<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>yurisk.info &#187; Linux</title>
	<atom:link href="http://yurisk.info/tag/linux/feed/" rel="self" type="application/rss+xml" />
	<link>http://yurisk.info</link>
	<description>Technical Blog about IT Security and Networking</description>
	<lastBuildDate>Tue, 07 Sep 2010 12:42:44 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0</generator>
		<item>
		<title>MAC finder script</title>
		<link>http://yurisk.info/2010/07/02/mac-finder-script/</link>
		<comments>http://yurisk.info/2010/07/02/mac-finder-script/#comments</comments>
		<pubDate>Fri, 02 Jul 2010 05:35:37 +0000</pubDate>
		<dc:creator>Yuri</dc:creator>
				<category><![CDATA[Checkpoint NG/NGX]]></category>
		<category><![CDATA[Cisco]]></category>
		<category><![CDATA[Esafe]]></category>
		<category><![CDATA[Fortigate]]></category>
		<category><![CDATA[Linux]]></category>
		<category><![CDATA[Solaris]]></category>
		<category><![CDATA[Checkpoint]]></category>

		<guid isPermaLink="false">http://yurisk.info/?p=959</guid>
		<description><![CDATA[While I don&#8217;t like going down to Layer 2 , recently I had to do it &#8211; I didn&#8217;t know IP address of the Cisco router I wanted to connect to but I had access to the Cisco router sitting in the same network. That would be pretty easy to do #show arp on this [...]]]></description>
			<content:encoded><![CDATA[<p>While I don&#8217;t like going down to Layer 2 , recently I had to do it &#8211; I didn&#8217;t know IP address of the Cisco router I wanted to connect to but I had access to the Cisco router sitting in the same network. That would be pretty easy to do #show arp on this router and then search on Google to whom belongs each MAC  if it wasn&#8217;t the subnet mask of /26. Copy pasting each entry of the ARP table into Google didn&#8217;t look like a lot of fun. So I wrote a python script that reads MAC addresses in bulk from command line and using downloaded beforehand database of MAC-vendor translations prints vendor for each MAC address. It works for &#35;show arp on CIsco,&#35;show mac-address-table on CIsco switches, &#35;arp -en  on Linux (means including Checkpoint), &#35;arp -a on Freebsd ,&#35;show arp of Junos from Juniper, &#35;get sys arp on Fortigate.<br />
Below is the script.<br />
Here&#58;<br />
<strong>mac-database.txt</strong> &#8211; file containing MAC-vendor translation in format &lt;MAC 6 hex digits as a sequence&gt; &lt;VENDOR&gt;, I used <a href="http://standards.ieee.org/regauth/oui/oui.txt"> standards.ieee.org/regauth/oui/oui.txt </a> as the source with a bit of sed, but if you want ready to use file I recommend <strong>nmap-mac-prefixes</strong> from nmap source-code distribution <a href="http://nmap.org/svn/nmap-mac-prefixes">http://nmap.org/svn/nmap-mac-prefixes</a><br />
Download script (to make sure formatting is preserved, an important thing for Python)<br />
<a href="http://yurisk.info/scripts/mac-finder.py">http://yurisk.info/scripts/mac-finder.py</a><br />Script AND mac database from nmap project &#8211; <a href="http://yurisk.info/scripts/mac.tar.gz"> http://yurisk.info/scripts/mac.tar.gz</a></p>
<div class="cmdout">
<pre>
&#35;!/usr/bin/python
&#35;This script accepts MAC addresses from the command line and
&#35;prints vendor for each mac address
&#35; Author&#58;Yuri, yurisk@yurisk.info,06.2010
import sys
import re
&#35;This function removes from MACs colon or dot and returns MAC as a sequence of HEX chars
def dotreplace(matchobj):
&nbsp;&nbsp;       if matchobj.group(0) == &#39;.&#39;&#58;
&nbsp;&nbsp;&nbsp;&nbsp;            return &#39;&#39;
&nbsp;&nbsp;       elif  matchobj.group(0) == &#39;&#58;&#39;&#58;
&nbsp;&nbsp;&nbsp;&nbsp;            return &#39;&#39;
&#35;open file with MAC addresses and vendors database,it has form xxxx &lt;Vendor&gt;
macs=open(&#39;mac-database.txt&#39;,&#39;r&#39;)
macs_lines=macs.readlines()
&#35;Read from stdinput
data = sys.stdin.readlines()
for ppp in data:
       popa=re.search(&#39;.*([a-f0-9]{4}\.[a-f0-9]{4}\.[a-f0-9]{4}).*&#39;,ppp,re.IGNORECASE)
       if popa:
             newpopa=re.sub(&#39;\.&#39;, dotreplace,popa.group(1))[0:6]
             newpopa_re=re.compile(newpopa,re.IGNORECASE)
             for mac_db in macs_lines:
                 vendor=re.search(newpopa_re,mac_db)
                 if vendor:
                    print ppp.strip(),mac_db[7:]
       popalinux = re.search(&#39;.*([a-f0-9]{2}&#58;[a-f0-9]{2}&#58;[a-f0-9]{2}&#58;[a-f0-9]{2}&#58;[a-f0-9]{2}&#58;[a-f0-9]{2}).*&#39;,ppp,re.IGNORECASE)
       if popalinux&#58;
             newpopalinux=re.sub(&#39;&#58;&#39;,dotreplace,popalinux.group(1))[0&#58;6]
             newpopalinux_re=re.compile(newpopalinux,re.IGNORECASE)
             for mac_db in macs_lines&#58;
                 vendor=re.search(newpopalinux_re,mac_db)
                 if vendor&#58;
                    print ppp.strip(),mac_db[7&#58;]

       popadash = re.search('.*([a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}).*',ppp,re.IGNORECASE)
       if popadash:
             newpopadash=re.sub('-',dotreplace,popadash.group(1))[0:6]
             newpopadash_re=re.compile(newpopadash,re.IGNORECASE)
             for mac_db in macs_lines:
                 vendor=re.search(newpopadash_re,mac_db)
                 if vendor:
                    print ppp.strip(),mac_db[7:]
</pre>
</div>
<p>Running it:</p>
<div class="cmd">
[root@darkstar ]# ./mac-finder.py</div>
<div class="cmdout">
&lt;now I copy paste output from arp -a in BSD&gt;<br />$ arp -a<br />
(10.99.99.150) at 00:50:56:95:74:72 on em0 [ethernet]<br />
 (10.99.99.254) at 00:09:0f:31:c8:24  on em0 [ethernet]<br /> &lt;Hit CTRL+D to signal the end of input&gt;<br />
 (10.99.99.150) at 00:50:56:95:74:72 on em0 [ethernet] VMware, Inc.<br />
 (10.99.99.254) at 00:09:0f:31:c8:24 on em0 [ethernet] Fortinet Inc.</div>
]]></content:encoded>
			<wfw:commentRss>http://yurisk.info/2010/07/02/mac-finder-script/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Autologin Expect scripts for telnet/ssh</title>
		<link>http://yurisk.info/2008/09/21/autologin-expect-scripts-for-telnetssh/</link>
		<comments>http://yurisk.info/2008/09/21/autologin-expect-scripts-for-telnetssh/#comments</comments>
		<pubDate>Sun, 21 Sep 2008 17:28:02 +0000</pubDate>
		<dc:creator>Yuri</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[Expect]]></category>

		<guid isPermaLink="false">http://yurisk.wordpress.com/?p=25</guid>
		<description><![CDATA[Tired of typing over and over  your username/password when using telnet/ssh ? Here are Expect http://expect.nist.gov/ scripts to autologin by Telnet and ssh Notes: - Yes, it is not secure to keep you username/password saved somewhere, so know what you do . In my opinion  as long as this is a dedicated for remote logins [...]]]></description>
			<content:encoded><![CDATA[<p>Tired of typing over and over  your username/password when using<br />
telnet/ssh ? Here are Expect <a href="http://expect.nist.gov/">http://expect.nist.gov/</a> scripts to autologin by Telnet and ssh<br />
Notes:<br />
- Yes, it is not secure to keep you username/password saved somewhere, so know<br />
what you do . In my opinion  as long as this<br />
is a dedicated for remote logins server, that has no access from outside, and hardened accordingly<br />
(pertinent to the scripts &#8211; only owner/root can read user&#8217;s home folder, etc.,) the risk is acceptable.</p>
<p>Note 2: password is saved in a file named &#8220;sword&#8221;</p>
<p>cat tel<br />
#!/usr/local/bin/expect   Change to the location of your Expect package<br />
 <br />
proc Usage {} {<br />
  puts &#8220;\n tel &lt;equipment to enter&gt; \n&#8221;<br />
  return<br />
            }<br />
 </p>
<p>set  argnumber  [llength $argv]<br />
 <br />
if {$argnumber==0} {<br />
      puts &#8220;You need to specify at least one piece of equipment to log into\n&#8221;<br />
      Usage<br />
      exit<br />
 <br />
   }  elseif {$argnumber&gt;1}  {<br />
       puts &#8220;You specified too many arguments, only one please\n&#8221;<br />
 <br />
      Usage<br />
       exit<br />
                  }<br />
 <br />
set hostName [lindex $argv 0]<br />
 <br />
 puts &#8220;Entering $hostName&#8221;<br />
 set username &#8220;myusername&#8221;<br />
 set HANDL [open "sword"]<br />
 set password [gets $HANDL]<br />
 close $HANDL<br />
 spawn telnet $hostName<br />
 expect {[Uu]sername*} {<br />
  send &#8220;$username\r&#8221;<br />
 }<br />
 <br />
 expect {[Pp]assword:} {<br />
 send &#8220;$password\r&#8221;<br />
 }<br />
 </p>
<p>#Cisco specific block &#8211; to enter enable level, you may remove this block if not needed<br />
 expect {*#}  {<br />
 send &#8220;enable\r&#8221;  }<br />
 <br />
 expect {[Pp]assword:} {<br />
 send &#8220;$password\r&#8221;<br />
 }<br />
 #End of Cisco specific block</p>
<p> interact<br />
 </p>
<p>Now SSH login script<br />
&gt; cat essh<br />
#!/usr/local/bin/expect   Change to the location of your Expect package<br />
 <br />
proc Usage {} {<br />
  puts &#8220;\n essh  &lt;equipment to enter&gt; \n&#8221;<br />
  return<br />
            }<br />
 </p>
<p>set  argnumber  [llength $argv]<br />
 <br />
if {$argnumber==0} {<br />
      puts &#8220;You need to specify at least one piece of equipment to log into\n&#8221;<br />
      Usage<br />
      exit<br />
 <br />
   }  elseif {$argnumber&gt;1}  {<br />
       puts &#8220;You specified too many arguments, only one please\n&#8221;<br />
 <br />
      Usage<br />
       exit<br />
                  }<br />
 <br />
set hostName [lindex $argv 0]<br />
 <br />
 puts &#8220;Entering $hostName&#8221;<br />
 set username &#8220;myusername&#8221;<br />
 set HANDL [open "sword"]<br />
 set password [gets $HANDL]<br />
 spawn ssh $hostName<br />
 <br />
 expect {[Pp]assword:} {<br />
 send &#8220;$password\r&#8221;<br />
 }</p>
<p>#Again goes Cisco &#8211; specific block , remove if not needed<br />
 expect {*#}  {<br />
 send &#8220;enable\r&#8221;  }<br />
 <br />
 expect {[Pp]assword:} {<br />
 send &#8220;$password\r&#8221;<br />
 }<br />
 #End of Cisco &#8211; specific block</p>
<p> interact</p>
]]></content:encoded>
			<wfw:commentRss>http://yurisk.info/2008/09/21/autologin-expect-scripts-for-telnetssh/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>find quicky</title>
		<link>http://yurisk.info/2008/09/06/find/</link>
		<comments>http://yurisk.info/2008/09/06/find/#comments</comments>
		<pubDate>Sat, 06 Sep 2008 07:55:17 +0000</pubDate>
		<dc:creator>Yuri</dc:creator>
				<category><![CDATA[Linux]]></category>

		<guid isPermaLink="false">http://yurisk.info/?p=4</guid>
		<description><![CDATA[The few find templates I find useful in a day to day job. The ones below were of great help when I had to clean Esafe that had more than 100,000 files in the spool ! So usual shell wild-card expansion didn&#8217;t work (try to do ls in a folder with 130000 files So I [...]]]></description>
			<content:encoded><![CDATA[<p>The few <code>find</code> templates I find useful in a day to day job.</p>
<p>The ones below were of great help when I had to clean Esafe that had more<br />
than 100,000 files in the spool ! So usual shell wild-card expansion didn&#8217;t work<br />
(try to do <code>ls</code> in a folder with 130000 files <img src='http://yurisk.info/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' />  So I removed files<br />
by date &#8211; files created last 24 hours per remove.<br />
<code><br />
find . -mtime 0 -exec rm -f {} \;<br />
find . -mtime 0 # find files created/modified within the past 24 hours<br />
find . -mtime -1 # find files created/modified within the past 0 - 24 hours<br />
find . -mtime 1 # find files modified between 24 and 48 hours ago<br />
find . -mtime +1 # find files modified more than 48 hours ago<br />
find . -mmin +3 -mmin -10 # find files modifed between 4 and 9 minutes<br />
</code><br />
Default is  logical AND between clauses<br />
NB the <code>-regexp</code> switch to the find looks for a complete match !<br />
 Finding by permission pattern and then removing:<br />
- FInd files that have at LEAST following permissions set<br />
<code>find . -type f -perm -0750 -exec rm -f {} \;</code><br />
 Find files with ANy of the permissions set:<br />
<code>find . -type f -perm +0750 -exec rm -f {} \;</code><br />
and finally find files with pattern EXACTLY matching :<br />
<code>find . -type f -perm 0750 -exec rm -f {} \;</code><br />
Find by UID filetype and size:<br />
	<code>find . -type f -uid 0 -size +2k -exec ls -l {} \;</code><br />
	modifiers to size switch: b w k c</p>
]]></content:encoded>
			<wfw:commentRss>http://yurisk.info/2008/09/06/find/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>
