script3.py

import os
import time
import mysql.connector

# List of important files to monitor
important_files = [
    "/etc/passwd",
    "/etc/shadow",
    "/etc/hostname",
    "/etc/sudoers",
    "/etc/ssh/sshd_config"
]

# Initialize file modification times
file_last_modified = {file: os.path.getmtime(file) for file in important_files}

# Database connection details
DB_CONFIG = {
    "host": "localhost",
    "user": "root",
    "password": "8520",  # Replace with your MariaDB root password
    "database": "hids",
    "charset"="utf8mb4",
    "collation"="utf8mb4_general_ci"
}

# Function to connect to MariaDB
def get_db_connection():
    try:
        connection = mysql.connector.connect(**DB_CONFIG)
        return connection
    except mysql.connector.Error as err:
        print(f"Error connecting to MariaDB: {err}")
        exit(1)

# Function to log the alert in the MariaDB database
def send_alert_to_db(message, file):
    try:
        conn = get_db_connection()
        cursor = conn.cursor()
        query = "INSERT INTO alerts (file, message) VALUES (%s, %s)"
        cursor.execute(query, (file, message))
        conn.commit()
        cursor.close()
        conn.close()
    except mysql.connector.Error as err:
        print(f"Error inserting data into MariaDB: {err}")

# Function to send an alert
def alert(message, file):
    print(f"ALERT: {message}")
    send_alert_to_db(message, file)

# Function to check file integrity
def check_file_integrity():
    while True:
        for file in important_files:
            try:
                # Check if the file's last modification time has changed
                if os.path.getmtime(file) != file_last_modified[file]:
                    alert(f"File modified: {file}", file)
                    file_last_modified[file] = os.path.getmtime(file)
            except FileNotFoundError:
                alert(f"File missing: {file}", file)
                # Reset the modification time for missing files to avoid errors
                file_last_modified[file] = None
        time.sleep(60)

if __name__ == "__main__":
    # Start file integrity monitoring
    try:
        print("Starting file integrity monitoring...")
        check_file_integrity()
    except KeyboardInterrupt:
        print("Monitoring stopped.")