Collection overview
These scripts turn manual terminal checks into focused tools with predictable output. They are intentionally small and standalone: each script solves one administration problem, handles expected failure cases, and can be run directly with Python 3 on a Linux host.
| Script | Operational use | Primary implementation skills |
|---|---|---|
| ping_test.py | Separate gateway, remote-network, and DNS failures | subprocess, sockets, route parsing, timeouts |
| system_report.py | Capture a repeatable Linux host inventory | system interfaces, regex, CIDR math, file output |
| shortcut.py | Create, remove, and report on symbolic links safely | pathlib, filesystem traversal, validation, type hints |
| attacker_report.py | Identify repeated failed-login sources in a syslog export | regex, Counter, thresholding, optional GeoIP |
01 / Network diagnostics
Network connectivity tester
ping_test.py provides a menu for checking the default route, local gateway reachability, remote IP reachability, and DNS name resolution. The checks are separated so the result points toward the failed layer instead of returning only a generic “network unavailable” message.
- Usage Diagnose whether a Linux host has a route, can reach its gateway, can reach a remote network, and can resolve and contact a hostname.
- Implementation A reusable run() wrapper executes argument lists with captured output and timeouts. The script parses ip r for the default gateway, calls ping without a shell, and uses socket.gethostbyname() for IPv4 resolution.
- Output Displays the underlying command output and reduces the return code to a clear SUCCESS or FAILED status while still showing the technical evidence.
02 / System inventory
Linux system inventory report
system_report.py gathers network, operating system, storage, processor, and memory information into one timestamped report. It is useful for documenting a VM before troubleshooting or recording the state of a host after configuration.
- Usage Produce a concise baseline containing the hostname, domain suffix, IPv4 address, netmask, gateway, DNS servers, OS and kernel, root-disk capacity, CPU data, and RAM.
- Implementation Individual functions read Linux interfaces including /etc/resolv.conf, /etc/os-release, and /proc/cpuinfo, while commands such as ip, df, free, and uname supply runtime data. The prefix_to_mask() function converts a CIDR prefix into dotted-decimal form with bit operations.
- Output Prints a labeled report and writes <hostname>_system_report.log to the user’s home directory, falling back to /tmp if the first write fails.
03 / Filesystem automation
Symbolic-link manager
shortcut.py wraps symbolic-link operations in a menu-driven interface. It can create a Desktop link to an existing file, delete a selected Desktop link, and report on links found on the Desktop and throughout the current user’s home directory.
- Usage Manage common symbolic-link tasks without manually constructing ln, find, and unlink commands.
- Implementation The script uses pathlib.Path for path handling, os.symlink() and os.readlink() for link operations, and os.walk(..., followlinks=False) to count links without recursively following them.
- Safety controls It verifies that the target exists, asks before replacing a same-named Desktop item, refuses to overwrite a real directory, lists only symbolic links for deletion, validates numeric menu choices, and handles Ctrl+C cleanly.
04 / Security log analysis
Failed-login source analyzer
attacker_report.py reads an exported syslog, extracts IPv4 sources from failed SSH password messages, counts attempts by source, and reports only addresses that meet a ten-attempt review threshold.
- Usage Reduce a long authentication log into a short list of repeat sources that deserve investigation, with the report date and attempt count preserved.
- Implementation A compiled regular expression extracts the address following Failed password ... from. collections.Counter aggregates attempts, a list comprehension applies the threshold, and a deterministic sort orders the output by count and IP.
- Enrichment and failure handling GeoIP lookup is optional: the script enables country information when the module is available and reports Unknown otherwise. It also exits with a clear message when syslog.log is missing.
Shared engineering practices
- Split each tool into small functions with a single responsibility.
- Passed command arguments as lists instead of building shell command strings.
- Preserved technical evidence while also producing readable success, inventory, or report output.
- Handled missing commands, files, paths, permissions, DNS responses, and optional packages without uncontrolled tracebacks.
- Used standard-library modules where possible so the tools remained portable across similar Linux hosts.
What I would improve
The scripts work as focused learning tools, but I would make the next version easier to test and reuse. I would replace hard-coded targets, filenames, and thresholds with argparse options; narrow broad exception handlers; add IPv6 and multi-interface support; and produce JSON or CSV alongside terminal output.
I would also add automated tests using mocked subprocess results, temporary filesystems, and authentication-log fixtures. For the log analyzer, I would validate addresses with ipaddress, support multiple SSH failure formats, cache GeoIP results, and make the review threshold configurable.