#!/usr/bin/perl
#
# bin/rusers.saint
#
# version 1, Mon Mar 20 18:49:25 1995, last mod by wietse
# mod by s.k. 2/25  Add fact for identified login name
#

# Query the target's rusers daemon and report which user logged in from
# which host.  Try to clean up unqualified host names or host names that
# are truncated.

$running_under_saint = 1;

require 'config/paths.pl';
require 'perl/fix_hostname.pl';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

print "BEGIN\n";

#
# Parse JCL.
#
$usage="Usage: rusers.saint target\n";
&Getopts("v");
 
if ($#ARGV < 0) {
	print STDERR $usage;
	exit 1;
}
$target = $ARGV[0];
$service = &basename($0, ".saint");

$| = 1;

#
# Examine the output from the rusers client.
#
open (RUSERS, "$RUSERS -l $target 2>/dev/null|") 
    || exit 1;

while (<RUSERS>) {
    ($user, $where, $month, $day, $time, $idle, $host) = split;

    # Deal with hostname stuff in case of remote logins.
    if (/\(.*\)/) {
	if ($idle && !$host) {
	    $host = $idle;
	}
	# Get rid of X display numbers.
	$host =~ s/:.*//;
	$host =~ s/[()]//g;
	# Verify hostname if anything interesting was left.
	if ($host ne "" && $host ne "localhost") {
	    # Canonicalize the host name.
	    if ($fqdn = &fix_hostname($host, $target)) {
		$host = $fqdn;
		$status = "a";
		$severity = "";
		$trustee = "$user\@$target";
		$trusted = "root\@$host";
		$service_output = "$user";
		$text = "identified login $user from $host";
		&saint_print();
	    } else {
		$status = "u";
		$severity = "";
		$trustee = "$user\@$target";
		$trusted = "root\@$host";
		$service_output = "$user";
		$text = "identified login $user from $host, unable to verify hostname";
		&saint_print();
	    }
	} else {
		$status = "a";
		$severity = "";
		$trustee = "";
		$trusted = "";
		$service_output = "";
		$text = "identified login $user";
		&saint_print();
	}
    } elsif ($where ne "") {
	$status = "a";
	$severity = "";
	$trustee = "";
	$trusted = "";
	$service_output = "";
	$text = "identified login $user";
	&saint_print();
    }
}
$status = "a";
$severity = "yi";
$trustee = "ANY@$target";
$trusted = "ANY@$target";
$service_output = "rusersd vulnerability";
$text = "Information from rusersd could help hacker";
&saint_print();
