#!/usr/bin/perl5.8.4
#
#  This software was derived from SATAN 1.1.1 by Dan Farmer and Wietse Venema
#  (http://www.porcupine.org/satan).
#
# version 2, Mon Mar 20 21:30:24 1995, last mod by wietse
# version 2, Mon Mar 08 23:30:00 1999, last mod by todd
#

# Query the target's finger daemon and report which user logged in from
# which host.  Try to clean up unqualified host names or host names that
# may be truncated. 

$running_under_sara = 1;

require 'config/paths.pl';
require 'perl/fix_hostname.pl';
require 'perl/misc.pl';
require 'perllib/getopts.pl';
 
#
# Parse JCL.
#
$usage="Usage: $0 [-u user] [user@]target\n";
$opt_u = ":0:\@:root:demo:guest";
&Getopts("u:v");
 
if ($#ARGV < 0) {
    print STDERR $usage;
    exit 1;
}

# If no user is given, iterate over a list of queries that might
# give us some interesting answers.

if ($ARGV[0] =~ /([^@]+)@([^@]+)/) {
    $login = $1;
    $target = $2;
} else {
    $target = $ARGV[0];
    $login = $opt_u;
}

$| = 1;
$service        = &basename($0, ".sara");
$trustee        = "";
$trusted        = "";
$severity       = "";
$service_output = "";
$text           = "";
$printed        = 0;

foreach $user (split(/:/, $login)) {
    print "trying: $SAFE_FINGER -l $user\@$target\n" if $opt_v;
    open (FINGER, "$SAFE_FINGER -l $user\@$target 2>/dev/null|") 
	|| exit 1;
    while (<FINGER>) {
	print if $opt_v;
	if (/^ login name: (\S+)/i) { 
	    $user = $1;
	}
	if (/^ login: (\S+)/i) { 
	    $user = $1;
	}
	if (/^ directory: (\S+)/i) { 
	    $home = $1;
	}
	if (/(on since|last login).*\s+from\s+(\S+)/i) { 
	    # Get rid of sync, daemon, localhost, X displays
	    next if ($user eq "sync" || $user eq "daemon");
	    $origin = $2;
	    $origin =~ s/:.*//;
	    # Strip off X display numbers.
	    if ($origin =~ /(.*)@(.*)/) {
		($ruser = $1) || ($ruser = "root");
		$host = $2;
	    } else {
		$ruser = "root";
		$host = $origin;
	    }
	    next if ($host eq "" || $host eq "localhost");
	    if ($fqdn = &fix_hostname($host, $target)) {
		$host = $fqdn;
		$status = "a";
		$severity = "";
		$trustee = $trusted = "";
                $service_output = "finger details";
		$text = "login $user home $home from $host";
                &sara_print();
	    }
#	    $text = "$user $home $host";
#    &sara_print();
	} elsif (/^ (never logged in|on since|last login)/i) { 
	    $status = "a";
            $sid = 'MISC-001';
            ($severity,$service_output,$text, $cve) = &get_sid($sid);
	    $trustee = $trusted = "ANY\@ANY";
            &sara_print() if $printed == 0;
            $printed = 1;
	}
    }
    close(FINGER);
}
