Single-DES in krbtgt/REALM key

[Christian]

Hi list,
> And we should probably add instructions about checking the logs for
> DES-only clients. 
how about this? Best,

Christian

#!/bin/bash
#
# get1des. chanlists at googlemail.com(2013). No warranties.
#
# Look for clients that are being issued session keys with type 1.
# Could easily be modified to look for other types. Run this from cron
# every ten minutes, say at
# :01,:11,:21,:31,;41,:51 on your first KDC, and at
# :02,:12,:22,:32,;42,:52 on your second KDC, ...
# It greps your log file for ISSUE lines during the previous ten minutes
# and adds the result to the table in $desfile. That file lives in AFS and
# should be writeable. We have an IP based afs ACL on it. Could be on any
# shared filesystem, really.
#
# When run during the ten minutes after 23:40 on the master KDC, it will
# output the whole table to stdout (effectively mailing it to the sysadmin)
# and delete $desfile to restart from scratch for the next day.
#
# We do this every ten minutes because some of our DHCP clients have dynamic
# DNS, and we only get the correct hostname, which tells us something about
# the actual machine, when the time interval between the ISSUE and the
# lookup is short enough.
#
afscell=afs.cell
krbrealm=REALM.NAME
masterkdc=afs1
desfile="/afs/${afscell}/system/dhcpd/output/1des"
kdclog=/var/log/auth.log

# Might have to mess with this depending on your time format and the logs
lookfor=$(date '+%b %d %H:%M' -d '10 minutes ago' | cut -b 1-11)

validip="^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$"
validprinc="^[a-zA-Z0-9 at ./-]+$"

# Change the 'ses=1}' to whatever you like if you want to look for other
# keys being issued...
(
  grep "$lookfor" "${kdclog}" | \
      grep 'ses=1}' | \
      grep 'ISSUE' | \
      awk '{printf "%s\t%s\t%s\n",$18,$10,$20}' | \
      sort | uniq | sed -e 's/://g' | \
  while read princ ip princfor || [ -n "$princ" ] ; do
    if [[ $ip =~ $validip ]] && [[ $princ =~ $validprinc ]] && [[
$princfor =~ $validprinc ]] ; then
      host=$(dig +short -x $ip)
      echo -ne "$princ\t$princfor\t"
      if [ -n "$host" ] ; then
        echo $host
      else
        echo $ip
      fi
    fi
  done
  [ -f "${desfile}" ] && cat "${desfile}"
) | sort | uniq >"${desfile}.tmp"
mv -f "${desfile}.tmp" "${desfile}"

if [[ $lookfor =~ 23:4$ ]] && [ "$HOSTNAME" == "afs1" ] ; then
  echo "+==============================================================+"
  echo "| The following hosts acquired des-cbc-crc session keys today: |"
  echo "+==============================================================+"
  echo
  (
    echo -e "req_princ\trequest\thostname_or_IP"
    [ -f "${desfile}" ] && cat "${desfile}" | sed -e "s/@${krbrealm}//g"
  ) | column -t
  rm -f "${desfile}"
fi