(getent passwd | cut -d: -f1 | sort) # Get the sorted list of system usernames.
}
#######################################
# Get list of system users with enabled shell.
# Globals:
# EXCLUDED_SHELL_PATTERNS
# SYSTEM_USERS_WITH_ENABLED_SHELL
# SYSTEM_USERS
# Arguments:
# None
# Returns:
# System users with enabled shell list.
#######################################
get_system_users_with_enabled_shell() {
# Iterate over each user in the SYSTEM_USERS array.
for user in "${SYSTEM_USERS[@]}"; do
# Get the login shell for the user by calling the get_user_shell function.
local user_shell
user_shell=$(get_user_shell "${user}")
# Check if the user's shell does not match any of the excluded shell patterns.
# `grep -q -E "${EXCLUDED_SHELL_PATTERNS}"` searches for any match of the excluded patterns.
# `<<< "${user_shell}"` provides the user’s shell as input.
if ! grep -q -E "${EXCLUDED_SHELL_PATTERNS}" <<< "${user_shell}"; then
# Add the user to the SYSTEM_USERS_WITH_ENABLED_SHELL array if their shell is not excluded.
SYSTEM_USERS_WITH_ENABLED_SHELL+=("${user}")
fi
done
}
#######################################
# Get unauthorized system users with enabled shell
# Globals:
# AUTHORIZED_USERS
# SYSTEM_USERS_WITH_ENABLED_SHELL
# Arguments:
# None
# Returns:
# Total amount of unauthorized system users with exit code 2
#######################################
get_unauthorized_system_users() {
local -i unauthorized_system_users_count=0
local unauthorized_system_users_details=""
# Iterate over each user in the SYSTEM_USERS_WITH_ENABLED_SHELL array.
for user in "${SYSTEM_USERS_WITH_ENABLED_SHELL[@]}"; do
local authorized_user=false
# Check if the user is in the authorized users list.
if [[ -n "${AUTHORIZED_USERS[$user]+x}" ]]; then
authorized_user=true
fi
# If the user is not in the authorized users list.
if [[ "${authorized_user}" == false ]]; then
# Get the user's UID by calling the get_user_uid function.
local user_uid
user_uid=$(get_user_uid "${user}")
# Get the user's shell by calling the get_user_shell function.
local user_shell
user_shell=$(get_user_shell "${user}")
# Log a message to log file if the user is not in the authorized users list.
logger "CRITICAL! Found unauthorized system user ${user} with uid ${user_uid} and enabled ${user_shell} shell."
# Increment the counter for unauthorized system users.
(( unauthorized_system_users_count += 1 ))
# Append the unauthorized user details to the string.
unauthorized_system_users_details+="${user} (uid ${user_uid}), "
fi
done
# If any unauthorized system users were found.
if [[ "${unauthorized_system_users_count}" -gt 0 ]]; then
# Invoke function to set lock file.
set_lock
# Remove trailing comma and space from details string.
unauthorized_system_users_details="${unauthorized_system_users_details%, }"
# Log a critical message with the count and details of unauthorized users.
logger "CRITICAL! Unauthorized system users found (${unauthorized_system_users_count}): ${unauthorized_system_users_details}" "no_log"
# Exit with code 2 to indicate that unauthorized users were found.
exit 2
fi
}
#######################################
# Get unauthorized system users recent logins using authentication logs
# Globals:
# AUTHORIZED_USERS
# AUTH_LOG
# SYSTEM_USERS_WITH_ENABLED_SHELL
# Arguments:
# None
# Returns:
# Total amount of unauthorized system users to login exit code 2
#######################################
get_unauthorized_system_users_logins() {
local threshold_timestamp
# Get the timestamp from 20 minutes ago
threshold_timestamp=$(get_minutes_ago_timestamp 20)
local -i unauthorized_system_users_logins_count=0
local unauthorized_system_users_logins_details=""
# Iterate over each user in the SYSTEM_USERS_WITH_ENABLED_SHELL array.
for user in "${SYSTEM_USERS_WITH_ENABLED_SHELL[@]}"; do
local matches
# Search for log entries related to "sshd" where a session was opened for the specified user.
# Filter the results to include only those entries that are equal to or greater than the threshold timestamp.
matches=$(grep -E "sshd.*: session opened for user ${user}" "${AUTH_LOG}" | \
awk -v threshold="${threshold_timestamp}" '$0 >= threshold')
# If there are any log entries matching the criteria.
if [[ -n "${matches}" ]]; then
local ssh_login_allowed=false
# If the user is in the authorized users list and has ssh login allowed
if [[ -n "${AUTHORIZED_USERS[$user]+x}" ]]; then
if [[ "${AUTHORIZED_USERS[$user]}" == "ssh_allowed" ]]; then
ssh_login_allowed=true
fi
fi
# If the user is not in the authorized users list or has ssh_denied
if [[ "${ssh_login_allowed}" == false ]]; then
# Get the user's UID by calling the get_user_uid function.
local user_uid
user_uid=$(get_user_uid "${user}")
# Get the user's shell by calling the get_user_shell function.
local user_shell
user_shell=$(get_user_shell "${user}")
# Log messages to log file if unauthorized system user login('s) found.
logger "CRITICAL! Recent login found for unauthorized system user ${user} with uid ${user_uid} and enabled ${user_shell} shell."
logger "According to the following record('s) from ${AUTH_LOG} log: ${matches}"
# Increment the counter for unauthorized system users logins.
(( unauthorized_system_users_logins_count += 1 ))
# Append the unauthorized user logins details to the string.
unauthorized_system_users_logins_details+="${user} (uid ${user_uid}), "
fi
fi
done
# If any unauthorized system users logins were found.
if [[ "${unauthorized_system_users_logins_count}" -gt 0 ]]; then
# Invoke function to set lock file.
set_lock
# Remove trailing comma and space.
unauthorized_system_users_logins_details="${unauthorized_system_users_logins_details%, }"
logger "CRITICAL! Unauthorized system users SSH logins found (${unauthorized_system_users_logins_count}): ${unauthorized_system_users_logins_details}" "no_log"
# Exit with code 2 to indicate that unauthorized users logins were found.
exit 2
fi
}
#######################################
# Get unauthorized system users and their logins.
# Globals:
# AUTHORIZED_USERS_FILE
# CPANEL_USERS_LIST
# Arguments:
# None
#######################################
main() {
# Check if the file exists and is not empty
if [[ -f "${AUTHORIZED_USERS_FILE}" && -s "${AUTHORIZED_USERS_FILE}" ]]; then
# Read the file line by line
while IFS=, read -r user access; do
# Skip lines that start with a hash (#) or if either user or access is empty.
if [[ "$user" =~ ^# || -z "$user" || -z "$access" ]]; then
continue
fi
# Trim any extra whitespace around user and access
user=$(echo "$user" | xargs)
access=$(echo "$access" | xargs)
# Ensure both user and access are non-empty before updating the array
if [[ -n "$user" && -n "$access" ]]; then
# Update the array with valid user and access
AUTHORIZED_USERS["$user"]="$access"
else
# Log an error message and exit with code 3 if user or access is invalid
logger "ERROR! Invalid username or access in ${AUTHORIZED_USERS_FILE}. User: '${user}', Access: '${access}'." "no_log"
exit 3
fi
done < "${AUTHORIZED_USERS_FILE}"
else
# Log an error message and exit with code 3 if the file is empty or not found
logger "ERROR! File ${AUTHORIZED_USERS_FILE} is either empty or not found." "no_log"
exit 3
fi
# Invoke function to get any user other than root with UID=0.
get_users_with_uid0
# Check if cPanel binary exists before calling the function.
if [ ! -f /usr/local/cpanel/cpanel ]; then
# Define cPanel users list as empty in case if there is no cPanel.
CPANEL_USERS_LIST=""
else
# Invoke function to get cPanel users list if cPanel is installed.
get_cpanel_users
fi
# Invoke function to get list of system users excluding cPanel users.
get_system_users
# Invoke function to get list of system users with enabled shell.
get_system_users_with_enabled_shell
# Invoke function to get recent logins of unauthorized system users.
get_unauthorized_system_users_logins
# Invoke function to get unauthorized system users with enabled shell.
get_unauthorized_system_users
# Handle the case when no unauthorized users were found but the lock file exists.
if [[ -f "$LOCK_FILE" ]]; then
# Invoke function to control lock file.
set_lock
else
# Print a message if everything is ok and exit with code 0.
logger "OK. Unauthorized system users and logins are NOT detected." "no_log"
exit 0
fi
}
# Run a default mode.
if [[ -z $* ]]; then
# Invoke main function
main
fi
Mini Shell