ghost
98 lines
3.6 KiB
Bash
Executable File
98 lines
3.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# /usr/local/bin/opsec-log-rotate.sh — Secure log rotation and cleanup
|
|
# Truncates sensitive logs, shreds rotated files, clears journald + shell histories
|
|
# Runs via cron (configurable LOG_ROTATION_HOURS in /etc/opsec/opsec.conf)
|
|
|
|
set -euo pipefail
|
|
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo "[-] Please run as root"
|
|
exit 1
|
|
fi
|
|
|
|
OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
|
|
_HAS_LIB=false
|
|
if [ -f "$OPSEC_LIB" ]; then
|
|
. "$OPSEC_LIB"
|
|
opsec_load_config 2>/dev/null || true
|
|
_HAS_LIB=true
|
|
else
|
|
opsec_green() { echo "[+] $*"; }
|
|
opsec_info() { echo "[~] $*"; }
|
|
fi
|
|
|
|
LOG_FILE="/var/log/opsec-log-rotate.log"
|
|
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
|
|
|
|
log() { echo "[$TIMESTAMP] $*" >> "$LOG_FILE"; }
|
|
|
|
log "Starting secure log rotation"
|
|
|
|
# ─── TRUNCATE SENSITIVE SYSTEM LOGS ────────────────────────────────────────────
|
|
SENSITIVE_LOGS=(
|
|
/var/log/auth.log
|
|
/var/log/syslog
|
|
/var/log/kern.log
|
|
/var/log/daemon.log
|
|
/var/log/messages
|
|
/var/log/user.log
|
|
/var/log/mail.log
|
|
/var/log/debug
|
|
/var/log/wtmp
|
|
/var/log/btmp
|
|
/var/log/lastlog
|
|
/var/log/faillog
|
|
)
|
|
|
|
for logfile in "${SENSITIVE_LOGS[@]}"; do
|
|
if [ -f "$logfile" ]; then
|
|
truncate -s 0 "$logfile" 2>/dev/null || true
|
|
log "Truncated: $logfile"
|
|
fi
|
|
done
|
|
|
|
# ─── SHRED ROTATED LOG FILES (SSD-aware) ─────────────────────────────────────
|
|
for rotated in /var/log/*.gz /var/log/*.1 /var/log/*.old; do
|
|
if [ -f "$rotated" ]; then
|
|
if [ "$_HAS_LIB" = "true" ]; then
|
|
opsec_secure_delete "$rotated"
|
|
else
|
|
shred -fuz "$rotated" 2>/dev/null || rm -f "$rotated"
|
|
fi
|
|
log "Wiped: $rotated"
|
|
fi
|
|
done
|
|
|
|
# ─── CLEAR JOURNALD ───────────────────────────────────────────────────────────
|
|
if command -v journalctl >/dev/null 2>&1; then
|
|
journalctl --vacuum-time=1h 2>/dev/null || true
|
|
log "Journald vacuumed (1h retention)"
|
|
fi
|
|
|
|
# ─── CLEAR SHELL HISTORIES ────────────────────────────────────────────────────
|
|
for user_home in /home/* /root; do
|
|
[ -d "$user_home" ] || continue
|
|
for hist_file in .bash_history .zsh_history .python_history .psql_history .mysql_history .lesshst .viminfo; do
|
|
if [ -f "${user_home}/${hist_file}" ]; then
|
|
if [ "$_HAS_LIB" = "true" ]; then
|
|
opsec_secure_delete "${user_home}/${hist_file}"
|
|
else
|
|
shred -fuz "${user_home}/${hist_file}" 2>/dev/null || truncate -s 0 "${user_home}/${hist_file}" 2>/dev/null || true
|
|
fi
|
|
log "Cleared: ${user_home}/${hist_file}"
|
|
fi
|
|
done
|
|
done
|
|
|
|
# ─── CLEAR RECENTLY USED ──────────────────────────────────────────────────────
|
|
for user_home in /home/* /root; do
|
|
[ -d "$user_home" ] || continue
|
|
rm -f "${user_home}/.local/share/recently-used.xbel" 2>/dev/null || true
|
|
done
|
|
|
|
# ─── CLEAR TEMP FILES ─────────────────────────────────────────────────────────
|
|
find /tmp -type f -mmin +60 -delete 2>/dev/null || true
|
|
find /var/tmp -type f -mmin +60 -delete 2>/dev/null || true
|
|
|
|
log "Secure log rotation complete"
|