Alerting on privileged logins to a cluster manager
A small service that emails the security team the moment an admin signs in, and keeps an audit trail.
My contribution
Sole author
Tools used
- Python
- systemd
- SMTP
- Cloudera Manager logs
DetailsSole author
On a sensitive platform, an administrator signing in to the cluster manager is something the security team should hear about straight away.
- A Python daemon follows the Cloudera Manager server log and keeps its file position in a state file, so a restart doesn’t re-send old alerts. It also detects log rotation and truncation.
- On a successful admin login it sends an email alert (multiple recipients, optional STARTTLS).
- Every event, including whether the email succeeded, is appended to a CSV audit trail that reviewers can open without extra tooling.
- Ships with install and uninstall scripts, a systemd unit that restarts on failure, a configuration template and a test script for the matching pattern.
Domains Security & governance · Observability & reliability
Code Not linked. The repository still contains client references and needs cleaning up first.