Robert
7 months ago
parent
546a36e9c4
commit
b23861110f
@ -1,8 +0,0 @@ |
||||
#!/bin/bash |
||||
go build -o execguard |
||||
if [ $? -eq 0 ]; then |
||||
sudo cp execguard /usr/local/bin/ |
||||
sudo ./execguard --update /usr/local/bin/execguard |
||||
echo -e "Running execguard...Hit CTRL+C to end." |
||||
sudo execguard |
||||
fi |
||||
@ -0,0 +1,38 @@ |
||||
# MalDetect For Ubuntu: |
||||
### FYI |
||||
I'm not sure how usefull this is on systems, it is for monitoring your web server. |
||||
## Install clamAV |
||||
``` |
||||
$ sudo apt update && sudo apt install -y perl wget |
||||
$ sudo apt install -y clamav clamav-daemon |
||||
$ sudo freshclam |
||||
``` |
||||
## maldetect |
||||
``` |
||||
$ sudo apt install -y inotify-tools |
||||
$ wget http://www.rfxn.com/downloads/maldetect-current.tar.gz |
||||
$ tar -xzf maldetect-current.tar.gz |
||||
$ cd maldetect-* |
||||
$ sudo ./install.sh |
||||
$ sudo nano /usr/local/maldetect/monitor_paths |
||||
/tmp |
||||
/var/www |
||||
/home |
||||
|
||||
$ sudo nano /usr/local/maldetect/conf.maldet |
||||
quarantine_hits Move infected files to quarantine 1 (enable) |
||||
quarantine_clean Automatically clean malware 0 (manual review recommended) |
||||
scan_clamscan Use ClamAV for scanning 1 (if ClamAV is installed) |
||||
inotify_monitor Enable real-time monitoring 1 (enable) |
||||
``` |
||||
## Active Monitor |
||||
``` |
||||
$ sudo maldet --monitor /usr/local/maldetect/monitor_paths |
||||
$ sudo crontab -e |
||||
0 2 * * * /usr/local/maldetect/maldet --scan-all /var/www /home -r /root/maldet-scan.log |
||||
``` |
||||
## Update maldetect Signatures |
||||
``` |
||||
$ sudo maldet --update |
||||
$ sudo maldet --monitor enable |
||||
``` |
||||
@ -1,3 +1,3 @@ |
||||
#!/bin/bash |
||||
sudo sqlite3 /etc/execguard/system.db "SELECT path FROM allowed;" > migrated_apps.txt |
||||
echo "On remote PC: \$ sudo execguard --initFile migrated_apps.txt" |
||||
/usr/bin/sudo /usr/bin/sqlite3 /etc/execguard/system.db "SELECT path FROM allowed;" > migrated_apps.txt |
||||
echo "On the remote PC: \$ sudo execguard --initFile migrated_apps.txt" |
||||
|
||||
@ -0,0 +1,206 @@ |
||||
#!/bin/bash |
||||
# See if the User can become ROOT user |
||||
if [ "$EUID" -eq 0 ]; then |
||||
USE_SUPER="" |
||||
elif groups "$USER" | grep -o "sudo" >/dev/null 2>/dev/null; then |
||||
USE_SUPER="/usr/bin/sudo" |
||||
elif groups "$USER" | grep -o "doas" >/dev/null 2>/dev/null; then |
||||
USE_SUPER="/usr/bin/doas" |
||||
elif groups "$USER" | grep -o "wheel" >/dev/null 2>/dev/null; then |
||||
USE_SUPER="/usr/bin/sudo" |
||||
elif groups "$USER" | grep -o "admin" >/dev/null 2>/dev/null; then |
||||
USE_SUPER="/usr/bin/sudo" |
||||
else |
||||
USE_SUPER="error" |
||||
fi |
||||
|
||||
if [ "$USE_SUPER" == "error" ]; then |
||||
/usr/bin/echo "Please run as root! OR add self to suders file!" |
||||
exit 1 |
||||
fi |
||||
|
||||
if [ ! -f config.json.example ]; then |
||||
/usr/bin/echo "Default config EXAMPLE file missing...Bailing..." |
||||
/usr/bin/echo "Please re-create or re-download the config.json.example file." |
||||
exit 1 |
||||
fi |
||||
if [ ! -f go.mod ]; then |
||||
/usr/bin/echo "go.mod program descriptor missing!" |
||||
exit 1 |
||||
fi |
||||
if [ ! -f execguard.go ]; then |
||||
/usr/bin/echo "execguard go code missing!" |
||||
exit 1 |
||||
fi |
||||
|
||||
|
||||
# Help OLD systems out...if apt does not exists link to apt-get! |
||||
if [ ! -x /usr/bin/apt ]; then |
||||
if [ -x /usr/bin/apt-get ]; then |
||||
${USE_SUPER} ln -s /usr/bin/apt-get /usr/bin/apt |
||||
fi |
||||
fi |
||||
|
||||
auto-pkg-installer() { |
||||
if [ -z "$1" ]; then |
||||
/usr/bin/echo "Please give a package name to install!" |
||||
return 1 |
||||
fi |
||||
|
||||
declare -A osInfo; |
||||
osInfo[/etc/redhat-release]="yum install" |
||||
osInfo[/etc/arch-release]="pacman -S" |
||||
osInfo[/etc/gentoo-release]="emerge" |
||||
osInfo[/etc/SuSE-release]="zypper install" |
||||
osInfo[/etc/debian_version]="/usr/bin/apt install -y" |
||||
osInfo[/etc/alpine-release]="apk add --no-cache" |
||||
for f in "${!osInfo[@]}" |
||||
do |
||||
if [[ -f $f ]];then |
||||
${USE_SUPER} ${osInfo[$f]} "$@" |
||||
fi |
||||
done |
||||
} |
||||
|
||||
if [ -f /etc/systemd/system/execguard.service ]; then |
||||
/usr/bin/echo "Existing Service found. Stopping..." |
||||
${USE_SUPER} /usr/sbin/service execguard stop |
||||
fi |
||||
if [ ! -d /etc/execgaurd ]; then |
||||
${USE_SUPER} /usr/bin/mkdir -p /etc/execguard |
||||
fi |
||||
if [ ! -x /usr/bin/wget ]; then |
||||
/usr/bin/echo "wget is needed to download go-lang..." |
||||
auto-pkg-installer wget |
||||
fi |
||||
if [ ! -x /usr/bin/tar ]; then |
||||
/usr/bin/echo "Installing tar..." |
||||
auto-pkg-installer tar |
||||
fi |
||||
if [ ! -x /usr/local/go/bin/go ]; then |
||||
if [ ! -d ~/Downloads ]; then |
||||
/usr/bin/mkdir -p ~/Downloads |
||||
fi |
||||
/usr/bin/echo "Installing go lang...." |
||||
/usr/bin/wget https://go.dev/dl/go1.24.3.linux-amd64.tar.gz |
||||
${USE_SUPER} tar -C /usr/local -xzf go1.24.3.linux-amd64.tar.gz |
||||
/usr/bin/mv go1.24.3.linux-amd64.tar.gz ~/Downloads/ |
||||
if [ -x /usr/local/bin/go ]; then |
||||
/usr/bin/sudo /usr/bin/rm /usr/local/bin/go |
||||
fi |
||||
/usr/bin/sudo /usr/bin/ln -s /usr/local/go/bin/go /usr/local/bin/ |
||||
fi |
||||
/usr/bin/echo "Building new execguard..." |
||||
DoBuild() { |
||||
/usr/local/bin/go build -o execguard |
||||
if [ $? -eq 0 ]; then |
||||
${USE_SUPER} /usr/bin/cp execguard /usr/local/bin/ |
||||
/usr/bin/echo "Success!" |
||||
return 0 |
||||
else |
||||
/usr/bin/echo "Failed to Build execguard from go file...!" |
||||
return 1 |
||||
fi |
||||
} |
||||
if ! DoBuild; then |
||||
# Prompt the user |
||||
/usr/bin/echo "Was their a go-lang version update?" |
||||
read -p "Try to clear the cache? [y/N] " choice |
||||
case "$choice" in |
||||
y|Y|[yY][eE][sS]) |
||||
/usr/bin/echo "Attempting to clean cache..." |
||||
;; |
||||
*) |
||||
echo "Aborting...!" |
||||
exit 1 |
||||
;; |
||||
esac |
||||
/usr/local/bin/go clean -modcache |
||||
/usr/local/bin/go clean -cache |
||||
/usr/local/bin/go mod tidy |
||||
/usr/bin/echo "Re-Builind 2nd Try, last try..." |
||||
if ! DoBuild; then |
||||
/usr/bin/echo "Could not clean source modules...!" |
||||
exit 1 |
||||
fi |
||||
fi |
||||
|
||||
if [ ! -x /usr/bin/nano ]; then |
||||
echo "Installing nano text editor..." |
||||
auto-pkg-installer nano |
||||
fi |
||||
if [ ! -f /etc/execguard/config.json ]; then |
||||
/usr/bin/mkdir -p /etc/execguard |
||||
${USE_SUPER} cp config.json.example /etc/execguard/config.json |
||||
# Make an xxTea safe KEY! |
||||
passphrase_content=$(./execguard --newKey) |
||||
# Escape special characters (like &, \, and newlines) for sed |
||||
escaped_content=$(/usr/bin/printf '%s' "$passphrase_content" | /usr/bin/sed -e 's/[&\\]/\\&/g') |
||||
|
||||
# Replace using | as delimiter (avoiding / conflicts) |
||||
# Replace the passphrase line in the config file |
||||
${USE_SUPER} /usr/bin/sed -i "s|\"passphrase\": \"cdzTE1Gk6/VuDlnU\"|\"passphrase\": \"$escaped_content\"|g" /etc/execguard/config.json |
||||
# Prompt the user |
||||
/usr/bin/echo "Please modidy your config home user's folders!!" |
||||
read -p "Do you want to edit your config.json file with nano? [y/N] " choice |
||||
case "$choice" in |
||||
y|Y|[yY][eE][sS]) |
||||
${USE_SUPER} /usr/bin/nano /etc/execguard/config.json |
||||
echo "File has been edited." |
||||
;; |
||||
*) |
||||
echo "Skipping file edit." |
||||
;; |
||||
esac |
||||
fi |
||||
|
||||
if [ ! -f /etc/systemd/system/execguard.service ]; then |
||||
/usr/bin/echo "Adding SystemD Serivce file..." |
||||
${USE_SUPER} cp execguard.service /etc/systemd/system/ |
||||
${USE_SUPER} systemctl daemon-reload |
||||
${USE_SUPER} service execguard status |
||||
fi |
||||
|
||||
# NOTE: If your clamav is way out of date, uninstall it: |
||||
# sudo apt purge clamav clamav-daemon clamav-freshclam |
||||
if [ ! -x /usr/bin/clamscan ]; then |
||||
/usr/bin/echo "Install clamAV..." |
||||
auto-pkg-installer clamav clamav-daemon clamav-freshclam |
||||
${USE_SUPER} /usr/bin/freshclam |
||||
fi |
||||
if [ ! -d /var/lib/clamav/quarantine ]; then |
||||
${USE_SUPER} mkdir -p /var/lib/clamav/quarantine |
||||
${USE_SUPER} chown -R clamav:clamav /var/lib/clamav/quarantine |
||||
${USE_SUPER} chmod 750 /var/lib/clamav/quarantine |
||||
fi |
||||
if [ ! -x /usr/bin/sqlite3 ]; then |
||||
/usr/bin/echo "Installing sqlite3 database tool..." |
||||
auto-pkg-installer sqlite3 |
||||
fi |
||||
/usr/bin/echo "Updating system bin files..." |
||||
/usr/bin/echo "Updating self into allowed list..." |
||||
${USE_SUPER} ./execguard --update /usr/local/bin/execguard |
||||
case $? in |
||||
0) |
||||
/usr/bin/echo -e "\nHey, it updated, config must be good." |
||||
;; |
||||
1) |
||||
/usr/bin/echo -e "\nMust be run as root OR invalid UPDATE Path...error!" |
||||
exit 1 |
||||
;; |
||||
2) |
||||
/usr/bin/echo -e "\nHey, the Database did not Open!" |
||||
exit 1 |
||||
;; |
||||
3) |
||||
/usr/bin/echo -e "\nHey, your Config File did not work!" |
||||
exit 1 |
||||
;; |
||||
*) |
||||
/usr/bin/echo -e "\nUnknown ERROR in execguard!" |
||||
exit 1 |
||||
;; |
||||
esac |
||||
${USE_SUPER} ./execguard --update "$(pwd)/update_bins.sh" |
||||
${USE_SUPER} ./execguard --update "$(pwd)/sys_update.sh" |
||||
./update_bins.sh |
||||
@ -0,0 +1,8 @@ |
||||
#!/bin/bash |
||||
/usr/local/bin/go build -o execguard |
||||
if [ $? -eq 0 ]; then |
||||
/usr/bin/sudo cp execguard /usr/local/bin/ |
||||
/usr/bin/sudo ./execguard --update /usr/local/bin/execguard |
||||
/usr/bin/echo -e "Running execguard...Hit CTRL+C to end." |
||||
/usr/bin/sudo execguard |
||||
fi |
||||
@ -1,30 +1,27 @@ |
||||
#!/bin/bash |
||||
|
||||
# Directories to search for executables |
||||
DIRS=("/usr/bin" "/usr/sbin" "/usr/local/bin") |
||||
DIRS=("/usr/bin" "/usr/sbin" "/usr/local/bin" "/usr/local/sbin/") |
||||
|
||||
# Process each directory |
||||
for dir in "${DIRS[@]}"; do |
||||
# Check if directory exists |
||||
if [[ -d "$dir" ]]; then |
||||
echo "Processing directory: $dir" |
||||
/usr/bin/echo "Processing directory: $dir" |
||||
|
||||
# Find all executable files in the directory |
||||
find "$dir" -maxdepth 1 -type f -executable | while read -r program; do |
||||
# Get just the program name without path: prog_name=$(basename "$program") |
||||
# Run execguard --update on the program |
||||
echo "Updating execguard for: $program" |
||||
sudo execguard --update "$program" |
||||
/usr/bin/echo "Updating execguard for: $program" |
||||
/usr/bin/sudo /usr/local/bin/execguard --update "$program" |
||||
done |
||||
else |
||||
echo "Directory not found: $dir" >&2 |
||||
/usr/bin/echo "Directory not found: $dir" >&2 |
||||
fi |
||||
done |
||||
|
||||
# custom files here: |
||||
sudo execguard --update /usr/bin/mail |
||||
if [ -x /usr/local/maldetect/maldet ]; then |
||||
sudo execguard --update /usr/local/maldetect/maldet |
||||
fi |
||||
sudo execguard --update /usr/lib/update-notifier/package-data-downloader |
||||
echo "Finished processing all directories" |
||||
/usr/bin/sudo /usr/local/bin/execguard --update /usr/bin/mail |
||||
/usr/bin/sudo /usr/local/bin/execguard --update /usr/lib/update-notifier/package-data-downloader |
||||
/usr/bin/echo "Finished processing all directories" |
||||
|
||||
@ -1,13 +1,4 @@ |
||||
#!/bin/bash |
||||
# sudo apt purge clamav clamav-daemon clamav-freshclam |
||||
sudo service execgaurd stop |
||||
if [ ! -x /usr/bin/clamscan ]; then |
||||
sudo apt install clamav clamav-daemon clamav-freshclam |
||||
sudo freshclam |
||||
fi |
||||
if [ ! -x /usr/bin/sqlite3 ]; then |
||||
sudo apt install sqlite3 |
||||
fi |
||||
sudo sqlite3 /etc/execguard/system.db "SELECT path FROM allowed;" > my_bins_apps.txt |
||||
clamscan -v --file-list=my_bins_apps.txt |
||||
echo "Done -- you may: rm my_bins_apps" |
||||
/usr/bin/sudo /usr/bin/sqlite3 /etc/execguard/system.db "SELECT path FROM allowed;" > my_bins_apps.txt |
||||
/usr/bin/clamscan -v --infected --move=/var/lib/clamav/quarantine --file-list=my_bins_apps.txt |
||||
/usr/bin/echo "Done -- you may: rm my_bins_apps" |
||||
|
||||
Loading…
Reference in new issue