diff options
author | Tar Committer <tar@ocjtech.us> | 1999-06-20 23:17:14 +0000 |
---|---|---|
committer | Tar Committer <tar@ocjtech.us> | 1999-06-20 23:17:14 +0000 |
commit | 8c5c1d20fc744c7e60a6197fc397b44d424c65b8 (patch) | |
tree | 4b32e7ecf45efe9619d3909df3a943edb86f7027 /bin/jlogin | |
download | rancid-8c5c1d20fc744c7e60a6197fc397b44d424c65b8.tar.gz rancid-8c5c1d20fc744c7e60a6197fc397b44d424c65b8.tar.xz rancid-8c5c1d20fc744c7e60a6197fc397b44d424c65b8.zip |
Imported from rancid-1.0.tar.gz.rancid-1.0
Diffstat (limited to 'bin/jlogin')
-rwxr-xr-x | bin/jlogin | 402 |
1 files changed, 402 insertions, 0 deletions
diff --git a/bin/jlogin b/bin/jlogin new file mode 100755 index 0000000..485db7f --- /dev/null +++ b/bin/jlogin @@ -0,0 +1,402 @@ +#!/usr/local/bin/expect -- +## +## +## Copyright (C) 1997 by Henry Kilmer, Erik Sherk and Pete Whiting. +## All rights reserved. +## +## This software may be freely copied, modified and redistributed without +## fee for non-commerical purposes provided that this copyright notice is +## preserved intact on all copies and modified copies. +## +## There is no warranty or other guarantee of fitness of this software. +## It is provided solely "as is". The author(s) disclaim(s) all +## responsibility and liability with respect to this software's usage +## or its effect upon hardware, computer systems, other software, or +## anything else. +## +## +# +# jlogin - juniper ssh login +# +## Most options are intuitive for logging into a Cisco router. +## The default username password is the same as the vty password. +# + +# Usage line +set usage "Usage: $argv0 \[-e encryption_type\] \[-u username\] \[-p user-password\]\ +\[-f cloginrc-file\] \[-c command\] \[-s script-file\]\ +router \[router...\]\n" + +# env(CLOGIN) may contain the following chars: +# x == do not set xterm banner or name + +# Password file +set password_file $env(HOME)/.cloginrc +# Default is to login to the router +set do_command 0 +set do_script 0 +# The default is to automatically enable +set enable 1 +# The default is to look in the password file to find the passwords. This +# tracks if we receive them on the command line. +set do_passwd 1 + +# Find the user in the ENV, or use the unix userid. +if {[ info exists env(CISCO_USER) ] } { + set default_user $env(CISCO_USER) +} else { + # This uses "id" which I think is portable. At least it has existed + # (without options) on all machines/OSes I've been on recently - + # unlike whoami or id -nu. + regexp {\(([^)]*)} [exec id] junk default_user +} + +# Sometimes routers take awhile to answer (the default is 10 sec) +set timeout 45 + +# Process the command line +for {set i 0} {$i < $argc} {incr i} { + set arg [lindex $argv $i] + + switch -glob -- $arg { + # Username + -u* - + -U* { + if {! [ regexp .\[uU\](.+) $arg ignore user]} { + incr i + set username [ lindex $argv $i ] + } + # user Password + } -p* - + -P* { + if {! [ regexp .\[pP\](.+) $arg ignore userpswd]} { + incr i + set userpswd [ lindex $argv $i ] + } + set do_passwd 0 + # Command to run. + } -c* - + -C* { + if {! [ regexp .\[cC\](.+) $arg ignore command]} { + incr i + set command [ lindex $argv $i ] + } + set do_command 1 + # Expect script to run. + } -s* - + -S* { + if {! [ regexp .\[sS\](.+) $arg ignore sfile]} { + incr i + set sfile [ lindex $argv $i ] + } + if { ! [ file readable $sfile ] } { + send_user "Error: Can't read $sfile\n" + exit 1 + } + set do_script 1 + # encryption type + } -e* - + -E* { + if {! [ regexp .\[eE\](.+) $arg ignore encrypt]} { + incr i + set encrypt [ lindex $argv $i ] + } + # alternate cloginrc file + } -f* - + -F* { + if {! [ regexp .\[fF\](.+) $arg ignore password_file]} { + incr i + set password_file [ lindex $argv $i ] + } + } -* { + send_user "Error: Unknown argument! $arg\n" + send_user $usage + exit 1 + } default { + break + } + } +} +# Process routers...no routers listed is an error. +if { $i == $argc } { + send_user "Error: $usage" +} + +# Only be quiet if we are running a script (it can log its output +# on its own) +if { $do_script } { + log_user 0 +} else { + log_user 1 +} + +# +# Done configuration/variable setting. Now run with it... +# + +# Sets Xterm title if interactive...if its an xterm and the user cares +proc label { host } { + global env + # if CLOGIN has an 'x' in it, don't set the xterm name/banner + if [info exists env(CLOGIN)] { + if {[string first "x" $env(CLOGIN)] != -1} { return } + } + # take host from ENV(TERM) + if [info exists env(TERM)] { + if [regexp \^(xterm|vs) $env(TERM) ignore ] { + send_user "\033]1;[lindex [split $host "."] 0]\a" + send_user "\033]2;$host\a" + } + } +} + +# This is a helper function to make the password file easier to +# maintain. Using this the password file has the form: +# add password sl* pete cow +# add password at* steve +# add password * hanky-pie +proc add {var args} { global $var ;lappend $var $args } + +proc find {var router} { + source_password_file + upvar $var list + if { [info exists list] } { + foreach line $list { + if { [string match [lindex $line 0] $router ] } { + return [lrange $line 1 end] + } + } + } + return {} +} + +# Loads the password file. Note that as this file is tcl, and that +# it is sourced, the user better know what to put in there, as it +# could install more than just password info... I will assume however, +# that a "bad guy" could just as easy put such code in the clogin +# script, so I will leave .cloginrc as just an extention of that script +proc source_password_file { } { + global env password_file read_password_file + if { [info exists read_password_file] } { return } + if { [info exists password_file] == 0 } { + set password_file $env(HOME)/.cloginrc + } + set read_password_file 1 + file stat $password_file fileinfo + if { [expr ($fileinfo(mode) & 007)] != 0000 } { + send_user "Error: $password_file must not be world readable/writable\n" + exit 1 + } + source $password_file +} + +# Log into the router. +proc login { router user passwd prompt encrypttype} { + global spawn_id in_proc do_command do_script + set in_proc 1 + + # ssh to the router & try to login. + if [ catch {spawn ssh -c $encrypttype -x -l $user $router} reason ] { + send_user "Error: failed to ssh: $reason\n" + exit 1 + } + sleep 0.3 + + # This helps cleanup each expect clause. + expect_after { + timeout { + send_user "\nError: TIMEOUT reached\n" + close; wait + if { $in_proc} { + return 1 + } else { + continue + } + } eof { + send_user "\nError: EOF received\n" + close; wait + if { $in_proc} { + return 1 + } else { + continue + } + } + } + + # Here we get a little tricky. There are several possibilities: + # the router can ask for a username and passwd and then + # talk to the TACACS server to authenticate you, or if the + # TACACS server is not working, then it will use the enable + # passwd. Or, the router might not have TACACS turned on, + # then it will just send the passwd. + expect { + eof { send_user "Error: Couldn't login\n"; wait; return 1 } + "Connection refused" { + expect eof + send_user "Error: Connection Refused\n"; wait; return 1 + } "Unknown host\r\n" { + expect eof + send_user "Error: Unknown host\n"; wait; return 1 + } "Host is unreachable" { + expect eof + send_user "Error: Host Unreachable!\n"; wait; return 1 + } "No address associated with name" { + expect eof + send_user "Error: Unknown host\n"; wait; return 1 + } + -re "Host key not found .* \(yes\/no\)\?" { + send "yes\r" + send_user "Host $router added to the list of known hosts.\n" + exp_continue } + -re "HOST IDENTIFICATION HAS CHANGED.* \(yes\/no\)\?" { + send "no\r" + send_user "Error: The host key for $router has changed. update the known_hosts file accordingly.\n" + return 1 } + -re "(Username|^login):" { send "$user\r" + expect { + eof { send_user "Error: Couldn't login\n"; wait; return 1 } + -re "\[Pp]assword:" { send "$passwd\r" } + "$prompt" { set in_proc 0; return 0 } + } + exp_continue + } + "\[Pp]assword:" { send "$passwd\r" + expect { + eof { send_user "Error: Couldn't login\n"; wait; return 1 } + "$prompt" { set in_proc 0; return 0 } + } + exp_continue + } + "$prompt" { } + denied { send_user "Error: Check your passwd for $router\n" + if { $do_command || $do_script } { + send "quit" + wait + return 1 + } else { + return 1 + } + } + "% Bad passwords" {send_user "Error: Check your passwd for $router\n"; return 1 } + } + set in_proc 0 + return 0 +} + +# Run commands given on the command line. +proc run_commands { prompt command } { + global in_proc + set in_proc 1 + + send "set cli complete-on-space off\r" + expect $prompt {} + send "set cli screen-length 0\r" + expect $prompt {} + + # Is this a multi-command? + if [ string match "*\;*" "$command" ] { + set commands [split $command \;] + set num_commands [llength $commands] + + for {set i 0} {$i < $num_commands} { incr i} { + send "[lindex $commands $i]\r" + expect { + -re "^\[^\n\r *]*$prompt $" {} + -re "^\[^\n\r]*$prompt." { exp_continue } + -re "(\r\n|\n)" { exp_continue } + } + } + } else { + send "$command\r" + expect { + -re "^\[^\n\r *]*$prompt $" {} + -re "^\[^\n\r]*$prompt." { exp_continue } + -re "(\r\n|\n)" { exp_continue } + } + } + send "quit\r" + expect { + "\n" { exp_continue } + timeout { return 0 } + eof { return 0 } + } + set in_proc 0 +} + +# +# For each router... (this is main loop) +# +set in_proc 0 +foreach router [lrange $argv $i end] { + set router [string tolower $router] + send_user "$router\n" + + set prompt ">" + + # Figure out passwords +# if { $do_passwd } { +# set pswd [find password $router] +# if { [llength $pswd] == 0 } { +# send_user "Error - no password for $router in $password_file.\n" +# continue +# } +# if { $do_enapasswd && !$autoenable && [llength $pswd] < 2 } { +# send_user "Error - no enable password for $router in $password_file." +# continue +# } +# set passwd [lindex $pswd 0] +# } + + # Figure out username + if {[info exists username]} { + # command line username + set loginname $username + } else { + set loginname [find user $router] + if { "$loginname" == "" } { set loginname $default_user } + } + + # Figure out loginname's password (if different from the vty password) + if {[info exists userpswd]} { + # command line passwd + set passwd $userpswd + } else { + set passwd [lindex [find password $loginname@$router] 0] + if { "$passwd" == "" } { set passwd [lindex [find password $router] 0] } + } + + # Figure out encryption tpye + if {[info exists encrypt]} { + # command line encryption type + set encrypttype $encrypt + } else { + set encrypttype "3des" + } + + # Login to the router + if {[login $router $loginname $passwd $prompt $encrypttype]} { + continue + } + + if { $do_command } { + if {[run_commands $prompt $command]} { + continue + } + } elseif { $do_script } { + send "set cli complete-on-space off\r" + expect $prompt {} + send "set cli screen-length 0\r" + expect $prompt {} + source $sfile + close + } else { + label $router + log_user 1 + interact + } + + # End of for each router + wait + sleep 0.3 +} +exit 0 |