Automate Auditing of User Accounts with a Bash Script

Creating the Script

In this example, we’ll be detecting changes to the system’s user accounts by using the cat command to read the /etc/passwd file. We’ll then store the output in a variable.

#!/bin/bash

current_users=$(cat /etc/passwd)

Next, we’ll use a while loop to continuously check the user accounts and compare it to the stored value using the diff command. If the user accounts have changed, we’ll output the new user accounts to a file.

#!/bin/bash

current_users=$(cat /etc/passwd | cut -d: -f1)

while true; do
    new_users=$(cat /etc/passwd | cut -d: -f1)
    diff=$(diff <(echo "$current_users") <(echo "$new_users"))
    if [[ -n "$diff" ]]; then
        echo "User accounts have changed:"
        echo "Current Users: $current_users"
        echo "New Users: $new_users"
        echo "Diff: $diff"
        echo "User accounts have changed: $diff" >> user_account_changes.txt
        current_users=$new_users
    fi
    sleep 5
done

This script will use the cut command to extract only the username from the output of cat /etc/passwd, and then uses the diff command to compare the current and new lists of users. If there is a difference, the script will print the current and new lists of users, as well as the difference, to the terminal and also write it to the user_account_changes.txt file, at last it uses the sleep command to run the script every 5 seconds.

Practical Use-Cases

Monitoring user account changes can be useful for a number of reasons:

• Security: By detecting changes to user accounts, we can quickly identify and respond to any unauthorized changes, such as the creation of a new account or the deletion of an existing one.
• Auditing: By logging changes to user accounts, we can keep track of who has made changes to the system and when.
• Compliance: In certain industries, it may be necessary to keep track of user account changes to meet compliance regulations.

Tips

Here are a few tips to keep in mind when creating your own bash script for monitoring user account changes:

1. Use the appropriate file: Make sure to use the correct file for detecting changes, in this case, the /etc/passwd file.
2. Keep the interval time in mind: The interval time (in this case, 5 seconds) should be set based on how often you expect user account changes to occur. You can probably set this to a much higher value.
3. Don’t forget to check for deletions: Make sure your script is also checking for deleted user accounts, not just new ones.
4. Make use of notifications: Consider setting up notifications to alert you when user account changes occur.
5. Test your script: As always, make sure to test your script thoroughly before using it in a production environment.

Challenge

Now that you’ve learned how to create a script to detect changes in user accounts, your challenge is to modify the script to detect changes in group accounts. Once you’ve done that, try to respond to changes in group accounts by sending an alert or taking any other necessary actions. Remember to test your script thoroughly before using it in a production environment. Happy scripting!