# # sudo.py # # Get number of sudo sessions for each user # import re from ..formatting import * from ..util import readlog, resolve from .. import config import logging logger = logging.getLogger(__name__) def parse_log(): output = '' logger.debug("Starting sudo section") output += opentag('div', 1, 'sudo', 'section') logger.debug("Searching for matches in {0}".format(config.prefs['logs']['auth'])) umatches = re.findall('.*sudo:session\): session opened.*', readlog(config.prefs['logs']['auth'])) num = sum(1 for line in umatches) # total number of sessions users = [] data = [] for match in umatches: user = re.search('.*session opened for user root by (\S*)\(uid=.*\)', match).group(1) exists = [i for i, item in enumerate(users) if re.search(user, item[0])] if (exists == []): users.append([user, 1]) else: users[exists[0]][1] += 1 commands = [] cmatches = re.findall('sudo:.*COMMAND\=(.*)', readlog(config.prefs['logs']['auth'])) for cmd in cmatches: commands.append(cmd) logger.debug("Finished parsing sudo sessions") output += writetitle("sudo") subtitle = plural("sudo session", num) + " for" if (len(users) == 1): logger.debug("found " + str(num) + " sudo session(s) for user " + str(users[0])) subtitle += ' ' + users[0][0] output += writedata(subtitle) else: for user in users: data.append(user[0] + ' (' + str(user[1]) + ')') logger.debug("found " + str(num) + " sudo sessions for users " + str(data)) output += writedata(subtitle, data) if (len(commands) > 0): commands = addtag(commands, 'code') commands = orderbyfreq(commands) commands = truncl(commands, config.prefs['maxcmd']) output += writedata("top sudo commands", [c for c in commands]) output += closetag('div', 1) return output logger.info("Finished sudo section")