TABLE OF CONTENTS
Directory Description config stores the config file ecescan.cfg log stores the system log files data output stores all the output files generated by the scripts, especially formattedoutput WWW stores all files that make up the web interface WWW output stores all web-generated reports and other web-related files CGI-BIN not used, converted from CGI scripts to PHP database backup stores all the backup files created by script dbbackup
The MySQL username and password can be found in the script ecescan.data.
Column Name Detailed Description IP text IP address
string, in '123.456.78.9' human-readable formatHostname hostname of IP
string, exactly as returned by NmapOS Operating System of IP
string, exactly as returned by NmapTimeActiveCounts internally encoded sequence of counters for each time interval (one counter for each 5-minute segment)
string of digits, padded with dash character (minus sign), 288 x 8 bytes total
each number is represented by 8 bytes / characters
zero is represented as "--------", 10: "10------", 65536: "65536---"
time segment number goes from 0 to 287
first 8 bytes give number count for time segment 0, last 8 bytes for segment 287
time segment 0 corresponds to the time interval from 12:00am to 12:05am
time segment 1 corresponds to the time interval from 12:05am to 12:10am
time segment 287 corresponds to the time interval from 11:55pm to 12:00am
adding each of the 288 numbers together would give the total countTimeTotalCounts exact same format as timeactivecount DateInserted date+time the IP was inserted into the database LastActive date+time the IP was last scanned to be active
Derived Fields, updated using updatederiveddataActive number of times that the IP was scanned and detected to be active (up)
4 bytes, network long integer converted from IP address formatTotal total number of times that the IP was scanned
4 bytes, network long integer converted from IP address formatPercentActive Percentage of Active / Total
4 bytes, network long integer converted from IP address formatDaysOffline Number of days that the IP have been offline (not active)
4 bytes, network long integer converted from IP address formatLastModified date+time the IP was last modified, updated only by updatederiveddata
converted to readable form by updatedderiveddata, not true timestamp field
Non-Display Fields, used internally only_LastModified true timestamp date and time, follows MySQL data format
updated by MySQL whenever data is written into the databaseLongIP 4 bytes, network long integer converted from text IP address format
No Software Website 1. Perl version 5 or higher www.perl.com 2. Perl Database Interface (DBI) library www.perl.com 3. Nmap version 2.54 beta 3 or higher www.insecure.org 4. MySQL version 9.38 distribution 3.22.30 or higher www.mysql.com 5. Perl module Spreadsheet::WriteExcel www.cpan.org 6. Web Hosting software (optional) www.apache.org 7. PHP www.php.net
cp ./ecescan.tar.gz /export/home1/supervision/ecescan/Now, you will have all the necessary files and directories copied into the directory.
cd /export/home1/supervision/ecescan/
gunzip ./ecescan.tar.gz
tar xf ecescan.tar
/usr/local/packages/mysql/bin/mysql -u username -pNow, you will be prompted for the password, so enter the password
# runs the MySQL monitor (command prompt shell)
*******The username and password are determined when the MySQL is installed, and can be different. Now, you will enter the MySQL monitor program. Use the following MySQL command:
# password required for MySQL user
create database ecescan;The system will then respond with "Query OK, ...". Now, exit the monitor:
# must have the trailing semi-colon
exitOk, the database is then created. Now you need to create the database table 'iptable'. Go to the directory where Ecescan was installed, then enter:
# out of the MySQL monitor program
./createtable overrideAfter creating the database and database table for the system, you would then need to specify the range of IP addresses to monitor.
# create new database table 'iptable'
123.123.123.1-99To exclude an IP address from 123.123.1-254.1-254, say 123.123.123.100, you need to split up the line into 4 separate lines:
123.123.123.101-254
123.123.1-122.1-254The final component of the installation is to set up the web interface for the system so that users can access the information collected by the system from the internet.
123.123.123.1-99
123.123.123.101-254
123.123.124-254.1-254
# to specify the alias for http://localhost/ecescan/You can also set up user authentication to restrict web access to selected users. The elaborate instructions for doing so can be found on www.apache.org.
Alias /ecescan /export/home1/supervision/ecescan/
Alias /ecescan/ /export/home1/supervision/ecescan/
<Directory "/export/home1/supervision/ecescan/">
Allow from All
</Directory>
cd /export/home1/supervision/ecescan/src makeexeThis will create shortcut scripts in the directory /export/home1/supervision/ecescan/, and after that you can run the shortcut scripts in the same way that you would run the original scripts. The only thing that the shortcut scripts do is to change the directory to the directory where the source files reside, /export/home1/supervision/ecescan/src, and then execute the program. This is necessary because if you try to execute a script using:
/export/home1/supervision/ecescan/src/scriptnamefrom another directory, then the program will not run correctly.
ecescan -test -watchThis will do a test-run of the scanning without affecting any of the time-activity counters in the database. In order to run it periodically, you need to setup the crontab file.
export VISUAL=picoYou will then enter the screen for entering the cron job specification. Now enter this line exactly, but modifying the directory of ecescan accordingly. This entire line must go in a single line, and cannot span two lines:
# optional, makes pico the default text editor; well, if you want to experiment with user-unfriendly software, try vi
crontab -e
# edit the existing crontab
*/5 * * * * /export/home1/supervision/ecescan/ecescanIt is necessary to use the cd command because the perl module file ecescan.pm is not installed in the filesystem, and hence ecescan.pm can only be accessed by programs that reside in the same directory as itself. Now exit the text editor. If you are using pico, you can exit by pressing Ctrl+X, then press 'y' when asked to save changes, and press the enter key to save the file and exit.
Now, you need to know how to work with Ecescan manually if necessary.# 24x7, once every 5 minutes */5 * * * * /export/home1/supervision/ecescan/ecescan > /dev/null 2>&1 # rescan ALL missing OS at 12:00 am everyday 0 0 * * * /export/home1/supervision/ecescan/rescanos > /dev/null 2>&1 # Generate the patch index page at 7:30 am everyday 30 7 * * * /export/home1/www/ece-supervisor/patch_reports/generate_list > /export/home1/www/ece-supervisor/pa$ # set proper permissions for all files at 12:00 am everyday 0 0 * * * /export/home1/supervision/ecescan/chmodall > /dev/null 2>&1 # backup database twice a month, 1st & 15th, 11:00 pm 0 23 1,15 * * /export/home1/supervision/ecescan/dbbackup > /dev/null 2>&1 # update all existing os once a month - this process takes a LONG time # 25th of every month, 12:00 am 0 0 25 * * /export/home1/supervision/ecescan/updateos > /dev/null 2>&1 # quick update all hostnames using gethostbyaddr(3) (Linux) # twice a day at 1:00am and 1:00pm ( qu = quick update ) 0 1,13 * * * /export/home1/supervision/ecescan/quhostnames > /dev/null 2>&1 # refresh all DNS data completely: once a day at 1:30am 30 1 * * * /export/home1/supervision/ecescan/update_dns.pl > /dev/null # update duphosts flag: once a day at 2:00am 0 2 * * * /export/home1/supervision/ecescan/update_duphosts.pl > /dev/null
Running the script ecescan manually is not recommended unless it is solely for testing purposes. If you run ecescan manually, it is advisable to use the -test switch at all times to avoid modifying the counters and thus affecting the accuracy of the gathered data.
Command Line Argument What it Does -test suppress the counters update, force program to run even in the time periods that are not under monitoring -w, -watch enter watch mode, print out descriptive progress status of the script -i input_file_name specifies input file containing all IP addresses, default is ecescan.in in the main directory -l log_file_name specifies log file to store program execution information, default is ecescan.log in the log files directory -help displays brief help information on using the command line arguments
There is no fixed rule for maintaining the system in the long run. However, the user can follow the prescribed maintenance system to set up the cronjob as described in Section Five. Using the System. Therefore, the only thing left for the user to do is to check the generated reports in future to oversee the level of activity of the entire subnet under monitoring.
- Database
- Log file
- Generated reports
- Future program restarting
./dbrestore /export/home/backup_ecescan/backup_filename overridePlease note that the restoration of the database is irrecoverable. Use with caution.
( e.g. filename - websec.2001-01-19.gz )
The restricted scripts can only be executed by supplying the command line argument "override". If the script requires other command line arguments, then "override" would be the last argument required.
Script What It Does makeexe creates shortcut scripts in /export/home1/supervision/ecescan/
these shortcut scripts are necessary so that any script can be executed correctly from any directory other than from the directory where the script itself resides. all the shortcut scripts do is to go to the directory where the real scripts reside (in subdirectory "src") and then execute the real script from thereipcount prints the number of IP addresses in the database table oscount prints the records with a null OS name and the number of OS types in use dumptable writes first five records into file out.txt, used for debugging purposes use argument 'all' to dump all records, or specify a number of records to dump stdquery generates report with standard specifications in stdquery.in textout dumps entire table in text format only accordingly to specifications in textout.in
this is the original script that precedes formattedoutputcustomquery make report with input from customquery.in formattedoutput main script to make report, this is usually executed through the files stdquery, textout and customquery; needless to run it directly dbbackup backup the database using a filename specifying the date and time of backup showip shows details of a single ip rescanos takes all IP with a missing / null OS name and scan them for the OS name excluding "Unspecified OS", "OS unknown", and "OS info unretrievable"
Meaning of OS fields:
"Unspecified OS" retrieved OS info successful, but OS name is NULL "OS info unretrievable" IP was active, but did not return OS name "OS unknown" IP was inactive at time of update, so fill-in-the-blank rescanhostname rescan the ip addrs with a missing / null hostname and fill in the hostname if possible, excluding "Hostname unknown" updateos rescan the OS name for ALL ip using OS scan; this process takes a very long time to complete (estimated half-a-day's time) quhostnames quick update ALL the hostnames using gethostbyaddr(3), there is no need to scan for the hostname using ping scan since gethostbyaddr(3) is very much faster webquery generates reports based on webquery.in found in the WWW output directory dns.php finds differences between data in DNS files and Ecescan database, outputs to STDOUT in HTML format duphostreport finds duplicate hostnames in database, outputs to STDOUT in HTML format checkwebauthuser prints 1 if given user is authorized to edit the database, prints 0 otherwise excelreport generates a full MS Excel formatted report as out.xls in $ECESCAN_WWW_OUT_DIR found in ecescan.cfg, currently $ECESCAN_WWW_OUT_DIR = '/export/home1/www/ece-supervisor/ecescan/output'; updatederiveddata updates all derived data fields in the iptable, takes less than half a minute to complete chmodall sets the correct file access permission and for all files. sets the ownership of ALL files to the root user.
Restricted scripts that causes permanent changes ( USE WITH CAUTION )resetqutable reset the database table for hostnames quick update log table resettable as the name implies, this will destroy the database table if it exists and re-create a blank one resetcounters this script sets all counters in the database table to zero dbrestore restores a backed-up database removeip deletes a single IP address