my $audit_auth_log = '/var/log/samba/audit_auth.log';
my $audit_auth_log = '/var/log/samba/audit_auth.log';
@ -25,132 +28,150 @@ if (not defined $samba_tool or not defined $pdbedit){
GetOptions(
GetOptions(
'pretty' => \$pretty,
'pretty' => \$pretty,
'since=i' => \$since,
'since=i' => \$since,
'audit-auth-log=s' => \$audit_auth_log
'audit-auth-log=s' => \$audit_auth_log,
'general' => \$general,
'ou=s' => \$ou
);
);
if ($since !~ m/^\d+$/){
if ($since !~ m/^\d+$/){
die "Invalid value for since\n";
die "Invalid value for since\n";
}
}
my $json = {
my $json = {};
accounts => {
users => 0,
if (defined $ou){
inactive_users => 0,
$json = {
active_users => 0,
objects => 0
groups => 0,
};
computers => 0
if ($ou !~ m/^(?<RDN>(?<Key>(?:\\[0-9A-Fa-f]{2}|\\\[^=\,\\]|[^=\,\\]+)+)\=(?<Value>(?:\\[0-9A-Fa-f]{2}|\\\[^=\,\\]|[^=\,\\]+)+))(?:\s*\,\s*(?<RDN>(?<Key>(?:\\[0-9A-Fa-f]{2}|\\\[^=\,\\]|[^=\,\\]+)+)\=(?<Value>(?:\\[0-9A-Fa-f]{2}|\\\[^=\,\\]|[^=\,\\]+)+)))*$/){
},
die "Invalid OU\n";
replication => 'UNKNWON',
}
processes => {
foreach (qx($samba_tool ou listobjects '$ou')){
cldap_server => 0,
die "Error while counting objects of OU $ou\n" if ($? != 0);
kccsrv => 0,
chomp;
dreplsrv => 0,
$json->{objects}++;
ldap_server => 0,
}
kdc_server => 0,
} elsif ($general){
dnsupdate => 0,
$json = {
'notify-daemon' => 0,
accounts => {
rpc_server => 0,
users => 0,
winbind_server => 0,
inactive_users => 0,
nbt_server => 0,
active_users => 0,
dnssrv => 0,
groups => 0,
samba => 0,
computers => 0
},
gpo => 0,
ou => 0,
activity => {
authentications => {
users => {
success => 0,
failure => 0
},
computers => {
success => 0,
failure => 0
}
},
},
authorizations => {
replication => 'UNKNWON',
users => 0,
processes => {
computers => 0
cldap_server => 0,
kccsrv => 0,
dreplsrv => 0,
ldap_server => 0,
kdc_server => 0,
dnsupdate => 0,
'notify-daemon' => 0,
rpc_server => 0,
winbind_server => 0,
nbt_server => 0,
dnssrv => 0,
samba => 0,
},
},
since => $since
gpo => 0,
}
ou => 0,
};
activity => {
authentications => {
# Get the numbers of users. pdbedit is prefered here because we can
users => {
# differentiate active and inactive users, which samba-tool can't do
success => 0,
# While at it, also get the computers
failure => 0
foreach (qx($pdbedit -L -v)){
},
next unless (m/^Account Flags:\s+\[(.*)\]/);
computers => {
my $flags = $1;
success => 0,
if ($flags =~ m/U/){
failure => 0
$json->{accounts}->{users}++;
}
if ($flags =~ m/D/){
},
$json->{accounts}->{inactive_users}++;
authorizations => {
} else {
users => 0,
$json->{accounts}->{active_users}++;
computers => 0
},
since => $since
}
};
# Get the numbers of users. pdbedit is prefered here because we can
# differentiate active and inactive users, which samba-tool can't do
# While at it, also get the computers
foreach (qx($pdbedit -L -v)){
next unless (m/^Account Flags:\s+\[(.*)\]/);
my $flags = $1;
if ($flags =~ m/U/){
$json->{accounts}->{users}++;
if ($flags =~ m/D/){
$json->{accounts}->{inactive_users}++;
} else {
$json->{accounts}->{active_users}++;
}
} elsif ($flags =~ m/W/){
$json->{accounts}->{computers}++;
}
}
} elsif ($flags =~ m/W/){
$json->{accounts}->{computers}++;
}
}
}
# Now count groups
# Now count groups
foreach (qx($samba_tool group list)){
foreach (qx($samba_tool group list)){
$json->{accounts}->{groups}++;
$json->{accounts}->{groups}++;
}
}
# Get replication status
# Get replication status
# We want just a quick summary, so only output the first line
# We want just a quick summary, so only output the first line
# manual checks will be needed to get the details, but if this field doesn't contains [ALL GOOD],
# manual checks will be needed to get the details, but if this field doesn't contains [ALL GOOD],
Daniel Berteaud
4 years ago