cschantz/Linux-Server-Management-Toolkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Move baseline storage to toolkit directory

Browse Source 
Issue: Baseline was stored in /var/lib/suspicious-login-monitor/ which
is outside the toolkit directory structure. When toolkit is deleted,
baseline data would remain on system.

Changes:
- Changed BASELINE_DIR from /var/lib/suspicious-login-monitor to
  $TOOLKIT_ROOT/data/suspicious-login-monitor
- Migrated existing baseline.dat to new location
- Removed old /var/lib/suspicious-login-monitor directory

Result: All toolkit data now contained within toolkit directory.
When toolkit is deleted, baseline is removed automatically.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
cschantz
2026-02-03 16:22:49 -05:00
parent 988cb7ef14
commit b9c9a058ba
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/suspicious-login-monitor/baseline.dat
+8
View File
@@ -0,0 +1,8 @@
# Baseline data for suspicious login monitor
# Last updated: Tue Feb 3 04:04:53 PM EST 2026
BASELINE_SSH_KEY_COUNT=1
BASELINE_USER_COUNT=3
BASELINE_TYPICAL_LOGIN_HOURS="16"
BASELINE_PASSWORD_CHANGES_PER_WEEK=0
BASELINE_NEW_USERS_PER_WEEK=0
BASELINE_LAST_UPDATE=1770152693
modules/security/suspicious-login-monitor.sh
+2 -2
View File
@@ -49,8 +49,8 @@ PANEL_EVENTS="$TMP_DIR/panel_events_$$.txt"
SUDO_EVENTS="$TMP_DIR/sudo_events_$$.txt" SUDO_EVENTS="$TMP_DIR/sudo_events_$$.txt"
SUSPICIOUS_IPS="$TMP_DIR/suspicious_ips_$$.txt" SUSPICIOUS_IPS="$TMP_DIR/suspicious_ips_$$.txt"
# Baseline storage (persistent across runs) # Baseline storage (persistent across runs, within toolkit directory)
BASELINE_DIR="/var/lib/suspicious-login-monitor" BASELINE_DIR="$TOOLKIT_ROOT/data/suspicious-login-monitor"
BASELINE_FILE="$BASELINE_DIR/baseline.dat" BASELINE_FILE="$BASELINE_DIR/baseline.dat"
mkdir -p "$BASELINE_DIR" 2>/dev/null mkdir -p "$BASELINE_DIR" 2>/dev/null