Aktualisierung Script windows.ad.user.discovery.raw.php
This commit is contained in:
parent
62274f57e5
commit
37c8e711d8
|
|
@ -0,0 +1,156 @@
|
|||
#!/usr/bin/php
|
||||
<?php
|
||||
error_reporting(E_ALL);
|
||||
date_default_timezone_set("Europe/Berlin");
|
||||
|
||||
define("UNIX_0", 116444736000000000.0);
|
||||
|
||||
$ldap_srv = explode(",", $argv[1]);
|
||||
$ldap_user = $argv[2];
|
||||
$ldap_pass = $argv[3];
|
||||
$ldap_base = $argv[4];
|
||||
$output = array();
|
||||
foreach($ldap_srv as $srv) {
|
||||
$cmd = "/usr/bin/ldapsearch -LLL -x -h ".$srv." -D ".$ldap_user." -w ".$ldap_pass." -b ".$ldap_base." \"(&(objectCategory=person)(objectClass=user))\" distinguishedName lastLogon logonCount whenCreated whenChanged pwdLastSet badPwdCount badPasswordTime lastLogoff accountExpires lastLogonTimestamp sAMAccountName lockoutTime userAccountControl";
|
||||
$tmp = "";
|
||||
exec($cmd, $tmp);
|
||||
$output = array_merge($output, $tmp);
|
||||
}
|
||||
|
||||
$rawData = $output;
|
||||
|
||||
$f = tempnam("/tmp", "aduser.json");
|
||||
$h = fopen($f, "w+");
|
||||
|
||||
// prepare raw ldap data
|
||||
$i=0;
|
||||
$data = array();
|
||||
$dn = NULL;
|
||||
foreach($rawData as $l) {
|
||||
$l = str_replace("\n", "", $l);
|
||||
if(empty($l)) {
|
||||
$dn=NULL;
|
||||
continue;
|
||||
}
|
||||
$r = explode(": ", $l);
|
||||
|
||||
if(count($r)!=2) continue;
|
||||
|
||||
if(is_null($dn)) {
|
||||
$dn = $r[1];
|
||||
} else {
|
||||
if (isset($data[$dn][$r[0]])) {
|
||||
$data[$dn][$r[0]] = max($data[$dn][$r[0]], $r[1]);
|
||||
} else {
|
||||
$data[$dn][$r[0]] = $r[1];
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$output = array();
|
||||
$output2 = array();
|
||||
foreach($data as $dn => $v) {
|
||||
if(!array_key_exists("sAMAccountName", $v)) continue;
|
||||
$v['sAMAccountName'] = str_replace("$", "", $v['sAMAccountName']);
|
||||
$output2[] = array(
|
||||
"{#WINDOWS.AD.USER.DISTINGUISHEDNAME}" => $dn,
|
||||
"{#WINDOWS.AD.USER.SAMACCOUNTNAME}" => $v['sAMAccountName']
|
||||
);
|
||||
foreach($v as $k => $v2) {
|
||||
switch($k) {
|
||||
case "lastLogon":
|
||||
case "pwdLastSet":
|
||||
case "lastLogonTimestamp":
|
||||
case "badPasswordTime":
|
||||
case "lockoutTime":
|
||||
case "lastLogoff":
|
||||
$v2 = ($v2>0 ? floor(($v2-UNIX_0)/10000000.0) : 0);
|
||||
break;
|
||||
|
||||
case "logonCount":
|
||||
case "badPwdCount":
|
||||
default:
|
||||
break;
|
||||
|
||||
case "whenCreated"://20030414134128.0Z
|
||||
case "whenChanged":
|
||||
$v2 = mktime(substr($v2, 8, 2), substr($v2, 10, 2), substr($v2, 12, 2), substr($v2, 4, 2), substr($v2, 6, 2), substr($v2, 0, 4));
|
||||
break;
|
||||
|
||||
case "accountExpires":
|
||||
break;
|
||||
|
||||
case "sAMAccountName":
|
||||
continue;
|
||||
break;
|
||||
case "userAccountControl":
|
||||
$uacs = MS_uac_convert($v2);
|
||||
foreach($uacs as $uack => $uacv) {
|
||||
$output[] = $v['sAMAccountName']." \"windows.activedirectory.users.".$uack."\" \"".$uacv."\"";
|
||||
}
|
||||
break;
|
||||
}
|
||||
$output[] = $v['sAMAccountName']." \"windows.activedirectory.users.".$k."\" \"".$v2."\"";
|
||||
}
|
||||
}
|
||||
$jsonData = array();
|
||||
$jsonData["data"] = $output2;
|
||||
echo json_encode($jsonData);
|
||||
|
||||
fwrite($h, implode("\n", $output));
|
||||
fclose($h);
|
||||
|
||||
$cmd = "/usr/bin/zabbix_sender --zabbix-server localhost --input-file ".$f;
|
||||
exec($cmd);
|
||||
#system($cmd);
|
||||
|
||||
unlink($f);
|
||||
|
||||
function MS_uac_convert($dec) {
|
||||
$uac_db = array(
|
||||
array("key"=>"ADS_UF_SCRIPT", "hex"=>"0x00000001", "desc"=>"The logon script is executed."),
|
||||
array("key"=>"ADS_UF_ACCOUNTDISABLE", "hex"=>"0x00000002", "desc"=>"The user account is disabled."),
|
||||
array("key"=>NULL),
|
||||
array("key"=>"ADS_UF_HOMEDIR_REQUIRED", "hex"=>"0x00000008", "desc"=>"The home directory is required."),
|
||||
array("key"=>"ADS_UF_LOCKOUT", "hex"=>"0x00000010", "desc"=>"The account is currently locked out."),
|
||||
array("key"=>"ADS_UF_PASSWD_NOTREQD", "hex"=>"0x00000020", "desc"=>"No password is required."),
|
||||
array("key"=>"ADS_UF_PASSWD_CANT_CHANGE", "hex"=>"0x00000040", "desc"=>"The user cannot change the password."),
|
||||
array("key"=>"ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED", "hex"=>"0x00000080", "desc"=>"The user can send an encrypted password."),
|
||||
array("key"=>"ADS_UF_TEMP_DUPLICATE_ACCOUNT", "hex"=>"0x00000100", "desc"=>"This is an account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. Also known as a local user account."),
|
||||
array("key"=>"ADS_UF_NORMAL_ACCOUNT", "hex"=>"0x00000200", "desc"=>"This is a default account type that represents a typical user."),
|
||||
array("key"=>NULL),
|
||||
array("key"=>"ADS_UF_INTERDOMAIN_TRUST_ACCOUNT", "hex"=>"0x00000800", "desc"=>"This is a permit to trust account for a system domain that trusts other domains."),
|
||||
array("key"=>"ADS_UF_WORKSTATION_TRUST_ACCOUNT", "hex"=>"0x00001000", "desc"=>"This is a computer account for a computer that is a member of this domain."),
|
||||
array("key"=>"ADS_UF_SERVER_TRUST_ACCOUNT", "hex"=>"0x00002000", "desc"=>"This is a computer account for a system backup domain controller that is a member of this domain."),
|
||||
array("key"=>NULL, "hex"=>"0x00004000", "desc"=>"Not used."),
|
||||
array("key"=>NULL, "hex"=>"0x00008000", "desc"=>"Not used."),
|
||||
array("key"=>"ADS_UF_DONT_EXPIRE_PASSWD", "hex"=>"0x00010000", "desc"=>"The password for this account will never expire."),
|
||||
array("key"=>"ADS_UF_MNS_LOGON_ACCOUNT", "hex"=>"0x00020000", "desc"=>"This is an MNS logon account."),
|
||||
array("key"=>"ADS_UF_SMARTCARD_REQUIRED", "hex"=>"0x00040000", "desc"=>"The user must log on using a smart card."),
|
||||
array("key"=>"ADS_UF_TRUSTED_FOR_DELEGATION", "hex"=>"0x00080000", "desc"=>"The service account (user or computer account), under which a service runs, is trusted for Kerberos delegation. Any such service can impersonate a client requesting the service."),
|
||||
array("key"=>"ADS_UF_NOT_DELEGATED", "hex"=>"0x00100000", "desc"=>"The security context of the user will not be delegated to a service even if the service account is set as trusted for Kerberos delegation."),
|
||||
array("key"=>"ADS_UF_USE_DES_KEY_ONLY", "hex"=>"0x00200000", "desc"=>"Restrict this principal to use only Data Encryption Standard (DES) encryption types for keys."),
|
||||
array("key"=>"ADS_UF_DONT_REQUIRE_PREAUTH", "hex"=>"0x00400000", "desc"=>"This account does not require Kerberos pre-authentication for logon."),
|
||||
array("key"=>"ADS_UF_PASSWORD_EXPIRED", "hex"=>"0x00800000", "desc"=>"The user password has expired. This flag is created by the system using data from the Pwd-Last-Set attribute and the domain policy."),
|
||||
array("key"=>"ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION", "hex"=>"0x01000000", "desc"=>"The account is enabled for delegation. This is a security-sensitive setting; accounts with this option enabled should be strictly controlled. This setting enables a service running under the account to assume a client identity and authenticate as that user to other remote servers on the network."),
|
||||
);
|
||||
|
||||
|
||||
$uac = strrev(base_convert ($dec, 10, 2));
|
||||
$return = array();
|
||||
for($i=0; $i<25;$i++) {
|
||||
if(!is_null($uac_db[$i]["key"])) {
|
||||
if($i>=strlen($uac)) {
|
||||
$v = 0;
|
||||
} else {
|
||||
$v = substr($uac, $i, 1);
|
||||
}
|
||||
$return[strtolower($uac_db[$i]["key"])] = ($v==1 ? 1 : 0);
|
||||
} else {
|
||||
continue;
|
||||
}
|
||||
}
|
||||
return $return;
|
||||
}
|
||||
|
||||
?>
|
||||
Loading…
Reference in New Issue