Question

Say I had a script that checked honeypot locations using md5sum.

#!/bin/bash
#cryptocheck.sh
#Designed to check md5 CRC's of honeypot files located throughout the filesystem.
#Must develop file with specific hashes and create crypto.chk using following command:
#/opt/bin/md5sum * > crypto.chk
#After creating file, copy honeypot folder out to specific folders

locations=("/share/ConfData" "/share/ConfData/Archive" "/share/ConfData/Application"
"/share/ConfData/Graphics")

for i in "${locations[@]}"
do
        cd "$i/aaaCryptoAudit"
        /opt/bin/md5sum -c /share/homes/admin/crypto.chk
done

And the output looked like this:

http://pastebin.com/b4AU4s6k

Where would you start to try and recognize the output and perhaps trigger some sort of response by the system if there is a 'FAILED'?

I've worked a bit with PERL trying to parse log files before but my attempts typically failed miserably for one reason or another.

This may not be the proper way to go about this, but I'd want to be putting this script into a cronjob that would run every minute. I had some guys telling me that an inotify job or script (I'm not familiar with this) would be better than doing it this way.

Any suggestions?

--- edit

I made another script to call the script above and send the output to a file. The new script then runs a grep -q on 'FAILED' and if it picks anything up, it sounds the alarm (tbd what the alarm will be).

#!/bin/bash
#cryptocheckinit.sh
#

#rm /share/homes/admin/cryptoalert.warn
/share/homes/admin/cryptocheck.sh > /share/homes/admin/cryptoalert.warn
grep -q "FAILED" /share/homes/admin/cryptoalert.warn && echo "LIGHT THE SIGNAL FIRES"
Was it helpful?

Solution

Use:

if ! /opt/bin/md5sum -c /share/homes/admin/crypto.chk
then 
    # Do something
fi

Or pipe the output of the loop:

for i in "${locations[@]}"
do
        cd "$i/aaaCryptoAudit"
        /opt/bin/md5sum -c /share/homes/admin/crypto.chk
done | grep -q FAILED && echo "LIGHT THE SIGNAL FIRES"
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top