In our last post we gave some examples of Unix audit script one liners for baselining information from a Unix system. It turns out there are more people than we thought who are interested in this topic and are looking to include commands like these in their scripts. We definitely appreciate everyone’s enthusiasm and decided to post more commands in an effort to help you with your scripts.
So here are a few more Unix audit script one liners for you to try. Enjoy!
List the available IPv4 Address(es) from a system:
ifconfig -a | awk '/inet addr:/ { print $2 }' | cut -d: -f2
List the available IPv6 Address(es) from a system:
ifconfig -a | awk '/inet6 addr:/ { print $3 }'
List the available MAC Address(es) from a system:
ifconfig -a | awk '/Ether/ { print $5 }'
Find all SUID files on a Unix system:
find / -ignore_readdir_race -perm 04000
Find all GUID files on a Unix system:
find / -ignore_readdir_race -perm 02000
Find all Sticky files on a Unix system:
find / -ignore_readdir_race -perm 01000
Again, we would strongly recommend scheduling your scripts and creating automated alerts via email alert functions and your help desk software. It will help keep you honest and track your progress.
Another fun idea that one of our clients suggested was to create your script and then execute it at the conclusion of every vulnerability scan that you run. It turns out most vulnerability scanners give you the ability to execute a script at the conclusion of your scan, your audit script could be what you execute. If you really want to get fancy, you could even centralize your output files via SSH to a central server so you, auditors, or sysadmins could review the results at will.