-
Notifications
You must be signed in to change notification settings - Fork 9
/
configarch.pl
1058 lines (865 loc) · 45.8 KB
/
configarch.pl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/local/bin/perl
########################################################################
# = configarch.pl v1.01 2/26/2001 = = Kris Drent, GTP =
# = Configuration Archiving Utility = = [email protected] =
#
# Currently supports: Juniper, F5, Cacheflow, MSFC2
#
# Usage :
# - Using hosts defined hosts file:
# "configarch.pl <host-type>"
# - Using hosts defined on command line:
# "configarch.pl <host-type> <host-1> <host-2> <host-N>
########################################################################
use Net::SNMP;
use Expect;
# Explicitly declare a few globals.
%config; # holds all configuration settings
%hosttype; # host group aliases
@hosts; # fqdn of hosts to operate on
%users; # user hash, entry is 3 cell array [user,passwd,enablepasswd]
$host_type;
# Set this for stdout debugging info, expect output, SNMP reports , etc...
# (0=no debugging output)
# 1: Print SNMP trap messages
# 2: Print SNMP msgs + all Expect output
$debugging = 2;
# Mute standard out for interactive "expect" sessions
if($debugging < 2){
$Expect::Log_Stdout = 0;
}
# Notify NerveCenter that we've started
$starttime = localtime;
send_trap("configarch.pl", 0, "START: $starttime");
if(scalar(@ARGV)<1){ # If no arguments are given, print usage message to stdout
print "Usage: \n"
." using hosts file: configarch.pl <host-type>\n"
." manual hosts list: configarch.pl <host-type> <hostname-1> <hostname-2> <hostname-N>\n";
snmp_die("configarch.pl", "EXIT: no command line arguments given.");
}
# Set specified host type
$host_type = shift(@ARGV);
# Load Configuration
load_config("./configarch.conf"); # reads config file, and creates host-type alias hash
# Load User Account Information
load_users($config{users_file}); # loads user name/pass per host type.
# Get host information from command line argument(s)
if(scalar(@ARGV)==0){ # Run by host group, read hosts from hosts file
load_hosts($config{hosts_file}, $host_type); # searches host file for hosts of type $host_type
}
elsif(scalar(@ARGV)>=1) { # Run from list of hosts given at command line
while(@ARGV){ # Load host array from remaining arguments
push(@hosts,[shift(ARGV), $hosttype{$host_type}]);
}
}
# Setup Local Paths (set in configarch.conf file)
my $sshpath = $config{ssh_path};
my $scppath = $config{scp_path};
my $telnetpath = $config{telnet_path};
# Host loop (host array contains hostname, handler name )
foreach $host (@hosts) {
$handler = @$host[1];
&$handler(@$host[0], $host_type); # Equivilent to: "handler_name(host_name, $host_type);"
} # end foreach host
# Send end timestamp trap
my $endtime = localtime;
send_trap("configarch.pl", 0, "END: $endtime");
exit;
#======- END MAIN -===============================================================
#==== Host Archive Handlers =======================================================
#-- Note: hostgroup handler entries in the config file must match the --
#-- names of these subroutines idendically (case sensitive too.) --
#==================================================================================
#---------------------------------------------------------------------------
#--- Archive JUNIPER config --- [ Completed: 3/28/2001 K. Drent]
# Note: due to a TACACS issue with Juniper, we no longer can use scp to copy
# the /config/juniper.conf file from the box. I've rewritten the handler to
# ssh in, then show config, capturing the screen output.
sub juniper_handler {
# Set up host, login name, and password(s)
my ($host, $htype) = @_;
unless ($host) { snmp_die ("juniper_handler", "No host provided. (Sub Argument)\n"); }
unless ($htype) { snmp_die ("juniper_handler", "No host type provided. (Sub Argument)\n"); }
my ($user, $passwd, $enablepw) = @{$users{$htype}};
unless ($user && $passwd) { snmp_die("juniper_handler","No user login/password supplied (Sub Argument.)\n"); }
# Allow explicitly empty entries using special key phrase "<none>" in users file
if($user eq "<none>") { $user = "";} # Not to be used in production
if($passwd eq "<none>") { $passwd = "";} # environment. (please)
if($enablepw eq "<none>") { $enablepw= "";}
# Set Expected prompt
my $prompt = ">";
# Create archive file name
my $archivename = $host."_".timestamp().".cfa";
# Make sure destination directory exists
if (! -d "$htype"){
if(! mkdir "$htype"){
send_trap("juniper_handler", 1, "Failed: Could not create directory ./$htype");
return;
}
}
# SSH: start ssh process
$ssh = Expect->spawn("$sshpath/ssh $host -l $user") || snmp_die("f5_handler","Failed: Couldn't spawn ssh: $!");
# SSH: Wait for password prompt:
$match = $ssh->expect(30, "Permission denied", "HOST IDENTIFICATION HAS CHANGED", "continue connecting (yes/no)", "ssword:");
if (!$match) {send_trap("juniper_handler", 1,"SSH Failed: Could not access host $host via ssh. (".$ssh->exp_error().")"); goto JUNIPER_END;}
elsif ($match==1) {send_trap("juniper_handler", 1,"SSH Failed: Permission denied for $user before giving password."); goto JUNIPER_END;}
elsif ($match==2) {send_trap("juniper_handler", 1,"SSH Failed: Host key for $host has changed, not allowed to connect with ssh."); goto JUNIPER_END;}
elsif ($match==3) {
# When the server hasn't connected to this host before, it says it can't validate the
# host key because it doesn't already have it stored.
send_trap ("juniper_handler", 1,"SCP Notice: Automatically adding host key for $host.\n");
print $ssh "yes\r";
}
# SSH: give password to ssh
$ssh->exp_stty('-echo'); # hide output text, (when debugging)
print $ssh $passwd."\r";
$ssh->exp_stty('echo'); # unhide
##--------------------------------------------------------------------
##----- With current TACACS configuration, we immediately get an enable prompt
##----- therefore we don't need this next section to do the enable.
##----- Un-comment if needed
##---------------------------------------------------------------------
## SSH: Expect basic prompt
#$match = $ssh->expect(30, "Permission denied",">");
#if (!$match) {send_trap("juniper_handler", 1,"Session Failed: Logged in, but did not receive root prompt ($user@$host.)"); goto JUNIPER_END;}
#elsif ($match==1) {send_trap("juniper_handler", 1,"SSH Failed: Permission denied for user $user on host $host. Check password."); goto JUNIPER_END;}
#
## SSH: send enable command
#print $ssh "enable\r";
#
## SSH: Expect Password prompt:
#$match = $ssh->expect(30, "ssword:");
#if (!$match) {send_trap("juniper_handler", 1,"Session Failed: Did not receive enable password prompt. (".$ssh->exp_error().")"); goto JUNIPER_END;}
## SSH: send enable password
#$ssh->exp_stty('-echo');
#print $ssh $enablepw."\r";
#$ssh->exp_stty('echo');
## Prompt should now be "#"
#$prompt="#";
#---------------------------------------------------------------------
# SSH: Expect the prompt:
$match = $ssh->expect(30, "Access denied", "Permission denied", $prompt);
if (!$match) {send_trap("juniper_handler", 1,"Session Failed: Did not receive enabled prompt after enable command. (".$ssh->exp_error().")"); goto JUNIPER_END;}
elsif($match==1 || $match==2){send_trap("juniper_handler", 1,"Session Enable Failed: Password rejected."); goto JUNIPER_END;}
# We now need to detect the full prompt, (This allows us to be smarter and look
# for more than just "#" for the prompt, avoiding problems when a "#" might occur
# somewhere in the configuration.)
# SSH: send \r, anthing that comes after the
print $ssh "\r";
$match = $ssh->expect(30, "\r\n"); # Read in the echoed cr lf to clear expect buffer.
$match = $ssh->expect(30, $prompt); # The end of the prompt response
if (!$match) {send_trap("juniper_handler", 1,"Session Failed: Did not receive enabled prompt after enable command. (".$ssh->exp_error().")"); goto JUNIPER_END;}
my $full_prompt = $ssh->exp_before() . $prompt; # prompt is everything captured before the >, and append the >
# SSH: send show configuration command
print $ssh "show configuration | no-more\r";
# SSH: Expect "show configuration\r\n" (note the \n")
# (The terminal echos back our command, read it in to clear the buffer.)
$match = $ssh->expect(30, "\n");
if (!$match) {send_trap("juniper_handler", 1,"Session Failed: Did not recieve echo of show command. (".$ssh->exp_error().")"); goto JUNIPER_END;}
# SSH: Expect the full enable prompt, capturing text until then.
$match = -2; # Set to unimportant value
my $config_file="";
$match = $ssh->expect(30, $full_prompt);
if (!$match) {send_trap("juniper_handler", 1,"Session Failed: Did not recieve prompt after show command. (".$ssh->exp_error().")"); goto JUNIPER_END;}
# All text before prompt is the configuration text.
$config_file = $ssh->exp_before() . "\r\n";
# Strip unwanted characters
$config_file =~ s/\r//g; # Strip the \r from the terminal \r\n line endings (create Unix endings)
# Optional, comment out if \r\n line ends are wanted.
# Save config file
my $CONFIG;
open(CONFIG, ">$htype/$archivename")
or send_trap("juniper_handler", 1, "Failed: could not create/open file $htype/$archivename. ($!)");
print CONFIG $config_file;
close CONFIG;
send_trap($host, 0, "Configuration archived and stored successfully.(file: $htype/$archivename)");
JUNIPER_END:
if ($ssh) {
print $ssh "exit\r";
$ssh->hard_close();
}
} # End juniper_handler
#---------------------------------------------------------------------------
#--- Archive CacheFlow config --- [ Completed: 2/15/2001 ]
sub cacheflow_handler {
# Set up host, login name, and password(s)
my ($host, $htype) = @_;
unless ($host) { snmp_die ("cacheflow_handler", "No host provided. (Sub Argument)\n"); }
unless ($htype) { snmp_die ("cacheflow_handler", "No host type provided. (Sub Argument)\n"); }
my ($user, $passwd, $enablepw) = @{$users{$htype}};
unless ($user && $passwd) { snmp_die("cacheflow_handler","No user login/password supplied (Sub Argument.)\n"); }
# Allow explicitly empty entries using special key phrase "<none>" in users file
if($user eq "<none>") { $user = "";} # Not to be used in production
if($passwd eq "<none>") { $passwd = "";} # environment. (please)
if($enablepw eq "<none>") { $enablepw= "";}
# Define paths, file names
my $telnetpath = "/usr/bin"; # local
my $archivename = $host."_".timestamp().".cfa";
# Make sure destination directory exists
if (! -d "$htype"){
if(! mkdir "$htype"){
send_trap("cacheflow_handler", 1, "Failed: Could not create directory ./$htype");
return;
}
}
# Telnet: start telnet process
$telnet = Expect->spawn("$telnetpath/telnet $host") || snmp_die("cacheflow_handler","Failed: Couldn't spawn telnet: $!");
# Telnet: Expect Username prompt:
$match = $telnet->expect(30, "Username:");
if (!$match) {send_trap("f5_handler", 1,"Telnet Failed: Could not access host $host via telnet. (".$telnet->exp_error().")"); goto CACHEFLOW_END;}
# Telnet: send username
print $telnet $user."\r";
# Telnet: Expect Password prompt:
$match = $telnet->expect(30, "Password:");
if (!$match) {send_trap("f5_handler", 1,"Telnet Failed: Did not receive password prompt. (".$telnet->exp_error().")"); goto CACHEFLOW_END;}
# Telnet: send password
$telnet->exp_stty('-echo'); # hide text output (When debugging)
print $telnet $passwd."\r";
$telnet->exp_stty('echo'); # unhide
# Telnet: Expect standard ">" prompt:
$match = $telnet->expect(30, ">", "Username");
if (!$match) {send_trap("f5_handler", 1,"Telnet Failed: Did not receive prompt after supplying password. (".$telnet->exp_error().")"); goto CACHEFLOW_END;}
elsif ($match=1) {send_trap("f5_handler", 1,"Telnet Failed: Incorrect login/password for host $host."); goto CACHEFLOW_END;}
# Telnet: send enable command
print $telnet "enable\r";
# Telnet: Expect Password prompt:
$match = $telnet->expect(30, "Password:");
if (!$match) {send_trap("f5_handler", 1,"Telnet Failed: Did not receive enable password prompt. (".$telnet->exp_error().")"); goto CACHEFLOW_END;}
# Telnet: send enable password
$telnet->exp_stty('-echo');
print $telnet $enablepw."\r";
$telnet->exp_stty('echo');
# FIXME: should add catch for failed enable login (ie. incorrect passwd)!
# Telnet: Expect the "#" enable prompt:
$match = $telnet->expect(30, "#");
if (!$match) {send_trap("f5_handler", 1,"Telnet Failed: Did not receive enable prompt after enable command. (".$telnet->exp_error().")"); goto CACHEFLOW_END;}
# We need to detect the full enable prompt.
# Telnet: send \r, anthing that comes after the
print $telnet "\r";
$match = $telnet->expect(30, "\r\n"); # The echo;
$match = $telnet->expect(30, "#"); # The end of the prompt response
if (!$match) {send_trap("f5_handler", 1,"Telnet Failed: Did not receive enabled prompt after enable command. (".$telnet->exp_error().")"); goto CACHEFLOW_END;}
my $en_prompt = $telnet->exp_before() . "#"; # prompt is everything before the #, and append the #
# Telnet: send show configuration command
print $telnet "show configuration\r";
# Telnet: Expect "show configuration\r\n" (note the \n")
# (The terminal echos back our command, read it in to clear the buffer.)
$match = $telnet->expect(30, "show configuration\r\n");
if (!$match) {send_trap("f5_handler", 1,"Telnet Failed: Did not receive command echo. (".$telnet->exp_error().")"); goto CACHEFLOW_END;}
# Telnet: Expect the full enable prompt OR "--More--", capturing test along the way.
$match = -2;
my $config_file="";
while($match != 2){
$match = $telnet->expect(30, "\r\n--More--", $en_prompt);
if (!$match) {send_trap("f5_handler", 1,"Telnet Failed: Did not recieve prompt after show command. (".$telnet->exp_error().")"); goto CACHEFLOW_END;}
elsif($match==1) { # Found "More" prompt, save text (not includeing more), and keep going."
$config_file .= $telnet->exp_before() . "\r\n";
print $telnet " "; # Keep going.
}
elsif( $match==2) {
$config_file .= $telnet->exp_before() . "\r\n";
last; # Found enable prompt. We're done capturing
}
}
# Strip unwanted characters
$config_file =~ s/\e\[2K\e\[120D//g; # Strip escape characters left from --More-- prompt
$config_file =~ s/\r//g; # Strip the \r from the terminal \r\n line endings (create Unix endings)
# Optional, comment out if \r\n are wanted.
# Save config file
my $CONFIG;
open(CONFIG, ">$htype/$archivename")
or send_trap("cacheflow_handler", 1, "Failed: could not create/open file $htype/$archivename. ($!)");
print CONFIG $config_file;
close CONFIG;
# Send trap signifying "success" (value=0)
send_trap($host, 0, "Configuration archived and stored successfully.(file: $htype/$archivename)");
CACHEFLOW_END:
if ($telnet) {
# Telnet: exit session, let CLI close connection.
print $telnet "exit\r";
$telnet->hard_close();
}
} # End cacheflow_handler
#----------------------------------------------------------------------------
#---- Archive F5 config ---- [ Completed: 2/15/2001 K. Drent]
sub f5_handler {
# Set up host, login name, and password(s)
my ($host, $htype) = @_;
unless ($host) { snmp_die ("f5_handler", "No host provided. (Sub Argument)\n"); }
unless ($htype) { snmp_die ("f5_handler", "No host type provided. (Sub Argument)\n"); }
my ($user, $passwd, $enable) = @{$users{$htype}};
unless ($user && $passwd) { snmp_die("f5_handler","No user login/password supplied (Sub Argument.)\n"); }
# Allow explicitly empty entries using special key phrase "<none>" in users file
if($user eq "<none>") { $user = "";} # Not to be used in production
if($passwd eq "<none>") { $passwd = "";} # environment. (please)
if($enablepw eq "<none>") { $enablepw= "";}
# Define paths, file names
my $archivename = "/var/tmp/".$host."_".timestamp().".tgz";
my $f5_file_list = "/etc/bigd.conf "
."/etc/bigip.conf "
."/etc/bigip.interfaces "
."/etc/bigd.conf "
."/etc/bigip.conf "
."/etc/bigip.interfaces "
."/etc/bigip.license "
."/etc/crontab "
."/etc/ethers "
."/etc/hosts.allow "
."/etc/hosts.deny "
."/etc/inetd.conf "
."/etc/ipf.conf "
."/etc/ipnat.conf "
."/etc/ipfw.conf "
."/etc/ipfw.filt "
."/etc/ipfwrate.conf "
."/etc/ipfwrate.filt "
."/etc/master.passwd "
."/etc/namedb "
."/etc/netstart "
."/etc/ntp.conf "
."/etc/passwd "
."/etc/rateclass.conf "
."/etc/snmpd.conf "
."/etc/rc "
."/etc/rc.local "
."/etc/rc.sysctl "
."/etc/resolv.conf "
."/etc/sendmail.cf "
."/etc/ssh_config "
."/etc/sshd_config "
."/etc/ttys.conf "
."/etc/ssh2/ssh2_config "
."/etc/ssh2/sshd2_config "
."/var/f5/bigdb/user.db "
."/var/f5/httpd/basicauth/users "
."/var/f5/www/seeit/.users "
."/var/asr/gateway/certs "
."/var/asr/gateway/private "
."/root/.ssh "
."/root/.ssh2 ";
# Get filename of archive, (i.e. strip path off)
$archivename =~ /.*\/(.+?)$/;
$filename = $1;
# Make sure destination directory exists
if (! -d "$htype"){
if(! mkdir "$htype"){
send_trap("f5_handler", 1, "Failed: Could not create directory ./$htype");
return;
}
}
# SSH: start ssh process
$ssh = Expect->spawn("$sshpath/ssh $host -l $user") || snmp_die("f5_handler","Failed: Couldn't spawn ssh: $!");
# SSH: Wait for password prompt:
$match = $ssh->expect(30, "Permission denied", "HOST IDENTIFICATION HAS CHANGED","continue connecting (yes/no)", "ssword:");
if (!$match) {send_trap("f5_handler", 1,"SSH Failed: Could not access host $host via ssh. (".$ssh->exp_error().")"); goto F5_END;}
elsif ($match==1) {send_trap("f5_handler", 1,"SSH Failed: Permission denied for $user before giving password."); goto F5_END;}
elsif ($match==2) {send_trap("f5_handler", 1,"SSH Failed: Host key for $host has changed, not allowed to connect with ssh."); goto F5_END;}
elsif ($match==3) {
# When the server hasn't connected to this host before, it says it can't validate the
# host key because it doesn't already have it stored.
send_trap ("f5_handler", 1,"SCP Notice: Automatically adding host key for $host.\n");
print $ssh "yes\r";
}
# SSH: give password to ssh
$ssh->exp_stty('-echo');
print $ssh $passwd."\r";
$ssh->exp_stty('echo');
# SSH: look for pre-prompt information or prompts
$match = $ssh->expect(30, "Terminal type?", "#", "Permission denied");
if (!$match) {send_trap("f5_handler", 1,"SSH Failed: Could not access host $host via ssh. (".$ssh->exp_error().")"); goto F5_END;}
elsif ($match==1) { print $ssh "vt100\r"; }
elsif ($match==2) { print $ssh "\r"; }
elsif ($match==3) { send_trap("f5_handler", 1, "SSH Failed: Password incorect for user $user on host $host.\n"); goto F5_END;}
# SSH: Expect hash (#) prompt
$match = $ssh->expect(30, "#");
if (!$match) {send_trap("f5_handler", 1,"SSH Failed: Logged in, but did not receive root prompt ($user@$host.)"); goto F5_END;}
# SSH: Archive files into /var/tmp/configarch_<datetimestamp>.tgz
print $ssh "tar -zcf $archivename $f5_file_list\r";
# SSH: Expect hash (#) prompt
$match = $ssh->expect(30, "#");
if (!$match) {send_trap("f5_handler", 1,"SSH Failed: After issuing remote archive command, did not receive root prompt.");
goto F5_END;}
#-- SCP: start scp process --
$scp = Expect->spawn("$scppath/scp $user\@$host:$archivename $htype/") || die "Couldn't spawn scp: $!";
# SCP: Wait for password prompt:
$match = $scp->expect(30, "HOST IDENTIFICATION HAS CHANGED", "password:");
if (!$match) {send_trap ("f5_handler", 1,"SCP Failed: Could not access host $host via scp. (".$scp->exp_error().")\n");
goto F5_END;}
elsif ($match==1) {send_trap ("f5_handler", 1,"SCP Failed: Host key for $host has changed, not allowed to connect with scp.\n");
goto F5_END;}
# SCP: Send paswsord to scp
print $scp $passwd."\r";
$match = $scp->expect(120, "Permission denied", "No such file or directory", "100%");
if (!$match) {send_trap("f5_handler", 1,"SCP Failed: Could not access host $host via scp. (".$scp->exp_error().")\n");
goto F5_END;}
elsif ($match==1) {send_trap("f5_handler", 1, "SCP Failed: Password incorect for $user@$host.\n"); goto F5_END;}
elsif ($match==2) {send_trap("f5_handler", 1, "SCP Failed: File \"$archivename\" does not exist on host $host.\n");
goto F5_END;}
elsif($match==3) {send_trap($host, 0, "Configuration archived and stored successfully.(file: $htype/$archivename)"); }# SUCCESS!
# SSH: delete temp remote archive
print $ssh "rm -f $archivename\r";
# SSH: Expect hash (#) prompt
$match = $ssh->expect(30, "#");
if (!$match) {send_trap("f5_handler", 1,"SSH Failed: After issuing remote delete command, did not receive root prompt.");
goto F5_END;}
F5_END:
if($ssh) {
print $ssh "exit\r";
$ssh->hard_close();
}
if($scp) { $scp->hard_close(); }
return;
} # End f5_handler()
#---------------------------------------------------------------------------
#--- Archive MSFC2 config --- [ Completed: 2/19/2001 K. Drent]
sub msfc2_handler {
# Set up host, login name, and password(s)
my ($host, $htype) = @_;
unless ($host) { snmp_die ("msfc2_handler", "No host provided. (Sub Argument)\n"); }
unless ($htype) { snmp_die ("msfc2_handler", "No host type provided. (Sub Argument)\n"); }
my ($user, $passwd, $enablepw) = @{$users{$htype}};
unless ($user && $passwd) { snmp_die("msfc2_handler","No user login/password supplied (Sub Argument.)\n"); }
# Allow explicitly empty entries using special key phrase "<none>" in users file
if($user eq "<none>") { $user = "";} # Not to be used in production
if($passwd eq "<none>") { $passwd = "";} # environment. (please)
if($enablepw eq "<none>") { $enablepw= "";}
# Create archive file name
my $archivename = $host."_".timestamp().".cfa";
# Make sure destination directory exists
if (! -d "$htype"){
if(! mkdir "$htype"){
send_trap("msfc2_handler", 1, "Failed: Could not create directory ./$htype");
return;
}
}
# SSH: start ssh process
$ssh = Expect->spawn("$sshpath/ssh $host -l $user") || snmp_die("msfc2_handler","Failed: Couldn't spawn ssh: $!");
# SSH: Wait for password prompt:
$match = $ssh->expect(100, "Permission denied", "HOST IDENTIFICATION HAS CHANGED", "continue connecting (yes/no)", "ssword:");
if (!$match) {send_trap("msfc2_handler", 1,"SSH Failed: Could not access host $host via ssh. (".$ssh->exp_error().")"); goto MSFC2_END;}
elsif ($match==1) {send_trap("msfc2_handler", 1,"SSH Failed: Permission denied for $user before giving password."); goto MSFC2_END;}
elsif ($match==2) {send_trap("msfc2_handler", 1,"SSH Failed: Host key for $host has changed, not allowed to connect with ssh."); goto MSFC2_END;}
elsif ($match==3) {
# When the server hasn't connected to this host before, it says it can't validate the
# host key because it doesn't already have it stored.
send_trap ("msfc2_handler", 1,"SCP Notice: Automatically adding host key for $host.\n");
print $ssh "yes\r";
}
# SSH: give password to ssh
$ssh->exp_stty('-echo'); # hide output text, (when debugging)
print $ssh $passwd."\r";
$ssh->exp_stty('echo'); # unhide
##--------------------------------------------------------------------
##----- With current TACACS configuration, we immediately get an enable prompt
##----- therefore we don't need this next section to do the enable.
##----- Un-comment if needed
##---------------------------------------------------------------------
## SSH: Expect basic prompt
#$match = $ssh->expect(30, "Permission denied",">");
#if (!$match) {send_trap("msfc2_handler", 1,"Session Failed: Logged in, but did not receive root prompt ($user@$host.)"); goto MSFC2_END;}
#elsif ($match==1) {send_trap("msfc2_handler", 1,"SSH Failed: Permission denied for user $user on host $host. Check password."); goto MSFC2_END;}
#
## SSH: send enable command
#print $ssh "enable\r";
## SSH: Expect Password prompt:
#$match = $ssh->expect(30, "ssword:");
#if (!$match) {send_trap("msfc2_handler", 1,"Session Failed: Did not receive enable password prompt. (".$ssh->exp_error().")"); goto MSFC2_END;}
## SSH: send enable password
#$ssh->exp_stty('-echo');
#print $ssh $enablepw."\r";
#$ssh->exp_stty('echo');
#--------------------------------------------------------
# SSH: Expect the "#" enable prompt:
$match = $ssh->expect(30, "Access denied", "Permission denied", "#");
if (!$match) {send_trap("msfc2_handler", 1,"Session Failed: Did not receive enabled prompt after enable command. (".$ssh->exp_error().")"); goto MSFC2_END;}
elsif($match==1 || $match==2){send_trap("msfc2_handler", 1,"Session Enable Failed: Password rejected."); goto MSFC2_END;}
# We now need to detect the full prompt, (This allows us to be smarter and look
# for more than just "#" for the prompt, avoiding problems when a "#" might occur
# somewhere in the configuration.)
# SSH: send \r, anthing that comes after the
print $ssh "\r";
$match = $ssh->expect(30, "\r\n"); # Read in the echoed cr lf to clear expect buffer.
$match = $ssh->expect(30, "#"); # The end of the prompt response
if (!$match) {send_trap("msfc2_handler", 1,"Session Failed: Did not receive enabled prompt after enable command. (".$ssh->exp_error().")"); goto MSFC2_END;}
my $en_prompt = $ssh->exp_before() . "#"; # prompt is everything captured before the #, and append the #
# SSH: set "term length 0" which will get rid of the "--More--" prompt when
# capturing the configuration from the terminal.
print $ssh "term length 0\r";
# SSH: Expect the "#" enable prompt:
$match = $ssh->expect(30, $en_prompt);
if (!$match) {send_trap("msfc2_handler", 1,"Session Failed: Did not receive enabled prompt after \"term length 0\" command. (".$ssh->exp_error().")"); goto MSFC2_END;}
# SSH: send show configuration command
print $ssh "show configuration\r";
# SSH: Expect "show configuration\r\n" (note the \n")
# (The terminal echos back our command, read it in to clear the buffer.)
$match = $ssh->expect(30, "show configuration\r\n");
$match = $ssh->expect(30, "-re", 'Using \d+ out of \d+ bytes\r\n');
if (!$match) {send_trap("msfc2_handler", 1,"Session Failed: Did not recieve Config line \"Using x out of x bytes\" after show command. (".$ssh->exp_error().")"); goto MSFC2_END;}
# SSH: Expect the full enable prompt, capturing text until then.
$match = -2; # Set to unimportant value
my $config_file="";
$match = $ssh->expect(30, $en_prompt);
if (!$match) {send_trap("msfc2_handler", 1,"Session Failed: Did not recieve prompt after show command. (".$ssh->exp_error().")"); goto MSFC2_END;}
# All text before prompt is the configuration text.
$config_file = $ssh->exp_before() . "\r\n";
# Strip unwanted characters
$config_file =~ s/\r//g; # Strip the \r from the terminal \r\n line endings (create Unix endings)
# Optional, comment out if \r\n line ends are wanted.
# Save config file
my $CONFIG;
open(CONFIG, ">$htype/$archivename")
or send_trap("msfc2_handler", 1, "Failed: could not create/open file $htype/$archivename. ($!)");
print CONFIG $config_file;
close CONFIG;
send_trap($host, 0, "Configuration archived and stored successfully.(file: $htype/$archivename)");
MSFC2_END:
if ($ssh) {
print $ssh "exit\r";
$ssh->hard_close();
}
} # End msfc2_handler
#---------------------------------------------------------------------------
#--- Archive cisco config --- [ ongoing: 6/18/2001 K. Baumann]
sub cisco_handler {
# Set up host, login name, and password(s)
my ($host, $htype) = @_;
unless ($host) { snmp_die ("cisco_handler", "No host provided. (Sub Argument)\n"); }
unless ($htype) { snmp_die ("cisco_handler", "No host type provided. (Sub Argument)\n"); }
my ($user, $passwd, $enablepw) = @{$users{$htype}};
unless ($user && $passwd) { snmp_die("cisco_handler","No user login/password supplied (Sub Argument.)\n"); }
# Allow explicitly empty entries using special key phrase "<none>" in users file
if($user eq "<none>") { $user = "";} # Not to be used in production
if($passwd eq "<none>") { $passwd = "";} # environment. (please)
if($enablepw eq "<none>") { $enablepw= "";}
# Create archive file name
my $archivename = $host."_".timestamp().".cfa";
# Make sure destination directory exists
if (! -d "$htype"){
if(! mkdir "$htype"){
send_trap("cisco_handler", 1, "Failed: $host: Could not create directory ./$htype");
return;
}
}
# SSH: start ssh process
$ssh = Expect->spawn("$sshpath/ssh $host -l $user") || snmp_die("cisco_handler","Failed: Couldn't spawn ssh: $!");
# SSH: Wait for prompt: Determine if ssh capable. If not, try telnet.
$match = $ssh->expect(100, "Permission denied", "HOST IDENTIFICATION HAS CHANGED", "continue connecting (yes/no)", "ssword:");
if (!$match) {goto CISCO_TELNET;}
elsif ($match==1) {send_trap("cisco_handler", 1,"SSH Failed: $host: Permission denied for $user before giving password."); goto CISCO_END;}
elsif ($match==2) {send_trap("cisco_handler", 1,"SSH Failed: Host key for $host has changed, not allowed to connect with ssh."); goto CISCO_END;}
elsif ($match==3) {
# When the server hasn't connected to this host before, it says it can't validate the
# host key because it doesn't already have it stored.
send_trap ("cisco_handler", 1,"SCP Notice: Automatically adding host key for $host.\n");
print $ssh "yes\r";
elsif ($match==4) {
}
# SSH: give password to ssh
$ssh->exp_stty('-echo'); # hide output text, (when debugging)
print $ssh $passwd."\r";
$ssh->exp_stty('echo'); # unhide
# Look to see if enabled or not - if not try to enable
$match = $ssh->expect(30, "(enable)" , ">" , "#" );
if (!$match) {send_trap("cisco_handler", 1,"Session Failed: $host: Enable not non-enable working. (".$ssh->exp_error().")"); goto CISCO_END;}
# SSH: Expect the "(enable)" enable prompt:
$match = $ssh->expect(30, "Access denied", "Permission denied", "(enable)" , ">" );
if (!$match) {send_trap("cisco_handler", 1,"Session Failed: $host: Did not receive first enabled prompt after enable command. (".$ssh->exp_error().")"); goto CISCO_END;}
elsif($match==1 || $match==2){send_trap("cisco_handler", 1,"Session Enable Failed: $host: Password rejected."); goto CISCO_END;}
elsif($match==4)
{
print $ssh "enable\r";
$match = $ssh->expect(30, "ssword:");
if (!$match) {send_trap("cisco_handler", 1,"Session Failed: Did not receive enable password prompt. (".$ssh->exp_error().")"); goto CISCO_END;}
# SSH: send enable password
$ssh->exp_stty('-echo');
print $ssh $enablepw."\r";
$ssh->exp_stty('echo');
}
# We now need to detect the full prompt, (This allows us to be smarter and look
# for more than just "#" for the prompt, avoiding problems when a "#" might occur
# somewhere in the configuration.)
# SSH: send \r, anthing that comes after the
print $ssh "\r";
print $ssh "\r";
$match = $ssh->expect(30, "\r\n"); # Read in the echoed cr lf to clear expect buffer.
$match = $ssh->expect(30, ")"); # The end of the prompt response
if (!$match) {send_trap("cisco_handler", 1,"Session Failed: $host: Did not receive second enabled prompt after enable command. (".$ssh->exp_error().")"); goto CISCO_END;}
my $en_prompt = $ssh->exp_before() . ")"; # prompt is everything captured before the #, and append the #
# SSH: send show configuration command
print $ssh "show config\r";
# SSH: Expect "show configuration\r\n" (note the \n")
# (The terminal echos back our command, read it in to clear the buffer.)
# $match = $ssh->expect(30, "show config\r\n");
# $match = $ssh->expect(30, "-re", 'Using \d+ out of \d+ bytes\r\n');
# if (!$match) {send_trap("cisco_handler", 1,"Session Failed: $host: Did not recieve Config line \"Using x out of x bytes\" after show command. (".$ssh->exp_error().")"); goto CISCO_END;}
# SSH: Expect the full enable prompt, capturing text until then.
$match = -2; # Set to unimportant value
my $config_file="";
#
# do the right thing when --More-- comes around
#
while($match != 2){
$match = $ssh->expect(30, "\r\n--More--", $en_prompt );
if (!$match) {send_trap("cisco_handler", 1,"SSH Failed: $host: Did not recieve prompt after show command. (".$ssh->exp_error().")"); goto CISCO_END;}
elsif($match==1) { # Found "More" prompt, save text (not includeing more), and keep going."
$config_file .= $ssh->exp_before() . "\r\n";
print $ssh " "; # Keep going.
}
elsif( $match==2) {
$config_file .= $ssh->exp_before() . "\r\n";
last; # Found enable prompt. We're done capturing
}
}
# Strip unwanted characters
$config_file =~ s/\e\[2K\e\[120D//g; # Strip escape characters left from --More-- prompt
$config_file =~ s/\r//g; # Strip the \r from the terminal \r\n line endings (create Unix endings)
# Optional, comment out if \r\n are wanted.
# Save config file
my $CONFIG;
open(CONFIG, ">$htype/$archivename")
or send_trap("cisco_handler", 1, "Failed: $host: could not create/open file $htype/$archivename. ($!)");
print CONFIG $config_file;
close CONFIG;
# Send trap signifying "success" (value=0)
send_trap($host, 0, "Configuration archived and stored successfully.(file: $htype/$archivename)");
#----------------------------------------------------
# Don't need this right now
#
# $match = $ssh->expect(30, $en_prompt);
# if (!$match) {send_trap("cisco_handler", 1,"Session Failed: Did not recieve prompt after show command. (".$ssh->exp_error().")"); goto CISCO_END;}
#
# # All text before prompt is the configuration text.
# $config_file = $ssh->exp_before() . "\r\n";
#
# # Strip unwanted characters
# $config_file =~ s/\r//g; # Strip the \r from the terminal \r\n line endings (create Unix endings)
# # Optional, comment out if \r\n line ends are wanted.
# # Save config file
# my $CONFIG;
# open(CONFIG, ">$htype/$archivename")
# or send_trap("cisco_handler", 1, "Failed: could not create/open file $htype/$archivename. ($!)");
# print CONFIG $config_file;
# close CONFIG;
#
# send_trap($host, 0, "Configuration archived and stored successfully.(file: $htype/$archivename)");
#
#----------------------------------------------------
CISCO_END:
if ($ssh) {
print $ssh "exit\r";
$ssh->hard_close();
}
} # End cisco_handler
###################
#---- Archive Quallaby config ---- [ Completed: 3/19/2001 K. Drent]
sub quallaby_handler {
# Set up host, login name, and password(s)
my ($host, $htype) = @_;
unless ($host) { snmp_die ("quallaby_handler", "No host provided. (Sub Argument)\n"); }
unless ($htype) { snmp_die ("quallaby_handler", "No host type provided. (Sub Argument)\n"); }
my ($user, $passwd, $enable) = @{$users{$htype}};
unless ($user && $passwd) { snmp_die("quallaby_handler","No user login/password supplied (Sub Argument.)\n"); }
# Allow explicitly empty entries using special key phrase "<none>" in users file
if($user eq "<none>") { $user = "";} # Not to be used in production
if($passwd eq "<none>") { $passwd = "";} # environment. (please)
if($enablepw eq "<none>") { $enablepw= "";}
# Define paths, file names
my $archivename = $host."_".timestamp().".tgz";
my $remotearchivename = "/db01/app/autoprov/prov_backup.tgz";
my $remotearchivescript= "/db01/app/autoprov/scripts/prov_backup.pl";
my $prompt = '$';
# Get filename of archive, (i.e. strip path off)
$archivename =~ /.*\/(.+?)$/;
$filename = $1;
# Make sure destination directory exists
if (! -d "$htype"){
if(! mkdir "$htype"){
send_trap("quallaby_handler", 1, "Failed: Could not create directory ./$htype");
return;
}
}
# SSH: start ssh process
$ssh = Expect->spawn("$sshpath/ssh $host -l $user") || snmp_die("quallaby_handler","Failed: Couldn't spawn ssh: $!");
# SSH: Wait for password prompt:
$match = $ssh->expect(30, "Permission denied", "HOST IDENTIFICATION HAS CHANGED","continue connecting (yes/no)", "ssword:");
if (!$match) {send_trap("quallaby_handler", 1,"SSH Failed: Could not access host $host via ssh. (".$ssh->exp_error().")"); goto QUALLABY_END;}
elsif ($match==1) {send_trap("quallaby_handler", 1,"SSH Failed: Permission denied for $user before giving password."); goto QUALLABY_END;}
elsif ($match==2) {send_trap("quallaby_handler", 1,"SSH Failed: Host key for $host has changed, not allowed to connect with ssh."); goto QUALLABY_END;}
elsif ($match==3) {
# When the server hasn't connected to this host before, it says it can't validate the
# host key because it doesn't already have it stored.
send_trap ("quallaby_handler", 1,"SSH Notice: Automatically adding host key for $host.\n");
print $ssh "yes\r";
}
# SSH: give password to ssh
$ssh->exp_stty('-echo');
print $ssh $passwd."\r";
$ssh->exp_stty('echo');
# SSH: look for pre-prompt information or prompts
$match = $ssh->expect(30, "Terminal type?", "Permission denied", $prompt);
if (!$match) {send_trap("quallaby_handler", 1,"SSH Failed: Could not access host $host via ssh. (".$ssh->exp_error().")"); goto QUALLABY_END;}
elsif ($match==1) { print $ssh "vt100\r"; }
elsif ($match==2) { send_trap("quallaby_handler", 1, "SSH Failed: Password incorect for user $user on host $host.\n"); goto QUALLABY_END;}
elsif ($match==3) { print $ssh "\r"; }
# SSH: Expect prompt
$match = $ssh->expect(30, $prompt);
if (!$match) {send_trap("quallaby_handler", 1,"SSH Failed: Logged in, but did not receive root prompt ($user@$host.)"); goto QUALLABY_END;}
# SSH: Run configuration file script (creates config file)
print $ssh $remotearchivescript . "\r";
# SSH: Expect prompt
$match = $ssh->expect(600, $prompt);
if (!$match) {send_trap("quallaby_handler", 1,"SSH Failed: After issuing remote archive command, did not receive root prompt.");
goto QUALLABY_END;}
#-- SCP: start scp process -- (copy remote archive to local archive, renaming the file in the process)
$scp = Expect->spawn("$scppath/scp $user\@$host:$remotearchivename $htype/$archivename") || die "Couldn't spawn scp: $!";
# SCP: Wait for password prompt:
$match = $scp->expect(30, "HOST IDENTIFICATION HAS CHANGED", "ssword:");
if (!$match) {send_trap ("quallaby_handler", 1,"SCP Failed: Could not access host $host via scp. (".$scp->exp_error().")\n");
goto QUALLABY_END;}
elsif ($match==1) {send_trap ("quallaby_handler", 1,"SCP Failed: Host key for $host has changed, not allowed to connect with scp.\n");
goto QUALLABY_END;}
# SCP: Send paswsord to scp
print $scp $passwd."\r";
$match = $scp->expect(120, "Permission denied", "No such file or directory", "100%");
if (!$match) {send_trap("quallaby_handler", 1,"SCP Failed: Could not access host $host via scp. (".$scp->exp_error().")\n");
goto QUALLABY_END;}
elsif ($match==1) {send_trap("quallaby_handler", 1, "SCP Failed: Password incorect for $user@$host.\n"); goto QUALLABY_END;}
elsif ($match==2) {send_trap("quallaby_handler", 1, "SCP Failed: File \"$archivename\" does not exist on host $host.\n");
goto QUALLABY_END;}
elsif($match==3) {send_trap($host, 0, "Configuration archived and stored successfully.(file: $htype/$archivename)"); }# SUCCESS!
# SSH: delete temp remote archive
print $ssh "rm -f $remotearchivename\r";
# SSH: Expect hash (#) prompt
$match = $ssh->expect(30, $prompt);
if(!$match){send_trap("quallaby_handler", 1,"SSH Failed: After issuing remote delete command, did not receive root prompt.");
goto QUALLABY_END;}
QUALLABY_END:
if($ssh) {
print $ssh "exit\r";
$ssh->hard_close();
}
if($scp) { $scp->hard_close(); }
return;
} # End quallaby_handler()
#----------------------------------------------------------------
#---- Configuration file loading subroutines ---------------------
#----------------------------------------------------------------
sub load_config{ # arg ($config_file_name)
my $conffile = shift(@_);
open(CONFIG, $conffile) or snmp_die("configarch.pl","Could not open script configuration file.");
while (<CONFIG>) {
chomp; # no newline
s/^#.*//; # no comments
s/^\s+//; # no leading white
s/\s+$//; # no trailing white
next unless length; # anything left?
my ($var, $value) = split(/\s*=\s*/, $_, 2);
$config{$var} = $value;
}
# Create a hash of host type aliases
create_hosttype_alias_hash($host_type);
}
sub load_users{ # arg ($user_file_name)
my $userfile = shift(@_);
open(USERS, $userfile) or snmp_die("configarch.pl","Could not open users file.");
while (<USERS>) {
chomp;
s/^#.*//;
s/^\s+//;
s/\s+$//;
next unless length;
my ($group, $user, $passwd, $enablepasswd) = split(/\s+/, $_, 4);
$users{$group} = [$user, $passwd, $enablepasswd];
}
}
sub load_hosts { #args ($hosts_file_name, $host_type)
my $hostfile = shift(@_);
open(IPS, $hostfile) or snmp_die("configarch.pl","Could not open remote hosts file.");
my $host_type = $_[1];
my $hostname,$htype;
while (<IPS>) {
# line format ip:hosttype - ex. "10.10.4.242:juniper"
chomp;
s/^#.*//;
s/^\s+//;
s/\s+$//;
next unless length;
($hostname, $htype) = split(/\s*:\s*/, $_, 2); # fqdn|ip:hosttype
# Add host to our host list, only if correct type.
if($hosttype{$htype}) {
push (@hosts, [ $hostname, $hosttype{$htype} ]);
}
}
# @hosts is now a 2 dimentional array containing:
# index 0: fqdn of host
# index 1: handler key (name)
}
#------------ Create Host Type Alias Hash --------------------------------
sub create_hosttype_alias_hash { #arg ($hosttype)
# Creates a hash of host type aliases, found in config file
# (Required after loading config file, but before
# calling "load_hosts($file, $htype)")
my $htype = shift(@_);
# Check to see if specified type is defined in config file
if(! $config{"hostgroup ". $htype}){
snmp_die("Config Error: No host type \"$htype\" defined in config file.");
return 0;
}
# line entry looks like this: "hostgroup f5 = f5_handler : f5_dedicated, f5_BigIP, f5_a"
# Parse handler identifier. (result: 0, handler 1, aliases)
@groupentry = split(/\s*:\s*/, $config{"hostgroup ". $htype});
@hosttypes = split(/\s*,\s*/, $groupentry[1]); # split aliases
foreach $halias (@hosttypes) {
$hosttype{$halias} = $groupentry[0]; # key=hostalias, value = handler keyword.
}
$hosttype{$htype} = $groupentry[0]; # set htype key as an alias for consistancy
# At this point, %hosttype exists with a entry for each alias that exists
# (when alias is used as the key). We can now use this hash as a reference
# for which host types we need when loading the hosts file.