sad
/
moose
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

optimize logging disable

This commit is contained in:
sad 2023-10-18 01:54:07 +00:00
parent 00f33c1f01
commit eab778a3bc
WARNING! Although there is a key with this ID in the database it does not verify this commit! This commit is SUSPICIOUS.
GPG Key ID: 28D3A882F3E6AD02
1 changed files with 20 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
moose.sh
View File

@ -144,24 +144,30 @@ if [[ -n $hostname_var ]]; then
fi
fi
if [ "$disable_logging" = true ]; then
systemctl disable --now rsyslog
systemctl disable --now systemd-journald
systemctl disable --now systemd-journald.socket
systemctl disable --now systemd-journald-dev-log.socket
systemctl disable --now auditd
# Files to modify and make read-only and immutable
log_files=("/var/log/wtmp" "/var/log/btmp" "/var/run/utmp" "/var/log/lastlog")
# Make logs read-only
chmod 444 /var/log/wtmp
chmod 444 /var/log/btmp
chmod 444 /var/run/utmp
chmod 444 /var/log/lastlog
# Disable logging services
for service in rsyslog systemd-journald systemd-journald.socket systemd-journald-dev-log.socket auditd logrotate logrotate.timer; do
if systemctl is-active --quiet "$service"; then
systemctl disable --now "$service"
fi
done
systemctl disable --now logrotate
systemctl disable --now logrotate.timer
# Modify rsyslog configuration
if [ -f /etc/rsyslog.conf ]; then
sed -i 's/auth\.priv\.warning/auth\.none/' /etc/rsyslog.conf
fi
sed -i 's/auth\.priv\.warning/auth\.none/' /etc/rsyslog.conf
# Make log files read-only and immutable
for log in "${log_files[@]}"; do
if [ -f "$log" ]; then
> "$log"
chmod 444 "$log"
chattr +i "$log"
fi
done
fi
if [ "$change_ssh_port" = true ]; then