a blog by Brie Gordon
Brie Gordon

I'm Brie, a 22 year-old graduate of Slippery Rock University's Computer Science department. My interests include Linux (generally and Ubuntu), networking, BSD-style operating systems including my own, BrieSD, translating English-Spanish-English for open source projects and LAMP configuration. Aside from that, I enjoy photography, making short films and soccer.

Posterous is one of my favorite new(ish) web sites!


brie@briegordon.com

       

Search

February 24th, 5:01am 2 comments

Easily monitor your computer security via Twitter

This was written for Ubuntu users but most *NIX-based people should be able to follow along. You'll need the basic set up described here.

Then place the following in a file called something like /etc/cron.hourly/auths:

#!/bin/bash

TWEET=`/bin/grep "Failed password" /var/log/auth.log | /usr/bin/tail -n1 | /usr/bin/cut -d"]" -f2`

echo $TWEET | /root/tweet.pl


Here is an example of what you'll see. It basically tells you about the last time someone tried to authenticate to your computer using the wrong password, their IP address and what username they tried. You may see duplicates but for something quick and dirty...it works. I'll do what needs to be done to eliminate the duplicates very soon. :-).

--Brie
Loading mentions Retweet
Posted 5 months ago

Comments (2)

Feb 24, 2010
@Thunder_Chicken said...
Should monitor successful logins, not failed ones.
Feb 24, 2010
Brie Gordon said...
Monitoring for successful logins is an excellent idea, though there's nothing wrong with monitoring failed ones, especially when they come from the same IP.

Monitoring for success is as easy as grepping for "Successful su" or "Accepted password" in addition or instead.

:+).

--
Brie

Leave a comment...

 
Got an account with one of these? Login here, or just enter your comment below.
Posterous-login    twitter