Authentication exploitation - Revision history

Tcepo: /* authentication-update */

2022-03-04T19:48:02Z

authentication-update

← Older revision		Revision as of 21:48, 4 March 2022
Line 40:		Line 40:

	==== authentication-update ====		==== authentication-update ====
	<~~pre~~>		<syntaxhighlight lang="bash">
	#!/bin/bash		#!/bin/bash
	#http://infocepo.com/wiki/index.php/Authentication_exploitation		#http://infocepo.com/wiki/index.php/Authentication_exploitation
Line 165:		Line 165:
	# End init		# End init
	cd -		cd -
	</~~pre~~>		</syntaxhighlight>

Tcepo at 23:24, 11 December 2016

2016-12-11T23:24:17Z

← Older revision		Revision as of 01:24, 12 December 2016
Line 42:		Line 42:
	<pre>		<pre>
	#!/bin/bash		#!/bin/bash
			#http://infocepo.com/wiki/index.php/Authentication_exploitation

	#20161103 APA UPDATE		#20161103 APA UPDATE
Line 48:		Line 49:
	#Debug		#Debug

	~~cd $(dirname $0)~~		# == settings ==
			MyRemoteDir="/"
	# == ~~Policies~~ settings ==
	~~MyExpireLenght~~="90"

	~~# == Other settings ==~~
	MyInfra='<infra_name>'		MyInfra='<infra_name>'
	MyCompany='<company>'		MyCompany='<company>'
Line 64:		Line 61:
	L equipe systeme"		L equipe systeme"

	~~MyRemoteDir~~=~"/"		# === Policies settings ===
			MyExpireLenght="90"

			# == Init ==
			cd $(dirname $0)

			if [ ! -f .htpasswd ] ;then
			touch .htpasswd
			chmod 600 .htpasswd
			fi
	# == Processing ==		# == Processing ==
	# Send mail for each group		# Send mail for each group
Line 73:		Line 78:
	IFS=';' read MyGroup MyMail MyDate <<< $MyLine		IFS=';' read MyGroup MyMail MyDate <<< $MyLine
	MyAppUrlList=$(grep $MyGroup authentication.cfg \|grep -v ^"\ *#" \|awk 'BEGIN{FS=";"}{print " "$1", "$2}' \|sort -u)		MyAppUrlList=$(grep $MyGroup authentication.cfg \|grep -v ^"\ *#" \|awk 'BEGIN{FS=";"}{print " "$1", "$2}' \|sort -u)
			MyHtpasswdOld=$(grep "^${MyGroup}:" .htpasswd)

	### Paramaters OK?		### Paramaters OK?
	if { [ "$(date +"%s")" -gt "$(date -d "$MyDate" +"%s")" ] \|\| [ -z "$MyDate" ] ;} && [ ! -z "$MyMail" ] && [ ! -z "$MyAppUrlList" ] ;then		if { [ "$(date +"%s")" -gt "$(date -d "$MyDate" +"%s")" ] \|\| [ -z "$MyDate" ] \|\| [ -z "${MyHtpasswdOld}" ] ;} && [ ! -z "$MyMail" ] && [ ! -z "$MyAppUrlList" ] ;then

	##### Information mail		##### Information mail
Line 114:		Line 120:

	# === Store password hash ===		# === Store password hash ===
	~~grep~~ "^${~~MyGroup~~}:" ~~.htpasswd~~ >>.htpasswd.history		echo "${MyHtpasswdOld}" >>.htpasswd.history
	htpasswd -b .htpasswd $MyGroup $MyPasswd		htpasswd -b .htpasswd $MyGroup $MyPasswd

Line 137:		Line 143:
	MyServer="${MyFilter}"		MyServer="${MyFilter}"

	~~ssh $MyServer "~~>/tmp/.$$ ;chmod 600 /tmp/.$$~~" </dev/null~~		>/tmp/.$$ ;chmod 600 /tmp/.$$
	MyGroupList="$(echo $MyGroups \|tr ',' ' ')"		MyGroupList="$(echo $MyGroups \|tr ',' ' ')"
	for MyGroup in $MyGroupList ;do		for MyGroup in $MyGroupList ;do
	(grep "^$MyGroup:" .htpasswd ~~\|ssh $MyServer "cat -~~ >>/tmp/.$$~~" )</dev/null~~		grep "^$MyGroup:" .htpasswd >>/tmp/.$$
	done		done

Line 149:		Line 155:
	MyConfigFile="${MyRemoteDir}etc/httpd/htpasswd/.$(echo $MyLocation \|tr -c '[:alnum:]\r\n' '_').htpasswd"		MyConfigFile="${MyRemoteDir}etc/httpd/htpasswd/.$(echo $MyLocation \|tr -c '[:alnum:]\r\n' '_').htpasswd"

	~~ssh $MyServer "~~sort -u /tmp/.$$ -o /tmp/.$$ ;diff /tmp/.$$ $MyConfigFile \|\|cat /tmp/.$$ >$MyConfigFile ;rm -f /tmp/.$$" </dev/null		sort -u /tmp/.$$ -o /tmp/.$$
			scp -p /tmp/.$$ ${MyServer}:/tmp/.$$ &&\
			rm -f /tmp/.$$ &&\
			sleep 1 &&\
			ssh $MyServer "diff /tmp/.$$ $MyConfigFile \|\|cat /tmp/.$$ >$MyConfigFile ;rm -f /tmp/.$$" </dev/null &&\
			sleep 1
	done		done

			# End init
	cd -		cd -
	</pre>		</pre>

Tcepo at 20:24, 8 December 2016

2016-12-08T20:24:09Z

← Older revision		Revision as of 22:24, 8 December 2016
Line 38:		Line 38:
	==== cron ====		==== cron ====
	2 2 * * * cd &&. ./.bash_profile &&cd <ScriptDir> &&./authentication-update		2 2 * * * cd &&. ./.bash_profile &&cd <ScriptDir> &&./authentication-update

			==== authentication-update ====
			<pre>
			#!/bin/bash

			#20161103 APA UPDATE
			#20161202 APA ADD
			#V2 optimization :date expire
			#Debug

			cd $(dirname $0)

			# == Policies settings ==
			MyExpireLenght="90"

			# == Other settings ==
			MyInfra='<infra_name>'
			MyCompany='<company>'
			MyEmailSupport='<email_support>'

			MyFoot="Ceci est un email automatique. Veuillez ne pas repondre, SVP.
			Pour toutes questions relatives a cet email, merci de contacter le Centre De Service a ${MyEmailSupport}.

			Cordialement,
			L equipe systeme"

			MyRemoteDir=~"/"

			# == Processing ==
			# Send mail for each group
			grep -v ^"\ *#" authentication.mail.cfg \|while read MyLine ;do

			### Paramaters load
			IFS=';' read MyGroup MyMail MyDate <<< $MyLine
			MyAppUrlList=$(grep $MyGroup authentication.cfg \|grep -v ^"\ *#" \|awk 'BEGIN{FS=";"}{print " "$1", "$2}' \|sort -u)

			### Paramaters OK?
			if { [ "$(date +"%s")" -gt "$(date -d "$MyDate" +"%s")" ] \|\| [ -z "$MyDate" ] ;} && [ ! -z "$MyMail" ] && [ ! -z "$MyAppUrlList" ] ;then

			##### Information mail
			if [ -z "$MyDate" ] ;then
			echo "Subject: [${MyInfra}] Information applications internes

			Bonjour,

			Voici les URLS des applications ${MyCompany} :

			${MyAppUrlList}

			${MyFoot}" \|sendmail "$(echo $MyMail \|tr ',' ' ')"
			sleep 1
			fi

			##### Password mail

			MyLogin=$MyGroup
			MyPasswd=$(pwgen 14 1)
			MyAppList=$(grep $MyGroup authentication.cfg \|grep -v ^"\ *#" \|awk 'BEGIN{FS=";"}{print " "$1}')

			echo "Subject: [${MyInfra}] Codes d acces applications internes

			Bonjour,

			Voici vos nouveaux codes d acces :

			login=${MyLogin}
			passwd=${MyPasswd}

			Pour les applications ${MyCompany} suivantes :

			${MyAppList}

			${MyFoot}" \|sendmail "$(echo $MyMail \|tr ',' ' ')"
			sleep 1

			# === Store password hash ===
			grep "^${MyGroup}:" .htpasswd >>.htpasswd.history
			htpasswd -b .htpasswd $MyGroup $MyPasswd

			# === Date update for expiration password ===
			grep $MyGroup authentication.mail.cfg >>authentication.mail.cfg.history
			MyNewDate=$(date -d "+${MyExpireLenght} days" '+%Y%m%d')
			sed -i "s/^${MyGroup};${MyMail}.*/${MyGroup};${MyMail};${MyNewDate}/g" authentication.mail.cfg
			fi
			done

			sort -u .htpasswd -o .htpasswd

			# == Remote update ==
			grep -v ^"\ *#" authentication.cfg \|while read MyLine ;do

			### Read url and groups
			IFS=';' read MyApplicationID MyUrlFull MyGroups <<< $MyLine

			MyFilter=$(MyPatern='^https?://([^/]+).*$'
			echo $MyUrlFull \|\
			sed -rn "s#$MyPatern#\1#p" \|head -1)
			MyServer="${MyFilter}"

			ssh $MyServer ">/tmp/.$$ ;chmod 600 /tmp/.$$" </dev/null
			MyGroupList="$(echo $MyGroups \|tr ',' ' ')"
			for MyGroup in $MyGroupList ;do
			(grep "^$MyGroup:" .htpasswd \|ssh $MyServer "cat - >>/tmp/.$$" )</dev/null
			done

			MyFilter=$(MyPatern='^https?://[^/]+/+(.+)/+[^/]*$'
			echo $MyUrlFull \|\
			sed -rn "s#$MyPatern#\1#p" \|head -1)
			MyLocation="${MyFilter}"
			MyConfigFile="${MyRemoteDir}etc/httpd/htpasswd/.$(echo $MyLocation \|tr -c '[:alnum:]\r\n' '_').htpasswd"

			ssh $MyServer "sort -u /tmp/.$$ -o /tmp/.$$ ;diff /tmp/.$$ $MyConfigFile \|\|cat /tmp/.$$ >$MyConfigFile ;rm -f /tmp/.$$" </dev/null
			done

			cd -
			</pre>

Tcepo at 20:19, 8 December 2016

2016-12-08T20:19:21Z

← Older revision		Revision as of 22:19, 8 December 2016
Line 1:		Line 1:
	== Guide rapide ==		== Guide rapide ==
	* Configurer ~~'''~~[authentication.mail.cfg]~~'''~~		* Configurer [[#authentication.mail.cfg\|authentication.mail.cfg]]
	* Configurer ~~'''~~[authentication.cfg]~~'''~~		* Configurer [[#authentication.cfg\|authentication.cfg]]
	* Lancer ~~'''~~[authentication-update]~~'''~~ avec le compte d exploitation		* Lancer [[#authentication-update\|authentication-update]] avec le compte d exploitation

	== Description ==		== Description ==

Tcepo at 19:54, 8 December 2016

2016-12-08T19:54:43Z

← Older revision		Revision as of 21:54, 8 December 2016
Line 2:		Line 2:
	* Configurer '''[authentication.mail.cfg]'''		* Configurer '''[authentication.mail.cfg]'''
	* Configurer '''[authentication.cfg]'''		* Configurer '''[authentication.cfg]'''
	* Lancer '''[authentication-update]''' avec le compte d'exploitation		* Lancer '''[authentication-update]''' avec le compte d exploitation

	== Description ==		== Description ==

Tcepo at 19:53, 8 December 2016

2016-12-08T19:53:54Z

← Older revision		Revision as of 21:53, 8 December 2016
Line 1:		Line 1:
	== Guide rapide ==		== Guide rapide ==
	* Configurer '''[authentication.mail.cfg]'''		* Configurer '''[authentication.mail.cfg]'''
	* Configurer "authentication.cfg"		* Configurer '''[authentication.cfg]'''
	* Lancer "authentication-update" avec le compte d'exploitation		* Lancer '''[authentication-update]''' avec le compte d'exploitation

	== Description ==		== Description ==

Tcepo at 19:52, 8 December 2016

2016-12-08T19:52:22Z

← Older revision		Revision as of 21:52, 8 December 2016
Line 1:		Line 1:
	== Guide rapide ==		== Guide rapide ==
	* Configurer ~~groups~~.cfg		* Configurer '''[authentication.mail.cfg]'''
	* Configurer ~~url~~.cfg		* Configurer "authentication.cfg"
	* Lancer authentication-update avec le compte d'exploitation		* Lancer "authentication-update" avec le compte d'exploitation

	== Description ==		== Description ==
	* "~~groups~~.cfg" contient les mails de chaque groupe.		* "authentication.mail.cfg" contient les mails de chaque groupe.

	* "~~url~~.cfg" contient les groupes pour chaque url.		* "authentication.cfg" contient les groupes pour chaque url.

	* "authentication-update" permet l envoi des mails et la mise à jour de l ensemble des serveurs.		* "authentication-update" permet l envoi des mails et la mise à jour de l ensemble des serveurs.

	=== Format des fichiers de configuration de l exploitation ===		=== Format des fichiers de configuration de l exploitation ===
	==== ~~url~~.cfg ====		==== authentication.mail.cfg ====
			group;mail[,...][;expiredate]

			* group : nom du groupe
			* mail : mails du groupe séparés par des virgules

			==== authentication.cfg ====
	ApplicationID;URL;group[,...]		ApplicationID;URL;group[,...]

Line 18:		Line 24:
	* URL : url complète avec au moins le dernier répertoire suivi d un "/"		* URL : url complète avec au moins le dernier répertoire suivi d un "/"
	* group[,...] : noms des groupes séparés par des virgules		* group[,...] : noms des groupes séparés par des virgules

	~~==== groups.cfg ====~~
	~~group;mail[,...][;expiredate]~~

	* group : nom du groupe
	* mail : mails du groupe séparés par des virgules

	=== Pour information ===		=== Pour information ===
Line 31:		Line 31:
	==== droits ====		==== droits ====
	drwx------ exploitation ../<ScriptDir>/		drwx------ exploitation ../<ScriptDir>/
	-rw------- exploitation ~~groups~~.cfg		-rw------- exploitation authentication.mail.cfg
	-rw------- exploitation ~~url~~.cfg		-rw------- exploitation authentication.cfg
	-rw------- exploitation .htpasswd		-rw------- exploitation .htpasswd
	-r-x------ exploitation authentication-update		-r-x------ exploitation authentication-update

Tcepo: Created page with "== Guide rapide == * Configurer groups.cfg * Configurer url.cfg * Lancer authentication-update avec le compte d'exploitation == Description == * "groups.cfg" contient les mai..."

2016-12-06T21:44:28Z

Created page with "== Guide rapide == * Configurer groups.cfg * Configurer url.cfg * Lancer authentication-update avec le compte d'exploitation == Description == * "groups.cfg" contient les mai..."

New page

== Guide rapide ==
* Configurer groups.cfg
* Configurer url.cfg
* Lancer authentication-update avec le compte d'exploitation

== Description ==
* "groups.cfg" contient les mails de chaque groupe.

* "url.cfg" contient les groupes pour chaque url.

* "authentication-update" permet l envoi des mails et la mise à jour de l ensemble des serveurs.

=== Format des fichiers de configuration de l exploitation ===
==== url.cfg ====
ApplicationID;URL;group[,...]

* ApplicationID : nom de l application
* URL : url complète avec au moins le dernier répertoire suivi d un "/"
* group[,...] : noms des groupes séparés par des virgules

==== groups.cfg ====
group;mail[,...][;expiredate]

* group : nom du groupe
* mail : mails du groupe séparés par des virgules

=== Pour information ===
* ".htpasswd" sert au stockage des mots de passes cryptés. Ce fichier est alimenté en automatique.
* "<Serveur_applicatif>:/etc/httpd/htpasswd/.<Répertoire uniquement alpha numérique de l appli>.htpasswd" sert au stockage des mots de passes pour chaque appli.

==== droits ====
drwx------ exploitation ../<ScriptDir>/
-rw------- exploitation groups.cfg
-rw------- exploitation url.cfg
-rw------- exploitation .htpasswd
-r-x------ exploitation authentication-update

==== cron ====
2 2 * * * cd &&. ./.bash_profile &&cd <ScriptDir> &&./authentication-update