#!/usr/bin/perl5.8.4
#  This software was derived from SATAN 1.1.1 by Dan Farmer and Wietse Venema
#  (http://www.porcupine.org/satan).
#
#
# version 1, Mon Mar 20 18:49:25 1995, last mod by wietse
# version 2, Mon Mar 08 23:30:00 1999, last do by Bob Todd
#

# Query the target's rusers daemon and report which user logged in from
# which host.  Try to clean up unqualified host names or host names that
# are truncated.

$running_under_sara = 1;

require 'config/paths.pl';
require 'perl/fix_hostname.pl';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

#
# Parse JCL.
#
$usage="Usage: rusers.sara target\n";
&Getopts("v");
 
if ($#ARGV < 0) {
	print STDERR $usage;
	exit 1;
}
$target = $ARGV[0];
$service = &basename($0, ".sara");

$| = 1;

#
# Examine the output from the rusers client.
#
open (RUSERS, "$RUSERS -l $target 2>/dev/null|") 
    || exit 1;

while (<RUSERS>) {
    ($user, $where, $month, $day, $time, $idle, $host) = split;

    # Deal with hostname stuff in case of remote logins.
    if (/\(.*\)/) {
	if ($idle && !$host) {
	    $host = $idle;
	}
	# Get rid of X display numbers.
	$host =~ s/:.*//;
	$host =~ s/[()]//g;

	# Verify hostname if anything interesting was left.
	if ($host ne "" && $host ne "localhost") {
	    # Canonicalize the host name.
	    if ($fqdn = &fix_hostname($host, $target)) {
		$host = $fqdn;
		$status = "a";
		$severity = "";
		$trustee = "$user\@$target";
		$trusted = "root\@$host";
		$service_output = "$user";
		$text = "login $user from $host";
		&sara_print();
	    } else {
		$status = "u";
		$severity = "";
		$trustee = "$user\@$target";
		$trusted = "root\@$host";
		$service_output = "$user";
		$text = "login $user from $host, unable to verify hostname";
		&sara_print();
	    }
	}
    }
    # Log this user, whether or not remote.
    $status = "a";
    $sid = 'MISC-003';
    ($severity,$service_output,$text, $cve) = &get_sid($sid);
    $trustee = "ANY@$target";
    $trusted = "ANY@$target";
    &sara_print();
}
