Example #1
0
    def __init__(self, output):
        self._logins = {}
        self._to_xml = make_to_xml(())

        try:
            tz = output.pop(0).strip()

        except IndexError:
            raise ValueError('Unable to initialize FailedLogins object: ' +
                             'no output received')

        if not output:
            raise ValueError('Unable to initialize FailedLogins object: ' +
                             'got timezone but no further output')

        # Start big, nasty kludge to deal with missing year in output
        last_date = datetime.now()
        year = last_date.year

        for line in output:
            try:
                # Parse output into sensible chunks
                month, day, time, _, process, vestige = line.split(None, 5)
                vestige, source, _, port, _ = vestige.rsplit(None, 4)
                vestige, reason, user, _ = vestige.rsplit(None, 3)

            except ValueError:
                logger.warn('Unable to parse failed login {}'.format(line))
                continue

            # Create datetime object from the local time
            date = datetime.strptime(' '.join((month, day, time, str(year))),
                                     "%b %d %H:%M:%S %Y")
            # If time appears to reverse, decrement the year by one
            if date > last_date:
                year -= 1
                date.replace(year=year)
            # Set last_date to this one and convert to UTC in ISO 8601 format
            last_date = date
            utc = adjust_time(date, tz)
            timestamp = utc.replace(tzinfo=pytz.UTC).isoformat()
            # Remove colon from end of process
            process = process.rstrip(':')
            # Interpret reason for failure
            reason = 'username' if reason == 'user' else 'password'
            # Create a new Login object
            login = Login(source, port, user, timestamp, process, reason)
            # Store the login in our internal dict
            try:
                self._logins[source].append(login)

            except KeyError:
                self._logins[source] = [login]
Example #2
0
    def __init__(self, output):
        self._sudologs = {}
        self._to_xml = make_to_xml(())

        try:
            tz = output.pop(0).strip()

        except IndexError:
            raise ValueError('Unable to initialize SudoLogs object: ' +
                             'no output received')

        if not output:
            raise ValueError('Unable to initialize SudoLogs object: ' +
                             'got timezone but no further output')

        # Start big, nasty kludge to deal with missing year in output
        last_date = datetime.now()
        year = last_date.year

        for line in output:
            try:
                # Parse output into sensible chunks
                month, day, time, _, _, user, vestige = line.split(None, 6)
                _, vestige = vestige.split('=', 1)
                tty, _, pwd, _, pseudo, vestige = vestige.split(None, 5)
                _, command = vestige.split(None, 1)

            except ValueError:
                logger.warn("Unable to parse sudo log '{}'".format(line))
                continue

            # Create datetime object from the local time
            date = datetime.strptime(' '.join((month, day, time, str(year))),
                                     "%b %d %H:%M:%S %Y")
            # If time appears to reverse, decrement the year by one
            if date > last_date:
                year -= 1
                date.replace(year=year)
            # Set last_date to this one and convert to UTC in ISO 8601 format
            last_date = date
            utc = adjust_time(date, tz)
            timestamp = utc.replace(tzinfo=pytz.UTC).isoformat()
            # Remove "XXXX=" from log elements
            args = [i.split('=', 1)[1] for i in (pwd, pseudo, command)]
            # Create a new Log object
            sudolog = Log(user, timestamp, tty, *args)
            # Store the log in our internal dict
            try:
                self._sudologs[user].append(sudolog)

            except KeyError:
                self._sudologs[user] = [sudolog]
Example #3
0
    def __init__(self, output):
        self._processes = {}
        self._sorted_pids = []
        self._to_xml = make_to_xml(())

        try:
            tz = output.pop(0).strip()  # Capture UTC offset
            del output[0]  # Remove column headers

        except IndexError:
            raise ValueError("Unable to initialize Processes object")

        for record in (l.strip().split() for l in output):
            try:
                local = datetime.strptime(' '.join(record[5:10]),
                                          "%a %b %d %H:%M:%S %Y")

                utc = adjust_time(local, tz)
                # Make datetime object timezone-aware
                started = utc.replace(tzinfo=pytz.UTC).isoformat()
                if '-' in record[10]:
                    days, hms = record[10].split('-')
                else:
                    days, hms = 0, record[10]

                hours, minutes, seconds = hms.split(':', 2)
                months, days = divmod(int(days), 30)
                years, months = divmod(months, 12)
                cpu_time = 'P{}Y{}M{}DT{}H{}M{}S'.format(str(years).zfill(4),
                                                         str(months).zfill(2),
                                                         str(days).zfill(2),
                                                         hours.zfill(2),
                                                         minutes.zfill(2),
                                                         seconds.zfill(2))

                process = Process(*(record[0:5] +
                                    [started, cpu_time, record[11]] +
                                    [' '.join(record[12:])]))

                self._processes[process.pid] = process

            except (IndexError, ValueError):
                # If not enough fields in record,
                logger.warn('Unable to parse process {}'.format(record))

        self._sorted_pids = sorted(self._processes.keys(), key=int)
Example #4
0
    def __init__(self, output, last_only=False):
        self._logins = {}
        self._to_xml = make_to_xml(())

        try:
            tz = output.pop(0).strip()

        except IndexError:
            raise ValueError('Unable to initialize LastLogins object')

        # Start big, nasty kludge to deal with missing year in output
        last_date = datetime.now()
        year = last_date.year

        for line in output:
            try:
                # Parse output into sensible chunks
                username, tty, day_of_week, vestige = line.split(None, 3)
                # month, day, time, year, vestige = vestige.split(None, 4)
                month, day, time, vestige = vestige.split(None, 3)
                vestige, duration, source = vestige.rsplit(None, 2)

            except ValueError:
                logger.warn('Unable to parse last_login {}'.format(line))
                continue
            # Create datetime object from the local time
            date = datetime.strptime(' '.join((day_of_week, month, day,
                                               time, str(year))),
                                     "%a %b %d %H:%M %Y")
            # If time appears to reverse, decrement the year by one
            if date > last_date:
                year -= 1
                date.replace(year=year)
            # Set last_date to this one and convert to UTC in ISO 8601 format
            last_date = date
            utc = adjust_time(date, tz)
            timestamp = utc.replace(tzinfo=pytz.UTC).isoformat()

            if duration == 'in':
                duration = 'still logged in'
            else:
                duration = duration.strip('()')
                # Detect days in duration output
                if '+' in duration:
                    days, hm = duration.split('+', 1)
                else:
                    days, hm = 0, duration
                # Calculate months, years from days for ISO 8601 format
                hours, minutes = hm.split(':', 1)
                months, days = divmod(int(days), 30)
                years, months = divmod(months, 12)
                duration = 'P{}Y{}M{}DT{}H{}M00S'.format(str(years).zfill(4),
                                                         str(months).zfill(2),
                                                         str(days).zfill(2),
                                                         hours.zfill(2),
                                                         minutes.zfill(2))
            # If last_only==True, capture only the first (most recent) login
            if last_only is True and username in self._logins:
                continue
            # Create a new Login object
            login = Login(username, tty, timestamp, duration, source)
            # Store the login in our internal dict
            try:
                self._logins[username].append(login)

            except KeyError:
                self._logins[username] = [login]