Skip to content

Instantly share code, notes, and snippets.

@rachejazz
Created August 22, 2022 22:34
Show Gist options
  • Save rachejazz/8eb541c2ff17cf617dfd87ba2adb56b4 to your computer and use it in GitHub Desktop.
Save rachejazz/8eb541c2ff17cf617dfd87ba2adb56b4 to your computer and use it in GitHub Desktop.
Sends an alert on webhook if an unprivileged user uses sudo on a machine
#!/bin/bash
while inotifywait -e modify /var/log/auth.log;
do
word=`tail -n1 /var/log/auth.log | grep 'user NOT in sudoers'`
if [[ $word ]]; then
echo '{"text":"'$word'"}' > sendtoslack
curl -X POST \
-H 'Content-type: application/json' \
--data @sendtoslack \
<webhook url>
rm sendtoslack
fi
done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment