tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ent-5708-review-discovery-h-d' into 'develop' 

Ent 5708 review discovery h d

See merge request artica/pandorafms!3195
This commit is contained in:
Alejandro Fraguas 2020-05-14 10:32:43 +02:00
parent 44b5f2671e 206970d143
commit aaf64e591c
7 changed files with 305 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pandora_console/extras/mr/38.sql Normal file
View File

@ -0,0 +1,5 @@
START TRANSACTION;
ALTER TABLE trecon_task add column `rcmd_enabled` TINYINT(1) UNSIGNED DEFAULT 0 AFTER `wmi_enabled`;
COMMIT;

1
pandora_console/extras/pandoradb_migrate_6.0_to_7.0.mysql.sql
View File

@ -1674,6 +1674,7 @@ ALTER TABLE trecon_task ADD `alias_as_name` int(2) unsigned default '0';
ALTER TABLE trecon_task ADD `snmp_enabled` int(2) unsigned default '0';
ALTER TABLE trecon_task ADD `vlan_enabled` int(2) unsigned default '0';
ALTER TABLE trecon_task ADD `wmi_enabled` tinyint(1) unsigned DEFAULT '0';
ALTER TABLE trecon_task ADD `rcmd_enabled` tinyint(1) unsigned DEFAULT '0';
ALTER TABLE trecon_task ADD `auth_strings` text;
ALTER TABLE trecon_task ADD `autoconfiguration_enabled` tinyint(1) unsigned default '0';
ALTER TABLE trecon_task ADD `summary` text;

9
pandora_console/godmode/wizards/DiscoveryTaskList.class.php
View File

@ -538,7 +538,14 @@ class DiscoveryTaskList extends HTML
}
$can_be_reviewed = false;
if ($task['review_mode'] == DISCOVERY_STANDARD) {
if (empty($task['summary']) === false
&& $task['summary'] == 'cancelled'
) {
$data[5] = __('Cancelled').ui_print_help_tip(
__('Server has been restarted while executing this task, please retry.'),
true
);
} else if ($task['review_mode'] == DISCOVERY_STANDARD) {
if ($task['status'] <= 0
&& empty($task['summary']) === false
) {

19
pandora_console/godmode/wizards/HostDevices.class.php
View File

@ -482,6 +482,7 @@ class HostDevices extends Wizard
$review_results = get_parameter_switch('review_results');
$review_limited = (bool) get_parameter('review_limited', 0);
$auto_monitor = get_parameter_switch('auto_monitor');
$recon_ports = get_parameter('recon_ports', null);
$autoconf_enabled = get_parameter_switch(
'autoconfiguration_enabled'
);
@ -491,6 +492,7 @@ class HostDevices extends Wizard
$parent_recursion = get_parameter_switch('parent_recursion');
$vlan_enabled = get_parameter_switch('vlan_enabled');
$wmi_enabled = get_parameter_switch('wmi_enabled');
$rcmd_enabled = get_parameter_switch('rcmd_enabled');
$resolve_names = get_parameter_switch('resolve_names');
$snmp_version = get_parameter('snmp_version', null);
$community = get_parameter('community', null);
@ -532,12 +534,14 @@ class HostDevices extends Wizard
}
$this->task['auto_monitor'] = $auto_monitor;
$this->task['recon_ports'] = $recon_ports;
$this->task['snmp_enabled'] = $snmp_enabled;
$this->task['os_detect'] = $os_detect;
$this->task['parent_detection'] = $parent_detection;
$this->task['parent_recursion'] = $parent_recursion;
$this->task['vlan_enabled'] = $vlan_enabled;
$this->task['wmi_enabled'] = $wmi_enabled;
$this->task['rcmd_enabled'] = $rcmd_enabled;
$this->task['resolve_names'] = $resolve_names;
$this->task['snmp_version'] = $snmp_version;
$this->task['snmp_auth_user'] = $snmp_auth_user;
@ -1036,6 +1040,21 @@ class HostDevices extends Wizard
],
];
$form['inputs'][] = [
'label' => __('Filter by opened ports').ui_print_help_tip(
__(
'Targets will be scanned if at least one of defined ports (comma separated) is open.'
),
true
),
'arguments' => [
'name' => 'recon_ports',
'type' => 'text',
'return' => true,
'value' => $this->task['recon_ports'],
],
];
$form['inputs'][] = [
'label' => __('Auto discover known hardware').ui_print_help_tip(
__(

1
pandora_console/pandoradb.sql
View File

@ -805,6 +805,7 @@ CREATE TABLE IF NOT EXISTS `trecon_task` (
`snmp_privacy_pass` varchar(255) NOT NULL default '',
`snmp_security_level` varchar(25) NOT NULL default '',
`wmi_enabled` tinyint(1) unsigned DEFAULT 0,
`rcmd_enabled` tinyint(1) unsigned DEFAULT 0,
`auth_strings` text,
`auto_monitor` TINYINT(1) UNSIGNED DEFAULT 1,
`autoconfiguration_enabled` tinyint(1) unsigned default 0,

135
pandora_server/lib/PandoraFMS/DiscoveryServer.pm
View File

@ -105,7 +105,7 @@ sub new ($$$$$$) {
get_server_id ($dbh, $config->{'servername'}, DISCOVERYSERVER));
# Reset (but do not restart) manual recon tasks.
db_do ($dbh, 'UPDATE trecon_task SET status = -1 WHERE id_recon_server = ? AND status <> -1 AND interval_sweep = 0',
db_do ($dbh, 'UPDATE trecon_task SET status = -1, summary = "cancelled" WHERE id_recon_server = ? AND status <> -1 AND interval_sweep = 0',
get_server_id ($dbh, $config->{'servername'}, DISCOVERYSERVER));
# Call the constructor of the parent class
@ -250,6 +250,13 @@ sub data_consumer ($$) {
}
}
if (!is_empty($task->{'recon_ports'})) {
# Accept only valid symbols.
if ($task->{'recon_ports'} !~ /[\d\-\,\ ]+/) {
$task->{'recon_ports'} = '';
}
}
my $recon = new PandoraFMS::Recon::Base(
communities => \@communities,
dbh => $dbh,
@ -276,6 +283,9 @@ sub data_consumer ($$) {
task_id => $task->{'id_rt'},
vlan_cache_enabled => $task->{'vlan_enabled'},
wmi_enabled => $task->{'wmi_enabled'},
rcmd_enabled => $task->{'rcmd_enabled'},
rcmd_timeout => $pa_config->{'rcmd_timeout'},
rcmd_timeout_bin => $pa_config->{'rcmd_timeout_bin'},
auth_strings_array => \@auth_strings,
autoconfiguration_enabled => $task->{'autoconfiguration_enabled'},
main_event_id => $main_event,
@ -399,8 +409,10 @@ sub exec_recon_script ($$$) {
################################################################################
# Guess the OS using xprobe2 or nmap.
################################################################################
sub PandoraFMS::Recon::Base::guess_os($$) {
my ($self, $device) = @_;
sub PandoraFMS::Recon::Base::guess_os($$;$) {
my ($self, $device, $string_flag) = @_;
return $self->{'os_id'}{$device} if defined($self->{'os_id'}{$device});
$DEVNULL = '/dev/null' if (!defined($DEVNULL));
$DEVNULL = '/NUL' if ($^O =~ /win/i && !defined($DEVNULL));
@ -420,7 +432,9 @@ sub PandoraFMS::Recon::Base::guess_os($$) {
my $return = `"$self->{pa_config}->{xprobe2}" $device 2>$DEVNULL`;
if ($? == 0) {
if($return =~ /Running OS:(.*)/) {
return pandora_get_os($self->{'dbh'}, $1);
my $str_os = $1;
return $str_os if is_enabled($string_flag);
return pandora_get_os($self->{'dbh'}, $str_os);
}
}
}
@ -431,7 +445,9 @@ sub PandoraFMS::Recon::Base::guess_os($$) {
return OS_OTHER if ($? != 0);
if ($return =~ /Aggressive OS guesses:\s*(.*)/) {
return pandora_get_os($self->{'dbh'}, $1);
my $str_os = $1;
return $str_os if is_enabled($string_flag);
return pandora_get_os($self->{'dbh'}, $str_os);
}
}
@ -444,6 +460,9 @@ sub PandoraFMS::Recon::Base::guess_os($$) {
sub PandoraFMS::Recon::Base::tcp_scan ($$) {
my ($self, $host) = @_;
return if is_empty($host);
return if is_empty($self->{'recon_ports'});
my $r = `"$self->{pa_config}->{nmap}" -p$self->{recon_ports} $host`;
# Same as ""| grep open | wc -l" but multi-OS;
@ -510,6 +529,9 @@ sub PandoraFMS::Recon::Base::test_module($$) {
) {
# Generic, plugins. (21-23 ASYNC)
if ($test->{'id_modulo'} == 6) {
return 0 unless $self->wmi_responds($addr);
# WMI commands.
$value = $self->call(
'wmi_get_value',
@ -527,9 +549,39 @@ sub PandoraFMS::Recon::Base::test_module($$) {
} elsif ($test->{'id_tipo_modulo'} >= 34 && $test->{'id_tipo_modulo'} <= 37) {
# Remote command.
# XXX TODO: Test remote commands.
# Disabled until we can ensure result.
return 0;
return 0 unless $self->rcmd_responds($addr);
my $target_os;
if ($test->{'custom_string_2'} =~ /inherited/i) {
$target_os = pandora_get_os(
$self->{'dbh'},
$self->{'os_cache'}{$test->{'ip_target'}}
);
} else {
$target_os = pandora_get_os($self->{'dbh'}, $test->{'custom_string_2'});
}
$value = enterprise_hook(
'remote_execution_module',
[
# pa_config,
$self->{'pa_config'},
# dbh,
$self->{'dbh'},
# module,
$test,
# target_os,
$target_os,
# ip_target,
$test->{'ip_target'},
# tcp_port
$test->{'tcp_port'}
]
);
chomp($value);
return 0 unless defined($value);
} elsif ($test->{'id_tipo_modulo'} >= 8 && $test->{'id_tipo_modulo'} <= 11) {
# TCP
@ -905,6 +957,16 @@ sub PandoraFMS::Recon::Base::create_network_profile_modules($$) {
$np_component->{'id_nc'}
);
# Tag cleanup.
if (!is_empty($component->{'tags'})) {
my @tags = map {
if ($_ > 0) { $_ }
else {}
} split ',', $component->{'tags'};
$component->{'tags'} = join ',', @tags;
}
$component->{'name'} = safe_output($component->{'name'});
if ($component->{'type'} >= 15 && $component->{'type'} <= 18) {
$component->{'snmp_community'} = safe_output($self->get_community($device));
@ -917,6 +979,15 @@ sub PandoraFMS::Recon::Base::create_network_profile_modules($$) {
$component->{'plugin_pass'} = $self->{'snmp_auth_pass'};
}
if ($component->{'type'} >= 34 && $component->{'type'} <= 37) {
# Update module credentials.
$component->{'custom_string_1'} = $self->rcmd_credentials_key($device);
$component->{'custom_string_2'} = pandora_get_os_by_id(
$self->{'dbh'},
$self->guess_os($device)
);
}
$component->{'__module_component'} = 1;
# 3. Try to register module into monitoring list.
@ -1012,7 +1083,10 @@ sub PandoraFMS::Recon::Base::report_scanned_agents($;$) {
|| $force_creation
) {
my $parent_id;
my $os_id = $self->guess_os($data->{'agent'}{'direccion'});
my $os_id = $data->{'agent'}{'id_os'};
if (is_empty($os_id)) {
$os_id = $self->guess_os($data->{'agent'}{'direccion'});
}
$self->call('message', "Agent accepted: ".$data->{'agent'}{'nombre'}, 5);
@ -1337,10 +1411,14 @@ sub PandoraFMS::Recon::Base::report_scanned_agents($;$) {
next if is_empty($label);
# Retrieve target agent OS version.
$self->{'agents_found'}->{$addr}{'agent'}{'id_os'} = $self->guess_os($addr);
$self->call('update_progress', $progress);
$progress += $step;
# Store temporally. Wait user approval.
my $encoded;
eval {
local $SIG{__DIE__};
$encoded = encode_base64(
@ -1436,28 +1514,33 @@ sub PandoraFMS::Recon::Base::apply_monitoring($) {
my @hosts = keys %{$self->{'agents_found'}};
$self->{'step'} = STEP_MONITORING;
# From 80% to 90%.
my ($progress, $step) = (80, 10.0 / scalar(@hosts));
my ($partial, $sub_step) = (0, 100 / scalar(@hosts));
my $progress = 80;
foreach my $label (keys %{$self->{'agents_found'}}) {
$self->{'c_network_percent'} = $partial;
$self->{'c_network_name'} = $label;
$self->call('update_progress', $progress);
$progress += $step;
$partial += $sub_step;
$self->call('message', "Checking modules for $label", 5);
if (scalar @hosts > 0) {
$self->{'step'} = STEP_MONITORING;
# From 80% to 90%.
my ($progress, $step) = (80, 10.0 / scalar(@hosts));
my ($partial, $sub_step) = (0, 100 / scalar(@hosts));
# Monitorization selected.
$self->call('create_network_profile_modules', $label);
foreach my $label (keys %{$self->{'agents_found'}}) {
$self->{'c_network_percent'} = $partial;
$self->{'c_network_name'} = $label;
$self->call('update_progress', $progress);
$progress += $step;
$partial += $sub_step;
$self->call('message', "Checking modules for $label", 5);
# Monitorization - interfaces
$self->call('create_interface_modules', $label);
# Monitorization selected.
$self->call('create_network_profile_modules', $label);
# Monitorization - WMI modules.
$self->call('create_wmi_modules', $label);
# Monitorization - interfaces
$self->call('create_interface_modules', $label);
# Monitorization - WMI modules.
$self->call('create_wmi_modules', $label);
}
}
$self->{'c_network_percent'} = 100;

180
pandora_server/lib/PandoraFMS/Recon/Base.pm
View File

@ -160,6 +160,12 @@ sub new {
# Globally enable/disable WMI scans.
wmi_enabled => 0,
# Globally enable/disable RCMD scans.
rcmd_enabled => 0,
rcmd_timeout => 4,
rcmd_timeout_bin => '/usr/bin/timeout',
auth_strings_array => [],
wmi_timeout => 3,
timeout_cmd => '',
@ -432,11 +438,11 @@ sub are_connected($$$$$) {
sub icmp_discovery($$) {
my ($self, $addr) = @_;
# Create an agent for the device and add it to the list of known hosts.
push(@{$self->{'hosts'}}, $addr);
# Create an agent for the device and add it to the list of known hosts.
push(@{$self->{'hosts'}}, $addr);
# Create an agent for the device and add it to the list of known hosts.
$self->add_agent($addr);
# Create an agent for the device and add it to the list of known hosts.
$self->add_agent($addr);
$self->add_module($addr,
{
@ -1349,11 +1355,11 @@ sub prepare_agent($$) {
my $main_address = $self->get_main_address($addr);
return unless is_empty($main_address);
# Resolve hostnames.
my $host_name = (($self->{'resolve_names'} == 1) ? gethostbyaddr(inet_aton($addr), AF_INET) : $addr);
# Resolve hostnames.
my $host_name = (($self->{'resolve_names'} == 1) ? gethostbyaddr(inet_aton($addr), AF_INET) : $addr);
# Fallback to device IP if host name could not be resolved.
$host_name = $addr if (!defined($host_name) || $host_name eq '');
# Fallback to device IP if host name could not be resolved.
$host_name = $addr if (!defined($host_name) || $host_name eq '');
$self->{'agents_found'} = {} if ref($self->{'agents_found'}) ne 'HASH';
@ -1429,6 +1435,12 @@ sub test_capabilities($$) {
# Add wmi scan if enabled.
$self->wmi_discovery($addr);
}
# RCMD discovery.
if (is_enabled($self->{'rcmd_enabled'})) {
# Add wmi scan if enabled.
$self->rcmd_discovery($addr);
}
}
################################################################################
@ -1537,6 +1549,11 @@ sub scan_subnet($) {
# Populate.
$self->call('update_progress', ceil($progress));
# Filter by port (if enabled).
if (!is_empty($self->{'recon_ports'})) {
next unless $self->call("tcp_scan", $addr) > 0;
}
# Enable/ disable capabilities.
$self->test_capabilities($addr);
}
@ -1961,10 +1978,10 @@ sub scan($) {
}
}
# Apply monitoring templates
$self->call('message', "[5/6] Applying monitoring.", 3);
# Apply monitoring templates
$self->call('message', "[5/6] Applying monitoring.", 3);
$self->{'step'} = STEP_MONITORING;
$self->call('apply_monitoring', $self);
$self->call('apply_monitoring', $self);
# Print debug information on found devices.
$self->call('message', "[Summary]", 3);
@ -1982,8 +1999,8 @@ sub scan($) {
$self->call('message', $dev_info, 3);
}
# Apply monitoring templates
$self->call('message', "[6/6] Processing results.", 3);
# Apply monitoring templates
$self->call('message', "[6/6] Processing results.", 3);
$self->{'step'} = STEP_PROCESSING;
# Send agent information to Database (Discovery) or XML (satellite.).
$self->call('report_scanned_agents');
@ -2209,8 +2226,8 @@ sub wmi_credentials {
# undef if it does not respond to WMI.
################################################################################
sub wmi_credentials_key {
my ($self, $target) = @_;
return $self->{'wmi_auth_key'}{$target};
my ($self, $target) = @_;
return $self->{'wmi_auth_key'}{$target};
}
################################################################################
@ -2268,6 +2285,110 @@ sub wmi_credentials_calculation {
return undef;
}
################################################################################
# Returns the credentials with which the host responds to WMI queries or
# undef if it does not respond to WMI.
################################################################################
sub rcmd_credentials {
my ($self, $target) = @_;
return $self->{'rcmd_auth'}{$target};
}
################################################################################
# Returns the credentials KEY with which the host responds to WMI queries or
# undef if it does not respond to WMI.
################################################################################
sub rcmd_credentials_key {
my ($self, $target) = @_;
return $self->{'rcmd_auth_key'}{$target};
}
################################################################################
# Calculate WMI credentials for target, 1 if calculated, undef if cannot
# connect to target. Credentials could be empty (-N)
################################################################################
sub rcmd_credentials_calculation {
my ($self, $target) = @_;
my $rcmd = PandoraFMS::Recon::Util::enterprise_new(
'PandoraFMS::RemoteCmd',[{
'psexec' => $self->{'parent'}->{'pa_config'}->{'psexec'},
'winexe' => $self->{'parent'}->{'pa_config'}->{'winexe'},
'plink' => $self->{'parent'}->{'pa_config'}->{'plink'}
}]
);
if (!$rcmd) {
# Library not available.
$self->call('message', "PandoraFMS::RemoteCmd library not available", 10);
return undef;
}
my $os = $self->{'os_cache'}{$target};
$os = $self->call('guess_os', $target, 1) if is_empty($os);
$rcmd->set_host($target);
$rcmd->set_os($os);
$self->{'os_cache'}{$target} = $os;
# Test all credentials selected.
foreach my $key_index (@{$self->{'auth_strings_array'}}) {
my $cred = $self->call('get_credentials', $key_index);
next if ref($cred) ne 'HASH';
$rcmd->clean_ssh_lib();
my $username;
my $domain;
if($cred->{'username'} =~ /^(.*?)\\(.*)$/) {
$domain = $1;
$username = $2;
} else {
$username = $cred->{'username'};
}
$rcmd->set_credentials(
{
'user' => $username,
'pass' => $cred->{'password'},
'domain' => $domain
}
);
$rcmd->set_timeout(
$self->{'rcmd_timeout_bin'},
$self->{'rcmd_timeout'}
);
my $result;
eval {
$result = $rcmd->rcmd('echo 1');
chomp($result);
my $out = '';
$out = $result if !is_empty($result);
$self->call('message', "Trying [".$key_index."] in [". $target."] [".$os."]: [$out]", 10);
};
if ($@) {
$self->call('message', "Failed while trying [".$key_index."] in [". $target."] [".$os."]:" . @_, 10);
}
if (!is_empty($result) && $result == "1") {
$self->{'rcmd_auth'}{$target} = $cred;
$self->{'rcmd_auth_key'}{$target} = $key_index;
$self->{'rcmd'}{$target} = 1;
$self->{'summary'}->{'RCMD'} += 1;
$self->call('message', "RCMD available for $target", 10);
return 1;
} else {
$self->call('message', "Last error ($target|$os|$result) was [".$rcmd->get_last_error()."]", 10);
}
}
# Not found.
return 0;
}
################################################################################
# Tests wmi capability for addr.
################################################################################
@ -2282,6 +2403,20 @@ sub wmi_discovery {
}
################################################################################
# Tests credentials against addr.
################################################################################
sub rcmd_discovery {
my ($self, $addr) = @_;
# Initialization.
$self->{'rcmd'} = {} unless ref($self->{'rcmd'}) eq 'HASH';
# Calculate credentials.
$self->rcmd_credentials_calculation($addr);
}
################################################################################
# Extra: WMI imported methods. DO NOT EXPORT TO AVOID DOUBLE DEF.
################################################################################
@ -2366,9 +2501,18 @@ sub wmi_get_command {
# Checks if target is reachable using wmi.
################################################################################
sub wmi_responds {
my ($self, $target) = @_;
return 1 if is_enabled($self->{'wmi'}{$target});
return 0;
my ($self, $target) = @_;
return 1 if is_enabled($self->{'wmi'}{$target});
return 0;
}
################################################################################
# Checks if target is reachable using rcmd.
################################################################################
sub rcmd_responds {
my ($self, $target) = @_;
return 1 if is_enabled($self->{'rcmd'}{$target});
return 0;
}
################################################################################