SecurityAlert

#!/bin/bash

# You should need to create a crontab entry for this script
# So this script runs every 10 minutes automatically.

# Checking for any authentication failure entry founded on
# /var/log/auth.log file and update twitter status.


# Checking command-line twitter client t is installed or not
t help &> /dev/null

if [ $? -ne 0 ]
then
	echo "Twitter Command Line Client t is not installed"
	echo "For how to install and configure t check the following links:"
	echo "https://miteshshah.github.io/sysadmin/security-alert/"
else
	# Calculate 10 Minutes ago time in unix time format
	TENMINAGO=$(date +%s --date "10 minute ago")

	# Take the last authentication failure entry from auth.log
	SMS=$(cat /var/log/auth.log | grep 'authentication failure' | tail -n1 )

	# Extract the time from SMS variable and convert it to unix time format
	SMSTIME=$(date -d "$(echo $SMS | awk '{print $1,$2,$3}')" +%s)

	if [ $SMSTIME -gt $TENMINAGO ]; then
	echo "Updating Twitter Status..."
	t update "$(echo $SMS | awk '{print $3,$5,$9,$10,$12,$14,$15,$16}')"
	fi
fi