#include #include #include #include #include int uid1=580; int uid2=650; char user1[] = "tmp-user1"; char user2[] = "tmp-user2"; char* password = "eal"; char* encryptedpassword = "42VmxaOByKwlA"; static const char* tempname = "/tmp/testXXXXXX\0"; int rc; int fd1, fd2; /* file descriptor */ char script_cmd1[1000], script_cmd2[1000], exec_cmd[1000]; char *filename1, *filename2; int main(int ac, char **av) { char command[256]; system("/etc/rc.d/init.d/auditd stop"); system("rm -f /var/log/audit/audit.log"); system("rm /tmp/loginuid_logs -f"); system("/etc/rc.d/init.d/auditd start"); /* Create expect script file to execute ftp session */ filename1 = (char *) malloc(strlen(tempname)); strcpy(filename1, tempname); if ((fd1 = mkstemp(filename1)) == -1) { printf("File creation error\n"); } filename2 = (char *) malloc(strlen(tempname)); strcpy(filename2, tempname); if ((fd2 = mkstemp(filename2)) == -1) { printf("File creation error\n"); } /* create test users */ sprintf(command, "/usr/sbin/useradd -u %d -m -G wheel -p %s %s",uid1,encryptedpassword,user1); system(command); sprintf(command, "/usr/sbin/useradd -u %d -m -G wheel -p %s %s",uid2,encryptedpassword,user2); system(command); /* insert watches and filters on loginuid "uid1" */ system("auditctl -w /tmp/file1 -k loginuid-key"); sprintf(command, "auditctl -a watch,always -F auid=%d", uid1); system(command); sprintf(command, "auditctl -a watch,never -F auid!=%d", uid1); //sprintf(command, "auditctl -a watch,never -F auid=%d", uid2); system(command); sprintf(script_cmd1, "expect -c \"spawn /usr/bin/ssh %s@localhost \nsleep 1 \nexpect -re \\\"password: \\\" \nsleep 1 \nsend \\\"%s\\r\\n\\\" \nsleep 1 \nexpect -re \\\"> \\\" \nsleep 1 \nsend \\\"touch /tmp/file1\\r\\n\\\" \nsleep 1 \nsend \\\"exit\\\" \nsend_user \\\"exit\\n\\\"\"", user1, password); sprintf(script_cmd2, "expect -c \"spawn /usr/bin/ssh %s@localhost \nsleep 1 \nexpect -re \\\"password: \\\" \nsleep 1 \nsend \\\"%s\\r\\n\\\" \nsleep 1 \nexpect -re \\\"> \\\" \nsleep 1 \nsend \\\"touch /tmp/file1\\r\\n\\\" \nsleep 1 \nsend \\\"exit\\\" \nsend_user \\\"exit\\n\\\"\"", user2, password); write(fd1, script_cmd1, strlen(script_cmd1)); fchmod(fd1, S_IRWXU | S_IRWXG | S_IRWXO); close(fd1); sprintf(exec_cmd, "/bin/sh -f %s", filename1); system(exec_cmd); system("rm -f /tmp/file1"); sleep(1); write(fd2, script_cmd2, strlen(script_cmd2)); fchmod(fd2, S_IRWXU | S_IRWXG | S_IRWXO); close(fd2); sprintf(exec_cmd, "/bin/sh -f %s", filename2); system(exec_cmd); /* Stop auditd to prevent more log entries. */ sleep(2); system("auditctl -W /tmp/file1"); system("/etc/rc.d/init.d/auditd stop"); system("cat /var/log/audit/audit.log >> /tmp/loginuid_logs"); system("rm -f /tmp/file1"); /* cleanup users and files */ if (filename1 != NULL) { unlink(filename1); free(filename1); } if (filename2 != NULL) { unlink(filename2); free(filename2); } sprintf(command, "/usr/sbin/userdel -r %s", user1); system(command); sprintf(command, "/usr/sbin/userdel -r %s", user2); system(command); }