I figured this out. On line 158 of the ssh_asa-fwsmconfig_diff script change $pass/r to $addpass/r. If you encounter this problem, don't forget to run through the fixes to the "*password:*" variables as well, as explained in this thread: http://www.mail-archive.com/[email protected]/msg15464.html
On Monday, February 25, 2013 5:23:46 PM UTC-7, [email protected] wrote: > > I am trying to test agentless connection to one of my ASAs. I have > enabled agentless, I have added the device with register_host.sh and have > added a ssh_asa-fwsmconfig_diff agentless config for the ASA in > ossec.config. I am now just trying to test the script by running: > > /var/ossec$ sudo ./agentless/ssh_asa-fwsmconfig_diff [email protected] > > Here is the output from that command: > ___________________________________________________________________ > ossec@OSSEC:/var/ossec$ sudo ./agentless/ssh_asa-fwsmconfig_diff > [email protected] > [sudo] password for ossec: > spawn ssh -c des [email protected] > > > No valid ciphers for protocol version 2 given, using defaults. > > > [email protected]'s password: > > This is a privately owned computing system.Access is permitted only by > authorized employees or agents of the company.The system may be used only > for authorized company business.Company management approval is required for > all access privileges.This system is equipped with a security system > intended to prevent and record unauthorized access attempts. Unauthorized > access or use is a crime under the law. > > Type help or '?' for a list of available commands. > > > 10ASA> INFO: Starting. > enable > > Password: ############ > ERROR: Timeout while running enable on host: [email protected] > ossec@OSSEC:/var/ossec$ ######### > -bash: ###: event not found > _________________________________________________________________________ > > The spot where you see the first series of hashes is where the script > stops and prompts me for a password. I'm assuming that it is asking me for > the enable password. I enter the correct enable password and, as you see, > I get a timeout. > > I did modify the ssh_asa-fwsmconfig_diff script a bit after an issue I > encountered with the ssh_pixconfig_diff script. I was having troubles > making the pix script work then came across this post: > http://www.mail-archive.com/[email protected]/msg15464.html > After reading that post and correcting the *password:* bugs, the script > started working perfectly. I opened the ssh_asa-fwsmconfig_diff script and > also found spacing issues everywhere "*password:*" is referenced. After > doing so I was at least able to get as far as you see above but am now > stuck again. > > Here is my ssh_asafwsmconfig_diff script with the "*password:*" > corrections. I have made no other changes. Any script geniuses out there > that can identify any other problems that could be causing this issue for > me? > > "ssh_asa-fwsmconfig_diff" [readonly] 210L, 5253C#!/usr/bin/env expect > > # @(#) $Id$ > # Agentless monitoring > # > # Copyright (C) 2009 Trend Micro Inc. > # All rights reserved. > # > # This program is a free software; you can redistribute it > # and/or modify it under the terms of the GNU General Public > # License (version 2) as published by the FSF - Free Software > # Foundation. > > > if {$argc < 1} { > send_user "ERROR: ssh_pixconfig_diff <hostname> <commands>\n"; > exit 1; > } > > > # NOTE: this script must be called from within /var/ossec for it to work. > set passlist "agentless/.passlist" > set hostname [lindex $argv 0]1,1Top2,0-13,1 45678910,1123,0-145,1 67{ > > > }8{ > > > }9,0-1201,1 23 > set commands [lrange $argv 1 end]24,10% > set pass "x"25,11% > set addpass "x"26,11% > set timeout 2027,12% > 28,0-12% > if {[string compare $hostname "test"] == 0} {29,13% > if {[string compare $commands "test"] == 0} {30,13% > exit 0;31,14% > }32,14% > {}33,15% > {}34,0-15% > # Reading the password list.35,16% > if [catch {36,16% > set in [open "$passlist" r]37,17% > { > > } loc_error] {38,18%{ > > } > send_user "ERROR: Password list not present (use \"register_host\" > first).\nn"39,19% > exit 1;40,19% > {}41,110% > {}42,0-110% > while {[gets $in line] != -1} {43,111% > set me [string first "|" $line]44,111% > set me2 [string last "|" $line]45,112% > set length [string length $line]46,112% > 47,113% > if {$me == -1} {48,113% > continue;49,114% > }50,114% > if {$me2 == -1} {51,115% > continue;52,115% > }53,116% > if {$me == $me2} {54,117% > continue;55,117% > }56,118% > 57,118% > set me [expr $me-1]58,119% > set me2 [expr $me2-1]59,119% > 60,120% set host_list [string range $line 0 $me] set me [expr > $me+2]61,120%2 > set pass_list [string range $line $me $me2]63,121% > set me2 [expr $me2+2]64,121% > set addpass_list [string range $line $me2 $length]65,122% > 66,0-122% > if {[string compare $host_list $hostname] == 0} {67,123% > set pass "$pass_list"68,124% > set addpass "$addpass_list"69,124% > break70,125% > }71,125% > }72,126% > close $in73,126% > 74,0-127% > 75,0-127% > if {[string compare $pass "x"] == 0} {76,128% > send_user "ERROR: Password for '$hostname' not found.\n"77,128% > exit 1;78,129% > { > > > }79,129% > { > > > }80,0-130% > 81,0-131% > # SSHing to the box and passing the directories to check.82,131% > if [catch {83,132% > spawn ssh -c des $hostname84,132% > { > > } loc_error] {85,133% > { > > } > send_user "ERROR: Opening connection: $loc_error.\n"86,133% > exit 1;87,134% > { > > > }88,134% > { > > > }89,0-135% > expect {90,135% > "WARNING: REMOTE HOST" {91,136% send_user "ERROR: RSA host key for > '$hostname' has changed. Unable to acccess.\n"92,137% > exit 1;93,137% > }94,138% > "*sure you want to continue connecting*" {95,138% > send "yes\r"96,139% > expect "*password:*" {97,139% > send "$pass\r"98,140% > 99,0-140% > expect {100,141% > "Permission denied" {101,142% send_user "ERROR: Incorrect password to > remote host: $hostnaame .\n"102,142% > exit 1;103,143% > }104,143% > timeout {105,144% send_user "ERROR: Timeout while running on host (too > long too finish): $hostname .\n"106,145% > exit 1;107,145% > }108,146% > "*>" {109,146% > send_user "\nINFO: Starting.\n"110,147% > }111,147% } }112,148%3 > }114,149% > "ssh: connect to host*" {115,149% > send_user "ERROR: Unable to connect to remote host: $hostname .\n"116,150% > exit 1;117,150% > }118,151% > "no address associated with name" {119,151% > send_user "ERROR: Unable to connect to remote host: $hostname .\n"120,152% > exit 1;121,152% > }122,153% "*Connection refused*" { send_user "ERROR: Unable to connect to > remote host: $hostname .\n"123,154%4 > exit 1;125,154% > }126,155% > "*Connection closed by remote host*" {127,155% send_user "ERROR: Unable > to connect to remote host: $hostname .\n" exit 1;128,156%9 > }130,157% > "*password:*" {131,157% > send "$pass\r"132,158% > 133,158% > expect {134,159% > "Permission denied" {135,159% send_user "ERROR: Incorrect password to > remote host: $hostname ..\n"136,160% > exit 1;137,161% > }138,161% > timeout {139,162% send_user "ERROR: Timeout while running on host (too > long to finnish): $hostname .\n"140,162% > exit 1;141,163% > }142,164% > "*>" {143,164% > send_user "INFO: Starting.\n"144,165% > }145,165% > }146,166% > }147,166% > timeout {148,167% > send_user "ERROR: Timeout while connecting to host: $hostname . > \n"149,167% > exit 1;150,168% > }151,168% > }152,169% > 153,0-169% > # Going into enable mode.154,170% > send "enable\r"155,170% > expect {156,171% "password:" { send "$addpass\r"157,172%8 > 159,0-172% > expect {160,173% > "*asswor*" {161,173% send_user "ERROR: Incorrect enable password to > remote host: $hosstname .\n"162,174% > exit 1;163,175% > }164,175% > "*rror in authenticatio*" {165,176% send_user "ERROR: Incorrect enable > password to remote host: $hosstname .\n"166,176% > exit 1;167,177% > }168,177% > timeout {169,178% send_user "ERROR: Timeout while going to enable mode on > host: $hhostname .\n"170,178% > exit 1;171,179% > }172,180% > "*#" {173,180% > send_user "ok on enable pass\n"174,181% > }175,181% > }176,182% > }177,182% > timeout {178,183% > send_user "ERROR: Timeout while running enable on host: $hostname > .\n"179,183% > exit 1;180,184% > }181,184%}182,185%3,0-1 > 184,0-186% > 185,0-186% > # Sending commands186,187%set timeout 60 > send_user "\nSTORE: now\n"187,188%8 > 189,0-188% > send "term pager 0\r"190,189% > 191,0-189%# Excluding uptime from the output > send "show version | grep -v Configuration last| up\r"192,190%3 > send "show running-config\r"194,191% > send "$commands\r"195,191% > send "exit\r"196,192% > 197,0-193% > expect {198,193% > timeout {199,194% > send_user "ERROR: Timeout while running commands on host: $hostname > .\n"200,194% > exit 1;201,195% > }202,195% > eof {203,196% > send_user "\nINFO: Finished.\n"204,196% > exit 0;205,197% > }206,197% > {}207,198% > {}208,0-198% > send_user "ERROR: Unable to finish properly.\n"209,199% > exit 1 > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
