Kali Defensive Monitoring & Log Analysis Scripts
Defensive monitoring and log analysis. Parse auth logs for failed SSH logins, watch critical file integrity with SHA-256 hashes, audit cron jobs and firewall rules, and snapshot a system baseline so you can spot exactly what changed.
Kali · Defensive Monitoring — script list
| Script | Category | What it does |
|---|---|---|
apache_log_parser.py | Log Analysis | Parses server access logs for 404/500 errors. |
failed_login_detector.py | Log Analysis | Scans `auth.log` for repeated SSH failures. |
file_integrity_monitor.py | Integrity | Monitors critical files using SHA-256 hashes. |
active_ports_analyzer.py | Monitoring | Lists local listening ports and their owning processes. |
resource_spike_alert.py | Monitoring | Watches CPU/RAM usage for anomalies. |
auth_log_parser.py | Log Analysis | Counts failed SSH logins from a mock `auth.log`. |
file_integrity_watcher.py | Integrity | Hashes critical files and alerts on changes. |
malicious_ip_blocker.py | Defense | Reads bad IPs and generates UFW block commands. |
suspicious_process_hunter.py | Monitoring | Flags processes running from unusual directories like `/tmp`. |
yara_rule_generator.py | Signatures | Generates basic YARA rule syntax for signature matching. |
check_root_privileges.sh | Privilege Audit | Verifies root/sudo escalation rights. |
find_suid_binaries.sh | Privilege Audit | Locates SUID/SGID files for auditing. |
backup_critical_configs.sh | Backup | Automates secure backup of `/etc` files. |
ssh_config_auditor.sh | Hardening | Audits `sshd_config` against hardening rules. |
firewall_status_checker.sh | Firewall | Monitors UFW/iptables rules and status. |
active_connections_monitor.sh | Monitoring | Lists established connections and their PIDs. |
suid_guid_finder.sh | Privilege Audit | Finds SUID/GUID files to audit privilege-escalation risk. |
firewall_status_check.sh | Firewall | Checks UFW/iptables status and dumps rules to a log. |
cronjob_auditor.sh | Persistence Audit | Lists scheduled cron jobs to check for persistence. |
system_baseline_snapshot.sh | Baseline | Snapshots installed packages and running services. |
Code samples
ssh_config_auditor.sh — audit sshd_config
#!/bin/bash
# ssh_config_auditor.sh
# Day 5: Security Auditing & System Defense
# Description: Audits sshd_config for common security misconfigurations.
SSH_CONFIG="/etc/ssh/sshd_config"
echo "[*] Auditing SSH Daemon Configuration: $SSH_CONFIG"
echo "--------------------------------------------------------"
if [ ! -f "$SSH_CONFIG" ]; then
echo "[!] SSH config not found at $SSH_CONFIG - skipping audit."
exit 0
fi
# Function to check specific settings
check_setting() {
local setting=$1
local expected=$2
local actual=$(grep "^$setting" "$SSH_CONFIG" | awk '{print $2}')
if [ -z "$actual" ]; then
echo "[WARNING] $setting is not explicitly set (using default)."
elif [ "$actual" == "$expected" ]; then
echo "[OK] $setting is set to $actual."
else
echo "[!!!] RISK DETECTED: $setting is set to $actual (Recommended: $expected)."
fi
}
check_setting "PermitRootLogin" "no"
check_setting "PasswordAuthentication" "no"
check_setting "PubkeyAuthentication" "yes"
check_setting "MaxAuthTries" "3"
check_setting "PermitEmptyPasswords" "no"
echo "--------------------------------------------------------"
echo "[*] SSH Audit complete. Follow best practices to harden your gateway."
file_integrity_monitor.sh — SHA-256 integrity check
#!/bin/bash
# file_integrity_monitor.sh - Checks hashes of critical system files.
# Day 9: Forensics and Hardening
HASH_DB="/tmp/sys_file_hashes.db"
CRITICAL_FILES=("/etc/passwd" "/etc/shadow" "/etc/sudoers" "/usr/bin/ssh")
generate_hashes() {
echo "Initializing Hash Database..."
for file in "${CRITICAL_FILES[@]}"; do
if [ -f "$file" ]; then
sha256sum "$file" >> "$HASH_DB"
fi
done
}
verify_integrity() {
echo "Starting Integrity Verification..."
if [ ! -f "$HASH_DB" ]; then
generate_hashes
return
fi
sha256sum -c "$HASH_DB" --status
if [ $? -eq 0 ]; then
echo "[OK] All critical files are intact."
else
echo "[ALERT] Integrity Violation Detected! Check /var/log/syslog."
sha256sum -c "$HASH_DB" | grep "FAILED"
fi
}
verify_integrity