Adventure's of a code writing SysAdmin

It's Australia Day!

2012-01-26T08:43:00.002+10:00

w00t!!!
Best country in the world (OK, so I'm slightly biased).

What would you like to see next in OAv2?

2011-11-20T13:00:00.001+10:00

Go here and vote for your preferred feature.
If you don't see your feature, let me know!

http://www.open-audit.org/phpBB3/viewtopic.php?f=20&t=5796

OAv2 beta3 released

2011-09-26T12:01:00.002+10:00

Go grab it.

To upgrade your database (for an existing beta1 or beta2 install), copy the OAv2 files over the old ones, then fire up OAv2 and go to Help -> about (as an Admin).

Then click the red upgrade text. Done.

Make sure you use the new audit script, too.

FWIW - I would backup your database before doing this and also copy your original OAv2 files somewhere else. That way, if the worst happens, you can always revert back...

Please submit some statistics (Help -> Statistics) so I have some idea of how many people are using OAv2 (and how many systems they are auditing with it). This submission cannot be linked back to your organisation.

Also - I am off camping with the family from tomorrow night (Tue, Brisbane time). I will have limited internet access and no access to debug issue's. I will check the forums, but fixes won't be forthcoming until next week. Apologies if this causes an inconvenience.

https://launchpad.net/oav2/trunk/beta3

Help wanted (vbscript)

2011-07-14T16:15:00.001+10:00

I am hacking some VBScript to attempt to determine the user that installed a program.
If I can get it going, I can add this to OAv2.

The script is below.
I get an unhelpful error and haven't managed to get it going.
If anyone can help, it would be most appreciated.
You can save it as blah.vbs and run it with "cscript blah.vbs".
It should dump any software it finds an entry for in the App Log - title, who installed it and when.
It should only dump the first entry it finds. IE - if you have installed, removed and installed a given piece of software, it may well have multiple entries in the Application Event Log.

Again, any help much appreciated.

strComputer = "."
const HKEY_LOCAL_MACHINE = &H80000002
set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("SELECT Message, User, TimeGenerated FROM Win32_NTLogEvent where logfile = 'Application' and eventcode = '11707'",,48)
strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
oReg.EnumKey HKEY_LOCAL_MACHINE,strKeyPath,arrSubKeys
for each subkey In arrSubKeys
newpath = strKeyPath & "\" & subkey
newkey = "DisplayName"
oReg.GetStringValue HKEY_LOCAL_MACHINE, newpath, newkey, strValue
if strValue <> "" then
package_name = strValue
for each objItem in colItems
mess1 = split(objItem.Message, "--")
mess2 = split(mess1(0), " ", vbTextCompare)
mess3 = split(mess2(0), "Product:")
message_retrieved = trim(mess3(1))
if (not isNull(message_retrieved)) then
if (InStr(message_retrieved, package_name) = 1) then
package_installed_by = objItem.User
package_installed_on = WMIDateStringToDate(objItem.TimeGenerated)
wscript.echo package_name & " Installed By: " & package_installed_by & " On: " & package_installed_on
exit for
else
package_installed_by = ""
package_installed_on = ""
end if
end if
next

end if
next

function WMIDateStringToDate(dtmDate)
WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
& " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
end function

OAv2 beta 1.1 released

2011-06-07T12:47:00.004+10:00

Based on some feedback (ie, bugs), I've released beta 1.1.
Make sure you grab 1.1 and not beta 1 from https://launchpad.net/oav2/trunk/beta1.

42 downloads in 24 hours - and feedback/testing submitted.
Thanks to all who take the time to help.

Make sure you visit the forms at
http://www.open-audit.org/phpBB3/viewforum.php?f=20

Beta 1 of OAv2 released

2011-06-06T10:39:00.004+10:00

Done, out, pushed, released... finally.

This is a bit of a warthog release - I haven't done anywhere near as much testing as I would have liked. Please report the bugs to the Open-AudIT.org forums.

Seeing as I have now classed this as "beta", I will (from now on) attempt to provide database schema upgrades as scripts. Eventually, I'd like to get an update system similar to Wordpress. Very easy for the user to do. Eventually.

What's new - well it's now available as an XAMPPLITE package. For the Windows users, download it, extract it to C:\ start the xampp-control.exe, start Apache and MySQL and you're done. You should be able to browse to the root of your machine in a browser and get the logon page.

There's also a "code only" release. for IIS, Linux, etc, etc users who just want the application.

Groups and Reports are now stored in OAv2/code_igniter/system/application/controllers/groups (and /reports) directories. Drop the XML definition in the directory and you can "activate" the group or report in the web interface. The other options (import, export, etc) still exist.

I've improved the audit script. SQL won't hang (on SQL Express, etc) auditing now. You can also supply credentials to the audit script for auditing system's not on your domain.

cscript audit_windows.vbs COMPUTERNAME strUser=USERNAME strPassword=PASSWORD

Nice and easy. You can also use the credentials in the "audit list" script. Just add them after the computer name (as above) and when it calls the "audit windows" script, all arguments are passed through.

I've cleaned up the theme-tango/tango-files directory. It's quite clean as far as the .css and .js files are concerned. JQuery has also been updated to the latest version.

Some big feature's since last time -
Creating an Organisation now creates a corresponding Group.

If you have "edit" rights, and Report that includes a System ID will show an extra column. You can select multiple systems and edit their details together. Like when you acknowledge an Alert - only now for all the manually settable item's on a System, itself. One example use would be viewing the Systems in an automatically created network (subnet) group. You could set ALL the owner fields to a particular entity. Very quick and easy, versus editing each system by individually.

I also mean to create an individual audit script when you create an Organisation. All it would do is also set the Org_ID tag in the script - therefore automatically assigning any system audited by that particular script to an Organisation and it's corresponding Group. That's very much on the list...

There are a few other improvements... download it and try them out !

https://launchpad.net/oav2/trunk/beta1

Currently...

2011-06-02T15:28:00.002+10:00

Am auditing a domain with 20k systems (not all active) with OAv2.

Not all are powered up at the same time, but it still take's a few hours for one system to audit all the others... I really need multiple audit hosts... Still, it work's fine - it's just a bit slow.

The actual DB / Web host that contains the application is a virtual machine that's constrained to 1GHz of processor and 1GB memory. Most reports run fine - with the exception of the "All Installed Software" report - it simply times out. I suppose that's to be expected. There are currently 5,500 systems in the DB...

I'm pretty happy with the performance - and I am yet to optimise the SQL !!!

Look for Beta 1 of OAv2 very, VERY soon.

Project Websites

2011-03-11T11:35:00.003+10:00

a - I am fed up.
b - Why ?
a - Damn spammers using phpBB is ticking me off. Seriously.
b - Well, what can we do about this, using phpBB ?
a - Not a whole lot, I've tried. And bulletin boards suck at this.
b - OK then - come up with a better thing, smarty pants.
a - Fine - let me try...

First, a project (in this case, my time sink that is Open-AudIT - but this could apply to most other software projects) needs a website for people to discuss the software in question.
Not a mailing list (apologies to those that love them - I don't think they're a good fit for this). Not even a bulletin board (phpBB, et al). A way to communicate that is relevant to the discussion being held. So - different types for different conversations.

What type's of conversations does a project (usually / regularly) have ?

Users submitting Bug Reports.
Users submitting Feature Requests.
Users wanting help.
Documentation provided by Dev's and commented on by users.
Recipes contributed by Users & Dev's for "doing stuff" with your software - FAQ, How do I, etc.
Other (general) conversations about the software.

OK, so they're stuff to "talk about", but what else does a project website need ?

Brochure type pages.
A demo of the software to play about in.
Statistics of "commits" and ChangeLog reports.
A developer blog.
Somewhere to download the code from.
An easy to use sign-in / sign-up system that stops a lot of spammers.

OK - so now go and try to find ONE easily installable package to deliver ALL that. It doesn't exist. Sure, the various parts exist separately.

Users submitting Bug Reports. Bugzilla.
Users submitting Feature Requests. UserVoice.
Users wanting help. StackOverflow.
Documentation provided by Dev's and commented on by users. PHP Docs.
Recipes contributed by Users & Dev's for "doing stuff" with your software - FAQ, How do I, etc. A website.
General Discussion's. phpBB.
Brochure type pages. A website.
A demo to play about in.
Statistics of "commits" and ChangeLog reports. SF.net reporting.
A developer blog. Wordpress.
Somewhere to download the code from. SF.net code hosting.
An easy to use sign-in / sign-up system that stops a lot of spammers. OpenID.

But I want ONE thing to do this. I want my users to come to ONE place. Not to have to sign in to several individual systems. To have a CONSISTENT experience. To be EASY to use and find stuff.

Nothing exists. Well, not that I have found and that is free. Damn.

I guess it's put up or shut-up time.

I don't want to build something from scratch. I don't have the time (just ask those waiting for the next OAv2 release !). So, what is out there that is written in PHP (I know PHP), runs on Linux (I use Linux on my home desktop and my hosting runs on Linux), is extensible, is well written, has a good community, has good Docs (and books about it even) and can do the above stuff (obviously with modification) ?

My answer is WordPress. Yes, it may not be everyone's answer - but I really don't care. It's what suits ME. I am writing this for ME. If other's wish to use it great - it will be Open Source licensed.

So I am currently reading some WordPress books and it looks to be able to accomplish most of the above. The one's I do not plan to tackle are the code hosting/version control stuff - although a plugin to report on SF.net, GitHub, BitBucker, Google code, LaunchPad, et al would be nice. Obviously an example install of any given project won't be done in/by WordPress. I think everything else though, is achievable.

So - that's my goal.

A theme & plugin and recipe for including others plugins to make this happen.

If you would like to get on board or have some constructive feedback, please let me know (or reply to this blog post). If there's other things a project website would find useful that I have missed, please do let me know.

I have two goals.

First and foremost - to get this working for MY project website.
Second - to package it as a theme & plugin and provide a recipe for others to easily use.

I don't think this is rocket science. I want an easy to use and simple user experience. I realise there will be edge cases and most of them will simply not be catered for. I don't plan for this to be an "all things to all people" type approach. I want it SIMPLE.

So, there you have it. Damn I hate making work for myself :-)

Alpha 7 is out

2011-01-17T21:56:00.001+10:00

Printers and Monitors now audited.
Many bugs squashed.
Get it now !

http://launchpad.net/oav2/trunk/alpha7/+download/OAv2.zip

Update

2010-12-03T15:31:00.003+10:00

Have fixed the reported Bugs in alpha 6.
Have been doing some streamlining / cleanup work on Groups.
Have added to the FAQ page, inside the application (help -> FAQ menu item) detailing how the columns work when displaying Groups and Reports.
Alpha 7 should be out soon with these updates.

OAv2 Alpha 6 released

2010-11-30T11:19:00.004+10:00

Heaps of changes in this release.
I'll attempt to detail them in a subsequent post.
Please download it and report feedback to the Open-AudIT forums - LINK.
I have a few days off, so I plan to code, code, code. Any feedback / bugs can be corrected quick smart !).
You can find the download link on the right of this page.

What's next ?

2010-11-04T14:14:00.001+10:00

CMDB or Software Licensing Register ?
Both will take a bit of time, so does anyone have a preferrence which I take a look at next ?
Personally, I'm thinking Software Register, but I'm open to change.

FYI - I have the DB design mostly complete for both of these - it's just the actual code that needs to happen now. "Just" the code he says... :-)

IIS Auditing

2010-11-04T14:12:00.000+10:00

IIS auditing for Windows 2003 and up is working.
I also have 64bit Windows CD Keys enumerating, too.
Some spit and polish to do, but another alpha should be inbound soon.

What's next for OAv2 ?

2010-10-04T08:16:00.001+10:00

My work program (in my head) is such:

1 - Finish off the existing functions that have been implemented.
2 - Get IIS auditing working.

Those two will take a week or so.
Look-out for another alpha next week sometime...

Alpha 5 released

2010-09-28T21:44:00.001+10:00

Fixed a few bugs.
Export a Group definition to XML and import.
SQL Database enumeration.

Update

2010-09-27T08:17:00.001+10:00

No coding done over the weekend - we have visitors staying with us.
I should be able to get a release up pretty soon though.
I've had some feedback (from alpha 4) and have also managed to get SQL Server DBs enumerating / storing / reporting.

CodeIgniter Sessions + IE sucks

2010-09-23T15:06:00.005+10:00

Man - what a pain in the ass.

Apparently the in built CodeIgniter session class and IE7/8/9 don't like each other.
On top of that, if you're using an internal computer name to access the site, well, that's not a valid W3C URL standard. You have to have at least two "." 's in the URL. So, trying to access the site via http://mycomputer is not strictly valid and IE will reject the cookie. Sigh.

So, I found the "session hybrid" class for CodeIgniter. Combining this with accessing the site via http://www.mypcname.com seems to work in IE. You also have to put the www.mypcname.com in your /etc/hosts file to make it work (otherwise it obviously will not resolve through normal DNS).

So, the long and the short is - I have sessions in OAv2 with IE7/8/9 working, but it requires a change to your /etc/hosts file (or your internal DNS). Or you could use the full domain name / path to your machine. In my case, that's rather long...

This does not affect submitting audit results, as that page does not use cookies.

If anyone has a better option - please advise.

BTW - IE6 & Firefox(3.6.9) work fine. Not sure about Chrome, Opera, et al... Strictly speaking Firefox should break just like IE if it followed standards. Maybe the Mozilla Devs are slack, maybe they thought they would deliberately _not_ meet the standard to make it easier for "internal to company" type sites - who knows ?

As per http://curl.haxx.se/rfc/cookie_spec.html,

Only hosts within the specified domain can set a cookie for a domain and domains must have at least two (2) or three (3) periods in them to prevent domains of the form: ".com", ".edu", and "va.us". Any domain that fails within one of the seven special top level domains listed below only require two periods. Any other domain requires at least three. The seven special top level domains are: "COM", "EDU", "NET", "ORG", "GOV", "MIL", and "INT".

Alpha 4 released

2010-09-21T21:19:00.002+10:00

I've created a release, even though the (internal OAv2) Change stuff isn't finished.
Grab it here -
http://launchpad.net/oav2/trunk/alpha4/+download/OAv2_alpha_4.zip

Enumerating SQL Server DBs

2010-09-21T14:32:00.003+10:00

Does anyone have a VBScript (that can be run from the command line) that can enumerate the databases (and their attributes) on a SQL Server - NOT using SQLDMO ?
IE - not like the one below

strDBServerName = "."

Set objSQLServer = CreateObject("SQLDMO.SQLServer")
objSQLServer.LoginSecure = True
objSQLServer.Connect strDBServerName

Set colDatabases = objSQLServer.Databases

For Each objDatabase In colDatabases
WScript.Echo objDatabase.Name
Next Set colDatabases =NOTHING
Set objSQLServer =NOTHING

My problem is that a standard (non SQL installed) machine doesn't have SQLDMO installed as far as I can tell - please correct me if I am mistaken. Basically I want to use the normal audit_windows.vbs script to enumerate all databases on a server and their size (and anything else that you might find interesting). Can anyone help ?

UPDATE - I found an example script, incorporated it into the audit script and it's all good. I created a basic "Show Databases" report and it works.

Posting each week

2010-09-21T14:30:00.000+10:00

OK, so I've now set a reminder in my calendar for every Monday to post something here...
Maybe I need a PA ?!?!?!

Too Long

2010-09-21T14:22:00.004+10:00

Wow - it's been waaaaay too long between posts.
Here's what's been happening.
I spoke at SAGE-AU in Hobart. It went down OK.
I've been away a couple of times with a work course (3 days at a time).
We're in the middle of ripping out our kitchen. Nearly there with the new one.
The kids have been to 1001 birthday parties lately.
Real life is just too busy !!!

OK, having mounted my defense of excuses, where is the next release of OAv2 at ? I'm glad you asked.

I think all that's left to do for another release is to post the Change form to the DB. Really. That's it. I'll do my best to knock it off tonight - but the kitchen benchtops and plumbing are going in this afternoon - sigh...

I've completed migrating the "reports" into the DB. You can now define a report and it's display columns. You can export it as XML (and import it back) as well. Essentially, someone can come up with a nice report, export the XML and post it to the forums for others to use.

There has been much refactoring and code cleanup, too. Oh, and partition use graphs are in, too (along with trend lines). And exporting to CSV and XML works (along with Excel). If you want, you can always grab the code from Launchpad using Bazaar.

Linking alerts to changes

2010-07-05T15:25:00.002+10:00

Finished the basics of linking generated alerts to changes.
What this means is that on the "list alerts" page, you can select multiple alerts and a form will appear so you can associate them to :
The "changes" table functionality in OAv2 (not complete),
An external system (via ID and/or URL),
A simple acknowledgement within the "alert" table in OAv2.

Very ITIL like. Very nice.

At the end of the day, you can audit machines, get a listing of alerts (which are changes to audited fields) and associate these with a Change System - either the basic one within OAv2 or an external one.

Next up is to start the Change System within OAv2. It's going to be simple (at least to start). Basically a recording of proposed changes - what, where, how, why, who, etc. Pretty simple from a coding perspective - CRUD mainly with a small amount of User credential checking. I don't plan on workflow style Changes (at least yet).

Once that is done, Alpha 4 will be inbound.

Alpha 3 available

2010-06-10T21:07:00.001+10:00

Yep, you read right - it's available.
Go grab it and give it a thrashing.
All previous Bugs should have been addressed.

http://www.open-audit.org/OAv2_03.zip

Import / Export in OAv2

2010-06-10T10:58:00.004+10:00

I have the import and export routines working for Devices, Locations and Organisations. Excel only at this stage.

One interesting aspect was the need to alter the network group creation routine. Think of a network device that you know about, but don't know specific IP details. IE - you know it's IP Address, but what about it's configured subnet ? What about it's MAC Address ? A lot of people will not know the details. So now network group creation has to account for IP Addresses in the system table - not just the sys_hw_networkcard_ip table. Interesting, but all good and working.

Any report type page (ie - a list of "All Devices") now has a shiny little button (an Excel icon). Click it and you can download & open the resulting Excel spreadsheet. At the moment it's a straight data dump, so things like column headings come direct from the DB. I will have to make another option that removes certain columns and alters the column headings (IE - man_ip_address would become IP Address, system_id would disappear altogether, etc). This would make two styles of output - a dump and a report. Will address this later on.

I think that's good enough for a release. Give me a few hours (when I get home from work) and I'll post again with release details.

Any help debugging would be appreciated.

Nearly ready for another release

2010-06-07T08:11:00.003+10:00

What have I been doing on OAv2 ?
Well, for one thing, creating routines so you can import your devices / locations / organisations from a spreadsheet. Most places can easily conjure up a listing of relevant data - most often in a spreadsheet. The import routines for Locations and Organisations are complete, I just need to finish off Devices (which I have working in test code).

I also have nearly finished the routine to export any Report to Excel, PDF or CSV. Thanks PHPExcel !

I've also completed the Group Edit pages so they don't break auto-created Groups.

Give me a couple of days to finish up and another release will be available.

Update

2010-05-05T15:12:00.005+10:00

Have created a couple of new reports in OAv2.
All reports are based on a Group of systems or optionally, all systems you are authorised to view, regardless of group:

System Shares
Orphaned Users

These now live alongside :

Partiton Useage,
Partiton Alert (partitions below %20 free space),
Local Admins
Audit Dates
System Locations

I fixed a bug in the audit script that would not retrieve share permissions when there was a space in the Share Name.

I altered the audit script to retrieve the size of remote Shared Directories.

One thing to note is the increase of script execution time when retrieving the size of remote shared directories. I've seen it take 10 minutes (on a large file server - multiple terrabytes) to complete... I run it overnight, so it isn't an issue for me, but I may make it an optional thing to enable...

ToDo for OAv2

2010-05-04T08:53:00.002+10:00

I think if I can get these done, I'll call it a 0.3 release...

Fix the Alter Groups code (as per OAv2 release notes).
Display all the "man_" fields for a system (as per OAv2 release notes). "man_" fields are meant to be manually updated data - stuff like physical location, etc, that cannot be derived from querying a system.
Revise the menu structure.
Fix the installed software SQL (as per OAv2 release notes).
Create a form to manually add a system. You can do this currently by taking an audit result XML file and replacing the details for the manual system - but it's ugly, annoying and a hack.

Presenting at SAGE-AU

2010-05-04T08:46:00.002+10:00

I have been asked to present at the SAGE-AU conference in August on Open Source Tools. My talk will be about Configuration Management and CMDB's... I wonder if Open-AudIT will get a plug ? :-)

FYI - SAGE-AU Conference is on from the 9th - 13th of Auagst in Hobart, Tasmaina.
http://www.sage-au.org.au/conference-2010/

They're (the organisers) still finalising details around schedule, presenters, etc, etc.

Progress

2010-05-04T08:44:00.002+10:00

I have already addressed a couple of issues with OAv2 Alpha 0.2.

It doesn't like PHP 5.3 - the short tags are ON in the code. Have replaced them. PHP 5.3 depreciates the "ereg" function(s) - I've replaced them with "preg_match" functions.

Look for Alpha 0.3 soon.

Alpha 0.2 released

2010-05-04T08:41:00.003+10:00

A new public Aplha of OAv2 has been uploaded. We're getting there slowly - but damn real life keeps getting in the way !!!

You can grab the code here:
http://www.open-audit.org/OAv2_02.zip

Some release notes...

The "system display" page still looks a bit weird in Internet Explorer.
The headings are in blue (should be dark grey).
The background of the sections overflows vertically.

Best not to alter a Groups - (eg: rename a Group).
When you alter a Group, it is not catered for when importing a system and a duplicate group is created.
It thinks the Group no longer exists and creates a new one if need be (think network groups).
I need to fix this ASAP.

There have been a few database changes.
Best to create a new database and go from there.

Not all man_ type fields are displayed on the "system display" page - to do.

Under the "Queries" menu, you will only see two options now.
Choose Groups and from there click the Group Name to see the systems.
Once a Group is being viewed, "Reports" menu becomes available.
You can run a "Report" on all systems YOU can see (not just one specific Group), by replacing the Group_id in the URL (the last number) with a zero - 0.
If you can view the "All Devices" group, it's better (SQL wise) to use that option.

The "Installed Software" SQL need attention.
Running it across ~3,000 systems takes so long, I haven't seen it actually complete.
Need to revise the SQL.
The main problem is the counting of how many installs a particular piece of software is on.
Have removed that and it is OK, but we NEED that functionality.
To be addresses ASAP.

Created a couple of seperate scripts to audit your domain or a list of PCs.
They both take the PCs and run audit_windows.vbs against them.
Check the scripts for details.
NOTE - if submitting online, make sure to set the URL in audit_windows.vbs

OAv2 Alpha update

2010-02-04T14:18:00.004+10:00

I have sent the Alpha to one of our Developers (Andy Hull).
Andy has sent some feedback, which we are working on.
I'll post the download link here, when I make a public upload (when I get home tonight).
** As promised - try this - http://www.open-audit.org/OAv2.zip

Things to bear in mind.
THIS IS ALPHA SOFTWARE.
IT WILL EAT ALL YOUR DATA.

Now that I've scared you...

I would NOT recommend this for running in Production.
Sure, you might audit a production system, but I wouldn't rely on this as a replacement for Open-AudIT right now. Feature wise, it's still a way behind.

There is no install routine. You will need to know how to setup MySQL databases, et al. There IS a readme in the file detailing basic steps needed to do this. Please don't ask for help. If you cannot install this, then you shouldn't be playing with it !!! One of the things high on the todo list is an installer (both for Windows and Linux).

Linux auditing probably wont work. I have spent most of my time on the Windows side of things. Linux auditing is on the list - and indeed there is a basic script in the download. I haven't even opened it for months though, so I'm guessing it wont upload into OAv2 correctly.

SQL Server doesn't have a database creation script. Simply because the database schema still isn't finalised.

What does work ?

Manual running of the audit script and inserting it into the web form. Running the audit script against a remote system. Running the audit script and auto uploading (via Explorer).

Dynamic Groups. I haven't built the web forms for static groups yet.
OAv2 users and Group permissions.
Locations and assigning systems to them.
Editing manual values in web forms.
Creating / Editing / Deleting Users, Groups and Locations.

Check back here later for a download link (I'm such a tease :-) ).
** As promised - try this - http://www.open-audit.org/OAv2.zip

OAv2 Alpha is inbound

2010-01-25T09:27:00.002+10:00

Well, I have today (Mon) and Wed off from work.
Am coding my butt off to get OAv2 into an Alpha state.
Have spent a couple of hours on it this morning, and I think be Wed night (at the latest), I will look to push the code to SVN.
Looking "good enough" at this stage.

As per my last post, the status on various items are...

* - Audit script runs on PCs and submits to database. DONE.
* - Users can be created and assigned rights to groups. DONE.
* - Groups can be created/edited/deleted. DONE.
* - Devices can be viewed with all submitted audit details. DONE.
* - Devices can have their "manual" fields edited. DONE.
* - "List" type pages (based on groups) complete DONE.

It's more about cleanup and release readiness than anything else now.

Apologies

2009-11-03T21:14:00.003+10:00

Apologies for the lack of recent updates.
Unfortunately, not a great deal has happened lately.
Damn "real life" keeps getting in the way.
So, what HAVE I managed to do...

Well, I have a MSSQL Server compatible database script.
I am working on a bug in the Software audit processing routine.

For an Alpha, I'd like to get basic functionality complete. By basic functionality I mean:
* - Audit script runs on PCs and submits to database.
* - Users can be created and assigned rights to groups
* - Groups can be created/edited/deleted
* - Devices can be viewed with all submitted audit details
* - Devices can have their "manual" fields edited
* - "List" type pages (based on groups) complete
Most of these items are nearly complete (as in 90%). It is more a matter of "finishing them off".
Realistically, I think it would be (maybe) 30 hours work. Not sure there. Might be way off.

My main problem is having a "real" job and a young family (and a slight World of Warcraft addiction, forgive me).

I also have to go back through the models (in CodeIgniter) and check the functions work with MSSQL. I've had a few enquiries about MSSQL compatibility lately, and want to make sure it's all OK. I've also had people say they (think Govt Dept Managers), don't want to use OpenSource. Not PHP, Linux, Apache or MySQL. They would like it rewritten in DotNet and MSSQL. It's frustrating that people STILL have this attitude. I don't mind catering to database abstraction, but the actual code ??? Sure, I'll just re-write the complete application, because you have a completely misguided notion of what "secure" means... sigh. Apologies for the slight rant.

Anyway - what you all want to know (well, the two people who bother to read this) is "WHEN CAN WE HAVE THE CODE ?". All I can say is that's there's not that much left to do for an Alpha and I want it done as much as you do.

Comparisons, Templates and Items

2009-07-14T11:01:00.002+10:00

Bit of a brain dump here.
Apologies if it doesn't make much sense.
Was talking with some collegues this morning, and the subject of reporting on systems with a config (or sections of a config) that do not match the SOE.
Naturally, I am thinking in terms of OAv2 and what it's database can provide.

Brain dump follows.

Want to compare items on a system with predefined items or a template.
Say we want to check a group of systems (WinXP) have a specific list of Group Accounts and that those Groups consist of a given list of Users & Groups.
Take a given system that fits what we want to check click "make a template".
Details on selected sections (thinking DB tables), ie - Groups for example are "imported" into a table and flagged as "Template 1".
Compare the systems in a given group to the "Template 1".
Report differences -
group does not exist,
group exists and is the same,
group exists but has these differences,
this additional group exists.

That would compare against all items (say all groups) on a group of systems.
Remember - a single system can belong to it's own group, so single systems are catered for.
Also need to define a single item, ie - software called "XYZ".
Need to compare against all systems in a group - the single line item.
Report differences -
software extsis
software does not exist
software exists with a differing version number

End goal - show me all our systems that do not meet a given Template, and give me the reasons they don't.

Code in such a way to allow for abstraction - don't care what item or table is catered for in a template. Can compare on a complete system or just selected tables (users, software, groups, etc, etc).

Brain dump finished.
Apologies if that doesn't make much sense...

Bling

2009-05-19T12:31:00.003+10:00

Added some sparkle to the List pages today.
When you mouse over a system, you get selected details appearing.
Done via jQuery and ajax.

Quick OAv2 update

2009-05-18T15:25:00.004+10:00

Just a quick one.

I now have columns on the list page, for any group, displaying selected fields associated with that group. You're probably now saying "what the?".

Let me explain.

On any given Group List page, you see a list of devices in that group. Previously, the columns that were displayed were static (set in the display code). The columns were System Name, Description, IP Address, OS Type, OS Name, Tags. If you wanted something with different columns, you would need to code the PHP display stuff in the View. Now, you can add and remove columns on a per group basis and it's stored in the database. Instant reporting !!! Sweet.

Think of this...

You create a dynamic group. That group includes any systems that have Apache installed. On the list page for that group you might also include the Apache version number (for instance).

This is available on a per group basis. You can define if a column has a link, and what to. If a column just displays text or is an image. This should aleviate a _lot_ of the requests we currently receive in Open-AudIT like "Can you make me a report page that shows blah...". Also, because they're defined in the app and the definitions are stored in the database, you can update the base OAv2 code and not loose your custom reports.

Now I just need to front end it... sigh.

Nominate Open-AudIT in the Sourceforge Community Choise Awards

2009-05-14T08:09:00.002+10:00

Anyone who likes what we're doing (or what we've done) with Open-AudIT could do us a favor. Go to the Open-AudIT homepage and click the shiny picture (or just click the one below). Don't forget to enter your email address and click the link in the email sent to you to confirm the vote.

Thanks in advance.

Open-AudIT as a CMDB

2009-04-30T09:30:00.003+10:00

So, I've been thinking about CMDB's (Configuration Management Database's) and how Open-AudIT can be used.

Essentially, I am thinking a CMDB is a list of CI's (Configuration Items) and their relationships (to other CI's). Open-AudIT contains a large list of details about many items - so there's a list of CI's right there. All we really need to do is to define how these CI's relate to one another.

I have encapsulated this data in essentially two tables. Table one defines a CI. What is it ? What table (and row) is it in ? Some other details not automatically captued by the audit scripts. Another table detailing the relationship between the CI's. The two CI's concerned. The type of relationship. Any credentials used, etc.

A large amount of this can be automatically populated, upon initial setup of a CI. I am thinking about the logic needed to auto create a number of CI's and their relationships by "following" the trail through the OAv2 database, linking them up.

I have also created a third table, essentially to say "These CI's (and their associated relationships) belong to this particular 'CMDB App'". So you can create a CMDB App of, say, a particular web application. Example CI's would be the website, the database, the users URL, the group of systems accessing it, the database credentials, etc, etc. Wrap the whole thing into a CMDB App, and it then becomes easy to run "what - if" type questions on the CMDB.

What if I change the website from server A to server B ? Show me all the affected CMDB Apps and the specific CI's for each CMDB App. That kind of thing.

I'm still thinking this through, but I think it could be a very powerful and compelling way to utilise the data contained within Open-AudIT.

Any comments and suggestions are more than welcome.

User Access Levels

2009-04-27T10:52:00.006+10:00

So, I am coding OAv2 with different levels of User access.
Basically, all Users have access of varying levels to different Groups.
A Group is a selection of systems (PCs, Printers, Switches, et al).
Bear in mind most systems will belong to several groups. If a system is in both a group with visibility and without, it _will_ be shown.

Below when I refer to a Group, this means the Group and the Systems that belong to it.

My Group access levels are below:
0 - No visibility of the group.
2 - Group visible in "list" type pages only. No "details" pages on individual items.
4 - Group visible in "list" type pages. "Details" pages on individual items. No "sensitive" class of information visible (CD Keys, etc).
6 - Group visible in "list" type pages. "Details" pages on individual items. "Sensitive" class of information visible (CD Keys, etc).
8 - Group visible in "list" type pages. "Details" pages on individual items. "Sensitive" class of information visible (CD Keys, etc). Fields belonging to system are editable.

The code for this is in place, but I have to audit the pages making sure it's implemented at a page level.

As well as the Group level access there is a single flag to indicate if a User is an Administrator of the application.

The Users that are designated "administrator" level access will be able to CRUD Groups and Users. "Normal" application users will not be able to CRUD Groups and Users.

If anyone can think of other User access levels, please let me know.

Weekend Coding

2009-04-27T08:29:00.004+10:00

Got a couple of neat things done on the weekend.

Wrote a function to log database calls to FirePHP. Every query now logs time to execute, rows returned/affected, SQL string, function performing the call. 3 lines of code needed for each SQL call. Very nice.

EDIT - this is mainly for debugging purposes. The App itself has an internal audit trail of who changed what, and when...

Finally got around to making the app create groups automatically, based on network segment. For example, if you audit a PC that is on 192.168.0.50 255.255.255.0 the app checks if there is a group that fits these criteria (192.168.0.0/24). If it exists, the PC is added to that group, if it doesn't exist it's created and the PC added. I just have to finish the assigning of User rights to the newly created group.

As an aside, I installed Ubuntu 9.04 (Jaunty Jackalope) on the weekend. I also re-installed Windows XP. It amazes me that people say Linux is difficult to install. Obviously they haven't tried it for years. Ubuntu install == 1 hour (installed, patched, configured). Windows XP install == 4 hours (installed, patched, configured + some additional apps). Windows, with the need to install drivers and reboot, install patches and reboot and install additional applications to get a functional system, is so much slower and more difficult. I implore anyone reading this - go download Ubuntu and try it. You can do so without affecting your installed system (Ubuntu has what's called a "Live CD" - boot from it and you can try the OS without affecting your Windows install).

Ubuntu user since 5.04 and loving it more with every release. [/Zealot rant] :-)

Status Update

2009-04-22T13:16:00.008+10:00

Task	Status
Audit results in XML format	done
Multiple levels of user access	done
Auto assigned groups (Linux, Windows, Database, Web Server, etc)	done
User Defined static and dynamic groups	done
Auto created groups (based on network segment)	in progress
Audit results encrypted using PKI	proof code complete
Audit initiated from Linux server	proof code complete
Auto generate network maps using GraphML markup (yEd - http://www.yworks.com/)	proof code complete
Alerting based on per User + Group + alert type + interval (immediate, daily, weekly)	idea
Each group can have displayed columns defined	idea

Debug with FirePHP

2009-04-03T08:09:00.007+10:00

I am using FirePHP to write debug messages. It works with CodeIgniter quite well. There's a simple flag (TRUE / FALSE) in a config file to enable it.

When enabled, every SQL statement along with a returned record count (in the case of a SELECT) is dumped to the console. Nice. Easy to see where you go wrong in your SQL statements. IE - "well, that query should have returned 100 rows - why is it returning 10?". It also has the nice side effect of displaying when a given query runs more than once. I had some logic in code that was causeing one SQL statement to be run 4 or 5 times. Output to the web page was fine, though. Using the FirePHP debugger, I soon realised that "Hey, how come that statement appears several times ?".

One other gotcha is that if you don't have FirePHP installed, but run with debugging on - it borks badly. I have to confirm this, but worse case... It should be off in production, anyway.

EDIT - no, it doesn't bork. It's fine to run with debug = on and not have FirePHP installed. I must have been having a bad hair day !!!

EDIT #2 - In Xampp (Windows) you need to alter the php.ini. In an Ubuntu LAMP install, you don't.

Stay tuned.

Tech used by OAv2

2009-03-23T15:05:00.002+10:00

A LAMP stack. Personally, I use Ubuntu, Apache, PHP, MySQL but OAv2 should be quite portable as far as databases and webservers go.
CodeIgniter for a PHP framework.
JQuery for a javascript abstraction framework.
XML Charts for pretty graphs.
The Tango icon set.
NMAP for network scanning.
WINexe for running programs on Windows machines, from Linux.

Weekend Work - organising directories in OAv2

2009-03-23T14:51:00.003+10:00

So, I'm using the CodeIgniter framework for OAv2. Best practice states you should move any sensitive files (think config.php) out of your web directories. So, a few hours and a few periods of WTF, and I have the application separated into two main sections.

Inside /var/www is index.php along with the JavaScript, css and images files. In another directory (outside the web) is the rest of the framework and application. It's working well. I think the directory structure I'll use will be along the lines of:

/var/www
/usr/bin/OAv2/codeigniter
/usr/bin/OAv2/scripts

Oh - as for Windows installs.... well, they're secondary. I plan to be able to run everything from a Debian/Ubuntu install. There should be no need for a Windows machine. This includes auditing a Windows Domain. Having said that, I'll probably expend a limited amount of effort to get it working under Windows....

Hello World

2009-03-23T13:11:00.000+10:00

Well, I figured I should get some things down "in print", and a blog is as good a place as any - hence "Hello World", and here we are.

I've never blogged before, so please excuse any foobar's, at least initially.

I plan for this blog to be (mainly) about the experience of re-writing Open-AudIT (OAv2). What I'm doing, reasons for decisions, updates and all that stuff. There will be a few note's on tech I am researching and how it could be used for OAv2.

For anyone that doesn't know, Open-AudIT (http://www.open-audit.org) is free software (GPL Licensed) for keeping track of the devices on your network and their configuration. OAv2 builds upon this notion with comprehensive alerting, multiple users, groups and tagging and a whole host of new features.

Needless to say - "Stay Tuned"...