Fast Network Discovery

The Need for Speed in Network Scanning

In network administration and security testing, quickly identifying active hosts on a subnet is a frequent requirement. While advanced tools offer comprehensive analysis, sometimes a simple, command-line solution is needed for rapid inventory and troubleshooting. The goal is efficiency and minimal overhead.

The ipsweep.sh script, available on GitHub, is designed specifically for this purpose. It provides a lightweight, effective method for performing a ping sweep across a local network using only standard operating system utilities.

How This Script Accelerates Scanning

This specialized Bash script speeds up network discovery by utilizing parallel execution. Rather than checking network addresses one by one in sequence, the tool performs concurrent ping requests to every potential host within the specified subnet simultaneously. This method significantly reduces the time required for a complete network sweep.

Key Functions and Benefits:

*    Parallel Execution: By running checks in the background, the script drastically cuts down the total time required for the sweep, allowing for near-instantaneous discovery of live hosts.

*    Active Host Identification: The core function uses the standard ping command to send ICMP requests and identify which IP addresses are actively responding on the network.

*    Automatic Hostname Resolution: A critical utility feature is the inclusion of a reverse DNS lookup (nslookup) for every active IP. This translates cryptic IP addresses (e.g., 192.168.1.109) into human-readable hostnames (e.g., My-Workstation or router.local), greatly improving the utility of the scan results.

*    Low Dependency: The script relies only on utilities that are standard across most Unix-like environments (Linux, macOS): bash, ping, and nslookup.

Getting Started: Deploying the Script

To integrate ipsweep.sh into your toolkit, follow these straightforward steps:

1. Obtain the Script

The script can be obtained by cloning the Git repository:

git clone https://github.com/2bitninja/ipsweep.git

2. Prepare for Execution

Navigate to the repository directory and ensure the script has the correct permissions:

cd ipsweep
chmod +x ipsweep.sh

3. Execute the Scan

Run the script by supplying the first three octets of the target subnet (e.g., for the range 10.0.0.1 to 10.0.0.254):

./ipsweep.sh 10.0.0

The script will output a clean, two-column list detailing the active IP addresses and their resolved hostnames:

These are the active IP Address for 192.168.1

IP Adress Hostname
==========================
192.168.1.1    router.asus.com.
192.168.1.104    Samsung.
192.168.1.128
192.168.1.136
192.168.1.137     Joel.
192.168.1.143     MacBook-Pro.
192.168.1.169
192.168.1.211
192.168.1.36

Summary

ipsweep.sh is a valuable, minimalist tool for network auditing and troubleshooting. Its combination of speed, simplicity, and automatic hostname resolution makes it an efficient utility for anyone needing to quickly map out the active devices on a local network.

For further details and to view the source code, please visit the repository:

View the ipsweep repository on GitHub

Taming Runaway tmux Sessions and Keeping Your Scans Smooth

This post tackles a common issue encountered during vulnerability scans with Tenable.sc (formerly Security Center). It addresses the problem of lingering tmux sessions that can hinder login attempts and system responsiveness.

The Problem

Recently, a critical plugin (21745) triggered on a Red Hat Enterprise Linux 8 (RHEL 8) system during a Tenable.sc scan. The scan user account wasn't locked out, but SSH login attempts hung indefinitely despite system logs showing a successful login. A reboot temporarily resolved the issue, but it kept reoccurring.

The Culprit: Unclosed tmux Sessions

Tenable.sc leverages tmux, a terminal multiplexer, to manage multiple connections during a scan. When a connection is established, tmux typically creates a session. The problem arose when these tmux sessions weren't being automatically closed after the scan completed. This led to a situation where the scan user ended up with thousands of orphaned sessions, causing login issues.

Fixing the Runaway Sessions

1. Automatic Cleanup

• Edit the system-wide tmux configuration file ( /etc/tmux.conf ).
• Add the line set -g destroy-unattached on to the configuration file. This instructs tmux to automatically terminate any sessions that are not actively in use.
• To implement this change:

scanuser@remotesystem> sudo echo "set -g destroy-unattached on" >> /etc/tmux.conf

2. User-Specific Control (Optional)

• This approach allows tmux usage only for the designated scan user ( scanuser ). 
• Create a custom shell script ( /etc/profile.d/custom.sh ) with the following content:

[ "$USER" != "scanuser" ]
 then if [ "$PS1" ]
   then parent=$(ps -o ppid= -p $$)
        name=$(ps -o comm= -p $parent) 
        case "$name" in (sshd|login) exec tmux
        esac 
 fi 
fi 

This script checks the current user and only allows tmux execution if the user is "scanuser" and the parent process is either "sshd" (SSH daemon) or "login" (login shell).

Understanding the Tools

tmux: An open-source terminal multiplexer that allows managing multiple terminal sessions within a single window. You can split your terminal into different panes, detach from sessions, and reattach later, similar to the "screen" application.

Tenable Plugin 21745: This is an informational plugin that gathers and displays information from other plugins, triggered in this instance due to potential login failures.

Additional Resources

• Tmux Cheat Sheet & Quick Reference: https://tmuxcheatsheet.com/
• A beginner's guide to tmux: https://www.redhat.com/en/blog/introduction-tmux-linux

By implementing these solutions, you can ensure that your Tenable.sc scans run smoothly without encountering issues caused by lingering tmux sessions.

Login hangs for scanning account

The Problem

I ran into this issue the other day. Tenable.sc (formerly Security Center) was reporting a hit on plugin 21745 for a Red Hat Enterprise Linux 8 (RHEL 8) system. I checked on the account used on the systems for scanning and it wasn't locked out or anything. When I tried to SSH into the system with the credentials, it would just hang. The system logs showed "login successful". When I rebooted the system was able to login normally again, but the problem would come back eventually.

The Cause

When the Nessus scanner connects to a system, it's scanning, it makes several connections to the host. Each connection starts a TMUX session. The problem is the TMUX sessions where not being closed after the Nessus scanner disconnected from the system. It turned out that the account used for security scanning had around 2,000 TMUX sessions running.

The Fix

Add "set -g destroy-unattached on" to the /etc/tmux.conf file.

scanuser@remotesystem> sudo echo "set -g destroy-unattached on" >> /etc/tmux.conf

This will append this line "set -g destroy-unattached on" into the /etc/tmux.conf configuration file. This will auto close sessions not being actively used.

Anther Fix

Set system wide rules for TMUX on the effected systems so only the account used by the Nessus scanner will have use of the TMUX terminal multiplexer. /etc/profile.d/custom.sh

[ "$USER" != "scanuser" ]
 then if [ "$PS1" ]
   then parent=$(ps -o ppid= -p $$)
        name=$(ps -o comm= -p $parent) 
        case "$name" in (sshd|login) exec tmux
        esac 
 fi 
fi 

Defs

TMUX is an open-source terminal multiplexer for Unix type systems. Multiple terminal sessions can be accessed simultaneously by splitting the terminal into different screens. Can also detach remote sessions and reattach later, similar to what the screen application can do.

 
Tenable Plugin a plugin is a script deployed by the Nessus scanner to check for security vulnerabilities. In this case plugin 21745 is an info plugin, it displays info from other plugins. This plugin is triggered (displayed) whenever a login failure occurs.

Other useful links

Tmux Cheat Sheet & Quick Reference
https://tmuxcheatsheet.com/
A beginner's guide to tmux
https://www.redhat.com/sysadmin/introduction-tmux-linux

Tape Format Script for Tape Pickup

The other day my co-worker showed me how to send our tapes offsite. Apparently you need to format the list of tapes in a certain way. So you can input the info to the Iron Mountain site for pickup. He was going though several steps to change the format in Excel. I told myself there has to be a better way, so wrote a script shown below.

First you need to put all the tapes in a list. I put the tape list in the file called list shown in the example below. Then I run the script, I created (tape-input.sh). I take the output and paste it into the web portal.


list

U00010L5
U00011L5
U00012L5
U00013L5
U00014L5
U00015L5
U00016L5
U00017L5
U00018L5
U00019L5
U00020L5
U00021L5
U00022L5
U00023L5
U00024L5
U00025L5
U00026L5
U00027L5
U00028L5
U00029L5
U00030L5 CAT

tape-input.sh

#!/bin/bash
# Created to format the tapes numbers to add to the web portal
echo -e "Packaged by man, $(date|awk '{print $2" "$3" "$6}')"

cat list |sed ':a;N;$!ba;s/\n/, /g'| perl -pe 's{,}{++$n % 3 ? $& :"\n"}ge'

man@earth> ./tape-input.sh
Packaged by man, Dec 13 2018
U00010L5, U00011L5, U00012L5
U00013L5, U00014L5, U00015L5
U00016L5, U00017L5, U00018L5
U00019L5, U00020L5, U00021L5
U00022L5, U00023L5, U00024L5
U00025L5, U00026L5, U00027L5
U00028L5, U00029L5, U00030L5 CAT

I take the output and paste it into the Iron Mountain web portal for pickup.

I hope this helps someone out. If you have any questions please ask below.

Remotely Login & Run Commands on ILOMs

Logging into Oracle's Integrated Lights Out Manager (ILOM) to get info can be a real pain, so I wrote this script to do it for me. Normally one would use use Simple Network Management Protocol (SNMP) or Intelligent Platform Management Interface (IPMI), but due to security concerns I was not able to use either of these options. Even with the latest firmware installed the ILOMs would not support modern security practices. So I was forced to find anther way. I needed to write a script that would wait for a prompt and then fill it in for me. Expect an extension to the Tcl scripting language is great for this kind of stuff, but I decided to use HERE which is even easier.

In order to make this work I created the user mancnt on the local system and on all the ILOMs. I also created a SSH key and setup an SSH agent on the local system and then I copied the key over to the ILOMs. If you don't know how to setup SSH keys check out my last post on how to do it  "A Better Way to Setup SSH Keys". You will also need a file containing the hostnames of the ILOMs you want access. In the example script below I use two such files, lsILOMb and lsILOMc, one for the blades and one for the chassis.

#!/bin/bash
#
# This section is for the ILOM blades
 HERE-ILOM(){
ssh $1 2>/dev/null <show /SP/network macaddress
HERE
}
# This section is for the ILOM Chassis
HERE-ILOMc(){
ssh $1 2>/dev/null <show /CMM/network macaddress
HERE
} 

# To get IP address from hostname
Ping-to-IP(){
ping -c1 $1 |grep PING|awk '{print $3}'|sed -e 's/(//' -e 's/)//'
}

# Main section
ps aux|grep manacnt|grep -v grep |grep agent &>/dev/null || echo "Need to have an agent running"

# Section for ILOMs on Oracle Blades
for s in $(cat lsILOMb)
do echo -e "$(Ping-to-IP $s),$(HERE-ILOM $s),Embedded Linux,$s"
done

# Section for ILOMs on Oracle Chassis
for s in $(cat lsILOMc)
do echo -e "$(Ping-to-IP $s),$(HERE-ILOMc $s),Embedded Linux,$s,FALSE,ILOM,N611"
done

So the script generates a comma-separated values (CVS) file, which contains the IP address, MAC address, OS, and hostname. I then give this file to the network security people.

Example output: 10.0.1.20,00:10:e0:40:c2,Embedded Linux,server-ilom

If you have any questions feel free to ask them below.

Free Python Books

Hello, I ran across some free books on Python and I thought I would share them with you. These books are written by Al Sweigart, who has made the books available under the Creative Commons License. So the books are free and legal for you to read and download. Click on the image of the book to go to the site hosting the free book.

The link below is the main site the books are on and there are also some free videos. There is also some online courses as well.
http://inventwithpython.com/




You can also get some free Python from Amazon as well. Use this link, to to see a list of Python books sorted by price, from low to high. These are kindle books that can also be read online with the kindle cloud player, if you don't have a kindle.

Turn a list into a CSV file

Hello today I'm showing you two simple ways to turn a list into a comma separated (CSV) output. This is helpful if you need to import the output into a spreadsheet. You can do this one of two ways, with a BASH for loop or with SED.

We are going to use list.txt which is a small list of solar objects for this example. 

list.txt

earth
moon
mars
venus
saturn

BASH Script

for s in $(cat list.txt)
do echo -en "$s, "
done

-note - if you don't want spaces or commas use "$s" instead

man@earth> ./BASHscript
earth, moon, mars, venus, saturn,

SED Script

cat list.txt |  sed ':a;N;$!ba;s/\n/, /g'

As you can see the SED statement is much shorter.

man@earth> ./SEDscript
earth, moon, mars, venus, saturn,

I hope someone out there finds this useful. If you have any questions or comments please post them below.

Rename & Combine Audio Book files into one audio book.

I like to listen to audio books and I get them them from places such as Audible, books on CD, the library or LibriVox. The issue is that all these places present the files to you in different ways. You can get one big file or a lot of small files. They all use different naming conventions which can make organizing your books difficult. To play my audio books I use the iBooks app from Apple and the Audible app form Audible, on my iPod Touch. Apples iBooks app works well but is missing some features that the Audible app has such as the bookmarking feature. The Audible app is really bad at playing books that are broken up into several files. The app will play the files out of order or show each file as a separate book.

So to fix the issues described above I recommend that you rename and/or combine all the files from one book into one file. Below I show the BASH script I wrote to fix this issue. I wrote and tested this script on a Mac. This script will also work on Linux and UNIX operating systems. After the files are combined the finder didn't show the right length for the audio book but when I imported the file into iTunes everything displayed right and the file worked fine.

The script below shows how to combine several MP3 files into one file. I put a comment after each command explaining what it is doing. If you have any questions about the script below ask it in the the comment section below.

script-book

Put contents of files here

#!/bin/bash
# This script was created on 20170216
# This script was created to combine MP3 files form audio books into one file.
# usage ./script-book bookname
#
if [ -z "$1" ]
  then
    echo -e "Please rerun the script with desired file name at the end \n 
              Example: ./script-book bookname"
    exit 1
fi

# The if statement checks for $1 variable. 

# If no variable is present then the gives error message and exits 

for s in $(ls |grep .mp3|egrep -v '(png|jpg)'|awk '{print $NF}')
# egrep removes pictures
# $NF gives the last column in the file name. This removes the spaces in the name.
do mv *$s $1$s
# This renames the files
cat *$s >> $1.mp3
# Cat combines the files
rm *$s
# Removes old files
done
ls -lh

In order to make the script work, copy it into the same directory the audio books files are located in. In the example below the script is called script-book and the ls command shows the script in the same directory as the audio book files.

man@earth> ls
The Hot Gate 001.mp3    The Hot Gate 021.mp3    The Hot Gate 041.mp3
The Hot Gate 002.mp3    The Hot Gate 022.mp3    The Hot Gate 042.mp3
The Hot Gate 003.mp3    The Hot Gate 023.mp3    The Hot Gate 043.mp3
The Hot Gate 004.mp3    The Hot Gate 024.mp3    The Hot Gate 044.mp3
The Hot Gate 005.mp3    The Hot Gate 025.mp3    The Hot Gate 045.mp3
The Hot Gate 006.mp3    The Hot Gate 026.mp3    The Hot Gate 046.mp3
The Hot Gate 007.mp3    The Hot Gate 027.mp3    The Hot Gate 047.mp3
The Hot Gate 008.mp3    The Hot Gate 028.mp3    The Hot Gate 048.mp3
The Hot Gate 009.mp3    The Hot Gate 029.mp3    The Hot Gate 049.mp3
The Hot Gate 010.mp3    The Hot Gate 030.mp3    The Hot Gate 050.mp3
The Hot Gate 011.mp3    The Hot Gate 031.mp3    The Hot Gate 051.mp3
The Hot Gate 012.mp3    The Hot Gate 032.mp3    The Hot Gate 052.mp3
The Hot Gate 013.mp3    The Hot Gate 033.mp3    The Hot Gate 053.mp3
The Hot Gate 014.mp3    The Hot Gate 034.mp3    The Hot Gate 054.mp3
The Hot Gate 015.mp3    The Hot Gate 035.mp3    The Hot Gate 055.mp3
The Hot Gate 016.mp3    The Hot Gate 036.mp3    The Hot Gate 056.mp3
The Hot Gate 017.mp3    The Hot Gate 037.mp3    The Hot Gate 057.mp3
The Hot Gate 018.mp3    The Hot Gate 038.mp3    The Hot Gate 058.mp3
The Hot Gate 019.mp3    The Hot Gate 039.mp3    The Hot Gate 059.mp3
The Hot Gate 020.mp3    The Hot Gate 040.mp3    script-book

Note- Make sure the script is executable before you run the command as shown below. Alternately you can also run the script by bash before the command if you don't know how to make the script executable. Example: bash ./script-book bookname

In the example below the I show how to execute the script and show example output. This shows that the script combined the files listed above and named the file TheHotGate and removed all the old unneeded files.

man@earth> ./script-book TheHotGate
total 447744
-rw-r--r--  1  arich   staff    219M  Feb 20 11:34    TheHotGate.mp3
-rw-r--r--  1  arich   staff    624B   Feb 20 11:33    script-book

I hope this helps anyone who is having a similar issue.


Links to places to get audio books.

LibriVox

             Audible

Latest Scripts for finding Java

I have in the past posted my script for finding instances of Java, on the servers I manage. I have since updated the script to I posted on this blog. You can still see the old script on this blog under the title "Checking Java Versions Remotely". My method of finding all the versions of Java on all the servers, consists of running two scripts. One script called check-java acts as a manager for the other script and gathers all the data into a nice report. The other script called stig-java does the actual work of finding Java on the target system.

In order for this script to work you will need to setup your SSH clients for auto login. If you don't know how to do this please refer to my post How to setup SSH Keys. This script doesn't need the automount in order to work.

What the scripts does.

First off you need to put both scripts in the same location. I put the scripts in the home directory in a folder called scripts. The main script, check-java copies the stig-java script to /tmp on all the servers. Then logs into all the servers, one at a time, and runs the stig-java script and sends the output to a file with the server's name. The check-java script then deletes stig-java form /tmp on all the servers. All those output files are then combined into a single file with extra lines removed.

The scripts have been test on Solaris 10, Red Hat 5 & 6 (RHEL) and SLES 11 and they work fine. On the Mac the colors don't work.

The check-java script

#!/bin/bash
# This script is for running the stig-java script on the servers.

SP=$(uname -n)

### Copy files section
echo -e "\e[1m Coping files \033[0m"
for host in $(cat COOP SOL SLES )
  do if  [ $host == $SP ]
        then cp ~/scripts/stig-java3 /tmp/stig-java3 2>/dev/null
        else scp -q stig-java $host:/tmp &>/dev/null
     fi
done
for host in $(cat ACAS RHEL)
do scp -q stig-java $host:/var/tmp
done
for host in $(cat TD)
do scp -q stig-java3 $host:/tmp &>/dev/null
done
echo -e "\e[1m                 Done copying files \033[0m \n"

### Running the stig-java script section
echo -e "\e[1mLooking for Java on Solaris Servers\033[0m "
echo "-------------------------------------------------"
for s in $(cat COOP SOL)
do echo -e "Checking $s "
ssh -qt $s /usr/local/bin/sudo /tmp/stig-java &> ~/scripts/outputJ/sol/$s
done
echo -e "\n\e[1mLooking Java on RHEL Servers\033[0m "
echo "-------------------------------------------------"
for r in $(cat ACAS RHEL)
do echo -e "Checking $r "
ssh -qt $r /usr/bin/sudo ~/scripts/stig-java &> ~/scripts/outputJ/rhel/$r || ssh -qt $r /usr/bin/sudo /var/tmp/stig-java &> ~/scripts/outputJ/rhel/$r
done
echo -e "\n\e[1mLooking Java on SLES Servers \033[0m "
echo "------------------------------------------------"
for l in $(cat SLES)
do echo -e "Checking $l "
  if [ $l == $SP ]
    then sudo ~/scripts/stig-java &> ~/scripts/outputJ/sles/$SP
    else
ssh -qt $l /usr/bin/sudo /tmp/stig-java &> ~/scripts/outputJ/sles/$l || ssh -q $l /usr/bin/sudo /tmp/stig-java &> ~/scripts/outputJ/sles/$l
  fi
done
echo -e "\n\e[1mLooking Java on Teradata Servers \033[0m "
echo "------------------------------------------------"
for t in $(cat TD)
do echo -e "Checking $t "
ssh -qt $t /usr/bin/sudo /tmp/stig-java3 &> ~/scripts/outputJ/td/$t || ssh -q $t /usr/bin/sudo /tmp/stig-java3 &> ~/scripts/outputJ/td/$t
ssh -q $t rm /tmp/stig-java3
done

# Clean Up
echo "Deleting tmp files"
for host in $(cat COOP SOL ACAS RHEL SLES)
do if [ $l == $SP ]
then rm /tmp/stig-java 2>/dev/null
else
ssh -q $host rm /tmp/stig-java 2>/dev/null ||ssh -q $host rm /var/tmp/stig-java
   fi
done
echo " "

# Finishing up
cat ~/scripts/outputJ/sol/*  > ~/scripts/outputJ/solM
cat ~/scripts/outputJ/rhel/*  > ~/scripts/outputJ/rhelM
cat ~/scripts/outputJ/sles/*  > ~/scripts/outputJ/slesM
cat ~/scripts/outputJ/td/*  > ~/scripts/outputJ/tdM

echo -e "\e[1m ------------------------ Solaris Servers -------------------------  \033[0m\n" > ~/scripts/outputJ/output
cat ~/scripts/outputJ/solM >> ~/scripts/outputJ/output
echo -e "\e[1m ------------------------ RHEL Servers -------------------------  \033[0m\n" >> ~/scripts/outputJ/output
cat ~/scripts/outputJ/rhelM >> ~/scripts/outputJ/output
echo -e "\e[1m ------------------------ SLES Servers -------------------------  \033[0m\n" >> ~/scripts/outputJ/output
cat ~/scripts/outputJ/slesM >> ~/scripts/outputJ/output
echo -e "\e[1m ------------------------ Teradata Servers -------------------------  \033[0m\n" >> ~/scripts/outputJ/output
cat ~/scripts/outputJ/tdM >> ~/scripts/outputJ/output

egrep -v "(1.8.0_${1}|1.7.0_${2}|1.6.0_${3}|1.8.0.${4}|1.7.0.${5}|1.6.0.{6})" outputJ/output|more

The stig-java script

#!/bin/bash
# This script is for finding versions of Java on a server.
#
DATE=$(date)
echo -e "\e[1;34m <<<<<<<<<<<<<<<<<<<< $(uname -n)  >>>>>>>>>>>>>>>>>>>\e[0m "
echo -e "Last scanned on $DATE"

### Find Java Section
for s in $(find / \( -name 10_Recommended* -o -name scratch -o -name zones -o -name mnt \) -prune -o -type f -name java -print 2>/dev/null)
do ee=$($s -fullversion 2>&1 |awk '{print $4}' )
echo -e "\e[1m$ee\e[0m \t $s"
done
echo " "
### Find Packages Section
if [ SunOS == $(uname -s) ]
  then if [[ -z $(pkginfo |grep SUNWj[3-8]) ]]
then echo -e "\e[1mNo Java packages found\e[0m"
else echo -e "\e[1mPackages found:\e[0m \n$( pkginfo |grep SUNWj[3-8])"
fi
  else if [[ -z $( rpm -qa |egrep '(jdk|jre)' ) ]]
 then echo -e "\e[1mNo Java packages found\e[0m"
 else echo -e "\e[1mPackages found:\e[0m \n$( rpm -qa |grep -v SYMC|egrep '(jdk|jre)' )"
        fi
fi
### Find Directories Section
if [ SunOS != $(uname -s) ]
 then DF=$( ls -d /usr/java/j*  2>/dev/null )
if [[ -n $DF ]]
  then echo -e "\e[1mDirectories found:\e[0m\n$DF" 2>/dev/null
else echo -e  "\e[1mNo directories found\e[0m"
fi
fi

### STIG Java Check List Section
if [ -e /usr/java ]
   then JCKL="Passed Java Check List"
       if [ -e  /usr/java/jre/lib/deployment.properties ] &>/dev/null
           then grep deployment.security.askgrantdialog.notinca=false /usr/java/jre/lib/deployment.properties &>/dev/null || JCKL="\e[1;31mFailed Java Check List\e[0m"
                grep deployment.security.askgrantdialog.notinca.locked /usr/java/jre/lib/deployment.properties &>/dev/null || JCKL="\e[1;31mFailed Java Check List\e[0m"
                grep deployment.security.validation.crl=true /usr/java/jre/lib/deployment.properties &>/dev/null || JCKL="\e[1;31mFailed Java Check List\e[0m"
                grep deployment.security.validation.crl.locked /usr/java/jre/lib/deployment.properties &>/dev/null || JCKL="\e[1;31mFailed Java Check List\e[0m"
                grep deployment.security.validation.ocsp=true /usr/java/jre/lib/deployment.properties &>/dev/null || JCKL="\e[1;31mFailed Java Check List\e[0m"
                grep deployment.security.validation.ocsp.locked /usr/java/jre/lib/deployment.properties &>/dev/null || JCKL="\e[1;31mFailed Java Check List\033[0m"
           else JCKL="\e[1;31mFailed Java Check List\e[0m"
        fi
        if [ -e  /usr/java/jre/lib/deployment.config ] &>/dev/null #JRE0070 V-32901 CAT II
           then grep deployment.system.config=file:/usr/java/jre/lib/deployment.properties /usr/java/jre/lib/deployment.config &>/dev/null || JCKL="\e[1;31mFailed Java Check List\e[0m"
                grep deployment.system.config.mandatory=false /usr/java/jre/lib/deployment.config &>/dev/null || JCKL="\e[1;31mFailed Java Check List\e[0m"
           else JCKL="\e[1;31mFailed Java Check List\e[0m"
        fi
   else echo -e "\e[1;34mNo System Java from Oracle Found \e[0m"
fi
echo -e "\e[1m$JCKL \e[0m"

This other script is used on the systems with spaces in the path

Put contents of files here
<<<<<<<<<<<<<<<<<<<< Linux server name  >>>>>>>>>>>>>>>>>>>
Last scanned on Thu Sep 29 13:17:30 GMT 2016
"1.8.0_101-b13"          /usr/java/jdk1.8.0_101/bin/java
"1.8.0_101-b13"          /usr/java/jdk1.8.0_101/jre/bin/java

Linux packages:
 java-1.7.0-openjdk-devel-1.7.0.111-2.6.7.2.el6_8.x86_64
java-1.7.0-openjdk-1.7.0.111-2.6.7.2.el6_8.x86_64
jdk1.8.0_101-1.8.0_101-fcs.x86_64 )
Directories found:
/usr/java/jdk1.8.0_101
Failed Java Check List

Example output

root@earth> ./check-java
<<<<<<<<<<<<<<<<<<<< Linux server name  >>>>>>>>>>>>>>>>>>>
Last scanned on Thu Sep 29 13:17:30 GMT 2016
"1.8.0_101-b13"          /usr/java/jdk1.8.0_101/bin/java
"1.8.0_101-b13"          /usr/java/jdk1.8.0_101/jre/bin/java

Linux packages:
 java-1.7.0-openjdk-devel-1.7.0.111-2.6.7.2.el6_8.x86_64
java-1.7.0-openjdk-1.7.0.111-2.6.7.2.el6_8.x86_64
jdk1.8.0_101-1.8.0_101-fcs.x86_64 )
Directories found:
/usr/java/jdk1.8.0_101
Passed Java Check List

Let me know if this script is helpful in anyway. If you need more details or have questions let me know, by posting below

Create user account and set password with one command

I often see forum posts where a System Administrators, wants to create local user accounts on several servers and doesn't want to have to have to set the user's password over and over again. Below I share two ways to do this. The first way creates the user account and sets the password in one command. The second method sets the password in a additional command. Ether way can be used in a script, which can speed things up if you need to create one or more accout on servel systems.

Below is an example of creating a user account.

root@earth> useradd -u 25 -g staff -G ftp,users -m -d /export/home/newuser -c "newuser" -s /bin/bash newuser
root@earth> passwd newuser
passwd: Changing password for username
New Password:
Re-enter new Password:
passwd: password successfully changed for newuser

This method can be very time consuming process and would be hard to use in script. Below is an example of how using the -p option in the useradd command, to set the user's password by setting the uses hash.

root@earth> useradd -u 25 -g staff -G ftp,users -m -d /export/home/newuser -c "newuser" -s /bin/bash -p '6$jbvkjjg$qFmFH.bQmmtXzyBY0s9v7Oicd2z4XSIecDzlB5KiA2/jctKu9YterLp8wwnSq.qc.eoxqOmSuNp2xS0ktL3nh/' newuser

This method works on Linux computers, such as SLES and RHEL. It however doesn't work on systems such as Solaris.

Alternately you can also set the users by echoing the password to standard in, as shown below. The major issue with doing it this way is that the password is recorded in the system logs and if your running the command remotely then your sending the password in the clear. So I don't recomend doing it this way.

root@earth> echo password | passwd newuser --stdin

This method works only Linux systems.

Other posts with similar info
Linux User Account Creation & Customization
Adding a new user to a UNIX based system

References pages.
Online man page - useradd
Online man page - passwd

Checking Java Versions Remotely

This is the script I use to find instances of Java, on the servers I manage. To do this I use two scripts, check-java and stig-java. The check-java script logs in to each server listed in the server-list file and acts  as the control for the other script. The check-java script also combines the output of the stig-java script from each server and combines the output into a single file. The stig-java script looks for Java on the servers and sends the output to a file.

I order for this script to work you will need to setup your SSH clients for auto login. If you don't know how to do this please refer to my post How to setup SSH Keys. This script doesn't needs the automount in order to work.

What the scripts do.
First off you need to put both script in the same location. Put the scripts in your home directory in a folder called scripts. The main script, check-java copies the stig-java script to /tmp on all the servers. Then logs into all the servers, one at a time, and runs the stig-java script and sends the output to a file with the servers name. The check-java script then deletes stig-java form /tmp on all the servers. All those output files are then combined into a single file with extra lines removed.


The check-java script

#!/bin/bash
# This script is for running the stig-java script on the servers.

for s in `cat  server-list`
scp stig-java $s:/tmp 2>&1 2>/dev/null
ssh -q $s /tmp/stig-java &> ~/scripts/outputJ/$s
ssh -q $s rm /tmp/stig-java
done
cat ~/scripts/outputJ/* |egrep -v '(Runtime|HotSpot)' > ~/scripts/outputJ/solM

# Finishing up
echo -e "\e[1m ------------------------ Servers -------------------------  \033[0m" > ~/scripts/outputJ/output
echo -e " "
cat ~/scripts/outputJ/solM >> ~/scripts/outputJ/output
more ~/scripts/outputJ/output

The stig-java script

#!/bin/bash
# This script is for finding versions of Java on a server.
#
host=$HOSTNAME
echo -e "\e[1m <<<<<<<<<<<<<<<<<<<<<<<<<<<<< $host >>>>>>>>>>>>>>>>>>>\033[0m "
sudo find / \( -name 10_Recommended* -o -name scratch -o -name zones -o -name mnt  \) -prune -o -type f -name java -print 2>/dev/null >/tmp/joutput
for s in `cat /tmp/joutput`
do echo -e "\e[1m  $s \033[0m "
sudo $s -version
done
echo -e " "
rm /tmp/joutput

Let me know if this script is helpful in anyway. If you need more details or have questions let me know, by posting below.

Check for a blank SSH key passphrase

I found out one of my co-workers was not using a passphrase to secure his SSH keys. This is very insecure way to do business. Many people leave passphrase blank because they do not know how to setup a SSH agent, or can't be bothered with setting up the SSH agent. If you don't know to set up a SSH agent refer to my How to setup SSH Keys post. I came up with a way to check all the accounts on the servers I manage. I wanted to know how many other people where not practicing good security. I have tested this script on Solaris 10, Red Hat Linux (RHEL 5) and SuSe (SLES 11.2).

What the script does.
The script mounts the share that all the users home directories auto-mount from.  This way the user needs not to be logged in for me to check there keys. I then copy all the names of the users home directories into a file. The script checks then checks for the word  ENCRYPTED in the id_rsa file. If the word ENCRYPTED is in the file then the passphrase is set. The temp files are then removed and the share unmounted.

This my script I came up with.

#!/bin/bash
# This script is for checking for a blank passphrase. Meaning no passphrase
to secure your SSH file.
# Script most be run as root.
# Example: sudo ./check-sshkeys

mount share:/vol/home /mnt
ls /mnt >/tmp/ls
for s in `cat /tmp/ls`
do echo -e "\e[1m User $s \033[0m "
if ls /mnt/$s/.ssh/id_rsa 2>/dev/null
        then grep ENCRYPTED /mnt/$s/.ssh/id_rsa || echo -e "No RSA
passphrase"
        else echo "RSA key not found"
fi
if ls /mnt/$s/.ssh/id_dsa 2>/dev/null
        then grep ENCRYPTED /mnt/$s/.ssh/id_dsa || echo -e "No DSA
passphrase"
        else echo "DSA key not found"
fi
done
rm /tmp/ls
umount /mnt

Draw backs
Now there are ways that a user can get around this, like putting the word ENCRYPTED in the right file. But most users will not do this, so this should still work for most users. The script above will need to be modified in order to check users who don't have their home directories auto-mounted.

I can't take all the credit for this, I had some help. Below I have posted the link to the forum were I  asked for help on this script.

Ref:
Is there a way to check a users SSH key to see if the passphrase is blank

Make Firefox load ILOM pages, Part III

This yet anther way to make Firefox load the ILOM web interface properly. Posted below is a script my co-worker wrote. Basically it adds the content to the userContent.css file via this script. This way you don't have to edit the file manually, like you had to in my other post "Make Firefaox load ILOM pages".




export PROFILE_IDZ=$(grep Path= $HOME/.mozilla/firefox/profiles.ini | awk -F={`print $2`})
export FILE4FIXZ-"~/.mozilla/firefox/${PROFILE_IDZ}/chrome"

mkdir -p ${FILE4FIXZ}
touch ${FILE4FIXZ}/userContent.css

echo "@media print {" > ${FILE4FIXZ}/userContent.css
echo "}" >> ${FILE4FIXZ}/userContent.css
echo " " >>  ${FILE4FIXZ}/userContent.css
echo "@namespace url (https:www.w3.org/1999/xhtml);" >>  ${FILE4FIXZ}/userContent.css
echo "#mainpage { visibility: visible !important; }" >>  ${FILE4FIXZ}/userContent.css

cat  ${FILE4FIXZ}/userContent.css

If you have comments please post below.

Script for checking accounts

In a perfect world all user accounts are centrally managed by a directory server such as NIS, LDAP or Active Directory. Unfortunately not all servers use accounts that are centrally managed or there are some servers that are set aside, as stand alone servers. It a can be a real pain to find out your account's password expired. Then be forced to change it before you can login. So I wrote this is a little script because I need to know when my passwords are about to expire. This way I can change my passwords on all the servers, before they expire.

I have three different operating systems at work so of course they all do this differently. In this how to I will be using examples from Solaris 10, RHEL 5 (Red Hat Enterprise Linux) and SLES 11 (SUSE Linux Enterprise Server). I created a different file, containing the server names, for each OS.

The script below logs into each server listed in the server-sol file and runs the passwd -s command and prints the output on the screen. It then runs the change -l command on the Linux servers. SUSE needs elevated privileges to run the change -l, so I add sudo to the line. The line where you see the echo statement, prints the server's name indented and in bold.

man@earth>cat check-login2
for s in `cat server-sol`
do echo -e "\e[1m $s \033[0m "
ssh -q $s sudo passwd -s man
done
for r in `cat server-rhel`
do echo -e "\e[1m $r \033[0m "
ssh -q $r chage -l man
done
for sles in `cat server-suse`
do echo -e "\e[1m $sles \033[0m "
ssh -q $sles sudo chage -l man
done
Examples of out from script on the different OS versions.
man@earth>./check-login2
   solaris-server
rich PS 04/03/13 7 56 7
   rhel-server
Last password change : Apr 03, 2013
Password expires : May 29, 2013
Password inactive : never
Account expires : never
Minimum number of days between password change : 7
Maximum number of days between password change : 56
Number of days of warning before password expires : 7
   sles-server
Minimum: 1
Maximum: 60
Warning: 7
Inactive: 35
Last Change: Apr 03, 2013
Password Expires: Jun 02, 2013
Password Inactive: Jul 07, 2013
Account Expires: Never
As you can see there is a difference in the output each OS gives you. If you have any comments or questions please post them below.

Run Commands Remotely on Multiple Servers

Have you ever had to run the same command on several servers? It takes a lot of time to login to each server and then run a command or group of commands. There is also the possibility for errors, so I wrote this note to remind myself how to do this, if ever I need it. To get the most from this post you need to have your SSH agent working. If your SSH agent is not working don't worry the script below will still work, but you will have to login to each server on your list as the script moves along.

I'm going to use a real world example to explain how to run commands on many servers. I often have to do security checks on my servers. Many of the checks I do consist of checking file permissions and ownership. An easy enough check, but it can take time if you have to check more then 10 servers. So with that being said, we are going to check ownership and permissions on the /etc/resolve.conf file. I will using a space theme for the terminal examples in this guide. The user account is man and the servers are earth, moon, mars and saturn. 

Lets get started by testing the command we are going to use.
man@earth> ssh moon ls -l /etc/resolve.conf
-rwxr-xr-x  1 root  root  20 Oct  6  2011 /etc/resolv.conf
man@earth>
Ok above I logged into moon and ran the ls -l command and the result was printed to the screen. After the command executed the connection to moon was disconnected and you are returned to earth.
Test the in a script.man@earth>for s in moon
> do
> ssh -q $s ls -l /etc/resolve.conf
> done
-rwxr-xr-x  1 root  root  20 Oct  6  2011 /etc/resolv.conf
man@earth>
Let me explain what is going on in the script above. The line for s in `moon` makes s a variable. So when the 3rd line says ssh -q $s it is seen as ssh -q moon, by the computer. The -q option for ssh stops any ssh banner from displaying. Which will make seeing the out put from several servers much easier to see.

Open your favorite text editor and create the file below and call it check.
#!/bin/bash
servers="moon mars saturn"
for s in $servers
do
ssh -q $s uname -n
ssh -q $s ls -l /etc/resolve.conf
done
Now lets test the check script.
man@earth> bash check
moon
-rwxr-xr-x  1 root  root  20 Oct  6  2011 /etc/resolv.conf
mars
-rwxr-xr-x  1 root  root  20 Oct  6  2011 /etc/resolv.conf
saturn
-rwxr-xr-x  1 root  root  20 Oct  6  2011 /etc/resolv.conf
man@earth
Now the output shows the script logging into moon 2 times and running uname -n and then the ls command. Then followed by output from mars and saturn.

Note - By typing bash in front of a BASH script you can execute the script without making it executable.

To make the script a little more useful I'm adding a server list file called servers. I will also append the output of the commands to a file called result, on the server (earth). The final script is below.

Example of the servers file
moon
mars
saturn

The final script
#!/bin/bash
for s in `cat servers`
do
ssh -q $s uname -n >> result
ssh -q $s ls -l /etc/resolve.conf >> result
done


I hope this helps someone