what does uemccli run as

cadencep45 commented 5 years ago

1 What account does the uemcli queries run as 2 from looking at

more agent_emcunity

#!/usr/bin/env python
# -*- encoding: utf-8; py-indent-offset: 4 -*-
# +------------------------------------------------------------------+
# |             ____ _               _        __  __ _  __           |
# |            / ___| |__   ___  ___| | __   |  \/  | |/ /           |
# |           | |   | '_ \ / _ \/ __| |/ /   | |\/| | ' /            |
# |           | |___| | | |  __/ (__|   <    | |  | | . \            |
# |            \____|_| |_|\___|\___|_|\_\___|_|  |_|_|\_\           |
# |                                                                  |
# | Copyright Mathias Kettner 2014             mk@mathias-kettner.de |
# +------------------------------------------------------------------+
#
# This file is part of Check_MK.
# The official homepage is at http://mathias-kettner.de/check_mk.
#
# check_mk is free software;  you can redistribute it and/or modify it
# under the  terms of the  GNU General Public License  as published by
# the Free Software Foundation in version 2.  check_mk is  distributed
# in the hope that it will be useful, but WITHOUT ANY WARRANTY;  with-
# out even the implied warranty of  MERCHANTABILITY  or  FITNESS FOR A
# PARTICULAR PURPOSE. See the  GNU General Public License for more de-
# tails. You should have  received  a copy of the  GNU  General Public
# License along with GNU Make; see the file  COPYING.  If  not,  write
# to the Free Software Foundation, Inc., 51 Franklin St,  Fifth Floor,
# Boston, MA 02110-1301 USA.
#
# Written/Edited by Philipp Näther
# philipp.naether@stadt-meissen.de

import getopt, os, sys, re, subprocess

def usage():
    sys.stderr.write("""Check_MK emcunity Agent

USAGE: agent_emcunity [OPTIONS] HOST
       agent_emcunity -h

ARGUMENTS:
   HOST                               Hostname or IP address of the target SP

OPTIONS:
  -h, --help                          Show this help message and exit
  -u USER, --user USER                Set the admin user
  -p PASSWORD, --password PASSWORD    Set the password for admin user
  --debug

it seems even though we have cached the password in the emc bitlocker and can query the unity application passwordless we are using the username and password explicitly for each call. I this correct ( as I working back through the code so could well be wrong )

ImTheLucKyOne commented 5 years ago

The way it is designed as a whole (with the WATO rule) is meant to work only with username/password combination. As stated in the readme, you have to set the datasource program WATO rule and define the user/password there. With this given credentials the uemcli is called by the agent.

cadencep45 commented 5 years ago

I had the wrong tree installed, working now, i.e.

[cid:image001.png@01D4AC21.CBC96A20]

One thing I am confused about is username and password.

I created an operator read-only account for this service, this words fine.

However I would really like to use the fact once you have saved the user login into the local ‘lockbox’, you should be able to do passwordless login this removing the need for using username/password for check_mk queries. The reason I am saying this is to avoid a password being captured in a packet sniff.

Ps its damn good.

-Bob

From: Philipp N. [mailto:notifications@github.com] Sent: 14 January 2019 14:56 To: ImTheLucKyOne/check_mk_emcunity check_mk_emcunity@noreply.github.com Cc: Flynn, Bob Bob.Flynn@msx.bala.susq.com; Author author@noreply.github.com Subject: Re: [ImTheLucKyOne/check_mk_emcunity] what does uemccli run as (#10)

The way it is designed as a whole (with the WATO rule) is meant to work only with username/password combination. As stated in the readme, you have to set the datasource program WATO rule and define the user/password there. With this given credentials the uemcli is called by the agent.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/ImTheLucKyOne/check_mk_emcunity/issues/10#issuecomment-454032451, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AsVb8D6S4VbGx8iwluqVrs3akaY3693Bks5vDJpsgaJpZM4Z1eu2.

IMPORTANT: The information contained in this email and/or its attachments is confidential and may only be used by the person to whom it is addressed. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this email and/or any attachment by an unintended recipient is strictly prohibited. Neither this email nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this email and/or any of its attachments are free of viruses. Any views expressed are personal to the author, except where specifically stated to be the views of SIG. SIG accepts no liability of any kind either for any errors arising as a result of electronic transmission or for any loss or damage which may be sustained by any person as a result of this email and/or its attachments being communicated to any person other than the intended recipient.

Susquehanna International Group Limited is a private company limited by shares and registered in Ireland. Registration No.: 445356. Registered Office Address: International Centre Memorial Road IFSC Dublin 1 Ireland

Susquehanna International Securities Limited is a private company limited by shares and registered in Ireland. Registration No.: 337946. Registered Office Address: International Centre Memorial Road IFSC Dublin 1 Ireland

Susquehanna International Securities Limited (UK Branch). Registration No.: FC033877

Liffeyview Property Holdings Limited is a private company limited by shares and registered in Ireland. Registration No.: 534083. Registered Office Address: International Centre Memorial Road IFSC Dublin 1 Ireland

Heights Capital Ireland, LLC is a branch registered in Ireland under registration no. 908306 of Heights Capital Ireland, LLC incorporated in Delaware USA under registration no.: 5762692

SAL Trading, LLC is a branch registered in Ireland under registration no. 906667 of SAL Trading, LLC incorporated in Delaware USA under registration no.: 4984826

Susquehanna International Securities Limited is regulated by the Central Bank of Ireland. Susquehanna International Securities Limited (UK Branch) is regulated by the Financial Conduct Authority for conduct of business rules

If this email relates to investment services and activities as defined in Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on Markets in Financial Instruments (MiFID II), you are receiving the email from Susquehanna International Securities Limited

ImTheLucKyOne commented 5 years ago

Good point, I will check how this could be integrated the easiest way. I wasn't aware of the functionality to do passwordless login to a EMC device using lockbox.

Could you provide some info about how the uemcli call works with a lockbox installed? Is it just uemcli -d HOST?

cadencep45 commented 5 years ago

Ref

https://community.emc.com/docs/DOC-66387

Example

[root@dubstormgmt8003 unity]# uemcli -d 10.170.95.45 -silent /stor/general/system show 1: Free space = 260917115748352 (237.3T) Used space = 555392958464 (517.2G) Total space = 261472508706816 (237.8T) Compression space saved = 268435456 (256.0M) Compression percent = 0% Compression ratio = 1:1 Data Reduction space saved = 268435456 (256.0M) Data Reduction percent = 0% Data Reduction ratio = 1:1

Here I am querying a unity device at 10.170.95.45 with the stored username/password so I can do the query without an on-the-wire password.

From: Philipp N. [mailto:notifications@github.com] Sent: 14 January 2019 16:17 To: ImTheLucKyOne/check_mk_emcunity check_mk_emcunity@noreply.github.com Cc: Flynn, Bob Bob.Flynn@msx.bala.susq.com; Author author@noreply.github.com Subject: Re: [ImTheLucKyOne/check_mk_emcunity] what does uemccli run as (#10)

Good point, I will check how this could be integrated the easiest way. I wasn't aware of the functionality to do passwordless login to a EMC device using lockbox.

Could you provide some info about how the uemcli call works with a lockbox installed? Is it just uemcli -d HOST?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/ImTheLucKyOne/check_mk_emcunity/issues/10#issuecomment-454063390, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AsVb8KAQtgadYAtV4AjQjiaFmIdGD11Pks5vDK2BgaJpZM4Z1eu2.