Introduction to Bash Scripting for Security Automation

Why Automate Security Tasks with Bash?

Cybersecurity professionals spend significant time on repetitive tasks: auditing user accounts, scanning logs for threats, and checking system health. Bash scripting lets you encode those tasks once and run them reliably whenever needed. Because Bash is the default shell on most Linux distributions, your scripts run without installing additional software — an important advantage in locked-down enterprise environments. CompTIA CySA+ explicitly tests your ability to use scripting and automation to support security operations, so these skills map directly to your certification goals.

Shell Script Basics

A Bash script is a plain-text file that begins with a shebang line: `#!/bin/bash`. This tells the kernel which interpreter to use. Make the file executable with `chmod +x scriptname.sh`, then run it with `./scriptname.sh`.

Key constructs you will use in every security script:

• Variables: Assign with `VAR=value` (no spaces around `=`). Reference with `$VAR` or, more safely, `"$VAR"` (always quote variables to prevent word-splitting and globbing errors).
• Command substitution: Capture command output into a variable: `RESULT=$(command)`.
• Conditionals: `if [ condition ]; then ... fi`. Use `-eq`, `-gt`, `-lt` for integers; `-z` for empty string; `-f` for file existence.
• Loops: `while read -r line; do ... done < file` processes a file line by line safely.
• Functions: Group reusable logic and call it by name.
• Exit codes: Every command returns 0 (success) or non-zero (error). Test with `$?` or inline with `if command; then`.

Safe Scripting Practices

Poor scripting habits create security vulnerabilities. Follow these rules:

1. Always quote variables. Unquoted variables containing spaces or special characters cause unexpected behavior and can be exploited.

2. Validate input. If your script accepts arguments, check that the expected argument exists and is the correct type before using it: `if [ -z "$1" ]; then echo "Usage: $0 <logfile>"; exit 1; fi`.

3. Use `sudo` only where necessary. Reading `/etc/shadow` requires elevated privilege. Request it explicitly for that command rather than running the entire script as root.

4. Avoid storing credentials in scripts. Never hard-code passwords or API keys.

5. Restrict output file permissions. Reports containing account data are sensitive. Set permissions with `chmod 600 reportfile.txt` immediately after creation.

6. Test in a non-production VM. The lab machines for this course are isolated VMs. Never run untested scripts on production systems.

Auditing User Accounts

Three system files power user auditing:

• `/etc/passwd` — one line per account; field 3 is the UID. A UID of 0 means root-level privilege. Any account besides `root` with UID 0 is a serious finding.
• `/etc/shadow` — field 2 holds the password hash. An empty field (`::`) or a `!` or `*` prefix indicates the account has no usable password (locked or never set).
• `lastlog` — the command outputs the last login time for every account. Accounts showing Never logged in may be stale and should be reviewed.

Use `awk -F: '$3 == 0 {print $1}' /etc/passwd` to extract UID-0 accounts. Use `sudo awk -F: '$2 == "" {print $1}' /etc/shadow` to find accounts with no password hash.

Parsing Log Files

`/var/log/auth.log` (Debian/Ubuntu) records authentication events. Failed SSH logins appear as lines containing `Failed password`. The source IP address follows the word `from`.

Pipeline pattern:

```

grep "Failed password" "$LOGFILE" | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn

```

Breaking it down: `grep` filters matching lines; `awk` extracts the IP field (position varies by log format — verify against a real sample); `sort` prepares for deduplication; `uniq -c` counts consecutive identical lines; the final `sort -rn` ranks by count descending.

Accept the log path as `$1` so the script is reusable against any log file.

Conditional Firewall Actions

Extending the log parser to take action is the core of automated threat response. Set a threshold variable at the top of the script: `THRESHOLD=${2:-10}` (uses the second argument if provided, otherwise defaults to 10). After ranking, loop through results and compare each count to the threshold:

```bash

while read -r count ip; do

if [ "$count" -gt "$THRESHOLD" ]; then

sudo ufw deny from "$ip"

echo "$(date --iso-8601=seconds) BLOCKED $ip ($count attempts)" >> audit.log

fi

done

```

`ufw deny from` adds a firewall rule blocking all traffic from that IP. Logging the action with a timestamp creates an audit trail — essential for incident response documentation and compliance.

Running and Verifying Scripts

After writing each script, test it with known data before using it on real systems. Your instructor supplies a sample `auth.log` designed to trigger specific outputs — use it to verify correctness. Check syntax without executing with `bash -n scriptname.sh`. Use `set -x` at the top during debugging to print each command as it runs, then remove it before submission.