Alerting

alert to remotely run a script

tmarlette
Motivator

I have created a python script in order to ssh to a remote machine and run a script on that machine to unlock user accounts.
I am only getting an return code 255.

I have eliminated all 'splunk code' from the script, and the python script by itself works just fine when ran, and unlocks the account on the remote machine. I am wondering what I am doing wrong.

I have also copied the appropriate .ssh key to the remote machines in order to remove authentication when ssh to the remote machine.

This is my script:

'''

import sys
import splunk.Intersplunk
import subprocess
import logging
import os

# System logging
logger = logging.getLogger('testssh')
hdlr = logging.FileHandler('/tmp/testssh.txt')
formatter = logging.Formatter('%(asctime)s %(levelname)s %(message)s')
hdlr.setFormatter(formatter)
logger.addHandler(hdlr)
logger.setLevel(logging.INFO)

try:

    keywords,options = splunk.Intersplunk.getKeywordsAndOptions() # Get all the options passed

    # Check for passed parameters
    if not options.has_key('host'):
        splunk.Intersplunk.generateErrorResults("no host specified")
        exit(0)
    if not options.has_key('user'):
        splunk.Intersplunk.generateErrorResults("no user specified")
        exit(0)
   if not options.has_key('command'):
        splunk.Intersplunk.generateErrorResults("no command specified")
        exit(0)

    command = options.get('command', None)
    host = options.get('host', None)
    user = options.get('user', None)

    results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
    for r in results:
        try:
            # Call the script passing all the necessary arguments
            p = subprocess.Popen(["ssh -i /idn/home/tmarlett/.ssh/id_rsa -q -t -t tmarlett@r[host] r[command]"],stdin=subprocess.PIPE, stdout=subprocess.PIPE,stderr=subprocess.STDOUT)
            # Get the output from script and push it to new output column
            out,err = p.communicate()
            #logger.info(out.decode("utf-8"))
            r["output"]= out.decode("utf-8")
            r["error"]=err
            r["return_code"]=p.returncode;
        except ValueError, e:
            results = splunk.Intersplunk.generateErrorResults(str(e))
        except OSError, e:
            results = splunk.Intersplunk.generateErrorResults(str(e))

    #Output results back to Splunk
    splunk.Intersplunk.outputResults(results)

except Exception, e:
    results = splunk.Intersplunk.generateErrorResults(str(e))

And this is the output it shows me when running the script:

alt text

Does anyone have any insight as to why this would be happening?

1 Solution

tmarlette
Motivator

I figured this out. This was an issue with passing ssh keys properly. Make sure the script you're using is passing the appropriate ssh key of the user that is running the Splunk instance on that search head.

View solution in original post

0 Karma

tmarlette
Motivator

I figured this out. This was an issue with passing ssh keys properly. Make sure the script you're using is passing the appropriate ssh key of the user that is running the Splunk instance on that search head.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Hello,

Your script needs a shebang

 #!/usr/local/python
0 Karma

jkat54
SplunkTrust
SplunkTrust
 which python

To get the proper path

0 Karma

jkat54
SplunkTrust
SplunkTrust

You'll also want to look at other apps on splunkbase to see how they implement the built in "splunk" python logger....

 _logger....
0 Karma

MuS
SplunkTrust
SplunkTrust

Or read the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/ModInputsLog on how to set up logging in python scripts

0 Karma

jkat54
SplunkTrust
SplunkTrust

there's a way to log it through splunkd.log or your own, etc. for more details than even Splunk docs offer, just see python docs for logging. https://docs.python.org/2/library/logging.html

0 Karma

tmarlette
Motivator

I wish that was the case, however I have the shebang in there, and it's still doing this. I just left it out of my answer. Sorry for the confusion.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Error 255 could coming from the subprocess too because subprocess returns 0-255.

0 Karma

tmarlette
Motivator

Can you recommend a good app to use as a reference for logging?

0 Karma

tmarlette
Motivator

Truthfully, I believe that is what this is. I say that because, when I adjust the syntax of the subprocess, I can see some of the output in splunk, so the script itself looks like it's working. For whatever reason It just doesn't like want to use the splunk search results accordingly.

also, when I do run the script with these settings, I also see a failed login attempt in the destination machine's syslog logs. here is the message:

Failed password for tmarlett from port 35168 ssh2

0 Karma

tmarlette
Motivator

mind you, the EXACT same line of the code is SUCCESSFUL when put into a python only script.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...