Open-AudIT

I have had a quick look at this, and the only gotcha so far is that the database is not updated with the tables for scheduling, we will need to add this in as an upgrade.
Its a bit of a show stopper, 'cos I cant test any further till I have the tables.
I dont however see any SQL in the files above to tell me how to do this, can you post, or modify the upgrade.php

Thanks.

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

OK I'm being a bit slow on the uptake here, I found the patches folder, but now I am unsure how to proceed, presumably it would be easier for me to let you provide patched copies of the files, and I will put them in the SVN. I have added the rest (including the patches, 'cos it was only at the point of sending everything to SVN when I spotted them ).

Should all be in SVN 1206, just need the patches applied, the menu updated and some testing.. we will need to change the version number to today, in case there have been other database updates since the code was written (the patches say 09.09.27 , we are on 09.11.15).

To add the tables manually, use....
[code]
DROP TABLE IF EXISTS `audit_commands`;
CREATE TABLE `audit_commands` (
`audit_cmd_id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
`audit_cmd_name` VARCHAR(100) NOT NULL default '',
`audit_cmd_command` VARCHAR(500) NOT NULL default '',
PRIMARY KEY(`audit_cmd_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

DROP TABLE IF EXISTS `audit_configurations`;
CREATE TABLE `audit_configurations` (
`audit_cfg_id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
`audit_cfg_name` VARCHAR(50) NOT NULL default '',
`audit_cfg_action` VARCHAR(25) NOT NULL default '',
`audit_cfg_type` VARCHAR(25) NOT NULL default '',
`audit_cfg_os` VARCHAR(25) NOT NULL default '',
`audit_cfg_max_audits` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_wait_time` INT(10) UNSIGNED NOT NULL default '1200',
`audit_cfg_ldap_conn` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_ldap_use_conn` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_audit_conn` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_audit_use_conn` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_audit_local` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_ldap_user` VARBINARY(255) NOT NULL default '',
`audit_cfg_ldap_pass` VARBINARY(255) NOT NULL default '',
`audit_cfg_ldap_server` VARCHAR(200) NOT NULL default '',
`audit_cfg_ldap_path` VARCHAR(200) NOT NULL default '',
`audit_cfg_ldap_page` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_filter` VARCHAR(200) NOT NULL default '',
`audit_cfg_filter_case` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_filter_inverse` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_audit_user` VARCHAR(200) NOT NULL default '',
`audit_cfg_audit_pass` VARCHAR(200) NOT NULL default '',
`audit_cfg_ip_start` VARCHAR(15) NOT NULL default '',
`audit_cfg_ip_end` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_pc_list` VARCHAR(2048) NOT NULL default '',
`audit_cfg_win_vbs` VARCHAR(200) NOT NULL default '',
`audit_cfg_com_path` VARCHAR(200) NOT NULL default '',
`audit_cfg_lin_sft` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_lin_sft_lst` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_sft_lst` VARCHAR(2048) NOT NULL default '',
`audit_cfg_lin_identity` VARCHAR(200) NOT NULL default '',
`audit_cfg_lin_url` VARCHAR(200) NOT NULL default '',
`audit_cfg_win_sft` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_win_url` VARCHAR(200) NOT NULL default '',
`audit_cfg_win_uuid` VARCHAR(10) NOT NULL default '',
`audit_cfg_nmap_int` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_nmap_srv` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_nmap_udp` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_nmap_tcp_syn` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_nmap_url` VARCHAR(200) NOT NULL default '',
`audit_cfg_nmap_path` VARCHAR(200) NOT NULL default '',
`audit_cfg_command_list` VARCHAR(2048) NOT NULL default '',
`audit_cfg_command_interact` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_log_enable` INT(10) UNSIGNED NOT NULL default '0',
`audit_cfg_mysql_ids` VARCHAR(200) NOT NULL default '',
`audit_cfg_cmd_list` VARCHAR(200) NOT NULL default '',
PRIMARY KEY(`audit_cfg_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

DROP TABLE IF EXISTS `audit_cron`;
CREATE TABLE `audit_cron` (
`audit_cron_id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
`audit_cron_active` INT(10) UNSIGNED NOT NULL default '0',
`audit_cron_interval` INT(10) UNSIGNED NOT NULL default '5',
`audit_cron_pid` INT(10) UNSIGNED NOT NULL default '0',
`audit_cron_service_enable` INT(10) UNSIGNED NOT NULL default '0',
`audit_cron_service_name` VARCHAR(200) NOT NULL default '',
`audit_cron_smtp_auth` INT(10) UNSIGNED NOT NULL default '0',
`audit_cron_smtp_port` INT(10) UNSIGNED NOT NULL default '25',
`audit_cron_smtp_from` VARCHAR(200) NOT NULL default '',
`audit_cron_smtp_user` VARBINARY(255) NOT NULL default '',
`audit_cron_smtp_pass` VARBINARY(255) NOT NULL default '',
`audit_cron_smtp_server` VARCHAR(100) NOT NULL default '',
`audit_cron_web_address` VARCHAR(200) NOT NULL default '',
PRIMARY KEY(`audit_cron_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

DROP TABLE IF EXISTS `audit_log`;
CREATE TABLE `audit_log` (
`audit_log_id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
`audit_log_message` VARCHAR(255) NOT NULL default '',
`audit_log_host` VARCHAR(255) NOT NULL default '',
`audit_log_schedule_id` VARCHAR(255) NOT NULL default '',
`audit_log_config_id` VARCHAR(255) NOT NULL default '',
`audit_log_time` INT(10) UNSIGNED NOT NULL default '0',
`audit_log_timestamp` INT(10) UNSIGNED NOT NULL default '0',
`audit_log_pid` INT(10) UNSIGNED NOT NULL default '0',
PRIMARY KEY(`audit_log_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

DROP TABLE IF EXISTS `audit_mysql_query`;
CREATE TABLE `audit_mysql_query` (
`audit_mysql_id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
`audit_mysql_cfg_id` INT(10) UNSIGNED NOT NULL default '0',
`audit_mysql_table` VARCHAR(50) NOT NULL default '',
`audit_mysql_field` VARCHAR(50) NOT NULL default '',
`audit_mysql_sort` VARCHAR(10) NOT NULL default '',
`audit_mysql_data` VARCHAR(500) NOT NULL default '',
PRIMARY KEY(`audit_mysql_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

DROP TABLE IF EXISTS `audit_schedules`;
CREATE TABLE `audit_schedules` (
`audit_schd_id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
`audit_schd_name` VARCHAR(100) NOT NULL default '',
`audit_schd_cfg_id` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_active` INT(10) UNSIGNED NOT NULL default '1',
`audit_schd_updated` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_type` VARCHAR(25) NOT NULL default '',
`audit_schd_strt_hr` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_strt_min` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_hr_frq_hr` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_hr_frq_min` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_hr_between` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_hr_strt_hr` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_hr_strt_min` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_hr_end_hr` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_hr_end_min` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_dly_frq` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_wk_days` VARCHAR(75) NOT NULL default '',
`audit_schd_mth_day` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_mth_months` VARCHAR(100) NOT NULL default '',
`audit_schd_last_run` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_next_run` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_log_disable` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_cron_line` VARCHAR(250) NOT NULL default '',
`audit_schd_email_log` INT(10) UNSIGNED NOT NULL default '0',
`audit_schd_email_list` VARCHAR(500) NOT NULL default '',
`audit_schd_email_subject` VARCHAR(100) NOT NULL default '',
`audit_schd_email_replyto` VARCHAR(100) NOT NULL default '',
`audit_schd_email_tt_html` VARCHAR(100) NOT NULL default '',
`audit_schd_email_tt_text` VARCHAR(100) NOT NULL default '',
`audit_schd_email_logo` VARCHAR(100) NOT NULL default '',
PRIMARY KEY(`audit_schd_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

DROP TABLE IF EXISTS `cron_log`;
CREATE TABLE `cron_log` (
`cron_log_id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
`cron_log_pid` INT(10) UNSIGNED NOT NULL default '0',
`cron_log_message` VARCHAR(100) NOT NULL default '',
`cron_log_timestamp` INT(10) UNSIGNED NOT NULL default '0',
PRIMARY KEY(`cron_log_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;
[/code]

I wont proceed any further till I have a copy of the patched files from chad...

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

Hi Andrew,

Sorry for the slow response time here! Work and personal stuff has been keeping me a little preoccupied lately I have a rather large patch for the files you've added. I've integrated most of the patches into SVN, so not much is needed to be done there. I've changed quite a few things though.

The major problems I've had is removing the stand alone audit settings page and moving it into the standard admin config page. I also eliminated a few options because I've made them seamless so people don't have to worry about what to configure, it will just do the "correct" thing. I also have an the upgrade and SQL code setup for new installs/upgrades. Since I moved the SMTP settings into the standard admin config area I needed to update the audit.pl file (and in turn the binary audit and audit.exe file) so it knows where to get the SMTP settings. However, I really wanted to make it so SMTP emails are sent by having the script send a POST to a PHP page to trigger the email go out. That way we only need to worry about SMTP stuff in PHP, and not in a Perl script as well.

Expect some updates sometime this week as I sort things out.

_________________
OA Server: Debian Squeeze w/ Apache2
Auditing: 700 Workstations, 250 or so Retail Terminals, about 75 Servers
OS's: Windows XP/2003/2008/2008 R2/Vista/7, Debian
LDAP: Active Directory 2008 R2

I have managed to make some progress with the code you previously posted. I did find a couple of issues.

1) I can set up an SMTP connection, but if I try to use authentication, it fails, saying I must provide a passwrord (obviously I am providing a password)
2) I cannot edit an SMTP connection to add a username and password, I see the same error.
3) The Nmap auditing doesn't include an optional servername to run the nmap from, this option would be good from the point of view of being able to push nmap to a remote LAN.
Nmap between subnets is of limited value as none of the MAC address related info is available (MAC level traffic is not passed between subnets, only IP level), and therefore
nmap must be run locally to the subnet being nmapped.
I will keep going and see if I can find any more, so far though I am very impressed.

EDIT: Oh... I knew there was something else, I cannot start the service, just keep getting a big red stop light, no clues... just wont start.. any ideas?

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

OK If I try to start the service manually with audit.pl I see...

[code]
./audit.pl --cron-start
DBD::mysql::db selectall_hashref failed: Table 'openaudit.audit_cron' doesn't exist at scripts/audit.pl line 337.
DBD::mysql::db selectall_hashref failed: Table 'openaudit.audit_cron' doesn't exist at scripts/audit.pl line 337.
[/code]

Where or how do I fix this?

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

BTW: Can perl fetch the modules it needs?

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

'audit_cron' is the table I used to store general settings for the audit.pl script. However, I've since re-named it 'audit_settings'. These tables are not created automatically yet though, unless you applied the patches from the patches folder to the SVN or created the tables yourself.

Btw - are you talking about the configuring a SMTP connection from the admin config area, or from the 'audit settings' page that is just that stand alone page with options for the service name, polling interval, etc? I've elminated the 'audit settings' stand alone page in my current version and it uses the standard 'admin config' area to do all the settings needed.

In the current version of the files I have, I utilize the SMTP connection defined from the 'LDAP/SMTP' area in 'admin config'. My plan is to not use the Perl script at all to send out emails, but to let the web page do it.

There isn't really an easy way for it to fetch the needed Perl modules, but it would be easy to include them somewhere in the 'lib' directory and then just add a path to there in the audit.pl file.

_________________
OA Server: Debian Squeeze w/ Apache2
Auditing: 700 Workstations, 250 or so Retail Terminals, about 75 Servers
OS's: Windows XP/2003/2008/2008 R2/Vista/7, Debian
LDAP: Active Directory 2008 R2

Any chance of merging your version with the SVN, it would save any confusion with patches etc.

It might be worth adding a check for Perl and the mudules on the setup page, with a hint when it fails to find them.
Shouldn't be a show stopper, for the installer, as the scheduled feature is optional, but would be good to increase the ease of install of OA.

FYI The SMTP error shows on the Admin page, but you may well have this fixed in the latest version.
[attachment=0] File comment: SMTP Edit Connection Error.

OA-EmailError.jpg [ 45.63 KiB | Viewed 14711 times ]

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

Oh boy, that was a rather embarrassing mistake lol. I fixed that along with a similar mistake I spotted nearby. It should now have no issues saving the connection if it uses authentication. Also, the slightly out-of-place checkbox shouldn't look so weird anymore.

I merged the all the latest files I have for the web-schedule stuff into SVN. I tried to test it as much as possible, and I squashed a lot of bugs from it in the past week. I've also rewritten some portions of it, especially the ajax pages. Stopping/starting the service from the web interface should be a little more reliable now.

There's still quite a few things I need to look into. I can still think of different situations in which the audit.pl script would behave unexpectedly. There's just a lot of cases to cover though when it's coded to work on both Windows and Linux =/

Anyway, I still didn't add menu entries for it. It would be nice to get someone to test the merged files a bit and let me know what issues they encounter. Btw - I moved general settings on the audit settings page into the general tab of the admin config area. Coincidentally I think adding fieldsets to that tab also fixed a problem where the text kept disappearing on from the labels on that tab in IE6...

_________________
OA Server: Debian Squeeze w/ Apache2
Auditing: 700 Workstations, 250 or so Retail Terminals, about 75 Servers
OS's: Windows XP/2003/2008/2008 R2/Vista/7, Debian
LDAP: Active Directory 2008 R2

OK, the SMTP stuff now works fine, but I still cannot start the Scheduler. This is probably a permissions issue, so perhaps we need to add some Run As credentials so we can be sure that we have the necessary rights to start. Not had enough time to investigate, and a few pointers in the right direction would be appreciated.

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

Hmmm...interesting. Are you trying to run it on Windows or Linux? Do you have the option checked in the admin config area to only use the audit.pl file? Also, what output do you get if you try to start the script from the shell using --cron-start? Is it still the same database error messages?

_________________
OA Server: Debian Squeeze w/ Apache2
Auditing: 700 Workstations, 250 or so Retail Terminals, about 75 Servers
OS's: Windows XP/2003/2008/2008 R2/Vista/7, Debian
LDAP: Active Directory 2008 R2

Running from an Ubuntu Linux box, yes I checked the Only Use audit.pl file, and the final question I see...

[code]
andrew@support:~$ su
Password:
root@support:/home/andrew# cd /var/www
root@support:/var/www# cd openaudit
root@support:/var/www/openaudit# cd scripts
root@support:/var/www/openaudit/scripts# ls *.pl
audit.pl
root@support:/var/www/openaudit/scripts# ./audit.pl --cron-start


[/code]

.... nothing?!


Other issues...

FATAL: Could not find view list_viewdef_cron_log.php

and

The requested URL /openauditsvn/audit_cron_settings.php was not found on this server.

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

Nothing may be a little deceiving The reason it probably displays nothing is because it is actually working...there are just no schedules added. So, it just sits in the mainloop with nothing to do, as there are no schedules to add or monitor. At least that's an educated guess on my part. Do you have any schedules added?

Also, to see if it's a permissions issue with the apache user stopping it from running, you could 'su www-data' as root, then try to run the script again.

Also, do you get the same result if you run the 'audit' file using '--cron-start' ? That's just a compiled version of the audit.pl file with all the needed modules included within it.

Btw - I removed the audit_cron_settings.php page, as I merged the configuration options into the admin config area. So that page no longer has a purpose in this newer version. The list_viewdef_cron_log.php file has been renamed to list_viewdef_ws_log.php.

_________________
OA Server: Debian Squeeze w/ Apache2
Auditing: 700 Workstations, 250 or so Retail Terminals, about 75 Servers
OS's: Windows XP/2003/2008/2008 R2/Vista/7, Debian
LDAP: Active Directory 2008 R2

I still cant start the service from the web page. Can you update all of your changes to to the SVN version, including menu_array.php I am sure I must be missing something.[attachment=0]
OA-Error.png [ 31.28 KiB | Viewed 14646 times ]

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

All my changes are in SVN, I haven't left anything out. I've not tested the exe on Windows 7 though, so I'm unsure if the windows service function of the exe works there. If I can find a copy here at work I can give it a shot when I have some time. I tested the custom service installation on my Windows XP box just now and it worked without issue.

To manually run a configuration that is in the DB, you just need it's ID. The easiest way to find it is to just edit the configuration and the ID will show up in the URL. The command to run it would be './audit.pl --run-config <id> --daemon'. The daemon option will force the process to fork if you are running on linux.

Edit: I'll upload the menu changes in a bit.

_________________
OA Server: Debian Squeeze w/ Apache2
Auditing: 700 Workstations, 250 or so Retail Terminals, about 75 Servers
OS's: Windows XP/2003/2008/2008 R2/Vista/7, Debian
LDAP: Active Directory 2008 R2