diff options
Diffstat (limited to 'mdk-stage1/ppp/scripts')
| -rw-r--r-- | mdk-stage1/ppp/scripts/README | 143 | ||||
| -rwxr-xr-x | mdk-stage1/ppp/scripts/callback | 77 | ||||
| -rw-r--r-- | mdk-stage1/ppp/scripts/chat-callback | 98 | ||||
| -rw-r--r-- | mdk-stage1/ppp/scripts/chatchat/README | 134 | ||||
| -rw-r--r-- | mdk-stage1/ppp/scripts/chatchat/chatchat.c | 409 | ||||
| -rw-r--r-- | mdk-stage1/ppp/scripts/ip-down.local.add | 20 | ||||
| -rw-r--r-- | mdk-stage1/ppp/scripts/ip-up.local.add | 24 | ||||
| -rw-r--r-- | mdk-stage1/ppp/scripts/options-rsh-loc | 1 | ||||
| -rw-r--r-- | mdk-stage1/ppp/scripts/options-rsh-rem | 1 | ||||
| -rw-r--r-- | mdk-stage1/ppp/scripts/options-ssh-loc | 1 | ||||
| -rw-r--r-- | mdk-stage1/ppp/scripts/options-ssh-rem | 1 | ||||
| -rwxr-xr-x | mdk-stage1/ppp/scripts/ppp-off | 34 | ||||
| -rwxr-xr-x | mdk-stage1/ppp/scripts/ppp-on | 36 | ||||
| -rwxr-xr-x | mdk-stage1/ppp/scripts/ppp-on-dialer | 17 | ||||
| -rwxr-xr-x | mdk-stage1/ppp/scripts/ppp-on-rsh | 72 | ||||
| -rwxr-xr-x | mdk-stage1/ppp/scripts/ppp-on-ssh | 76 | ||||
| -rwxr-xr-x | mdk-stage1/ppp/scripts/redialer | 96 | ||||
| -rw-r--r-- | mdk-stage1/ppp/scripts/secure-card | 111 |
18 files changed, 1351 insertions, 0 deletions
diff --git a/mdk-stage1/ppp/scripts/README b/mdk-stage1/ppp/scripts/README new file mode 100644 index 000000000..00e032ca6 --- /dev/null +++ b/mdk-stage1/ppp/scripts/README @@ -0,0 +1,143 @@ +This directory contains a set of scripts which have been used on Linux +as well as Solaris 2.x systems to initiate or maintain a connection +with PPP. The files in this directory were contributed by Al Longyear +(longyear@netcom.com) and Adi Masputra (adi.masputra@sun.com) + +------------------------------------------------------------------------ + +1. README + +This file. You are reading it. It is just documentation. + +------------------------------------------------------------------------ + +2. ppp-on + +This script will initiate a connection to the PPP system. It will run +the chat program with the connection script as a parameter. This is a +possible security hole. However, it is simple. It is meant to replace +the previous version of ppp-on which was not very functional. + +The ppp-on script has entries for the account name, password, IP +addresses, and telephone numbers. The parameters are passed to the +pppd process and, then in turn, to the second part of the connect +script, as a set of environment variables. + +Please make sure that you put the full path name to the ppp-on-dialer +script in the reference to it in ppp-on. + +------------------------------------------------------------------------ + +3. ppp-on-dialer + +This is the second part to the simple calling script, ppp-on. It +executes the chat program to connect the user with a standard UNIX +style getty/login connection sequence. + +------------------------------------------------------------------------ + +4. callback + +This script may be used in lieu of the ppp-on-dialer to permit the +common modem callback sequence. You may need to make changes to the +expected prompt string for the modem. + +The script works by disabling the system's detection of the DCD +condition and working on the modem status message "NO CARRIER" which +is generated when the modem disconnects. + +It is crude. It does work for my modem connection. Use as you see fit. + +------------------------------------------------------------------------ + +5. redialer + +The redialer script is a replacement for the ppp-on-dialer script. It +will do 'attack dialing' or 'demon dialing' of one or more telephone +numbers. The first number which responds will be used for a +connection. + +There is a limit of ten attempts and a 15 second delay between dialing +attempts. Both values are set in the script. + +------------------------------------------------------------------------ + +6. ppp-off + +This is a script which will terminate the active ppp connection. Use +as either "ppp-off" to terminate ppp0, or "ppp-off <device>" to +terminate the connection on <device>. For example, "ppp-off ppp2" will +terminate the ppp2 connection. + +------------------------------------------------------------------------ + +7. secure-card + +This script was written by Jim Isaacson <jcisaac@crl.com>. It is a script +for the 'expect' programming language used with Tcl. You need to have +expect and Tcl installed before this script may be used. + +This script will operate with a device marketed under the name "SecureCARD". +This little device is mated with its controller. On the credit card size +device, there is a sequence number which changes on a random basis. In order +for you to connect you need to enter a fixed portion of your account name +and the number which is displayed on this card device. The number must match +the value at the controller in order for the account name to be used. + +The problem is that chat uses fixed response strings. In addition, the +timing for running the script may prevent the use of a script that reads the +value before it starts the dial sequence. What was needed was a script which +asked the user at the user's console at the time that it is needed. + +This led to the use of expect. + +------------------------------------------------------------------------ + +8. ppp-on-rsh + +This script will initiate a PPP connection to a remote machine using rsh. +This is implemented by creating a master/slave pseudo-tty with the slave +pointing to rsh, specifically with the 'pty' and 'notty' options of pppd. +It is assumed that the remote machine contains some sort of trust +mechanisms (such as ~/.rhosts, et al) to allow the local machine to +connect via rsh as root. + +------------------------------------------------------------------------ + +9. ppp-on-ssh + +This script will initiate a PPP connection to a remote machine using the +secure shell, or ssh. I've only tested this on ssh 1.x, so those of you +who are running ssh 2.x mahy need to modify the ssh options slightly. +This is implemented by creating a master/slave pseudo-ttyt with the slave +pointing to ssh, specifically with the 'pty' and 'notty' options of pppd. +It is assumed that the remote machine can accept the ssh connection from +the local host, in the sense that all ssh authentication mechanisms have +been properly configured, so that a remote root user can open a ssh +connection. + +------------------------------------------------------------------------ + +10. options-rsh-loc & options-rsh-rem + +These options files accompany the ppp-on-rsh script mentioned above. In +theory, you'd want to copy the options-rsh-rem to the remote machine where +in.rshd is running. The only extra option required on the remote machine +options file is the 'notty' option. In addition, all ASCII control characters +[0x00 to 0x1f], plus 0xff, are escaped. This may need to be modified +depending on the rsh (or pseudo-tty) implementation which may differ across +platforms, for further optimizations. + +------------------------------------------------------------------------ + +11. options-ssh-loc & options-ssh-rem + +These options files accompany the ppp-on-ssh script mentioned above. I've +only tested this on ssh 1.x, so those of you who are running ssh 2.x need +to modify the ssh options slightly. In theory, you'd want to copy the +options-ssh-rem to the remote machine where sshd daemon is running. The only +extra options required on the remote machine options file is the 'notty' +option. In addition, all ASCII control characters [0x00 to 0x1f], plus 0xff, +are escaped. This may need to be modified depending on the ssh (or +pseudo-tty) implementation which may differ across platforms, for further +optimizations. diff --git a/mdk-stage1/ppp/scripts/callback b/mdk-stage1/ppp/scripts/callback new file mode 100755 index 000000000..3e74e10b2 --- /dev/null +++ b/mdk-stage1/ppp/scripts/callback @@ -0,0 +1,77 @@ +#!/bin/sh +################################################################### +# +# Script to dial the remote system, negotiate the connection, and send +# it the id. Then wait for the modem to disconnect. Reset the modem +# to answer mode and wait for the system to call back. +# +# The telephone number and modempass are used when establishing the +# connection to the modem. +# +PHONE=555-1212 +MODEMPASS=modem_identifier +# +# Once the modem calls back, the account name and password are used for +# a UNIX style login operation. +# +ACCOUNT=my_account_name +PASSWORD=my_password + +################################################################### +# +# Step 1. Dial the modem and negotiate the initial dialog. +# note: the modem is configured to ignore loss of DCD at this point. +# it is important that this be performed because the loss of DCD +# will normally prevent system from working since 'modem' is used +# for pppd. +# +# The script is terminated normally when the carrier is lost. +# +chat -v \ + TIMEOUT 3 \ + ABORT '\nBUSY\r' \ + ABORT '\nNO ANSWER\r' \ + ABORT '\nRINGING\r\n\r\nRINGING\r' \ + '' AT \ + 'OK-+++\c-OK' 'AT&C0&D2S0=0H0 \ + TIMEOUT 30 \ + OK ATDT$TELEPHONE \ + CONNECT '' \ + assword: $MODEMPASS \ + "\nNO CARRIER\r" + +if [ "$?" = "0" ]; then + +################################################################### +# +# Step 2. Wait for the call back from the remote. This will wait for at most +# 30 seconds for the call back should the first attempt fail or +# something happen with the callback logic at the remote. +# +# note: when the callback occurs, the DCD setting is re-enabled. +# +# If some voice call should happen during this period, the system will +# answer the telephone and then hang up on them. I realize that this is +# rude, but there is little that this script can do. +# + chat -v \ + TIMEOUT 30 \ + ABORT '\nVOICE\r' \ + '\nRING\r' 'AT&C1A' \ + CONNECT '' \ + TIMEOUT 10 \ + ogin:--ogin: $ACCOUNT \ + TIMEOUT 45 \ + assword: $PASSWORD + + if [ "$?" = "0" ]; then + exit 0 + fi +fi + +################################################################### +# +# The script has failed. Terminate the connection mode. +# +chat -v TIMEOUT 3 "" AT 'OK-+++\c-OK' 'AT&C1&D2S0=0H0' OK +exit 1 diff --git a/mdk-stage1/ppp/scripts/chat-callback b/mdk-stage1/ppp/scripts/chat-callback new file mode 100644 index 000000000..d014d6af3 --- /dev/null +++ b/mdk-stage1/ppp/scripts/chat-callback @@ -0,0 +1,98 @@ +# ===================================================================================== +# Chat script to dial our Company PPP account. +# They uses a call-back system to identify us and to reverse +# charge the call cost. +# ===================================================================================== +# +ECHO OFF +# All the usual abort strings +ABORT "NO CARRIER" +ABORT "VOICE" +ABORT "BUSY" +ABORT "NO DIALTONE" +ABORT "NO ANSWER" +# +# If calling outside allowed time we get this: +# +ABORT "Access denied" +# +# Modem initialisation stuff +# +TIMEOUT 5 +SAY "Initialising modem ...\n" +'' ATE1 +'OK\r\n' ATS0=1S11=60X4&K4S42.1=1 +# +# Now dial our ISP and wait for connection +# +SAY "Dialling our ISP ...\n" +'OK\r\n' ATDT09834657 +TIMEOUT 60 +CONNECT \c +SAY "Connected ...\n" +# +# This is the first stage login, we identify ourself so that the remote +# system will agree to call us back. +# +TIMEOUT 30 +SAY "Sending Callback login ID ...\n" +name:-BREAK-name: callme +# +# From now on, we must assume no carrier is normal as well +# as receiving a HANGUP signal because it will be the +# case if our ISP clears the call to call us back. +# +CLR_ABORT "NO CARRIER" +HANGUP OFF +# +ABORT "Invalid" +# +# Now send password and wait to see what happens +# +SAY "Sending Callback password ...\n" +word:--word: xvsgsgs +"You will be" \c +# +# What can happen now is: +# either: we get "You will be called back..." which is the successful case +# or: we get "Invalid login" and we abort (bad login ID or password) +# or: we get "NO CARRIER" because of an error, this will not abort +# and we will time out after 30 seconds +# or: we get nothing and we will time out after 30 seconds +# +# +# We reach here if we got "You will be called back..." +# +CLR_ABORT "Invalid" +SAY "Now waiting for Call back ...\n" +# +# The remote system will now hangup and we will get both "NO CARRIER" +# and a hangup signal which are ignored. We now wait for a connection +# for up to 120 seconds. What happens here if somebody else calls before +# the remote system is a bit dangerous: +# +# If a malicious user connects and says 'name:', he will see 'PPPuser' +# If he then says 'word:' he will see the passowrd 'blipblop'. I may not +# know to which systems these belong to, though. It is up to you to consider +# that case and decide wether the risk is too big or not .... +# +TIMEOUT 120 +"CONNECT" \c +# +# We have been called, re-arm ABORT on NO CARRIER and normal hangup signal +# behaviour +# +HANGUP ON +ABORT "NO CARRIER" +# +# Second stage login in order to start PPP +# +SAY "Remote system called back, logging in ...\n" +SAY "Sending login ID ...\n" +name:-BREAK-name: PPPuser +SAY "Sending password ...\n" +word:--word: blipblop +SAY "Asking to start PPP ...\n" +'CnetSrv' "ppp default" +"Entering PPP mode" \c +SAY "ISP PPP started ...\n" diff --git a/mdk-stage1/ppp/scripts/chatchat/README b/mdk-stage1/ppp/scripts/chatchat/README new file mode 100644 index 000000000..88a4c6939 --- /dev/null +++ b/mdk-stage1/ppp/scripts/chatchat/README @@ -0,0 +1,134 @@ +v 0.1 gpk@onramp.net 3/27/99 + +I Intro + + This document covers the use of the modified "chat" program and its +adjunct "chatchat" to login using the Security Dynamics SecurID card +on a linux system. + + This set of files comprises a modified version of the chat program +(the one distributed with ppp-2.3.5) and a new program called chatchat +that allows you to supply data from the keyboard to the chat program. + + The SecurID card generates passwords that have a lifetime of one +minute and are used as a first layer in dial up security. The only +software I know of for this card is for windows, so I wrote my own. +This software allows you to type in the time-sensitive password right +when your chat script is asked to supply the passcode by the remote +system. + + +II How It Works + + This version of chat his an additional command that can be put into +its options that says "Don't reply with this string. Open this pipe, +read the contents, and reply with that instead." Chatchat creates a +pipe and lets you type your passcode into it, then chat picks that up +and sends it out just as though the passcode was hardcoded into the +options. + + +III Installation + + I've provided intel binaries and source code the the modified chat +program and the chatchat program. I'll recommend that you copy the +chat.c program into your ppp-2.3.5/chat directory (save your original +chat.c program first!) and re-make it using the Makefile that comes +with chat. Copy the new chat somewhere into your path. (On my system +chat lives in /usr/sbin/chat, so I've copied the modified one into +/usr/sbin/chat.new and changed my dial in script to call chat.new +instead of chat. + + Second, compile chatchat.c and install it somewhere in your path: + + gcc -g -o chatchat chatchat.c + cp chatchat /usr/sbin + + Third, modify your chat script to use the chatchat program. Mine +looks something like this: + + + -------------------- + +#!/bin/sh +# +# This is part 2 of the ppp-on script. It will perform the connection +# protocol for the desired connection. +# use atm0 to turn down the speaker volume on my sportster x2 voice modem +# gpk 11/2/97 + +exec /usr/sbin/chat.new -V -v \ + ABORT "BUSY" \ + ABORT "NO DIAL TONE" \ + ABORT "NO ANSWER" \ + TIMEOUT 50 \ + "" "atm0" \ + OK ATDT$TELEPHONE \ + CONNECT '' \ + name: \\da0xxxxxx \ + word: @/var/tmp/p \ + compress. '' + + + ----------------------- + + This is a standard chat script: + +* abort if the modem is busy, you don't get a dial tone, no one + answers, or 50 seconds elapses. + +* use atm0 to mute the modem + +* dial the modem, when it connects, wait to be asked for account name + +* when we see "name:" prompt, delay briefly then respond with your + account name (fill in your account name) + +Now we get to the new stuff: + +* when we see "word:" in the password prompt, instead of responding + with "@/var/tmp/p", the modified chat program will open the pipe + /var/tmp/p, read the passcode out of there, and send it + +* when we see "compress." (the last word before ppp starts), reply + with nothing. The script ends and we start ppp. + +Note: + +* Make sure there is some whitespace between the filename and the \. + + +IV Usage + + To use this install the modified chat and chatchat programs, and +modify your chat script similar to the above. Before you dial in, +start that chatchat program giving it the same pipe as in your config +file. In the above case: + +chatchat /var/tmp/p + + Wait until you have one or two tick marks left on your card's +current number, then start your dial up process that eventually calls +chat. When chat goes to open and read the pipe, chatchat will prompt: + + +type PIN into SecurID card and + enter resulting passcode: + + At that point, type your PIN number into your Securid card, press +the diamond, and type the resulting numbers in as your passcode. If +you've left the -V -v options on your chat command you'll see +everything so out, otherwise it works silently. + + If you type the number wrong or run out of time, the server will +respond with an authentication failure. In that case you will have to +hang up and start again. I don't know how to build a conditional script +that says either expect "compress" next, but if you see "name:" again, +do this instead. + + +V Additional Information + + You can obtain additional information about chat and ppp from the +man pages for chat and pppd, as well as the PPP-HOWTO. + diff --git a/mdk-stage1/ppp/scripts/chatchat/chatchat.c b/mdk-stage1/ppp/scripts/chatchat/chatchat.c new file mode 100644 index 000000000..4534fb9e3 --- /dev/null +++ b/mdk-stage1/ppp/scripts/chatchat/chatchat.c @@ -0,0 +1,409 @@ +/* ************************************************************************* +* NAME: chatchat.c +* +* DESCRIPTION: +* +* This program creates a pipe for the chat process to read. The user +* can supply information (like a password) that will be picked up +* by chat and sent just like the regular contents of a chat script. +* +* Usage is: +* +* chatchat <filename> +* +* where <filename> matches the option given in the chat script. +* +* for instance the chat script fragment: +* +* ... +* name: \\dmyname \ +* word: @/var/tmp/p \ +* ... +* ^ +* (note: leave some whitespace after the filename) +* +* expect "name:", reply with a delay followed by "myname" +* expect "word:", reply with the data read from the pipe /var/tmp/p +* +* the matching usage of chatchat would be: +* +* chatchat /var/tmp/p +* +* eg: +* +* $chatchat /var/tmp/p +* ... +* some other process eventually starts: +* chat ... +* chat parses the "@/var/tmp/p" option and opens +* /var/tmp/p +* (chatchat prompts:) +* +* type PIN into SecurID card +* enter resulting passcode: [user inputs something] +* +* chat reads /var/tmp/p & gets what the +* user typed at chatchat's "enter string" prompt +* chat removes the pipe file +* chat sends the user's input as a response in +* place of "@/var/tmp/p" +* +* PROCESS: +* +* gcc -g -o chatchat chatchat.c +* +* +* GLOBALS: none +* +* REFERENCES: +* +* see the man pages and documentation that come with the 'chat' program +* (part of the ppp package). you will need to use the modified chat +* program that accepts the '@' operator. +* +* LIMITATIONS: +* +* REVISION HISTORY: +* +* STR Description Author +* +* 23-Mar-99 initial coding gpk +* 12-May-99 unlink the pipe after closing paulus +* +* TARGET: ANSI C +* This program is in the public domain. +* +* +* ************************************************************************* */ + + + + +#include <sys/time.h> +#include <stdio.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <fcntl.h> +#include <unistd.h> +#include <string.h> + +/* MAXINPUT - the data typed into chatchat must be fewer */ +/* characters than this. */ + +#define MAXINPUT 80 + + + + + + +/* ************************************************************************* + + + NAME: main + + + USAGE: + + int argc; + char * argv[]; + + main(argc, argv[]); + + returns: int + + DESCRIPTION: + if the pipe file name is given on the command line, + create the pipe, prompt the user and put whatever + is typed into the pipe. + + returns -1 on error + else # characters entered + REFERENCES: + + LIMITATIONS: + + GLOBAL VARIABLES: + + accessed: none + + modified: none + + FUNCTIONS CALLED: + + REVISION HISTORY: + + STR Description of Revision Author + + 25-Mar-99 initial coding gpk + + ************************************************************************* */ + +int main(int argc, char * argv[]) +{ + int retval; + + int create_and_write_pipe(char * pipename); + + if (argc != 2) + { + fprintf(stderr, "usage: %s pipename\n", argv[0]); + retval = -1; + } + else + { + retval = create_and_write_pipe(argv[1]); + } + return (retval); +} + + + + +/* ************************************************************************* + + + NAME: create_and_write_pipe + + + USAGE: + + int some_int; + char * pipename; + + some_int = create_and_write_pipe(pipename); + + returns: int + + DESCRIPTION: + given the pipename, create the pipe, open it, + prompt the user for a string to put into the + pipe, write the string, and close the pipe + + on error, print out an error message and return -1 + + returns -1 on error + else #bytes written into the pipe + REFERENCES: + + LIMITATIONS: + + GLOBAL VARIABLES: + + accessed: none + + modified: none + + FUNCTIONS CALLED: + + REVISION HISTORY: + + STR Description of Revision Author + + 25-Mar-99 initial coding gpk + 12-May-99 remove pipe after closing paulus + + ************************************************************************* */ + +int create_and_write_pipe(char * pipename) +{ + int retval, created, pipefd, nread, nwritten; + char input[MAXINPUT]; + char errstring[180]; + + int create_pipe(char * pipename); + int write_to_pipe(int pipefd, char * input, int nchar); + + created = create_pipe(pipename); + + if (-1 == created) + { + sprintf(errstring, "unable to create pipe '%s'", pipename); + perror(errstring); + retval = -1; + } + else + { + + /* note: this open won't succeed until chat has the pipe */ + /* open and ready to read. this makes for nice timing. */ + + pipefd = open(pipename, O_WRONLY); + + if (-1 == pipefd) + { + sprintf(errstring, "unable to open pipe '%s'", pipename); + perror(errstring); + retval = -1; + } + else + { + fprintf(stderr, "%s \n %s", + "type PIN into SecurID card and", + "enter resulting passcode:"); + nread = read(STDIN_FILENO, (void *)input, MAXINPUT); + + + if (0 >= nread) + { + perror("unable to read from stdin"); + retval = -1; + } + else + { + /* munch off the newline character, chat supplies */ + /* a return when it sends the string out. */ + input[nread -1] = 0; + nread--; + nwritten = write_to_pipe(pipefd, input, nread); + /* printf("wrote [%d]: '%s'\n", nwritten, input); */ + retval = nwritten; + } + close(pipefd); + + /* Now make the pipe go away. It won't actually go away + completely until chat closes it. */ + if (unlink(pipename) < 0) + perror("Warning: couldn't remove pipe"); + } + } + return(retval); +} + + + + + + + +/* ************************************************************************* + + + NAME: create_pipe + + + USAGE: + + int some_int; + char * pipename; + + some_int = create_pipe(pipename); + + returns: int + + DESCRIPTION: + create a pipe of the given name + + if there is an error (like the pipe already exists) + print an error message and return + + return -1 on failure else success + + REFERENCES: + + LIMITATIONS: + + GLOBAL VARIABLES: + + accessed: none + + modified: none + + FUNCTIONS CALLED: + + REVISION HISTORY: + + STR Description of Revision Author + + 25-Mar-99 initial coding gpk + + ************************************************************************* */ + +int create_pipe(char * pipename) +{ + mode_t old_umask; + int created; + + /* hijack the umask temporarily to get the mode I want */ + /* on the pipe. */ + + old_umask = umask(000); + + created = mknod(pipename, S_IFIFO | S_IRWXU | S_IWGRP | S_IWOTH, + (dev_t)NULL); + + /* now restore umask. */ + + (void)umask(old_umask); + + if (-1 == created) + { + perror("unable to create pipe"); + } + + return(created); +} + + + + + + +/* ************************************************************************* + + + NAME: write_to_pipe + + + USAGE: + + int some_int; + int pipefd; + char * input; + int nchar; + + some_int = write_to_pipe(pipefd, input, nchar); + + returns: int + + DESCRIPTION: + write nchars of data from input to pipefd + + on error print a message to stderr + + return -1 on error, else # bytes written + REFERENCES: + + LIMITATIONS: + + GLOBAL VARIABLES: + + accessed: none + + modified: none + + FUNCTIONS CALLED: + + REVISION HISTORY: + + STR Description of Revision Author + + 25-Mar-99 initial coding gpk + 12-May-99 don't write count word first paulus + + ************************************************************************* */ + +int write_to_pipe(int pipefd, char * input, int nchar) +{ + int nwritten; + + /* nwritten = write(pipefd, (void *)&nchar, sizeof(nchar)); */ + nwritten = write(pipefd, (void *)input, nchar); + + if (-1 == nwritten) + { + perror("unable to write to pipe"); + } + + return(nwritten); +} diff --git a/mdk-stage1/ppp/scripts/ip-down.local.add b/mdk-stage1/ppp/scripts/ip-down.local.add new file mode 100644 index 000000000..b93590e49 --- /dev/null +++ b/mdk-stage1/ppp/scripts/ip-down.local.add @@ -0,0 +1,20 @@ + +# +# This sample code shows you one way to modify your setup to allow automatic +# configuration of your resolv.conf for peer supplied DNS addresses when using +# the `usepeerdns' option. +# +# In my case I just added this to my /etc/ppp/ip-down.local script. You may need to +# create an executable script if one does not exist. +# +# Nick Walker (nickwalker@email.com) +# + +if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then + if [ -f /etc/ppp/resolv.prev ]; then + cp -f /etc/ppp/resolv.prev /etc/resolv.conf + else + rm -f /etc/resolv.conf + fi +fi + diff --git a/mdk-stage1/ppp/scripts/ip-up.local.add b/mdk-stage1/ppp/scripts/ip-up.local.add new file mode 100644 index 000000000..80172093a --- /dev/null +++ b/mdk-stage1/ppp/scripts/ip-up.local.add @@ -0,0 +1,24 @@ + +# +# This sample code shows you one way to modify your setup to allow automatic +# configuration of your resolv.conf for peer supplied DNS addresses when using +# the `usepeerdns' option. +# +# In my case I just added this to my /etc/ppp/ip-up.local script. You may need to +# create an executable script if one does not exist. +# +# Nick Walker (nickwalker@email.com) +# + +if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then + rm -f /etc/ppp/resolv.prev + if [ -f /etc/resolv.conf ]; then + cp /etc/resolv.conf /etc/ppp/resolv.prev + grep domain /etc/ppp/resolv.prev > /etc/resolv.conf + grep search /etc/ppp/resolv.prev >> /etc/resolv.conf + cat /etc/ppp/resolv.conf >> /etc/resolv.conf + else + cp /etc/ppp/resolv.conf /etc + fi +fi + diff --git a/mdk-stage1/ppp/scripts/options-rsh-loc b/mdk-stage1/ppp/scripts/options-rsh-loc new file mode 100644 index 000000000..b015b87fe --- /dev/null +++ b/mdk-stage1/ppp/scripts/options-rsh-loc @@ -0,0 +1 @@ +debug asyncmap FFFFFFFF escape FF kdebug 0 noipdefault nodefaultroute noauth mtu 1460 diff --git a/mdk-stage1/ppp/scripts/options-rsh-rem b/mdk-stage1/ppp/scripts/options-rsh-rem new file mode 100644 index 000000000..4b10bb9e9 --- /dev/null +++ b/mdk-stage1/ppp/scripts/options-rsh-rem @@ -0,0 +1 @@ +notty debug asyncmap FFFFFFFF escape FF kdebug 0 noipdefault nodefaultroute noauth mtu 1460 diff --git a/mdk-stage1/ppp/scripts/options-ssh-loc b/mdk-stage1/ppp/scripts/options-ssh-loc new file mode 100644 index 000000000..add03d659 --- /dev/null +++ b/mdk-stage1/ppp/scripts/options-ssh-loc @@ -0,0 +1 @@ +debug asyncmap FFFFFFFF escape FF kdebug 0 noipdefault nodefaultroute noauth mtu 1400 diff --git a/mdk-stage1/ppp/scripts/options-ssh-rem b/mdk-stage1/ppp/scripts/options-ssh-rem new file mode 100644 index 000000000..d690722c6 --- /dev/null +++ b/mdk-stage1/ppp/scripts/options-ssh-rem @@ -0,0 +1 @@ +notty debug asyncmap FFFFFFFF escape FF kdebug 0 noipdefault nodefaultroute noauth mtu 1400 diff --git a/mdk-stage1/ppp/scripts/ppp-off b/mdk-stage1/ppp/scripts/ppp-off new file mode 100755 index 000000000..a22b5ea3d --- /dev/null +++ b/mdk-stage1/ppp/scripts/ppp-off @@ -0,0 +1,34 @@ +#!/bin/sh +###################################################################### +# +# Determine the device to be terminated. +# +if [ "$1" = "" ]; then + DEVICE=ppp0 +else + DEVICE=$1 +fi + +###################################################################### +# +# If the ppp0 pid file is present then the program is running. Stop it. +if [ -r /var/run/$DEVICE.pid ]; then + kill -INT `cat /var/run/$DEVICE.pid` +# +# If the kill did not work then there is no process running for this +# pid. It may also mean that the lock file will be left. You may wish +# to delete the lock file at the same time. + if [ ! "$?" = "0" ]; then + rm -f /var/run/$DEVICE.pid + echo "ERROR: Removed stale pid file" + exit 1 + fi +# +# Success. Let pppd clean up its own junk. + echo "PPP link to $DEVICE terminated." + exit 0 +fi +# +# The ppp process is not running for ppp0 +echo "ERROR: PPP link is not active on $DEVICE" +exit 1 diff --git a/mdk-stage1/ppp/scripts/ppp-on b/mdk-stage1/ppp/scripts/ppp-on new file mode 100755 index 000000000..ab79db471 --- /dev/null +++ b/mdk-stage1/ppp/scripts/ppp-on @@ -0,0 +1,36 @@ +#!/bin/sh +# +# Script to initiate a ppp connection. This is the first part of the +# pair of scripts. This is not a secure pair of scripts as the codes +# are visible with the 'ps' command. However, it is simple. +# +# These are the parameters. Change as needed. +TELEPHONE=555-1212 # The telephone number for the connection +ACCOUNT=george # The account name for logon (as in 'George Burns') +PASSWORD=gracie # The password for this account (and 'Gracie Allen') +LOCAL_IP=0.0.0.0 # Local IP address if known. Dynamic = 0.0.0.0 +REMOTE_IP=0.0.0.0 # Remote IP address if desired. Normally 0.0.0.0 +NETMASK=255.255.255.0 # The proper netmask if needed +# +# Export them so that they will be available at 'ppp-on-dialer' time. +export TELEPHONE ACCOUNT PASSWORD +# +# This is the location of the script which dials the phone and logs +# in. Please use the absolute file name as the $PATH variable is not +# used on the connect option. (To do so on a 'root' account would be +# a security hole so don't ask.) +# +DIALER_SCRIPT=/etc/ppp/ppp-on-dialer +# +# Initiate the connection +# +# I put most of the common options on this command. Please, don't +# forget the 'lock' option or some programs such as mgetty will not +# work. The asyncmap and escape will permit the PPP link to work with +# a telnet or rlogin connection. You are welcome to make any changes +# as desired. Don't use the 'defaultroute' option if you currently +# have a default route to an ethernet gateway. +# +exec /usr/sbin/pppd debug lock modem crtscts /dev/ttyS0 38400 \ + asyncmap 20A0000 escape FF kdebug 0 $LOCAL_IP:$REMOTE_IP \ + noipdefault netmask $NETMASK defaultroute connect $DIALER_SCRIPT diff --git a/mdk-stage1/ppp/scripts/ppp-on-dialer b/mdk-stage1/ppp/scripts/ppp-on-dialer new file mode 100755 index 000000000..7d66765f1 --- /dev/null +++ b/mdk-stage1/ppp/scripts/ppp-on-dialer @@ -0,0 +1,17 @@ +#!/bin/sh +# +# This is part 2 of the ppp-on script. It will perform the connection +# protocol for the desired connection. +# +exec chat -v \ + TIMEOUT 3 \ + ABORT '\nBUSY\r' \ + ABORT '\nNO ANSWER\r' \ + ABORT '\nRINGING\r\n\r\nRINGING\r' \ + '' \rAT \ + 'OK-+++\c-OK' ATH0 \ + TIMEOUT 30 \ + OK ATDT$TELEPHONE \ + CONNECT '' \ + ogin:--ogin: $ACCOUNT \ + assword: $PASSWORD diff --git a/mdk-stage1/ppp/scripts/ppp-on-rsh b/mdk-stage1/ppp/scripts/ppp-on-rsh new file mode 100755 index 000000000..30a50dba6 --- /dev/null +++ b/mdk-stage1/ppp/scripts/ppp-on-rsh @@ -0,0 +1,72 @@ +#!/bin/sh +# +# A sample script to establish PPP session(s) via rsh +# +# Adi Masputra <adi.masputra@sun.com> +# Jan 24, 2000 +# + +# +# You'd definitely want to change the following addresses to suit +# your network configuration +# +LOC_IP=10.0.0.1 +REM_IP=10.0.0.2 +NETMASK=255.255.0.0 + +export LOC_IP REM_IP + +# +# This is the remote peer where in.rshd is running, either +# its hostname or IP address +# +PPPD_RHOST=myremotehost + +# +# For this example, we assume that pppd on both local and remote +# machines reside in the same place, /usr/local/bin/pppd +# +PPPD_LOC=/usr/local/bin/pppd + +# +# The location of local options file (where rsh client is running). +# Note that the sample options file included in the distribution +# may need further customizations, depending on your needs. The 'noauth' +# option specified in the file is there to simplify the example. In +# reality, you'd probably want to remove such option. +# +PPPD_LOC_OPT=/etc/ppp/options-rsh-loc + +# +# The location of remote options file (where in.rshd daemon is running). +# Note that the sample options file included in the distribution +# may need further customizations, depending on your needs. The 'noauth' +# option specified in the file is there to simplify the example. In +# reality, you'd probably want to remove such option. Also note that +# the remote options file need to include the 'notty' option for this +# to work +# +PPPD_REM_OPT=/etc/ppp/options-rsh-rem + +# +# The location of rsh client on the local machine +# +RSH_LOC=/bin/rsh + +export PPPD_LOC PPPD_LOC_OPT PPPD_REM_OPT PPPD_RHOST RSH_LOC + +# +# Uncomment the following to enable IPv6, note that the IPv6 support +# needs to be enabled during compilation +# +# PPPD_IPV6='+ipv6 ipv6cp-use-ipaddr' +export PPPD_IPV6 + +# +# And execute pppd with the pty option, specifying rsh client as the +# slave side of the pseduo-tty master/slave pair. +# +exec $PPPD_LOC \ + pty '$RSH_LOC $PPPD_RHOST $PPPD_LOC $REM_IP:$LOC_IP $PPPD_IPV6 file $PPPD_REM_OPT' \ + $LOC_IP:$REM_IP netmask $NETMASK $PPPD_IPV6 file $PPPD_LOC_OPT + diff --git a/mdk-stage1/ppp/scripts/ppp-on-ssh b/mdk-stage1/ppp/scripts/ppp-on-ssh new file mode 100755 index 000000000..0e41acac6 --- /dev/null +++ b/mdk-stage1/ppp/scripts/ppp-on-ssh @@ -0,0 +1,76 @@ +#!/bin/sh +# +# A sample script to establish PPP session(s) via SSH 1.x +# +# Adi Masputra <adi.masputra@sun.com> +# Jan 24, 2000 +# + +# +# You'd definitely want to change the following addresses to suit +# your network configuration +# +LOC_IP=10.0.0.1 +REM_IP=10.0.0.2 +NETMASK=255.255.0.0 + +export LOC_IP REM_IP + +# +# This is the remote peer where sshd is running, either +# its hostname or IP address +# +PPPD_RHOST=myremotehost + +# +# For this example, we assume that pppd on both local and remote +# machines reside in the same place, /usr/local/bin/pppd +# +PPPD_LOC=/usr/local/bin/pppd + +# +# The location of local options file (where ssh client is running). +# Note that the sample options file included in the distribution +# may need further customizations, depending on your needs. The 'noauth' +# option specified in the file is there to simplify the example, although +# some may choose to have it there and rely on ssh authentication +# instead. +# +PPPD_LOC_OPT=/etc/ppp/options-ssh-loc + +# +# The location of remote options file (where sshd daemon is running) +# Note that the sample options file included in the distribution +# may need further customizations, depending on your needs. The 'noauth' +# option specified in the file is there to simplify the example, although +# some may choose to have it there and rely on ssh authentication +# instead. Also note that the remote options file need to include the 'notty' +# options for this to work. +# +PPPD_REM_OPT=/etc/ppp/options-ssh-rem + +# +# The location of ssh client on the local machine +# +SSH_LOC=/usr/local/bin/ssh + +export PPPD_LOC PPPD_LOC_OPT PPPD_REM_OPT PPPD_RHOST SSH_LOC + +# +# Uncomment the following to enable IPv6, note that the IPv6 support +# needs to be enabled during compilation +# +# PPPD_IPV6='+ipv6 ipv6cp-use-ipaddr' +export PPPD_IPV6 + +# +# And execute pppd with the pty option, specifying ssh client as the +# slave side of the pseudo-tty master/slave pair. Note that on this example, +# ssh has been compiled to allow NULL encryption (thus the '-c none' option), +# but in reality, you'd probably want to specify the encryption algorithm. +# See the man page of ssh(1) for details. +# +exec $PPPD_LOC \ + pty '$SSH_LOC -c none $PPPD_RHOST $PPPD_LOC $REM_IP:$LOC_IP $PPPD_IPV6 file $PPPD_REM_OPT' \ + $LOC_IP:$REM_IP netmask $NETMASK $PPPD_IPV6 file $PPPD_LOC_OPT + diff --git a/mdk-stage1/ppp/scripts/redialer b/mdk-stage1/ppp/scripts/redialer new file mode 100755 index 000000000..5bbde4e9d --- /dev/null +++ b/mdk-stage1/ppp/scripts/redialer @@ -0,0 +1,96 @@ +#!/bin/sh +################################################################### +# +# These parameters control the attack dialing sequence. +# +# Maximum number of attempts to reach the telephone number(s) +MAX_ATTEMPTS=10 + +# Delay between each of the attempts. This is a parameter to sleep +# so use "15s" for 15 seconds, "1m" for 1 minute, etc. +SLEEP_DELAY=15s + +################################################################### +# +# This is a list of telephone numbers. Add new numbers if you wish +# and see the function 'callall' below for the dial process. +PHONE1=555-1212 +PHONE2=411 + +################################################################### +# +# If you use the ppp-on script, then these are passed to this routine +# automatically. There is no need to define them here. If not, then +# you will need to set the values. +# +ACCOUNT=my_account_name +PASSWORD=my_password + +################################################################### +# +# Function to initialize the modem and ensure that it is in command +# state. This may not be needed, but it doesn't hurt. +# +function initialize +{ + chat -v TIMEOUT 3 '' AT 'OK-+++\c-OK' + return +} + +################################################################### +# +# Script to dial a telephone +# +function callnumber +{ +chat -v \ + ABORT '\nBUSY\r' \ + ABORT '\nNO ANSWER\r' \ + ABORT '\nRINGING\r\n\r\nRINGING\r' \ + '' ATDT$1 \ + CONNECT '' \ + ogin:--ogin: $ACCOUNT \ + assword: $PASSWORD +# +# If the connection was successful then end the whole script with a +# success. +# + if [ "$?" = "0" ]; then + exit 0 + fi + + return +} + +################################################################### +# +# Script to dial any telephone number +# +function callall +{ +# echo "dialing attempt number: $1" >/dev/console + callnumber $PHONE1 +# callnumber $PHONE2 +} + +################################################################### +# +# Initialize the modem to ensure that it is in the command state +# +initialize +if [ ! "$?" = "0" ]; then + exit 1 +fi + +# +# Dial telephone numbers until one answers +# +attempt=0 +while : ; do + attempt=`expr $attempt + 1` + callall $attempt + if [ "$attempt" = "$MAX_ATTEMPTS" ]; then + exit 1 + fi + sleep "$SLEEP_DELAY" +done diff --git a/mdk-stage1/ppp/scripts/secure-card b/mdk-stage1/ppp/scripts/secure-card new file mode 100644 index 000000000..a32138b7d --- /dev/null +++ b/mdk-stage1/ppp/scripts/secure-card @@ -0,0 +1,111 @@ +#!/usr/local/bin/expect -f +# +# This script was written by Jim Isaacson <jcisaac@crl.com>. It is +# designed to work as a script to use the SecureCARD(tm) device. This +# little device is mated with a central controller. The number displayed +# on this card changes every so often and you need to enter the number +# along with your user account name in order to gain access. Since chat +# is based upon fixed strings this procedure will not work with chat. +# +# It is included by permission. An excellent reference for the expect +# program used by this script is in the book: +# +# "Exploring Expect" +# by Don Libes +# Published by O'Rielly and Associates +# + +send_user "hello, starting ppp\n" + +system "stty 19200 -echoe -echo raw < /dev/cua3 > /dev/cua3" + +# +# These are the parameters for the program. +# +set user Pxxxxxx +set password xxxxxxx +set modem /dev/cua3 +set dialup <put phone number here> +set timeout 60 + +spawn -noecho -open [open $modem "r+"] + +send "AT&F\r" +expect "OK" + +send "ATe0v1x4&c1q0&d2&c1s2=128s0=0DT $dialup\r" +set timeout 15 +set counter 0 + +set still_connecting 1 + +expect { + -re ".*CONNECT.*\n" { + set timeout 5 + set still_connecting 0 + continue -expect + } + -re ".*CONNECT.*\r" { + set timeout 5 + set still_connecting 0 + continue -expect + } + -re ".*NO.*CARRIER" { + send_user "Failed to Connect, exiting...\n" + exit + } + -re ".*NO.*DIAL.*TONE" { + send_user "Failed to Connect, exiting...\n" + exit + } + -re ".*VOICE" { + send_user "Failed to Connect, exiting...\n" + exit + } + -re ".*sscode:.*\n" { + continue -expect + } + -re ".*sscode:" { + set timeout -1 + expect_user -re "(.*)\n" + send "$expect_out(1,string)\r" + set timeout 30 + continue -expect + } + -re ".*Next.*:" { + set timeout -1 + expect_user -re "(.*)\n" + send "$expect_out(1,string)\r" + set timeout 30 + continue -expect + } + -re "Your.*" { + send "\r" + continue -expect + } + -re ".*in:" { + send "$user\r" + continue -expect + } + -re ".*word:" { + send "$password\r" + } + + timeout { + if { $still_connecting > 0 } { + continue -expect + } + set timeout 15 + send "\r" + incr counter + if { $counter > 8 } { + send_user "Cannot Connect\n" + exit + } else { + continue -expect + } + } +} + +overlay -0 $spawn_id -1 $spawn_id pppd /dev/cua3 19200 192.111.187.215: \ + crtscts modem defaultroute debug |