pts_ldap

#!/usr/bin/perl -w
############################################################################
##
## Netezza an IBM Company Copyright 2011
##
## Name: nz-ldap-tools.pl
##
## Author: Adam Currier
##
## Description:
## ------------
## This script is used for NPS LDAP diagnostics
## It is not written well - only to work. Putting checks into subroutines
## and splitting into modules should be done in the future ;)
##
############################################################################
system $^O eq 'MSWin32' ? 'cls' : 'clear';
$? = 1; # print out buffered text
my $REV = "1.0b"; # script revision
use Term::ANSIColor;
use Cwd;
# include list
use lib "../install_modules";
use get_system;
use print_color;
# directories
my $DIR = getcwd;
# global
my $SPACER = 55;
#
# add time base to file name
#
my $time = `date`;
my ($dummy, $mon, $day, $year);
($dummy, $mon, $day, $time, $dummy, $year) = split(/s+/, $time);
my $FINAL_RESULTS_FILE = "../pts_logs/ldap_check_".$mon."_".$day."_".$time."_".
$year.".txt";
#
# Check user for root
#
my $user = `whoami`;
if ($user !~ /^root$/)
{
$print = "Check user is root ";
print("You must be root to run this script!n");
exit;
} else {
# print banner
my $print = "-------------------------BASE CHECK";
my $line = ("-" x (($SPACER + 6) - length($print)));
$print = $print.$line."n";
print_color::color_change_yellow($print, $FINAL_RESULTS_FILE);
$print = "Check user is root ";
print_color::printout($print, $FINAL_RESULTS_FILE);

print_color::print_space($print, $FINAL_RESULTS_FILE, $SPACER);
print_color::color_change_green("[PASS]n", $FINAL_RESULTS_FILE)
}
$nz_file="/nz/lost+found";
if (-e $nz_file)
{
$print = "Check for active host ";
print_color::color_change_green("[PASS]n",
$FINAL_RESULTS_FILE);
}else {
$print = "Check for active host ";
print_color::print_space($print, $FINAL_RESULTS_FILE,
$SPACER);
print_color::color_change_red("[FAIL]n",
$print = "-" x ($SPACER + 6);
print_color::color_change_yellow("$printn",
print("You must run this from the active host!nnn");
exit;
}
$print = "Check NPS is Online";
# check to see if online or not
my $state = `su - nz -c "nzstate" 2>&1`;
if ($state =~ /Online/i || $state =~ /paused/i)
{
print_color::color_change_green("[PASS]n", $FINAL_RESULTS_FILE);
}
else
{
print_color::color_change_yellow("[WARN]n", $FINAL_RESULTS_FILE);
}
# check if we have FTP access:
my $ftp = '1';
if ($ftp ne '') {
$print = "Check FTP access ";
} else {
$print = "Check FTP access ";
print_color::color_change_red("[FAIL]n", $FINAL_RESULTS_FILE);
}
$print = "Check LDAP tools installed";

# check to see if openldap-clients installed or not
my $ldap_tools = `rpm -qa | grep openldap-clients`;
if ($ldap_tools ne '')
{
}
else
{
}
#check if we have strace installed:
my $ftp = `rpm -qa | grep -i strace`;
if ($ftp ne '') {
$print = "Check STRACE installed ";
} else {
$print = "Check STRACE installed ";
print_color::color_change_yellow("[WARN]n",
}
# remove the file
system("rm -rf $FINAL_RESULTS_FILE");
# global for failed
my $FAIL = 0;
# begin
main();
#
# Function: put the base functionality checks here
#
sub main
{
# print banner
my $print = "-----------------------SYSTEM CHECK";
# check /nz/data/pg_hba.conf file for value lowercase
my $pghba = `egrep -v '^(#|$)' /nz/data/pg_hba.conf 2>/dev/null | grep
lowercase`;
if ($pghba eq '') {
$print = "Check pg_hba.conf ";

} else {
$print = "Check pg_hba.conf ";
}
# check /nz/data/config/ldap.conf' ownership and permissions:
my $permission = `ls -al /nz/data/config/ldap.conf 2>/dev/null | egrep
'^(-rw).*nz.*nz'`;
if ($permission ne '') {
$print = "Check ownership and permissions ";
} else {
$print = "Check ownership and permissions";
}
# check that the libssl.so.4 symlink points to libssl.so.0.9.7a like it's
supposed to
my $libssl4 = `ls -l /lib/libssl.so.4 | grep "libssl.so.6"`;
if ($libssl4 ne '') {
$print = "Check libssl.so.4 ";
} else {
$print = "Check libssl.so.4";
}
# check that the libssl.so.6 symlink points to libssl.so.0.9.8e like it's
supposed to
my $libssl6 = `ls -l /lib/libssl.so.6 | grep "libssl.so.0.9.8e"`;
if ($libssl6 ne '') {
} else {
}
# check that the libcrypto.so.4 symlink points to libcrypto.so.0.9.7a like it's
supposed to
my $libcrypto4 = `ls -l /lib/libcrypto.so.4 | grep "libcrypto.so.6"`;
if ($libcrypto4 ne '') {

$print = "Check libcrypto.so.4 ";
} else {
$print = "Check libcrypto.so.4";
}
# check that the libcrypto.so.6 symlink points to libcrypto.so.0.9.8e like it's
supposed to
my $libcrypto6 = `ls -l /lib/libcrypto.so.6 | grep
"libcrypto.so.0.9.8e"`;
} else {
}
network_check();
nps_check();
final_out_file(1);
# give a total status
$FAIL = final_status();
exit($FAIL);
}
#
# Function: put all network checks here
#
sub network_check
{
# print banner
my $print = "----------------------NETWORK CHECK";
# Check ping to ldap host
# Need to programmatically get the host name
my $host = `egrep '^host' /etc/ldap.conf | awk '{ print $2 }'`;
$host =~ s/^s+//;
$host =~ s/s+$//;
# add some exception handling here
if ($host eq '') {
$host = "fail.localhost.com";
}

#debug
#rint "ping -c 1 $host | grep '1 received'`";
if (`ping -c 1 $host | grep '1 received'` ) {
$print = "Check ping to LDAP server";
} else {
$print = "Check ping to LDAP server ";
}
#debug
#print "nc -z $host 389 |grep succeeded`";
if ($host eq "fail.localhost.com") {
$print = "Check port 389 accessible ";
} else {
my $port1 = `nc -z $host 389 |grep succeeded`;
if ($port1 ne '') {
} else {
}
my $port2 = `nc -z $host 636 | grep succeeded`;
if ($port2 ne '') {
} else {
}
}
}
#
# Function: NPS checks go here
#
sub nps_check
{
# print banner
my $print = "------------------------NPS CHECK";

# Check that NZSQL authentication is set to LDAP
my $ldap = `su - nz -c "nzsql -admin -c 'show authentication'" &>
/tmp/1`;
my $ldap2 = `grep ldap /tmp/1`;
if ($ldap2 ne '') {
$print = "Check SET AUTHENTICATION";
} else {
$print = "Check SET AUTHENTICATION";
}
# Check if we have some users who are authenticated locally (mixed mode)
my $mixed = `su - nz -c "nzsql -admin -c 'select count(*) from _t_user
where useauth = 1'" &> /tmp/2`;
my $mixed2 = `grep 0 /tmp/2`;
if ($mixed2 eq '') {
$print = "Check Mixed Mode";
} else {
$print = "Check Mixed Mode";
}
}
#
# Function: this will print out all the files to the log
#
sub final_status
{
my $number_of_fail = 1;
my $number_of_warn = 1;
# print out banner
my $print = "---------------------LDAP.CONF CHECK";
# $print = "Failing message ";
# print_color::printout($print, $FINAL_RESULTS_FILE);
# print_color::print_space($print, $FINAL_RESULTS_FILE, $SPACER);
# print_color::color_change_red("[FAIL]n", $FINAL_RESULTS_FILE);
#
# $print = "Warning message ";

# print_color::color_change_yellow("[WARN]n", $FINAL_RESULTS_FILE);
#
# $print = "Passing message ";
# print_color::color_change_green("[PASS]n", $FINAL_RESULTS_FILE);
# Check that ldap.conf doesn't have a line that begins with uri.
# if it does, warn - it may be legitiamte or it may point to 127.0.0.1 (jira
bug# )
my $uri = ègrep '^(uri)' /etc/ldap.conf`;
if ($uri eq '') {
$print = "Test URI line ";
} else {
$print = "Test URI line ";
}
# check that search attribute is sAMAccountName (Most often used for Active
Directory - otherwise WARN
my $pla = ègrep '^pam_login_attribute' /etc/ldap.conf | awk '{ print
$2 }'`;
$pla =~ s/^s+//;
$pla =~ s/s+$//;
#print "$pla n";
if ($pla eq 'sAMAccountName') {
$print = "Check search attribute ";
} else {
$print = "Check search attribute";
}
# check that the bind user isn't blank
my $binddn1 = ègrep '^binddn' /etc/ldap.conf | awk '{ print $2 }'`;
$binddn1 =~ s/^s+//;
$binddn1 =~ s/s+$//;
if ($binddn1 ne '') {
$print = "Check bind user";
} else {
$print = "Check bind user";
}

# check that the bind password isn't blank
my $bindpw1 = `egrep '^bindpw' /etc/ldap.conf | awk '{ print $2 }'`;
$bindpw1 =~ s/^s+//;
$bindpw1 =~ s/s+$//;
if ($bindpw1 ne '') {
$print = "Check bind password";
} else {
$print = "Check bind password";
}
# check that the libcrypto.so.4 symlink points to libcrypto.so.0.9.7a like it's
supposed to
"libcrypto.so.0.9.7a"`;
$print = "Check libcrypto.so.4 ";
} else {
print_color::print_space($print, $FINAL_RESULTS_FILE,
$SPACER);
}
# check that the libcrypto.so.6 symlink points to libcrypto.so.0.9.8e like it's
supposed to
"libcrypto.so.0.9.8e"`;
} else {
}
# print out banner
my $print = "--------------------LDAPSEARCH CHECK";
# Perform some ldapsearch tests:
my $host2 = `egrep '^host' /etc/ldap.conf | awk '{ print $2 }'`;
$host2 =~ s/^s+//;
$host2 =~ s/s+$//;
#print "$host2 n";

my $binddn = ègrep '^binddn' /etc/ldap.conf | awk '{ print $2 }'`;
$binddn =~ s/^s+//;
$binddn =~ s/s+$//;
#print "$binddn n";
my $bindpw = ègrep '^bindpw' /etc/ldap.conf | awk '{ print $2 }'`;
$bindpw =~ s/^s+//;
$bindpw =~ s/s+$//;
#print "$bindpw n";
my $base = ègrep '^base' /etc/ldap.conf | awk '{ print $2 }'`;
$base =~ s/^s+//;
$base =~ s/s+$//;
#print "$base n";
# if host is not real then skip these tests and fail:
# add some exception handling here
if ($host2 eq '') {
$host2 = "fail.localhost.com";
}
if ($host2 eq "fail.localhost.com") {
$print = "Perform test ldapsearch ";
$print = "Perform test ssl ldapsearch ";
} else {
my $ldaptest = `ldapsearch -x -D "$binddn" -b "$base" -H ldap://$host2 -w
$bindpw 2>/dev/null | wc -l`;
#print "$ldaptest n";
if ($ldaptest > 25) {
} elsif ($ldaptest > 1) {
} else {
}
my $ldaptest2 = `ldapsearch -x -D "$binddn" -b "$base" -H ldaps://$host2 -w
$bindpw 2>/dev/null | wc -l`;
#print "$ldaptest n";
if ($ldaptest2 > 25) {

} elsif ($ldaptest2 > 1) {
} else {
}
}
# print footer
print_color::color_change_yellow("$printn", $FINAL_RESULTS_FILE);
$print = "Log file - $FINAL_RESULTS_FILE";
print_color::color_change_green("$printn", $FINAL_RESULTS_FILE);
print_color::color_change_yellow("$printn", $FINAL_RESULTS_FILE);
}
#
# Function: this will print out all the files to the log
#
sub final_out_file
{
my $when = $_[0];
if ($when == 1)
{
# get all the files
for (my $sys_idx = 0; $sys_idx < @TESTS_NO_BOOTPSRV; $sys_idx++)
{
system("cat $TESTS_NO_BOOTPSRV[$sys_idx][$TEST_CMD].txt >>
$FINAL_RESULTS_FILE");
open DATA, ">>$FINAL_RESULTS_FILE";
print DATA "n";
close DATA;
}
}
else
{
for (my $sys_idx = 0; $sys_idx < @TESTS_BOOTPSRV; $sys_idx++)
{
system("cat $TESTS_BOOTPSRV[$sys_idx][$TEST_CMD].txt >>
$FINAL_RESULTS_FILE");
open DATA, ">>$FINAL_RESULTS_FILE";
print DATA "n";
close DATA;
}
}
}

pts_ldap

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to pts_ldap

Similar to pts_ldap (20)

pts_ldap