/usr/sbin/astra-modeswitch get
238145
05.11.2024 14:11:05
SSK208-5SOB
/usr/sbin/astra-modeswitch -c                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 #!/bin/bash

TEXTDOMAINDIR=/usr/share/locale
TEXTDOMAIN=astra-modeswitch


astralic_conffile="/etc/astra_license"

astralic_extra="URL=https://astralinux.ru/information/licenses\n"

# m_nid - numeric id to be saved to conf
# m_mod - internal mode code (if nid ever has to change)
# m_txt - text representation (not localized)
# m_loc - text representation (localized)

m_nid[0]=0
m_mod[0]=0
m_txt[0]="base(orel)"
m_loc[0]=$"base(orel)"

m_nid[1]=1
m_mod[1]=1
m_txt[1]="advanced(voronezh)"
m_loc[1]=$"advanced(voronezh)"

m_nid[2]=2
m_mod[2]=2
m_txt[2]="maximum(smolensk)"
m_loc[2]=$"maximum(smolensk)"


# defaults and availability for modes

astramode_options="digsig-control secdel-control swapwiper-control mic-control mac-control"

mode_unavail[0]="digsig-control secdel-control swapwiper-control mic-control mac-control"
mode_unavail[1]="mac-control"
mode_unavail[2]=""

mode_default[0]=""
mode_default[1]="mic-control"
mode_default[2]="mic-control mac-control"

function get_astra_mode()
{
	astra_mode=""
	nid=`cat $astralic_conffile 2> /dev/null | grep "^MODE=" | tail -n1 | cut -d "=" -f2`
	for i in ${!m_nid[*]}; do
		if [ "${m_nid[$i]}" != "$nid" ]; then continue; fi
		astra_mode=${m_mod[$i]};
		astra_mode_nid=${m_nid[$i]};
		return;
	done
}

function is_avail()
{
	func=`echo "$1" | sed -e 's/^astra-//'`
	if [ -z "$astra_mode" ]; then return 1; fi # fail-safe all unavailable
	if ! echo "${mode_unavail[$astra_mode]}" | grep -q "\b$func\b"; then return 0; else return 1; fi
}

function is_default()
{
	func=`echo "$1" | sed -e 's/^astra-//'`
	if [ -z "$astra_mode" ]; then return 0; fi # fail-safe all disabled
	if echo "${mode_default[$astra_mode]}" | grep -q "\b$func\b"; then return 0; else return 1; fi
}


# BT-42539 variable values
lastlog_inact[0]=90
lastlog_inact[1]=45
lastlog_inact[2]=45

flydmrc="/etc/X11/fly-dm/fly-dmrc"

flydm_sec[0]="X-\*-Greeter"
flydm_key[0]="NetworkAccess"
flydm_sec[1]="X-\*-Greeter"
flydm_key[1]="UserList"
flydm_sec[2]="X-\*-Greeter"
flydm_key[2]="ShowChargeLevelIndicator"
flydm_sec[3]="X-\*-Core"
flydm_key[3]="AllowShutdown"

flydm_netaccs[0]=true
flydm_netaccs[1]=false
flydm_netaccs[2]=false

flydm_userlst[0]=true
flydm_userlst[1]=false
flydm_userlst[2]=false

flydm_chrglvl[0]=true
flydm_chrglvl[1]=false
flydm_chrglvl[2]=false

flydm_shutdwn[0]=All
flydm_shutdwn[1]=Root
flydm_shutdwn[2]=Root

function modeswitch_set_vars()
{
	mode=$1

	if [ -s /usr/share/pam-configs/lastlog ]; then
		sed -e 's/\(.*required.*pam_lastlog\.so.*inactive=\)\S*/\1'${lastlog_inact[$mode]}'/g' -i /usr/share/pam-configs/lastlog
		[ -x /usr/sbin/pam-auth-update ] && /usr/sbin/pam-auth-update --enable lastlog
	fi

	if [ -s "$flydmrc" ]; then
		# make sure all required keys are in place
		for i in 0 1 2 3; do
			line=$(sed -nr "/^#/b; /\[${flydm_sec[$i]}\]/,/\[/{/${flydm_key[$i]}/Ip}" $flydmrc)
			if [ -n "$line" ]; then continue; fi
			awk -v sec=["${flydm_sec[$i]}"] -v kv="${flydm_key[$i]}=" 'p && $1~/\[[^]]*\]/{p=0; print kv} $1==sec{p=1} END{if (p) print kv} 1' $flydmrc > /tmp/tmp
			cat /tmp/tmp > $flydmrc
		done

		sed -e '/^\[X-\*-Greeter]/,/^\[/{s/^\(NetworkAccess\s*=\).*/\1'${flydm_netaccs[$mode]}'/i}' -i $flydmrc
		sed -e '/^\[X-\*-Greeter]/,/^\[/{s/^\(UserList\s*=\).*/\1'${flydm_userlst[$mode]}'/i}' -i $flydmrc
		sed -e '/^\[X-\*-Greeter]/,/^\[/{s/^\(ShowChargeLevelIndicator\s*=\).*/\1'${flydm_chrglvl[$mode]}'/i}' -i $flydmrc
		sed -e '/^\[X-\*-Core]/,/^\[/{s/^\(AllowShutdown\s*=\).*/\1'${flydm_shutdwn[$mode]}'/i}' -i $flydmrc
	fi
}
function write_action_to_log()
{
	local scriptname=`basename $0`
	uid=$SUDO_USER
	if [ -n "$USER" ] && [ "$USER" != "root" ]; then
		exit 1
	fi
	if [ -z "$2" ]; then
		result="success"
	elif [ "$2" = "failed" ]; then
		result="failed"
	else
		uid="$2"
		result="success"
	fi
	if [ "$1" = "disable" ] || [ "$1" = "enable" ] || [[ "$1" =~ ^set[0-2]$ ]]; then
		type=$1
	else
		type="error"
	fi
	echo "`date +%Y.%m.%d-%T` uid=$uid name=astra-safepolicy version=$(dpkg -s astra-safepolicy | grep -m 1 "Version:" | cut -d' ' -f2) script=$scriptname type=$type res=$result" >> /var/log/astra-safepolicy.log
}
function not_in_astra_install()
{
	if [ -r /proc/cmdline ] && grep -q '\bastra_install=1\b' /proc/cmdline; then return; fi
	$*
}

function in_astra_install()
{
	if [ -r /proc/cmdline ] && grep -q '\bastra_install=1\b' /proc/cmdline; then
		if [ -n "$*" ]; then
			$*;
		else
			return 0
		fi
	fi
	return 1
}

function keep_pdpl()
{
	if ! [ -e "/parsecfs/ctl" ]; then return; fi
	if [ -z "$1" ]; then
		pdpl-file $pdpl_label $pdpl_file 2> /dev/null
		unset pdpl_label
		unset pdpl_file
	else
		pdpl_label=`pdpl-file $1 2> /dev/null`
		pdpl_file=$1
	fi
}

chk_kernel_support()
{
	if in_astra_install; then return 0; fi
	for module in parsec nochmodx; do
		if [ -e /sys/module/$module/parameters ]; then
			return 0;
		fi
	done
	return 1;
}


function usage()
{
	echo $"Usage: $0 <list/get/getname/set> [<value>]"
	write_action_to_log "$mode" "failed"
	exit 1
}

if [ "$1" = "list" ]; then
	for i in ${!m_nid[*]}; do
		echo -e "${m_nid[$i]}\t${m_txt[$i]}"
	done
elif [ "$1" = "get" ] || [ "$1" = "getname" ]; then
	get_astra_mode
	nid=$astra_mode_nid
	if [ -z "$nid" ]; then
		echo $"can't read config fle " $astralic_conffile >&2
		write_action_to_log "$mode" "failed"
		exit 1;
	fi

	for i in ${!m_nid[*]}; do
		if [ "${m_nid[$i]}" != "$nid" ]; then continue; fi

		if [ "$1" = "getname" ]; then
			echo "${m_loc[$i]}"
		else
			echo "${m_nid[$i]}"
		fi
		exit 0;
	done

	echo $"unknown mode" >&2
	write_action_to_log "$mode" "failed"
	exit 1;
elif [ "$1" = "set" ]; then
	mode="$2"
	for i in ${!m_nid[*]}; do
		if [ "${m_nid[$i]}" = "$mode" ] || [ "${m_txt[$i]}" = "$mode" ]; then 
			echo -ne "MODE=${m_nid[$i]}\nDESCRIPTION=${m_txt[$i]}\n${astralic_extra}" > $astralic_conffile
			if [ $? -ne 0 ]; then exit 1; fi

			# disable unavailable options
			get_astra_mode
			for opt in $astramode_options; do
				if ! is_avail $opt; then
					echo "astra-$opt disable"
					astra-$opt disable;
				fi
			done

			r=$?

			# refresh defaults
			/usr/sbin/astra-mount-lock

			# add/remove parsec-cifs alias
			if [ "${m_mod[$i]}" = "2" ]; then
				echo "alias fs-cifs parsec-cifs" > /etc/modprobe.d/parsec-cifs.conf
				r=$(($r+$?))
			else
				echo "alias fs-cifs cifs" > /etc/modprobe.d/parsec-cifs.conf
				r=$(($r+$?))
			fi

			not_in_astra_install update-initramfs -u -k all

			# add/remove dbus parsecoff config
			if [ "${m_mod[$i]}" = "2" ]; then
				rm -f /etc/dbus-1/system.d/parsecoff.conf
			elif [ -d /etc/dbus-1/system.d/ ]; then
				cat <<EOF > /etc/dbus-1/system.d/parsecoff.conf
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
  <pdplinux_parsecoff />
</busconfig>
EOF
				r=$(($r+$?))
			fi

			/usr/bin/genfly-dmconf.post > /dev/null 2>&1
			write_action_to_log "set${mode}"
			exit $r
		fi
	done

	echo $"unknown mode" >&2
	write_action_to_log "$mode" "failed"
	exit 1;

else
	usage
fi

exit 0
 /usr/sbin/astra-modeswitch get
238145
05.11.2024 14:11:05
SSK208-5SOB
grep ^MODE=
238145
05.11.2024 14:11:05
SSK208-5SOB
cat /etc/astra_license
238145
05.11.2024 14:11:05
SSK208-5SOB
tail -n1
238145
05.11.2024 14:11:05
SSK208-5SOB
cut -d = -f2
238145
05.11.2024 14:11:05
SSK208-5SOB
/usr/bin/gnome-keyring-daemon --start --foreground --components=secrets
238145
05.11.2024 14:11:04
SSK208-5SOB
/usr/bin/smbnetfs /run/user/238145/fly-fm-vfs/smb -o big_writes,smb_tree_scan_period=536870912,show_hidden_hosts=true,smb_query_browsers=false
238145
05.11.2024 14:11:04
SSK208-5SOB
/usr/bin/fly-fm SMB/192.168.2.192/Энергосбыт
238145
05.11.2024 14:11:04
SSK208-5SOB
/usr/bin/fly-fm-service
238145
05.11.2024 14:11:04
SSK208-5SOB
/usr/sbin/astra-modeswitch get
238145
05.11.2024 14:11:04
SSK208-5SOB
/usr/sbin/astra-modeswitch -c exec '/usr/sbin/astra-modeswitch' "$@" /usr/sbin/astra-modeswitch get
238145
05.11.2024 14:11:03
SSK208-5SOB
/bin/bash -c exec fly-open --exec /home/SSK63/nazarenkoas/Desktop/shortcut.desktop
238145
05.11.2024 14:11:03
SSK208-5SOB
fly-open --exec /home/SSK63/nazarenkoas/Desktop/shortcut.desktop
238145
05.11.2024 14:11:03
SSK208-5SOB
/usr/bin/smbclient --option=client min protocol=NT1 -L 192.168.2.192 -k
238145
05.11.2024 14:11:03
SSK208-5SOB
/usr/bin/smbclient --option=client min protocol=NT1 -L 192.168.2.192 -U guest%
238145
05.11.2024 14:10:30
SSK208-5SOB
fly-thumbnails-creator unix:path=/run/user/238145/fly-thumbnails/socket
238145
05.11.2024 14:10:30
SSK208-5SOB
/usr/bin/bsign --show-info --xml /home/SSK63/nazarenkoas/Desktop/shortcut.desktop
238145
05.11.2024 14:10:30
SSK208-5SOB
/usr/bin/bwrap --ro-bind /lib /lib --ro-bind-try /lib64 /lib64 --ro-bind-try /lib32 /lib32 --ro-bind /usr /usr --dev-bind /dev/u
238145
05.11.2024 14:10:30
SSK208-5SOB
/usr/bin/fly-thumbnails-service
238145
05.11.2024 14:10:29
SSK208-5SOB
/usr/bin/fly-open-service
238145
05.11.2024 14:10:28
SSK208-5SOB
/usr/sbin/astra-modeswitch get
238145
05.11.2024 14:10:28
SSK208-5SOB
/usr/sbin/astra-modeswitch -c exec '/usr/sbin/astra-modeswitch' "$@" /usr/sbin/astra-modeswitch get
238145
05.11.2024 14:10:28
SSK208-5SOB
/usr/sbin/astra-modeswitch get
238145
05.11.2024 14:10:28
SSK208-5SOB
/usr/sbin/astra-modeswitch -c                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 #!/bin/bash

TEXTDOMAINDIR=/usr/share/locale
TEXTDOMAIN=astra-modeswitch


astralic_conffile="/etc/astra_license"

astralic_extra="URL=https://astralinux.ru/information/licenses\n"

# m_nid - numeric id to be saved to conf
# m_mod - internal mode code (if nid ever has to change)
# m_txt - text representation (not localized)
# m_loc - text representation (localized)

m_nid[0]=0
m_mod[0]=0
m_txt[0]="base(orel)"
m_loc[0]=$"base(orel)"

m_nid[1]=1
m_mod[1]=1
m_txt[1]="advanced(voronezh)"
m_loc[1]=$"advanced(voronezh)"

m_nid[2]=2
m_mod[2]=2
m_txt[2]="maximum(smolensk)"
m_loc[2]=$"maximum(smolensk)"


# defaults and availability for modes

astramode_options="digsig-control secdel-control swapwiper-control mic-control mac-control"

mode_unavail[0]="digsig-control secdel-control swapwiper-control mic-control mac-control"
mode_unavail[1]="mac-control"
mode_unavail[2]=""

mode_default[0]=""
mode_default[1]="mic-control"
mode_default[2]="mic-control mac-control"

function get_astra_mode()
{
	astra_mode=""
	nid=`cat $astralic_conffile 2> /dev/null | grep "^MODE=" | tail -n1 | cut -d "=" -f2`
	for i in ${!m_nid[*]}; do
		if [ "${m_nid[$i]}" != "$nid" ]; then continue; fi
		astra_mode=${m_mod[$i]};
		astra_mode_nid=${m_nid[$i]};
		return;
	done
}

function is_avail()
{
	func=`echo "$1" | sed -e 's/^astra-//'`
	if [ -z "$astra_mode" ]; then return 1; fi # fail-safe all unavailable
	if ! echo "${mode_unavail[$astra_mode]}" | grep -q "\b$func\b"; then return 0; else return 1; fi
}

function is_default()
{
	func=`echo "$1" | sed -e 's/^astra-//'`
	if [ -z "$astra_mode" ]; then return 0; fi # fail-safe all disabled
	if echo "${mode_default[$astra_mode]}" | grep -q "\b$func\b"; then return 0; else return 1; fi
}


# BT-42539 variable values
lastlog_inact[0]=90
lastlog_inact[1]=45
lastlog_inact[2]=45

flydmrc="/etc/X11/fly-dm/fly-dmrc"

flydm_sec[0]="X-\*-Greeter"
flydm_key[0]="NetworkAccess"
flydm_sec[1]="X-\*-Greeter"
flydm_key[1]="UserList"
flydm_sec[2]="X-\*-Greeter"
flydm_key[2]="ShowChargeLevelIndicator"
flydm_sec[3]="X-\*-Core"
flydm_key[3]="AllowShutdown"

flydm_netaccs[0]=true
flydm_netaccs[1]=false
flydm_netaccs[2]=false

flydm_userlst[0]=true
flydm_userlst[1]=false
flydm_userlst[2]=false

flydm_chrglvl[0]=true
flydm_chrglvl[1]=false
flydm_chrglvl[2]=false

flydm_shutdwn[0]=All
flydm_shutdwn[1]=Root
flydm_shutdwn[2]=Root

function modeswitch_set_vars()
{
	mode=$1

	if [ -s /usr/share/pam-configs/lastlog ]; then
		sed -e 's/\(.*required.*pam_lastlog\.so.*inactive=\)\S*/\1'${lastlog_inact[$mode]}'/g' -i /usr/share/pam-configs/lastlog
		[ -x /usr/sbin/pam-auth-update ] && /usr/sbin/pam-auth-update --enable lastlog
	fi

	if [ -s "$flydmrc" ]; then
		# make sure all required keys are in place
		for i in 0 1 2 3; do
			line=$(sed -nr "/^#/b; /\[${flydm_sec[$i]}\]/,/\[/{/${flydm_key[$i]}/Ip}" $flydmrc)
			if [ -n "$line" ]; then continue; fi
			awk -v sec=["${flydm_sec[$i]}"] -v kv="${flydm_key[$i]}=" 'p && $1~/\[[^]]*\]/{p=0; print kv} $1==sec{p=1} END{if (p) print kv} 1' $flydmrc > /tmp/tmp
			cat /tmp/tmp > $flydmrc
		done

		sed -e '/^\[X-\*-Greeter]/,/^\[/{s/^\(NetworkAccess\s*=\).*/\1'${flydm_netaccs[$mode]}'/i}' -i $flydmrc
		sed -e '/^\[X-\*-Greeter]/,/^\[/{s/^\(UserList\s*=\).*/\1'${flydm_userlst[$mode]}'/i}' -i $flydmrc
		sed -e '/^\[X-\*-Greeter]/,/^\[/{s/^\(ShowChargeLevelIndicator\s*=\).*/\1'${flydm_chrglvl[$mode]}'/i}' -i $flydmrc
		sed -e '/^\[X-\*-Core]/,/^\[/{s/^\(AllowShutdown\s*=\).*/\1'${flydm_shutdwn[$mode]}'/i}' -i $flydmrc
	fi
}
function write_action_to_log()
{
	local scriptname=`basename $0`
	uid=$SUDO_USER
	if [ -n "$USER" ] && [ "$USER" != "root" ]; then
		exit 1
	fi
	if [ -z "$2" ]; then
		result="success"
	elif [ "$2" = "failed" ]; then
		result="failed"
	else
		uid="$2"
		result="success"
	fi
	if [ "$1" = "disable" ] || [ "$1" = "enable" ] || [[ "$1" =~ ^set[0-2]$ ]]; then
		type=$1
	else
		type="error"
	fi
	echo "`date +%Y.%m.%d-%T` uid=$uid name=astra-safepolicy version=$(dpkg -s astra-safepolicy | grep -m 1 "Version:" | cut -d' ' -f2) script=$scriptname type=$type res=$result" >> /var/log/astra-safepolicy.log
}
function not_in_astra_install()
{
	if [ -r /proc/cmdline ] && grep -q '\bastra_install=1\b' /proc/cmdline; then return; fi
	$*
}

function in_astra_install()
{
	if [ -r /proc/cmdline ] && grep -q '\bastra_install=1\b' /proc/cmdline; then
		if [ -n "$*" ]; then
			$*;
		else
			return 0
		fi
	fi
	return 1
}

function keep_pdpl()
{
	if ! [ -e "/parsecfs/ctl" ]; then return; fi
	if [ -z "$1" ]; then
		pdpl-file $pdpl_label $pdpl_file 2> /dev/null
		unset pdpl_label
		unset pdpl_file
	else
		pdpl_label=`pdpl-file $1 2> /dev/null`
		pdpl_file=$1
	fi
}

chk_kernel_support()
{
	if in_astra_install; then return 0; fi
	for module in parsec nochmodx; do
		if [ -e /sys/module/$module/parameters ]; then
			return 0;
		fi
	done
	return 1;
}


function usage()
{
	echo $"Usage: $0 <list/get/getname/set> [<value>]"
	write_action_to_log "$mode" "failed"
	exit 1
}

if [ "$1" = "list" ]; then
	for i in ${!m_nid[*]}; do
		echo -e "${m_nid[$i]}\t${m_txt[$i]}"
	done
elif [ "$1" = "get" ] || [ "$1" = "getname" ]; then
	get_astra_mode
	nid=$astra_mode_nid
	if [ -z "$nid" ]; then
		echo $"can't read config fle " $astralic_conffile >&2
		write_action_to_log "$mode" "failed"
		exit 1;
	fi

	for i in ${!m_nid[*]}; do
		if [ "${m_nid[$i]}" != "$nid" ]; then continue; fi

		if [ "$1" = "getname" ]; then
			echo "${m_loc[$i]}"
		else
			echo "${m_nid[$i]}"
		fi
		exit 0;
	done

	echo $"unknown mode" >&2
	write_action_to_log "$mode" "failed"
	exit 1;
elif [ "$1" = "set" ]; then
	mode="$2"
	for i in ${!m_nid[*]}; do
		if [ "${m_nid[$i]}" = "$mode" ] || [ "${m_txt[$i]}" = "$mode" ]; then 
			echo -ne "MODE=${m_nid[$i]}\nDESCRIPTION=${m_txt[$i]}\n${astralic_extra}" > $astralic_conffile
			if [ $? -ne 0 ]; then exit 1; fi

			# disable unavailable options
			get_astra_mode
			for opt in $astramode_options; do
				if ! is_avail $opt; then
					echo "astra-$opt disable"
					astra-$opt disable;
				fi
			done

			r=$?

			# refresh defaults
			/usr/sbin/astra-mount-lock

			# add/remove parsec-cifs alias
			if [ "${m_mod[$i]}" = "2" ]; then
				echo "alias fs-cifs parsec-cifs" > /etc/modprobe.d/parsec-cifs.conf
				r=$(($r+$?))
			else
				echo "alias fs-cifs cifs" > /etc/modprobe.d/parsec-cifs.conf
				r=$(($r+$?))
			fi

			not_in_astra_install update-initramfs -u -k all

			# add/remove dbus parsecoff config
			if [ "${m_mod[$i]}" = "2" ]; then
				rm -f /etc/dbus-1/system.d/parsecoff.conf
			elif [ -d /etc/dbus-1/system.d/ ]; then
				cat <<EOF > /etc/dbus-1/system.d/parsecoff.conf
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
  <pdplinux_parsecoff />
</busconfig>
EOF
				r=$(($r+$?))
			fi

			/usr/bin/genfly-dmconf.post > /dev/null 2>&1
			write_action_to_log "set${mode}"
			exit $r
		fi
	done

	echo $"unknown mode" >&2
	write_action_to_log "$mode" "failed"
	exit 1;

else
	usage
fi

exit 0
 /usr/sbin/astra-modeswitch get
238145
05.11.2024 14:10:28
SSK208-5SOB
cat /etc/astra_license
238145
05.11.2024 14:10:28
SSK208-5SOB
grep ^MODE=
238145
05.11.2024 14:10:28
SSK208-5SOB
tail -n1
238145
05.11.2024 14:10:28
SSK208-5SOB
cut -d = -f2
238145
05.11.2024 14:10:27
SSK208-5SOB
/usr/bin/fly-fops-service
238145
05.11.2024 14:10:26
SSK208-5SOB
/bin/bash -c exec fly-props --show -geometry 800x600+0+505 /home/SSK63/nazarenkoas/Desktop/shortcut.desktop
238145
05.11.2024 14:10:26
SSK208-5SOB
fly-props --show -geometry 800x600+0+505 /home/SSK63/nazarenkoas/Desktop/shortcut.desktop
238145
05.11.2024 14:02:02
SSK208-5SOB
mv /tmp/logcheck.6PsEnr/checked.1 /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v -f /tmp/logcheck.6PsEnr/ignore/ntpdate /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v -f /tmp/logcheck.6PsEnr/ignore/ntpdate /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v -f /tmp/logcheck.6PsEnr/ignore/ntpdate /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
mv /tmp/logcheck.6PsEnr/checked.1 /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v -f /tmp/logcheck.6PsEnr/ignore/syslog-ng /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v -f /tmp/logcheck.6PsEnr/ignore/syslog-ng /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
mkdir /tmp/logcheck.6PsEnr/violations
112
05.11.2024 14:02:02
SSK208-5SOB
run-parts --list /etc/logcheck/violations.d
112
05.11.2024 14:02:02
SSK208-5SOB
mkdir /tmp/logcheck.6PsEnr/violations-ignore
112
05.11.2024 14:02:02
SSK208-5SOB
run-parts --list /etc/logcheck/violations.ignore.d
112
05.11.2024 14:02:02
SSK208-5SOB
basename /etc/logcheck/violations.ignore.d/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/violations.ignore.d/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/violations.ignore.d/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v ^[[:space:]]*$|^# /etc/logcheck/violations.ignore.d/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
basename /etc/logcheck/ignore.d.server/gpg-agent
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/gpg-agent
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/gpg-agent
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/gpg-agent
112
05.11.2024 14:02:02
SSK208-5SOB
basename /etc/logcheck/ignore.d.server/libsasl2-modules
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/libsasl2-modules
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/libsasl2-modules
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/libsasl2-modules
112
05.11.2024 14:02:02
SSK208-5SOB
basename /etc/logcheck/ignore.d.server/ntpdate
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/ntpdate
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/ntpdate
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/ntpdate
112
05.11.2024 14:02:02
SSK208-5SOB
basename /etc/logcheck/ignore.d.server/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
mkdir /tmp/logcheck.6PsEnr/cracking
112
05.11.2024 14:02:02
SSK208-5SOB
run-parts --list /etc/logcheck/cracking.d
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.server/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
run-parts --list /etc/logcheck/ignore.d.paranoid
112
05.11.2024 14:02:02
SSK208-5SOB
basename /etc/logcheck/ignore.d.paranoid/cracklib-runtime
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.paranoid/cracklib-runtime
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.paranoid/cracklib-runtime
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.paranoid/cracklib-runtime
112
05.11.2024 14:02:02
SSK208-5SOB
basename /etc/logcheck/ignore.d.paranoid/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.paranoid/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v ^[[:space:]]*$|^# /etc/logcheck/ignore.d.paranoid/syslog-ng
112
05.11.2024 14:02:02
SSK208-5SOB
bash /usr/sbin/logcheck
112
05.11.2024 14:02:02
SSK208-5SOB
Нет данных
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v -h (^#|^[[:space:]]*$) /etc/logcheck/logcheck.logfiles
112
05.11.2024 14:02:02
SSK208-5SOB
basename /var/log/syslog
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/bin/perl /usr/sbin/logtail2 -f /var/log/syslog -o /var/lib/logcheck/offset.var.log.syslog
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
mkdir /tmp/logcheck.6PsEnr/ignore
112
05.11.2024 14:02:02
SSK208-5SOB
run-parts --list /etc/logcheck/ignore.d.server
112
05.11.2024 14:02:02
SSK208-5SOB
tr / .
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v -f /tmp/logcheck.6PsEnr/ignore/gpg-agent /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v -f /tmp/logcheck.6PsEnr/ignore/gpg-agent /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v -f /tmp/logcheck.6PsEnr/ignore/gpg-agent /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
mv /tmp/logcheck.6PsEnr/checked.1 /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v -f /tmp/logcheck.6PsEnr/ignore/libsasl2-modules /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v -f /tmp/logcheck.6PsEnr/ignore/libsasl2-modules /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v -f /tmp/logcheck.6PsEnr/ignore/libsasl2-modules /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
basename /var/log/auth.log
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /usr/sbin/logtail2 -f /var/log/auth.log -o /var/lib/logcheck/offset.var.log.auth.log
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/bin/perl /usr/sbin/logtail2 -f /var/log/auth.log -o /var/lib/logcheck/offset.var.log.auth.log
112
05.11.2024 14:02:02
SSK208-5SOB
sed -e s/[[:space:]]\+$//
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
sort -k 1,3 -s /tmp/logcheck.6PsEnr/logoutput/auth.log /tmp/logcheck.6PsEnr/logoutput/syslog
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/cat /etc/logcheck/header.txt
112
05.11.2024 14:02:02
SSK208-5SOB
ls -1 /tmp/logcheck.6PsEnr/cracking
112
05.11.2024 14:02:02
SSK208-5SOB
rm -f /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
ls -1 /tmp/logcheck.6PsEnr/violations
112
05.11.2024 14:02:02
SSK208-5SOB
cp /tmp/logcheck.6PsEnr/logoutput-sorted /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
ls -1 /tmp/logcheck.6PsEnr/ignore/
112
05.11.2024 14:02:02
SSK208-5SOB
cat
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/egrep --text -v -f /tmp/logcheck.6PsEnr/ignore/cracklib-runtime /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
/bin/sh /bin/egrep --text -v -f /tmp/logcheck.6PsEnr/ignore/cracklib-runtime /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v -f /tmp/logcheck.6PsEnr/ignore/cracklib-runtime /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
mv /tmp/logcheck.6PsEnr/checked.1 /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/bin/perl -w /bin/mime-construct --header Auto-Submitted: auto-generated --subject SSK208-5SOB.ssk63.ru 2024-11-05 15:02 +04
112
05.11.2024 14:02:02
SSK208-5SOB
sendmail -oi logcheck
0
05.11.2024 14:02:02
SSK208-5SOB
sh -c id
0
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/exim4 -t -oem -oi -f <> -E1t8HJy-00021T-Lg
0
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/exim4 -Mc 1t8HJy-00021a-QR
0
05.11.2024 14:02:02
SSK208-5SOB
sh -c id
0
05.11.2024 14:02:02
SSK208-5SOB
grep -E --text -v -f /tmp/logcheck.6PsEnr/ignore/syslog-ng /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
mv /tmp/logcheck.6PsEnr/checked.1 /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
ls -1 /tmp/logcheck.6PsEnr/cracking/
112
05.11.2024 14:02:02
SSK208-5SOB
ls -1 /tmp/logcheck.6PsEnr/violations/
112
05.11.2024 14:02:02
SSK208-5SOB
wc -c
112
05.11.2024 14:02:02
SSK208-5SOB
cat /tmp/logcheck.6PsEnr/checked
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/astra-shebang /bin/mime-construct --header Auto-Submitted: auto-generated --subject SSK208-5SOB.ssk63.ru 2024-11-05 15:02 +0400 System Events --to logcheck --file /tmp/logcheck.6PsEnr/report
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/bin/perl -w /bin/mime-construct --header Auto-Submitted: auto-generated --subject SSK208-5SOB.ssk63.ru 2024-11-05 15:02 +0400 System Events --to logcheck --file /tmp/logcheck.6PsEnr/report
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/bin/perl -w /bin/mime-construct --header Auto-Submitted: auto-generated --subject SSK208-5SOB.ssk63.ru 2024-11-05 15:02 +04
112
05.11.2024 14:02:02
SSK208-5SOB
/usr/sbin/exim4 -Mc 1t8HJy-00021T-Lg
0
05.11.2024 14:02:02
SSK208-5SOB
lockfile-remove /run/lock/logcheck/logcheck
112
05.11.2024 14:02:02
SSK208-5SOB
rm -r /tmp/logcheck.6PsEnr
112
05.11.2024 14:02:01
SSK208-5SOB
/usr/sbin/astra-shebang /usr/sbin/logcheck
112
05.11.2024 14:02:01
SSK208-5SOB
nice -n10 /usr/sbin/logcheck
112
05.11.2024 14:02:01
SSK208-5SOB
nice -n10 /usr/sbin/logcheck
112
05.11.2024 14:02:01
SSK208-5SOB
nice -n10 /usr/sbin/logcheck
112
05.11.2024 14:02:01
SSK208-5SOB
bash /usr/sbin/logcheck
112
05.11.2024 14:02:01
SSK208-5SOB
date +%Y-%m-%d %H:%M %z
112
05.11.2024 14:02:01
SSK208-5SOB
expr 1 - 1
112
05.11.2024 14:02:01
SSK208-5SOB
lockfile-create --retry 1 /run/lock/logcheck/logcheck
112
05.11.2024 14:02:01
SSK208-5SOB
lockfile-touch /run/lock/logcheck/logcheck
112
05.11.2024 14:02:01
SSK208-5SOB
mktemp -d -p /tmp logcheck.XXXXXX
112
05.11.2024 14:02:01
SSK208-5SOB
/bin/sh -c    if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi
112
05.11.2024 14:02:01
SSK208-5SOB
nice -n10 /usr/sbin/logcheck
112 Это активность на хосте. 112 это Subject.id, то есть пользователь. 0 тоже. И третье число тоже. Проанализируй активность на хосте, скажи что там не так. Что может быть опасно, что повторяется. Давай, ты кибербезопасник