handybashscripts: security

Showing posts with label security. Show all posts

Password card.

#!/bin/bash
# Filename: passcard.sh
# Version: 120212
# Author: robz
# Generates a random alpha-numeric text block for a password card.
# Just double click and run, the text block file will appear in the same 
# directory as the script.

DATEMARK=$(date +%d-%m-%y" @ "%H:%M:%S)
BLOCKLOC="$(dirname $0)/Passcard generated on $DATEMARK/Alphanumeric block.txt"

mkdir "$(dirname "$BLOCKLOC")"                      # Create a new directory.

for x in {1..8}; do                                 # Loop to create 8 lines.
    tr -cd [:alnum:] < /dev/urandom |\
    head -c 29 >> "$BLOCKLOC"                       # Write alpha-numeric line. 
    echo >> "$BLOCKLOC"                             # Move to next line.
done

echo -e "Generated $DATEMARK" >> "$BLOCKLOC"        # Date/time of generation.

#!/bin/bash
# Filename: hosts-update ## file name changed, see "(bug #38022)"
# Version: 030711
# Author: robz
# The hosts file, simple text file that associates IP addresses with hostnames,
# http://en.wikipedia.org/wiki/Hosts_%28file%29 also some more reading and the
# zipped source file http://winhelp2002.mvps.org/hosts.htm
# The script will backup Ubuntu's original hosts file, it must be the original
# to not a modded one, this is insurance so if it all goes pear shaped you'll
# have a clean file escape route, just use as a template and copy it over.
# This script needs to run as root, or automate by dropping it in cron weekly
# and doing "sudo chmod 755 /etc/cron.weekly/hosts-update" in a terminal.
# In case you where wondering, apparently with "127.0.0.1" your browser will
# wait for a timeout hence the editing to "0.0.0.0" which will go straight to
# "404 not found" without waiting.

# EXCLUDES list for any sites you really want but are listed so won't load.
# To exclude a range just list the common part of the pattern, i.e. "666.com"
# will affect many of the addresses whereas "xs.666.co.ruok" is more exclusive,
# case matters by the way Google/google.
EXCLUDES="
troganviriidownload.doh
www.skankyhookers.ick
malwaredrivebyselfservice.eek
deaddodgysoftwarez.duh
google-analytics
googleadservices
adservices.google
adsenseshare.com
" # Don't block these.
URLHOSTS="http://winhelp2002.mvps.org/hosts.zip" # Hosts download site.
BAKHOSTS="/etc/hosts.bak" # Insurance file.
INMAILTO="robz1@$HOSTNAME root@$HOSTNAME" # Error/or not mail.

if [ ! -e "$BAKHOSTS" ]; then
cp /etc/hosts "$BAKHOSTS" # Backup original file.
chmod 444 "$BAKHOSTS" # Make it read only.
fi

cd /tmp

# Wget the new hosts file.
if [ ! -e "hosts.zip" ]; then wget -q -i -T 60 "$URLHOSTS"; fi
if [ -e "hosts.zip" ]; then
 echo -e "New hosts file installed, be aware:-\
 \nThis may affect web access to some previously ok websites." | \
 mail -s "[HOSTS FILE] Good download." $INMAILTO
 zenity --notification --text "New Hosts file - Check web access" & disown
else echo -e "Non critical: The weekly download of hosts.zip has failed.\
 \nRun hosts-update.sh as root to install the latest hosts file." | \
 mail -s "[HOSTS FILE] Failed download." $INMAILTO
 exit 1
fi

unzip -c "$(basename "$URLHOSTS")" HOSTS Hosts hosts 2>/dev/null > RAWHOSTS
sed -i 's/.$//' RAWHOSTS # Convert dos to unix.

# Create hybrid hosts file.
cat > /tmp/hosts << EOF
#-----------------------------------------------------------------------------
# This hosts block list was created on $(date)
# using the script "hosts-update" by robz.
# It combines the original Ubuntu hosts file saved as "$BAKHOSTS"
# and the latest the hosts file from: $URLHOSTS
#-----------------------------------------------------------------------------

# Start of default hostfile list text copied from "$BAKHOSTS"

$(cat $BAKHOSTS)

# End of default hostfile list text, what follows is supplemental.
#
# Any failure to connect to a previously ok website may be traced to an entry
# in the following list. Modifications to the list should be double hash ##
# commented out rather than deleted.
#
$(sed 's/127.0.0.1/0.0.0.0/g' RAWHOSTS | \
sed -ne '1,/of lines/!p' -e '1,/of entries/!p')

EOF

# Implement excludes list to comment out addresses you don't want to block.
for MODHOSTS in $EXCLUDES; do
sed -i '/'$MODHOSTS'/ s/^$[^## ]$/## \1/g' hosts
done
mv -f hosts /etc/hosts # Overwrite old hosts.

Alias scan

#!/bin/bash
# Filename: scan.sh
# Version: 230411
# Author: robz
# $HOME scanner with "ClamAV" run from a virtual terminal with a bash alias.
# Check first if you've any other programs called scan, try "man scan" to see
# if manual pages exist, If ok add the alias to the bottom of your ~/.bashrc
# file, modify so it's path points to your scripts directory location.
# "alias scan="/home/user/users_scripts/scan.sh"" save, do "source ~/.bashrc"
# in a terminal to reload the bash configuration, type "scan" to scan.
# Scanning is done recursively on the directory you are in, terminal wise,
# ie. the $PWD - present working directory.
# If this script is likely to be run logged in as another user you'll need to
# be more specific with the path of the sound files.

export DISPLAY=:0                                       # Make sounds work.
LOGFILE="/tmp/ClamAV-$(date +%A-%H:%M).log"             # Make new logfile.
SOUND1=$HOME/Audio/DingLing.wav                         # OK sound.
SOUND2=$HOME/Audio/HyprBlip.wav                         # Warning sound.

echo -e "\n\033[37;1mScanning directory:\033[0m $(pwd)\n"
echo -e "\033[33;1mEnter password to update virus definitions\033[0m"

sudo -k freshclam                                       # Update definitions.
# Scan $PWD, do it nicely! exclude large pre-scanned or encrypted directories
# and, as this runs as user, files not belonging to the user.
nice -n 19 /usr/bin/clamscan -r ${pwd} -l $LOGFILE\
    --heuristic-scan-precedence\
    --exclude-dir="$HOME/Audio"\
    --exclude-dir="$HOME/Music"\
    --exclude-dir="$HOME/Pictures"\
    --exclude-dir="$HOME/.Private"\
    --exclude-dir="$HOME/Video"\
    --exclude-dir="$HOME/.ntop"\
    --exclude-dir="$HOME/.thumbnails"\
    --exclude="$HOME/.Synaptic-markings"\
    --exclude="$HOME/.selected_editor"
CLAMSCAN=$?                                             # Get exit status.

if [ "$CLAMSCAN" -eq "1" ]; then
    echo -e "\033[31;1m[VIRUS FOUND"\!"]\033[0m"
    /usr/bin/canberra-gtk-play --volume=4 -f $SOUND2 &
elif [ "$CLAMSCAN" -gt "1" ]; then
    echo -e "Scan found errors...\n"$(grep "Access denied" $LOGFILE) | more
    echo -e "\033[34;1m[ERROR $CLAMSCAN]\033[0m"
    /usr/bin/canberra-gtk-play --volume=4 -f $SOUND1 &
else echo -e "\033[32;1mNo virus found :)\033[0m"
    /usr/bin/canberra-gtk-play --volume=4 -f $SOUND1 &
fi

echo -e "\033[1mFor scan details see logfile at $LOGFILE.\033[0m\n"

Clear swap partition

#!/bin/bash
# Filename: Clear-swap
# Author: robz
# Version: 280611
# One for the "nautilus-scripts" directory use to clear the swap partition.
# In this script I'm assuming you use a separate partition for your swap and
# that that swap uses a UUID to identify it, have a look in your /etc/fstab.
# It works by dismounting the swap file, writing zeros to the partition it
# occupied then remounting again with the original parameters.
# Enhanced dd "dcfldd" will be needed for this, "sudo apt-get install dcfldd"
# Using "dcfldd if=/dev/zero" will clear swap fairly rapidly, an option for the
# paranoid being "dcfldd if=/dev/urandom" :)

C2="\033[1m\E[32m" C6="\033[1m\E[36m" C7="\033[1m\E[37m"    # green cyan white.
TOTL=$(awk '/SwapTotal/{print $2/1024}' /proc/meminfo)      # Swap size MBs.

# Run a terminal and execute all in a root shell.
gnome-terminal --title "Clear Swap Partition" --geometry=62x11+0+24 -x\
    sudo bash -c "\
    ${LCTN=$(awk 'NR==2 {print $1}' /proc/swaps)};\
    ${UUID=$(awk -F'[= ]' '/^UUID.*swap/{print $2}' /etc/fstab)};\
    tput clear; tput civis;\
    if [[ -z $LCTN || -z $UUID ]]; then\
        echo -e '$C6''\n[Error] Can'\''t read location and/or UUID, exiting.';\
        read -t10; exit 1;\
    fi;\
    echo -ne '$C6''Write ''$C7''$TOTL''MiBs''$C6'' of zeros to ';\
    echo -e 'swap space on partition ''$C7''$LCTN''$C6\n';\
    swapoff -a;\
    trap 'killall dcfldd 2> /dev/null; mkswap -U $UUID $LCTN;\
    swapon -a; sleep 5; exit' INT TERM EXIT;\
    dcfldd if=/dev/zero of=$LCTN statusinterval=2 bs=10M conv=notrunc;\
    echo -ne '$C2''\nAll Done.....''$C6''\nRe-mounting swap on partition: ';\
    echo -e '$C7''$LCTN''$C6''\nusing UUID: ''$C7''$UUID\n''$C6';\
    read -t5"

# TODO this needs zero the free space code adding to it for an all singing all
# dancing version.

RKHunter script

#!/bin/bash
# Filename: RKHunter.sh
# Author: robz
# Version: 051210
# Root Kit Hunter
# Strictly speaking best results from RKHunter are obtained by setting it up
# with a fresh Linux install, so there is no doubt as to the integrity of the
# system files present.
# However, this script runs RKHunter manually, saves a logfile to your home
# directory then parses that log to display any problems it "may" have found.
# Run the script directly, from nautilus-scripts or make yourself a launcher.
# For configuration info. and interpretation of the logfile look at
# /usr/share/doc/rkhunter/FAQ.gz or the readme or goto:
# http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/FAQ
# Don't worry too much if you get a terminal full of red warnings at first,
# read the FAQs or Google for answers first, worry after:)

LOG=/home/$USER/.rkhunter.log

gnome-terminal --geometry=90x65+0+0 -x bash -c "\
    rm -f /home/$USER/.rkhunter*.log
    sudo rkhunter --update -c --sk -l $LOG;\
    read -p 'Hit a key to see logged warnings' -n 1;\
    tput cuu1; tput cuu1; tput cuu1; tput cuu1; echo;\
    sudo chmod a+r $LOG;\
    export GREP_COLOR='1;37;41';\
    grep -A4 -B4 --color=always Warning $LOG |\
    more;\
    export GREP_COLOR='1;31';\
    read -p 'Hit a key to exit' -n 1"

sudo -K

Private directory on/off

#!/bin/bash
# Filename: private.sh
# Version: 011210
# Author: robz
# Toggle the mounting and unmounting of the default ecryptfs ~/.Private
# directory. If you're set up with a Private/.Private directory that is.
# https://help.ubuntu.com/community/EncryptedPrivateDirectory - all you need.
# Run it from a launcher if you like, Type: Application, Name: Private,
# Command: /home/user/.scripts/private.sh, Comment: Private Directory on/off.
# You can use the encrypted directory for email and browser profiles, just
# move the relevant directory eg. /home/*user*/.evolution to /home/*user*
# /Private/.evolution and replace it with a symbolic link. Make sure the
# link has exactly the same name eg. ".evolution" not "Link to .evolution"
# You'll need some padlock icons for the notification.

grep ~/Private /etc/mtab > /dev/null
if [ "$?" -eq "0" ]; then
    ecryptfs-umount-private
    notify-send -i /$HOME/.icons/lock.png \
    "Private Directory is LOCKED" "Browser and email profiles inaccessable"
else
    gnome-terminal --geometry=36x4 --title="Private" -x bash -c "\
    echo -e 'Access to \"Private\" Directory'
    ecryptfs-mount-private
    notify-send -i /$HOME/.icons/unlock.png 'Private Directory is UNLOCKED'"
fi
sudo -K

Delete files and/or directories

#!/bin/bash
# Filename: Recursive-Wipe
# Author: robz
# Version: 200111
# Script to securely multi-pass erase multiple files and/or directories.
# Put it in your "nautilus-scripts" directory and right click to use.
# Will overwrite file & filename with 2 passes of random data, truncate file
# size then erase the sorry remains. If a directory is erased all directories
# and files within it will receive the same treatment.
# Default gnome-terminal profile actions are used, ie. auto close on exit.
# CAVEAT - this is secure within the limits of a journalling file system.
# See man pages for "wipe or shred" for full explanation.

# Create newline delimited selected files list, handling spaces in file names.
FILE=$(echo -e "$NAUTILUS_SCRIPT_SELECTED_FILE_PATHS" |\
 awk 'BEGIN { FS = "\n" } { printf "\"%s\" ", $1 }' | sed -e s#\"\"##)

zenity\
 --question\
 --title="Secure Wipe"\
 --text="You are about to permanantly wipe:\n$FILE\
 \nAre you sure you want to do this?"\
 --ok-label="ZAP!"\
 --cancel-label="Hell No!"

if [ "$?" = 1 ] ; then
 exit $?
else
 gnome-terminal --geometry 70x10+5+30\
 --title="WIPE FILES - It's really gone!!" -x\
 bash -c "wipe -rfcqQ2 $FILE && tput bold; tput setaf 3;\
 echo -en '\nHit a key to exit this shell '; tput civis;\
 read -t10 -n1"
fi

Automate ClamAV antivirus

#!/bin/bash
# Filename: ClamAV-scan
# Version: 291110
# Author: robz
# This runs clamscan via a "user crontab", scans reports & logs to your home
# directory every 3 days, or alter to your prefs. "30 19 */3 * * export
# DISPLAY=:0 && /home//.scripts/ClamAV-scan > /dev/null 2>&1" all on one
# line without the enclosing quotes.
# The patched notify-osd package is reqd. see this page for an explanation.
# http://www.webupd8.org/2010/05/finally-easy-way-to-customize-notify.html
# You might also need to "sudo chmod 444" some files to allow read access for
# "others", something to check if script fails see below.

LOGFILE="$HOME/ClamAV-scan-for-$(date +%A-%H:%M).log"
SUBJECT="ClamAV scan report:"
VERSION="271010"
TARGET=/home/robz1                                  # Where to scan.
SOUND=$HOME/Audio/HyprBlip.wav                      # Warning sound (file.wav)
ICON=$HOME/Pictures/user_graphics/Icons/clam.png    # Find yourself an icon.
OSDRC=$HOME/.notify-osd
BBCOL="bubble-background-color = "

mod_osd ()                                          # Mod colours etc.
{
echo $SUBJECT >> $LOGFILE
sed -i "s/bubble-background-color.*/${BBCOL}/" $OSDRC
pkill notify-osd; notify-send -i "$ICON" "$SUBJECT"
# Next bit returns notify-osd to original check yours in "~/.notify-osd"
sed -i 's/bubble-background-color.*/bubble-background-color = 131313/' $OSDRC
/usr/bin/canberra-gtk-play --loop 2 --volume 6 -f $SOUND &
sleep 10; pkill notify-osd
}

rm -f "$HOME/ClamAV-scan-for-"*.log                 # Junk old logfile.
echo -e "$SUBJECT - $(date)\n" > $LOGFILE           # Create new logfile.
echo -e "Script: $(basename $0) v$VERSION - for user: $LOGNAME" >> $LOGFILE
echo -e "Scanmode: Recursive\nFiles Scanned: $TARGET" >> $LOGFILE

# If nessesary, may fail otherwise!
sudo chmod 444 /var/lib/clamav/bytecode.cld /var/lib/clamav/main.cld\
/var/lib/clamav/daily.cld

# Read man clamscan to configure, this may require a tweak or not.
nice -n 19 /usr/bin/clamscan\
    $TARGET\
    --exclude-dir="$TARGET/Music"\
    --exclude-dir="$TARGET/Audio"\
    --exclude-dir="$TARGET/Pictures"\
    --exclude-dir="$TARGET/.Private"\
    --log=$LOGFILE\
    --infected\
    --recursive\
    --max-files=500\
    --max-recursion=8\
    --max-dir-recursion=8
CLAMSCAN=$?                                         # Exit status.

if [ "$CLAMSCAN" -eq "1" ]; then
    SUBJECT=$SUBJECT" [VIRUS FOUND!]"
    BBCOL=$BBCOL"ff0000"; mod_osd                   # Red osd warning.
elif [ "$CLAMSCAN" -gt "1" ]; then
    SUBJECT=$SUBJECT" [ERROR $CLAMSCAN]"
    BBCOL=$BBCOL"0000ff"; mod_osd                   # Blue advisory.
else SUBJECT=$SUBJECT" No virus Found"
    SOUND=$HOME/Audio/2tone.wav                     # All OK sound (file.wav)
    BBCOL=$BBCOL"00cc00"; mod_osd                   # Green OK, nothing found.
fi

Get firewall statistics

#!/bin/bash
# Filename: fwanalogcron.sh
# Version: 140112
# Author: robz
# This script runs fwanalog to analyse ufw statistics and notify you to view.
# You'll need fwanalog from the repositories, a dingdong.wav sound and an icon.
# Use this in your root crontab, it'll run the script at 6 hour intervals.
# 05 */6 * * * export DISPLAY=:0 && $HOME/.scripts/security_scripts/fwlogcron
# > /dev/null 2>&1    # NB. All on one line for cron, no newline breaks!
# You could set up a launcher using the one of the commented out lines at the
# end of this script in the "Command" box, uncomment the line to start a up a
# browser automatically, or just go to /var/log/fwanalog/ and open any .html
# that tickles yer fancy.

MYFILE="robz"   # Your user name.
SOUND="/home/robz/Audio/DingLing.wav" # Path to sound file.
ICON="/home/robz/Pictures/Firewall.png" # Path to icon file.

rm -f /var/log/fwanalog/fwanalog.lock                   # Delete any residuals.
fwanalog -t                                             # Analyze today.
# fwanalog -y                                           # Analyze yesterday.
sudo chown -R "$MYFILE" '/var/log/fwanalog/'            # Allow user access.

notify-send -i "$ICON" "New firewall stats are ready" \
"View at: /var/log/fwanalog/today.html"                 # Announce new stats.
/usr/bin/canberra-gtk-play --volume 2 -f $SOUND         # HELLO, stats :)

#google-chrome --incognito %U file:///var/log/fwanalog/today.html
#chromium-browser --incognito %U file:///var/log/fwanalog/today.html
#firefox --private-toggle %U file:///var/log/fwanalog/today.html
#opera --newprivatetab %U file:///var/log/fwanalog/today.html

Zero free space

#!/bin/bash
# Filename: Zero-it
# Author: robz
# Version: 150910
# Use as a right clicker for the nautilus-scripts directory.
# This will create a very large file effectively overwriting all free drive
# space with zeros or random characters, on completion this file is deleted.
# Zeros can take a while on a big drive, random a very long time.
# You will need package "apt-get install dcfldd"

C3="\033[1m\E[33m"  # yellow
C6="\033[1m\E[36m"  # cyan
C7="\033[1m\E[37m"  # white
SOUND=/home/robz1/Audio/Success.wav
ICON=/usr/share/icons/gnome/scalable/emotes/face-smile.svg
NORMAL="NORMAL - zeros-fastish"
PARANOID="PARANOID - random-vslow"
TITLE="FREE SPACE OVERWRITE"
FILE=/home/robz1/TO_BE_DELETED
FREE=`df | awk '/sda2/ {print $4/1024}'`
VERBAL=$C3"WORKING.........."\\n$C7"Approx space to overwrite $FREE""Mb"\\n\
$C3"Press Ctrl+C to exit"$C6

MODE=$(zenity --title "Zero-It" --width 235 --height 190 --list --text \
    "Select write mode - I am:" --radiolist --column "" --column "" \
    TRUE "$NORMAL" FALSE "$PARANOID");
if [ $? = 1 ]; then
exit $?
fi

MODE=$(echo $MODE | sed "s/$NORMAL/zero/g; s/$PARANOID/urandom/g;")

gnome-terminal --geometry=42x15 --title="$TITLE" -x bash -c "\
    trap 'rm -f "$FILE" 2>/dev/null; killall dcfldd; exit' TERM INT SIGKILL;\
    echo -e '$VERBAL';\
    sync;\
    dcfldd if=/dev/$MODE of=$FILE statusinterval=10 bs=10M conv=notrunc;\
    echo -e 'File: \"TO_BE_DELETED\" is being deleted';\
    sync && rm -f $FILE;\
    echo 'ALL DONE.........';\
    notify-send -i $ICON '## OPERATION COMPLETE ##';\
    /usr/bin/canberra-gtk-play --volume 6 -f $SOUND"

exit