Linux OS Login Attempts Monitoring and Auditing System (client-side). This software sends real-time login attempt information to the server.
This script is executed using PAM (Pluggable Authentication Module). Information about the login attempt and its details are passed to the script's environment. Then, this information is sent to a preconfigured endpoint using a POST request. It is intended to be used together with Gryffine-server, but there are no artificial technical limitations on its use with an alternative server-side component.
Clone the repository
git clone https://github.com/PressXToWin/gryffine-client.git
Copy the script to the directory /usr/local/bin/
sudo cp gryffine-client/gryffine.py /usr/local/bin/gryffine.py
Create a backup of the PAM configuration
sudo cp /etc/pam.d/common-auth /etc/pam.d/common-auth.bkp
Modify the PAM configuration as follows:
- Change the line
auth [success=1 default=ignore] pam_unix.so nullok_secure
to
auth [success=2 default=ignore] pam_unix.so nullok_secure
- Add the following line with action for case of failed login and set the endpoint
auth optional pam_exec.so /usr/local/bin/gryffine.py http://gryffine-server/api/v1/records/ fail
- After the line
auth requisite pam_deny.so
add action for case of successful login and set the endpoint
auth optional pam_exec.so /usr/local/bin/gryffine.py http://gryffine-server/api/v1/records/ success
As a result, it should look something like this:
# here are the per-package modules (the "Primary" block)
auth [success=2 default=ignore] pam_unix.so nullok_secure
# here's the fallback if no module succeeds
auth optional pam_exec.so /usr/local/bin/gryffine.py http://gryffine-server/api/v1/records/ fail
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth optional pam_exec.so /usr/local/bin/gryffine.py http://gryffine-server/api/v1/records/ success
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth optional pam_cap.so
# end of pam-auth-update config