Monday, November 25, 2019

clean up openbox failed purged vms

#!/bin/bash
work=/home/uid/tmp
validvms=/home/uid/tmp/validvms
workclean=/home/uid/tmp/cleanvms
virtualboxvmsdir=/home/uid/VirtualBox\ VMs
box=$(hostname)
purgedate=$(date +"%m-%d-%Y")

# clean  up old work directories
rm -rf $work
mkdir $work

# find all vbox vms - not just running
# make the vbox vms into a list and remove
# extraneous information

vboxmanage list vms >> $validvms
cut -d '"' -f2 < $validvms >> $workclean

# change directory into where vbox vms reside

cd /home/uid/VirtualBox\ VMs
echo $purgeate >> $work/purgedvms-use
echo ".........................." >> $work/purgedvms-use
echo "start" >> $work/purgedvms-use
du -hsc >> $work/purgedvms-use

# exit if vbox vms directory is not found
if (($?>0)); then
    echo "cannot find virtualbox dir exiting"
    exit
fi

# grep is going through the validvm list
# if the line item is not found then it is deleted
# as each item is being deleted it is being captured
# in a file

for i in *; do
    if ! grep -qxFe "$i" $workclean; then
        echo "Deleting: $i"
        echo $i >> $work/purgedvms
        # the next line is commented out.  Test it.  Then uncomment to remove the files
        rm -rf "$i"
    fi
done

echo "finish" >> $work/purgedvms-use
du -hsc >> $work/purgedvms-use
echo ".........................." >> $work/purgedvms-use
sed -i '/total/d' $work/purgedvms-use


# here we email the results

cat $work/purgedvms-use $work/purgedvms > $work/purgedvms-union
mail -s "$box purged $purgedate" me@inhell < $work/purgedvms-union

exit

Thursday, November 21, 2019

Friday, November 15, 2019

who is accessing my nis server?

 
 first, figure out the port the nis daemon (ypserv) is running on:  
   
 # rpcinfo -p|grep ypserv  
   100004  2  udp  951 ypserv  
   100004  1  udp  951 ypserv  
   100004  2  tcp  954 ypserv  
   100004  1  tcp  954 ypserv  
   
 gather up all the clients talking to the daemon:  
   
 # tcpdump -n -n port 951 or port 954  
   
 the output will look like this:  
   
 10:55:35.482333 IP 6.6.6.6.951 > 9.9.9.107.729: UDP, length 28  
 10:55:38.099478 IP 9.9.9.173.1013 > 6.6.6.6.951: UDP, length 64  
 10:55:38.099631 IP 6.6.6.6.951 > 9.9.9.173.1013: UDP, length 28  
 10:55:55.483328 IP 9.9.9.107.730 > 6.6.6.6.951: UDP, length 64  
 10:55:55.483491 IP 6.6.6.6.951 > 9.9.9.107.730: UDP, length 28  
 10:56:15.484442 IP 9.9.9.107.731 > 6.6.6.6.951: UDP, length 64  
 10:56:15.484747 IP 6.6.6.6.951 > 9.9.9.107.731: UDP, length 28  
 10:56:18.443343 IP 9.9.9.173.50256 > 6.6.6.6.951: UDP, length 140  
 10:56:18.443468 IP 6.6.6.6.951 > 9.9.9.173.50256: UDP, length 28  
 10:56:35.485748 IP 9.9.9.107.732 > 6.6.6.6.951: UDP, length 64  
 10:56:35.485920 IP 6.6.6.6.951 > 9.9.9.107.732: UDP, length 28  
   
 the ip address with 951 or 954 is the nis server.  
   
 in this case, our clients are:  
 9.9.9.107 & 9.9.9.173  
   
 what do if you don't have tcpdump? go straight to the source!  
 this nis server is older than dirt. good thing there are some old versions  
 of tcpdump and libpcap that are compatible with the kernel...  
   
 wget http://www.tcpdump.org/release/tcpdump-3.9.5.tar.gz  
 wget http://www.tcpdump.org/release/libpcap-0.9.6.tar.gz  
   
 tar xvfz and away you go.