Re: Re: Port Knocking - An interesting idea

On Wed, 2004-03-17 at 06:16, Alex Earl wrote:
> > It sent an email to the email address of his cell phone.
> > --
> > Bryce C <Plug@BryceCo.Net>
> > CoBryce Communications
>
> Well...I feel sheepish, thanks, I was thinking along the lines of SMS or
> something.
>
> Alex

Bryce is correct. The script just fired a message to the email address
of my cell phone. Something like:

# /etc/profile
#
who | mail -s "`whoami` login at `hostname`" 6021234567@tmomail.net


Also...
I recently learned that, upon logout, I can send a list of the commands
typed by simply emailing the output of the `history` command.

# ~/.bash_logout
#
history | mail -s "`whoami` login at `hostname`" 6021234567@tmomail.net


The only gotcha there was that bash preserves history across sessions.
So, to keep the history records from piling up, my login script archives
the current .bash_history and starts a new one for each session. That
way, my logout script only sends the history records for the current
session.

# /etc/profile
#
rm ~/.bash_history.3 &>/dev/null
mv ~/.bash_history.2 ~/.bash_history.3 &>/dev/null
mv ~/.bash_history.1 ~/.bash_history.2 &>/dev/null
mv ~/.bash_history ~/.bash_history.1 &>/dev/null


Makes for a simple auditing system for a box that should rarely be
logged into (it's a firewall remember). In addition to sending to a
cellphone, I can send it to an auditing mailbox. Then, I will have a
login and logout message for each session that will contain the
username, the source ip address, and all commands typed (including su
sessions and sudo commands).


Hmm. This is starting to come together. Maybe I will find time to
re-configure all this on my new firewall and bring all these pieces
together. :~)

...Kevin







---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss