Skript se sprehodi skozi navedene dostopovne točke in zamenja geslo PSK za navedeno
omrežje PSK. Vsebino prekopirajte v izvršilno datoteko, vpišite ustrezne
nastavitve in poženite kadar želite zamenjati gesla. Ločen skript pred menjavo gesla administratorju pošlje e-pošto z novim geslom.
- AccessPoints -> vsebuje seznam dostopovnih točk. Uporabite lahko naslove IP ali imena DNS.
- apUsername -> uporabniško ime za dostop do dostopovnih točk.
- apPassword -> geslo za dostop do dostopovnih točk.
- apSSID -> ime omrežja, kateremu naj se spremeni geslo PSK.
- mailTo -> Naslov, kamor naj se pošlje obvestilo o novem geslu.
- mailFrom -> Naslov pošiljatelja. Tu svetujemo, da vnesete svoj naslov.
- mailSubject -> Naslov zadeve poslanega sporočila.
- mailServer -> Naslov poštnega strežnika, preko katerega naj se pošlje sporočilo.
Dodatne nastavitve na dostopovni točki
Na dostopovnih točkah moramo urediti dodatno uporabniško ime in neposredni dostop do nastavitev:
-
CISCO
username <USER> privilege 15 secret <PASS>
aaa new-model
aaa authorization exec default local
-
LANCOM
cd /Setup/Config/Admin
tab Administrator Password Active Access-Rights Function-Rights
add "<USER>" "<PASS>" yes admin-rw 0x001ff
Skript za pošiljanje e-pošte z novim geslom
#! /usr/bin/python
# -*- coding: UTF-8 -*-
###########
# Copyright (C) 2014, Marko Dolničar & Arnes AAI <aaa-podpora(at)arnes(dot)si>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
###########
from datetime import datetime
import random
import string
import os
import smtplib
from email.mime.text import MIMEText
oldpass = "/var/lib/PSK-old"
newpass = "/var/lib/PSK-new"
mailTo = "psk-users@arnes.si"
mailFrom = "aaa-podpora@arnes.si"
mailSubject = "New wireless password"
mailServer = "mail.arnes.si"
apSSID = "wpa-gost"
date = datetime.now()
try:
os.rename(newpass, oldpass)
except:
print ("RENAME ERROR! - This is OK if you are running this script for the first time.\nIf not - please check "+oldpass+ " and "+newpass)
psk_len = random.randint(12,16)
global psk
psk = ""
while psk_len:
psk += random.choice(string.digits + string.ascii_letters)
psk_len -= 1;
f = open(newpass, 'w')
f.write(psk)
f.close()
print(psk)
text = "The new password for SSID "+'"'+apSSID+'"'+" will be: "+psk
msg = MIMEText(text)
msg['Subject'] = mailSubject
msg['From'] = mailFrom
msg['To'] = mailTo
# Send the message via our own SMTP server, but don't include the
# envelope header.
s = smtplib.SMTP(mailServer)
s.sendmail(mailFrom, mailTo, msg.as_string())
s.quit()
print ("T H E E N D !")
Skript za menjavo gesla na dostopovnih točkah CISCO in LANCOM
Skript uporablja knjižnico pxssh za povezovanje in konfiguracijo dostopovnih točk. V pythonu 2.6 ima knjižnica napako, zato uporabite priložen - popravljen pxssh.py (datoteko prenesite v isto mapo, kot skript).
#! /usr/bin/python
# -*- coding: UTF-8 -*-
###########
# Copyright (C) 2014, Marko Dolničar & Arnes AAI <aaa-podpora(at)arnes(dot)si>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
###########
import time
import sys
import os
# pxssh in python 2.6 has a bug... you should have recieved a fixed pxssh.py
import pxssh
# pxssh in python 2.7 is OK
# from pexpect import pxssh
####### ORGANIZATION SPECIFIC VARIABLES ########
#
AccessPoints = ["10.0.99.100", "10.0.99.101", "10.0.99.1", "10.0.99.61"]
apUsername = "pskchanger"
apPassword = "supersecretpassword123"
apSSID = "gost-wpa"
global psk
logfile="/var/log/psk_log.txt"
pskfile="/var/lib/PSK-new"
def ConfigureLancom():
ssh.sendline("cd /Setup/Interfaces/WLAN/Encryption")
ssh.sendline("tab Ifc Key")
ssh.sendline("set WLAN-1-2 "+psk)
ssh.sendline("set WLAN-2-2 "+psk)
ssh.sendline("q")
ssh.logout()
def ConfigureCisco():
ssh.sendline("terminal length 0")
ssh.sendline("conf t")
ssh.sendline("dot11 ssid " + apSSID)
ssh.sendline("wpa-psk ascii " + psk)
ssh.sendline("end")
ssh.logout()
f = open(logfile, 'w')
psk = open(pskfile, "r").read()
ssh = pxssh.pxssh(timeout=5, logfile=f)
ssh.force_password = True
#ssh.PROMPT = ">"
os.linesep = "\r\n"
for AP in AccessPoints:
ssh.PROMPT = ">"
print AP+":",
try:
ssh = pxssh.pxssh(timeout=5, logfile=f)
ssh.login(AP, apUsername, apPassword, original_prompt="#", login_timeout=5, auto_prompt_reset=False)
ssh.PROMPT = ">|#"
ssh.prompt()
ssh.sendline("sysinfo")
time.sleep(1)
ssh.prompt()
a = ssh.before
if "Bad IP address" in a:
print "-Cisco-",
ConfigureCisco()
print " - OK"
elif "DEVICE:" in a:
print "-Lancom-",
ConfigureLancom()
print " - OK"
else:
print ("-Unknown response- - FAILED!")
f.write("\nAP: "+AP+" does not match [Cisco | Lancom], skipping configuration of "+AP+" - if IP/hostname is correct you will have to configure it manually!\n")
f.write("Error - returned response between hashes\n######\n"+a+"\n######\n")
except:
print(" Login/configuration exception - check "+AP+" manually!")
f.write("\nError - Could not log in to/configure AP: "+AP+" - check username/password/IP and configure it manually!\n")
pass
f.close()
Svetujemo, da skripta poganjate enkrat tedensko. Vpišete ju lahko tudi v crontab z ukazom
crontab -e.
# Poslji mail z novim geslom vsak petek ob 09:00 zjutraj.
0 9 * * fri /root/setAndSendNewPass.py
# Menjaj geslo vsak ponedeljek ob 04:00 zjutraj.
0 4 * * mon /root/configureAPs.py
