Registrations to Open-AudIT forums are now closed. To ask any new questions please visit Opmantek Community Questions.

Open-AudIT

What's on your network?
It is currently Fri Apr 19, 2024 5:35 pm

All times are UTC + 10 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 5 posts ] 
Author Message
PostPosted: Tue Aug 28, 2007 2:56 am 
Offline
Moderator
User avatar

Joined: Tue Jan 25, 2005 3:09 am
Posts: 2140
Location: Scotland
I have been meaning to add this code for a while, but there have been other changes going on with the audit.vbs file which made my original idea "break" audit.vbs.

What I have done is add in a line at the start of the audit.vbs file.
[code]
this_config_url = "http://localhost/openaudit/scripts/audit.config.defaults"
[/code]

and the following section

[code]
dim filesys
Set filesys = CreateObject("Scripting.FileSystemObject")
'
If not filesys.FileExists(this_config) Then
'
' This section takes a look at the local audit.config, and if there is none, it makes one from the server URL
' The idea is to allow us to throw the audit.vbs file to a browser and have it grab the config it needs.
' We should only need to set one thing, namely the URL from which we will grab the remainder of the config.
'
'
' We assume the local config file will always be audit.config
this_config = "audit.config"

' Now we open the web page where the remote config lives
Set WshShell = WScript.CreateObject("WScript.Shell")

Set http = CreateObject("Microsoft.XmlHttp")
' ...and we grab it..
http.open "GET",this_config_url, FALSE
http.send ""
'
Set config_file = CreateObject("Scripting.FileSystemObject")
Set our_config = config_file.OpenTextFile( this_config, ForWriting, True)
'... and post it to our local config.
our_config.write http.responseText
End If
' End of web config script.
'
' break (this is a good point to break if testing the config)

[/code]
This URL is checked if there is no local audit.config file,. A set of defaults are send to the audit.vbs from the URL which audit.vbs then writes to the local audit.config file.

The idea being that we can script this in such a way that when we need to create a new audit for or from a new location, we simply modify this url.
We then create a new audit.config.(location) file on the web server and run the audit.vbs from wherever we want.

Since the only change we need is the first line of audit.vbs, we can easily script this on the web server.

Therefore we can now store all of the config info in pages on the server. We can also create new locations on the web server with an Audit This Location button which will throw back a suitably modified audit.vbs

If this is not clear let me know and I will explain further.

The mod should do nothing if audit.config already exists.

Please read the next section carefully: Proceed with caution....

To test, copy your current audit.config (just in case) and modify audit.config.defaults on the web server to match.
Now mod the URL at the start of the new audit.vbs to point to the web server, note you are best using the Fully qualified name of the server rather than localhost, even if you are running mainly from the OA host, if you do this the script will theoretically work from wherever you want to run it.

PLEASE NOTE as it stands there is not check for the validity of this URL, so if audit.vbs breaks at abot line 61, check the URL and the config file.

Remove the existing audit.config. (Thats why I told you to take a copy of it... What do you mean you weren't listening! :twisted: )
Now run audit.vbs magically your audit.config should re-appear and the audit should go smoothly as before.

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]


Top
 Profile  
Reply with quote  
PostPosted: Fri Sep 14, 2007 8:43 pm 
Offline
Open-AudIT Fellow

Joined: Thu May 17, 2007 5:47 pm
Posts: 568
Location: Italy
Hi Andrew,
I had to remove line 169 from audit.vbs
[code]
Const ForAppending = 8
[/code]
to make it working. ForAppending was declared before on line 25.


Top
 Profile  
Reply with quote  
PostPosted: Fri Sep 14, 2007 10:02 pm 
Offline
Moderator
User avatar

Joined: Tue Jan 25, 2005 3:09 am
Posts: 2140
Location: Scotland
Can you think of any problems this method might cause?

I think it may be the way to go, for the majority of us, we can see the audit server from the auditing location (otherwise we wouldn't be able to post back the results) so it makes sense to keep the config there too as it will allow us to modify the config from the web pages.

For local audits, we can keep a local copy of the config.

The only problem I have thought of is security. We really need to be able to authenticate the script, to avoid the possibility of...
1) Un-authorised users seeing the config and therefore potentially seeing ldap users and password details used by the script.
2) Malicious injections into the database from unauthorised scripts.

Obviously our current method also exposes this info if we are not careful, so things are no worse with this method.

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]


Top
 Profile  
Reply with quote  
PostPosted: Sat Sep 15, 2007 1:03 am 
Offline
Contributor

Joined: Fri Jul 14, 2006 1:16 am
Posts: 151
Location: Iowa
I would actually like to see this go a step further. I would like to see a script on the auditing server that downloads the config and the audit.vbs. Then I wouldn't have to update the audit script on multiple machines. I would guess that a script that only downloads files would need a lot less updating than the audit script would.


Top
 Profile  
Reply with quote  
PostPosted: Sat Sep 15, 2007 2:10 am 
Offline
Moderator
User avatar

Joined: Tue Jan 25, 2005 3:09 am
Posts: 2140
Location: Scotland
[quote="glampe"]I would actually like to see this go a step further. I would like to see a script on the auditing server that downloads the config and the audit.vbs. Then I wouldn't have to update the audit script on multiple machines. I would guess that a script that only downloads files would need a lot less updating than the audit script would.


That's the idea, except you only need to download the Audit.vbs as the config is kept on the server.
If you think about it, the server can create the config dynamically, so we can use the calling script to work out where it is, and request its config

Something like ...
[code]
...Pseudocode
this_config_url = "http://support.cmarine.local/openaudit/list_export_config.php"
Dim ComputerObject
set ComputerObject = Wscript.CreateObject("Wscript.Network" )
GetComputerName = ComputerObject.ComputerName
Set ob = nothing
this_config_url=this_config_url + "?location=" + GetComputerName
...etc
[/code]

The only line what ever needs to change in the script is line 1 which can be set using the OA Admin>Config page.
All else will be generated dynamically depending on the machine name.

Then we can have a link which will throw the script to the browser, (with the first line set correctly).
After this it is down to the server to create a suitable response to the calling URL which includes the config variables suitable for that location.

Obviously if you run the script from elsewhere then it will fail, unless there is a valid local audit.config file.

... your thoughts?

(BTW can you post your working audit.vbs as I have slightly mangled mine, and it would save a lot of backtracking in the SVN)

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 5 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group