Cut Help

chrism01 · 12-11-2007, 04:41 PM

Add
Timeout => 5
option to the new() method to make it give up trying after 5 seconds

metallica1973 · 12-11-2007, 05:27 PM

Its that easy?

ilikejam · 12-11-2007, 07:10 PM

Yes. Yes it is.

metallica1973 · 12-11-2007, 07:48 PM

right on! I will test it out and give you an update!

chrism01 · 12-11-2007, 09:49 PM

Of course, it's Perl

metallica1973 · 12-12-2007, 05:58 AM

chrism01,

one more stupid questions(my next book is PERL for jackasses) but

Quote:

Add
Timeout => 5
option to the new() method to make it give up trying after 5 seconds

I would add that to

PHP Code:



Telnet=$(perl -e  'use IO::Socket; print new IO::Socket::INET (PeerAddr => "'$SNIFFERS'", PeerPort => "23", ) ? "open\n" : "closed\n";')

like

PHP Code:



Telnet=$(perl -e  'use IO::Socket; print new IO::Socket::INET (PeerAddr => "'$SNIFFERS'", PeerPort => "23", Timeout=>5 ) ? "open\n" : "closed\n";')

I think that this correct, a plurality

metallica1973 · 12-12-2007, 06:17 AM

Correct me if I am wrong but this scripts seems a lot faster then the previous one. Could it be that I do not have this script written corrrectly or that Perl IO::Socket is just quicker and more efficient?

PHP Code:



 
#!/bin/ksh 
NAMFILE="nam_output" 
SNIFFILE="sniffer_output" 
OUT="Report.doc" 
MAIL_LIST="test_admin@ccc.edu" 
 
> $NAMFILE 
> $SNIFFILE 
> $OUT 
 
echo       Daily Sniffer and NAMs Scan as of - `date` >> $OUT 
echo     >> $OUT 
echo       There is a 8 sec timeout of devices  >> $OUT 
 
echo >>$OUT 
exec 2>/dev/null 
 
printf " %-15.20s %-8s %-6s \n" NAM Status Telnet >> $NAMFILE 
 
echo " ===============================" >>$NAMFILE 
for NAM in $(<namlist) 
 
do 
        Status=down 
        Telnet=closed 
        if ping $NAM 5 >/dev/null 2>&1 
        then 
                Status=up 
                Telnet=$(perl -e  'use IO::Socket; print new IO::Socket::INET (PeerAddr => "'$SNIFFERS'", PeerPort => "23", Timeout => 5 
 ) ? "open\n" : "closed\n";') 
                READPID=$! 
               # sleep 15 
                if ps | awk '{print $1}' | grep $READPID 2>/dev/null 
                then 
                        Telnet="open" 
                        kill $READPID 
                fi 
                printf " %-15.20s %-8s %-6s \n" $NAM $Status $Telnet >> $NAMFILE 
        else 
                Telnet="n/a" 
                printf " %-15.20s %-8s %-6s \n" $NAM $Status $Telnet >> $NAMFILE 
        fi 
 
done 
 
echo >> $SNIFFILE 
 
printf " %-15.20s %-15.20s %-8s %-6s \n" SNIFFERS IP_Address Status Telnet >> $SNIFFILE 
 
echo " ===============================================" >> $SNIFFILE 
 
for SNIFFERS in $(<snifflist) 
 
do 
        TRUNCSNIF=$(echo $SNIFFERS | awk -F'.' '{for (i=1;i<=NF-2;i++) {if (i<NF-2) printf $i"."; else print $i}}') 
        Status=down 
        Telnet=closed 
        if ping $SNIFFERS 5 >/dev/null 2>&1 
        then 
           Status=up 
                Telnet=$(perl -e  'use IO::Socket; print new IO::Socket::INET (PeerAddr => "'$SNIFFERS'", PeerPort => "23", Timeout =>5 
) ? "open\n" : "closed\n";') 
                READPID=$! 
                sleep 15 
                if ps | awk '{print $1}' | grep $READPID 2>/dev/null 
                then 
                        Telnet="open" 
                        kill $READPID 
                fi 
 
                IP_Addr="$(nslookup $SNIFFERS | tail -3 | grep '^Address:' | awk '{print $2}')" 
                IP_Address="$IP_Addr" 
                [[ -z "$IP_Address" ]] && IP_Address="n/a" 
                printf " %-15.20s %-15.20s %-8s %-6s \n" $TRUNCSNIF $IP_Address $Status $Telnet >>$SNIFFILE 
        else 
                IP_Address="$(nslookup $SNIFFERS | tail -2 |head -1 | awk -F: '{print $2}'| sed 's/ //g')" 
                [[ -z "$IP_Address" || "$IP_Address" == "SERVFAIL" ]] && IP_Address="n/a" 
                Telnet="n/a" 
                printf " %-15.20s %-15.20s %-8s %-6s \n" $TRUNCSNIF $IP_Address $Status $Telnet >>$SNIFFILE 
 
        fi 
 
done 
 
cat $NAMFILE $SNIFFILE >> $OUT 
mailx -s"Daily NAM and Sniffer Report" $MAIL_LIST < $OUT

Something is still not right!

metallica1973 · 12-12-2007, 06:37 AM

it doesnt work. help

ilikejam · 12-12-2007, 10:16 AM

Code:

Telnet=$(perl -e  'use IO::Socket; print new IO::Socket::INET (PeerAddr => "'$SNIFFERS'", PeerPort => "23", Timeout => 5
 ) ? "open\n" : "closed\n";')

should probably read

Code:

Telnet=$(perl -e  'use IO::Socket; print new IO::Socket::INET (PeerAddr => "'$NAM'", PeerPort => "23", Timeout => 5
 ) ? "open\n" : "closed\n";')

Why the two loops anyway? What's the NAM loop for?

Dave

metallica1973 · 12-12-2007, 10:30 AM

I tried that but it didnt work! It is giving me false positives:

PHP Code:



perl -e  'use IO::Socket; print new IO::Socket::INET (PeerAddr => "'192.18.158.17'", PeerPort => "23", ) ? "closed\n" : "open\n";' 
closed

when I know that telnet is open on that server. the logic is wrong. It doesnt matter if I flip it around or not.

PHP Code:



perl -e  'use IO::Socket; print new IO::Socket::INET (PeerAddr => "'192.18.158.17'", PeerPort => "23", ) ? "open\n" : "closed\n";' 
closed

metallica1973 · 12-12-2007, 10:41 AM

the problem is the

PHP Code:



 ? "closed\n" : "open\n";'

at the end of the string.

chrism01 · 12-12-2007, 06:25 PM

ok, here's a client socket snippet from my own code:

Code:

        # Create socket
        $socket_errmsg = "";
        $cfg::send_socket = IO::Socket::INET->new( PeerAddr => $server,
                                                   PeerPort => $port,
                                                   Proto    => "tcp"
                                                    )
                    or $socket_errmsg =
                        "Couldn't create socket to $server port $port: $@";

        if( !$socket_errmsg )
        {
# DEBUG
print  "get_sending_socket() Success\n";
        }

Here's the Perl Net::Telnet module desc+examples
http://search.cpan.org/~jrogers/Net-.../Net/Telnet.pm
If you're going to write a prog to do what you want, do it all in Perl, it'll be more robust & faster.
Perl has loads of Networking/Socket modules. See also the Perl Cookbook for pre-written examples.
See also: http://perldoc.perl.org/

metallica1973 · 12-13-2007, 06:39 AM

I have my boss on my bumper and I really need to get this done. Can you just explain to me why this command always produces a closed anwser, no matter what address I put in. The logic is wrong and I have been looking around like crazy and it is driving me crazy:

PHP Code:



perl -e  'use IO::Socket; print new IO::Socket::INET (PeerAddr => "'192.18.158.17'", PeerPort => "23", ) ? "closed\n" : "open\n";'

PHP Code:



closed

I need this section to reliably give me the correct output and then I can take a class in programming (Perl, General Programming and etc.)

Just figure out this one liner and I will cry tears of joy!

chrism01 · 12-13-2007, 05:26 PM

Well, for a start you've got the logic backwards; if it connects, it returns true, but you print closed (and vice versa).
Eg on my mchine ssh is running (port 22) but port 230 is reserved (see /etc/services).
Using your code, I get 'closed' for 22 and 'open' for 230 (opposite of reality).

ilikejam · 12-13-2007, 06:13 PM

<RANT>
I'm going to go out on a limb, and assume that this script is a security audit tool to find hosts which have insecure services running on your network (sounds like it anyway). If that's the case, you should point out to your management that not allowing you to use the correct tools (i.e. nmap) to do the audit reliably and quickly is a far greater security risk than having a single host with a single nmap binary installed (chmod 500, if they like).

This sort of thing is /exactly/ what nmap was designed to do - a single line in cron and a list of hostnames is all you'd require to scan for telnet hosts automatically. Instead, they've got you hacking up a script in a language you're not comfortable with, that's proving to be difficult to implement and debug. Unreliable audit tools are worse than no audit tools.

I saw crap like this from admin' management when I worked in software support - they'd rather have completely un-patched hosts than allow outbound connections to update servers through their firewalls/proxies - for security, of course. Their idiotic management annoyed me then, and your idiotic management annoys me now. You can tell them I said as much.
</RANT>

Anyway, Chris is right, and

Code:

perl -e 'use IO::Socket; print new IO::Socket::INET (PeerAddr => "'192.18.158.17'", PeerPort => "23", ) ? "open\n" : "closed\n";'

works for me. Not sure why it's failing for you.

Dave