セキュアSMSコマンダー

 #!/bin/sh NRPETOOL="/usr/local/libexec/nagios/check_nrpe2" IPMITOOL="/usr/local/bin/ipmitool" FPINGTOOL="/usr/local/sbin/fping" PARAMFILE="/usr/local/etc/smshandlers/param.list" OPIEKEYBIN="/usr/bin/opiekey" OPIESEED="HABROPIEProc" OPIEPASS="StrongOPIEPassword" OPIEUSEDSEED="/var/tmp/used.opie" SMSDOUTSPOOL="/var/spool/sms/outgoing" if [ ! -f ${OPIEUSEDSEED} ]; then echo "#USED SEEDS FILE. Do not EDIT" > ${OPIEUSEDSEED} fi if [ ! -w ${OPIEUSEDSEED} ]; then echo "file ${OPIEUSEDSEED} is not writable" exit fi if [ ! -r ${PARAMFILE} ]; then echo "file ${PARAMFILE} is not readable" exit fi IFS=" " FOUNDNUM="" NUMBER="" # search any properties search (){ # $1 - section [name] from param.list # $2 - search string in section SECTION=$1 SEARCHSTR=$2 shift shift OLDIFS=${IFS} IFS=" " [ "X"${SEARCHSTR} == "X" ] && exit for i in ${PARAMS}; do # search section definition if [ `echo ${i} | grep -e "^\["` ]; then CURSECTION=${i} continue fi if [ "${CURSECTION}" == "["${SECTION}"]" ]; then if [ `echo ${i} | grep -e "^\b${SEARCHSTR}\b:"` ]; then echo ${i} break fi fi done IFS=${OLDIFS} } cut_message_body (){ # split sms file to parts # BSD buggy "grep -m 1 -A 10 -e '^$'" replacement # FILE=$1 NULLSTR=0 for i in `cat -e $1`; do if [ "X"${i} == "X\$" ]; then NULLSTR=1 continue fi if [ ${NULLSTR} -eq 1 ]; then echo ${i} fi done } process_command () { CMD=$1 shift CMDPARAM=$* oIFS=$IFS IFS=" " for host in ${CMDPARAM}; do HOSTACCOUNT=$( search hosts "${host}" ) if [ "X"${HOSTACCOUNT} != "X" ]; then ACCOUNT=`echo ${HOSTACCOUNT} | cut -d ":" -f 2-` LOGINPW=$( search logins "${ACCOUNT}" ) if [ "X"${ACCOUNT} != "X" ]; then if [ "${ACCOUNT}" != "null" ]; then USER=`echo ${LOGINPW} | cut -d ":" -f 2` PASSWORD=`echo ${LOGINPW} | cut -d ":" -f 3` else USER="USER" PASSWORD="PASSWORD" fi else echo "ACCOUNT ${ACCOUNT} NOT FOUND!" break fi else echo "HOST ${host} NOT FOUND!" continue fi opierequired=$( search commands_template "${CMD}" | cut -d ":" -f 2 ) commandtemplate=$( search commands_template "${CMD}" | \ cut -d ":" -f 3- | sed \ -e "s@\%HOST\%@${host}@g" \ -e "s@\%FPING\%@${FPINGTOOL}@g" \ -e "s@%IPMITOOL%@${IPMITOOL}@g" \ -e "s@%CHECK_NRPE%@${NRPETOOL}@g" \ -e "s@%USER%@${USER}@g" \ -e "s@%PASSWORD%@${PASSWORD}@g" ) if [ "${opierequired}" -eq "1" ]; then if [ "${OPIERES}" == "True" ]; then echo "OPIE Success" res=$( eval ${commandtemplate} ) sendsms ${NUMBER} ${host} ${res} else echo "OPIE Failed" sendsms ${NUMBER} ${host} "OPIE Challenge failed" fi else res=$( eval ${commandtemplate} ) sendsms ${NUMBER} ${host} ${res} fi done IFS=$oIFS } sendsms () { NM=$1 shift TMPFILE=`mktemp ${SMSDOUTSPOOL}/smscmd.XXXXXX` || exit 1 echo "To: ${NM}" >> ${TMPFILE} echo >> ${TMPFILE} echo "$*" >> ${TMPFILE} } opiecheck () { OPIESEQ=`echo $* | cut -d " " -f 1 | sed -e 's/[^0-9]//g'` OPIESTR=`echo $* | cut -d " " -f 2-` if [ "X"${OPIESEQ} == "X" ]; then echo "OPIE SEQUENCE FOR NUMBER ${NUMBER} IS NOT SET!" OPIERES="False" break fi if [ `grep "^${OPIESEQ}$" ${OPIEUSEDSEED}` ]; then echo "USED OPIE SEQUENCE ${OPIESEQ} DETECTED" OPIERES="False" sendsms ${NUMBER} "OPIE SEQUENCE ${OPIESEQ} ALREADY USED" exit 1 else echo ${OPIESEQ} >> ${OPIEUSEDSEED} fi OPIEGEN=`echo ${OPIEPASS} | ${OPIEKEYBIN} -5 -a ${OPIESEQ} ${OPIESEED} 2>/dev/null` if [ "X"${OPIESTR} != "X"${OPIEGEN} ]; then OPIERES="False" else OPIERES="True" fi } parse_commands () { for command in $*; do command=`echo ${command} | sed -e 's/\$$//g' -e 's/^\#//g'` CURCOMMAND=`echo ${command} | cut -d " " -f 1` CMDPARAM=`echo ${command} | cut -d " " -f 2-` case "${CURCOMMAND}" in "OPIE") opiecheck ${CMDPARAM} continue ;; *) if [ `echo ${FOUNDNUM} | cut -d : -f 2 | grep "\b${CURCOMMAND}\b"` ]; then TMPMSG="ALLOWED COMMAND FOR NUMBER "${NUMBER}" - COMMAND: "${CURCOMMAND}" ARGS "${CMDPARAM} echo ${TMPMSG} process_command ${CURCOMMAND} ${CMDPARAM} else TMPMSG="DISALLOWED COMMAND FOR NUMBER "${NUMBER}" - COMMAND: "${CURCOMMAND}" ARGS "${CMDPARAM} echo ${TMPMSG} fi ;; esac done } PARAMS=`cat ${PARAMFILE} | grep -E -v '^#'` if [ $1 == "RECEIVED" ]; then FILENAME=$2 NUMBER=`grep 'From:' ${FILENAME} | sed -e 's/^From\:\ //g' -e 's/[^0-9]//g;'` FOUNDNUM=$( search phones ${NUMBER} ) if [ "X"${FOUNDNUM} != "X" ]; then commands=$( cut_message_body ${FILENAME} ) parse_commands ${commands} fi elif [ $1 == "SENT" ]; then echo $@ else echo "UNKNOWN STATUS $@" fi 

 # --------------------------------------- # # ALLOWED PHONES # PHONENUMBER:COMMAND,COMMAND,COMMAND # --------------------------------------- [phones] 79030000000:RESET,PWROFF,PWRON,REBOOT,SHUTDOWN,STOPSERVER,STARTSERVER,ALIVE,PWRSTAT 79160000000:ALIVE,PWRSTAT 79020000000:PWRON,STARTSERVER,ALIVE # --------------------------------------- # # HOST LIST # REAL_IP:IPMI_USER # --------------------------------------- [hosts] 192.168.55.2:ADMSM 192.168.54.2:null 192.168.55.5:ADMDEF 192.168.54.5:null # --------------------------------------- # # IPMI LOGINS # IPMI_ACCOUNT:IPMI_NAME:IPMI_PASSWORD # --------------------------------------- [logins] ADMSM:ADMIN:PW1234 ADMDEF:ADMIN:ADMIN ADMIBM:USERID:USERID # --------------------------------------- # # COMMANDS TEMPLATE # COMMAND:OPIE_CHECK:COMMAND_TEXT # --------------------------------------- [commands_template] RESET:1:%IPMITOOL% -H %HOST% -U %USER% -P %PASSWORD% power reset PWROFF:1:%IPMITOOL% -H %HOST% -U %USER% -P %PASSWORD% power off PWRON:0:%IPMITOOL% -H %HOST% -U %USER% -P %PASSWORD% power on PWRSTAT:0:%IPMITOOL% -H %HOST% -U %USER% -P %PASSWORD% power status REBOOT:1:%CHECK_NRPE% -H %HOST% -p 5666 -c reboot SHUTDOWN:1:%CHECK_NRPE% -H %HOST% -p 5666 -c shutdown STOPSERVER:1:%CHECK_NRPE% -H %HOST% -p 5666 -c stop_server STARTSERVER:0:%CHECK_NRPE% -H %HOST% -p 5666 -c start_server ALIVE:0:%FPING% %HOST%