checkmk local check for checking that the console hasn't been left logged in

check_idle_console

#!/bin/bash
# check_idle_console - report on root capable interfaces with long sessions
# Purpose:
# This script tries to ensure that people don't leave ilo's logged in as root
# Author:       Rawiri Blundell
# Copyright:    See provided LICENCE file
###############################################################################
# Source the config mapping library
# Provides variables "${thisHost}", "${thisJob}" and
# positional parameters as "${arg1}" "${arg2}" etc.
# It also provides the functions printDebug, printOK, printWarn and printCrit
if [[ ! -r /opt/checkmk/lib/libconfmap.sh ]]; then
  printf '%s\n' "3 ${0##*/} - libconfmap.sh not readable"
  exit 0
else
  # shellcheck disable=SC1091
  . /opt/checkmk/lib/libconfmap.sh
fi
########################################

# Define our thresholds.
# By default, we Warn on 1 hour, Crit on 3
warnThres="${arg1:-1}"
critThres=${arg2:-3}

# Convert our thresholds from hours to seconds
warnThres=$(( warnThres * 60 * 60 ))
critThres=$(( critThres * 60 * 60 ))

# Default the following vars
critCount=0; warnCount=0; okCount=0

# This check relies on the existence of /etc/securetty
if [[ -r /etc/securetty ]]; then
  printDebug -x "/etc/securetty not found on ${thisHost}"
fi

# We simply dump out the interface column of 'who' and grep it
# using /etc/securetty as a source of potential interfaces
# /etc/securetty defines the interfaces that 'root' can login to
# Typically we would see 'tty1' or 'console', but others may exist

if who | awk '{print $2}' | grep -qf /etc/securetty; then
  while read -r username term_interface datestamp timestamp remote_host; do
    # If possible, we try to detect when the interface was last used
    if [[ -e /dev/"${term_interface}" ]]; then
      idle_start=$(stat -c %Y /dev/"${term_interface}")
    # Otherwise we convert the login time to epoch
    else
      idle_start=$(date -d "${datestamp} ${timestamp}" +%s)
    fi

    # Get our current epoch time
    curEpoch=$(date +%s)

    # Go through our comparisons and store our findings
    if (( (idle_start + critThres) < curEpoch )); then
      (( critCount++ ))
      critLine="${remote_host}/${username} is idle on ${term_interface}"
      critArray+=( "${critLine}" )
    elif (( (idle_start + warnThres) < curEpoch )); then
      (( warnCount++ ))
      warnLine="${remote_host}/${username} is idle on ${term_interface}"
      warnArray+=( "${warnLine}" )
    else
      (( okCount++ ))
      okLine="${remote_host}/${username} is active on ${term_interface}"
      okArray+=( "${okLine}" )
    fi
  done < <(who | grep -f /etc/securetty)
  
  # Now determine criticality and act
  if (( critCount >= 1 )); then
    printCrit "${critArray[@]}" "${warnArray[@]}" "${okArray[@]}"
  elif (( warnCount >= 1 )); then
    printWarn "${warnArray[@]}" "${okArray[@]}"
  else
    printOK "${okArray[@]}"
  fi
else
  printOK "No idle console sessions found."
fi