Description
This article describes how to create a BASH script for continuous monitoring via an SSH connection for a specific time and an unknown amount of data that will be provided.
Scope
FortiManager, FortiAnalyzer and FortiGate
Solution
The following must be installed on the Linux/GNU platform:
-
openssh-client
-
ssh-keygen (optional, better security and fluency)
-
ssh-pass (when the ssh-keygen can not be used)
-
crontab
This article will demonstrate how to create a script that can be used for different purposes such as:
- Periodically retrieving data from FortiManager, FortiAnalyzer and FortiGate when needed.
- Occasionally changing parts of their configuration.
Two users will be used in this example:
- A localuser under the Linux/GNU platform.
- A remoteuser under the FortiAnalyzer.
Under the localuser, the 'ssh-keygen' will create a private and public key for the user, which will be in .ssh/id_ed25519(.pub) by default. The public key will be copied and pasted later in to the FortAnalyzer administrator profile.
Use the following command to open the default public key:
cat ~/.ssh/.ssh/id_ed25519.pub
This script relies on SSH multiplexing to achieve its goals.
SSH multiplexing is a feature that keeps persistent a single SSH session for specific time.
All of the settings can be reviewed from the man pages (man 5 ssh_config):
- mkdir ~/.ssh/controlmasters (if the directory does not exist).
- ~/.ssh/config (will have the following settings:).
Host fazy
HostName faz.example.com
ControlPath ~/.ssh/controlmasters/%C
ControlMaster auto
ControlPersist 10m
Compression yes
RequestTTY force
If the debug will take 5 minutes, specifying 10m under ControlPersist is recommended. Additionally, consider how often the script will be started.
-
Host: Name for the current configuration.
-
HostName: IP/FQDN also 'Tokens'.
-
ControlPath: The path to the control socket (mkdir ~/.ssh/controlmasters/ to create it if there is not yet created one).
-
ControlMaster: Auto means to create a new session if there is not an existing one.
-
ControlPersist: Define a specific time to keep an already created connection in the background. Yes for persistent connection without specific limits.
-
RequestTTY: Yes is the equivalent of -t and -T of the ssh.
Connect to the FortiAnalyzer.
After copying the public key of localuser under the settings related to remoteuser under FortiAnalyzer, the next login will not require a password.
FortiAnalyzer administrator settings:
config system admin username
edit remoteuser
set ssh-public-key1 “ssh-ed25519 AAAA….” <- Up to 3 keys per username.
end
Example of the BASH script:
#!/bin/bash
# Author: vraev
# Source: https://community.fortinet.com
remotecommands="remotecommands.txt"
#the name of the file which will contain all required commands
USERNAME=('remoteuser')
HOSTS=('fazy')
# For more hosts use the example: HOSTS=('faz.example.com' ‘12.12.12.1’)
SSHDATE=$(date +"%Y%m%dT%H%M")
NLINES=('1,6 p' '8,10 p')
NTIME=('600' '1')
function sanit()
{
sed 's/^[ \t]*//;s/[ \t]*$//' | tr -s '[:space:]'
}
function remote()
{
ssh -tt ${USERNAME}@${1}
}
# This “remote” function is related with the SSH keygen when is in use.
#function remote()
# {
# SSHPASS='PassWord' sshpass -e ssh -tt remoteuser@faz.example.com
# }
# When the user is restricted, SSHPass is the other option to have this script working.
function retrieve()
{
for i in "${!NLINES[@]}"; do
for HOSTNAME in "${HOSTS[@]}"
do
remote ${HOSTNAME} < <(sed -n "${NLINES[i]}" ${remotecommands} | sanit ) >> ${HOSTNAME}_${SSHDATE}.log &
sleep ${NTIME[i]} && kill %%
done
done
exit 1
}
#cd ~/ssh_test/
retrieve
The example below provides the way to set up NLINES and NTIME.
Note: The last entry in the NTIME array is 1.
For instructions on how to schedule with crontab, see Technical Tip: Continuous Debug Monitoring with Bash and Crontab. More options regarding file security and additional troubleshooting steps can also be found in this aritcle.
Troubleshooting:
root@DebTestFr:~# gpg -d -q .hidenpass.gpg | sshpass ssh remoteuser@10.5.17.152
A pseudo-terminal will not be allocated because stdin is not a terminal.
This error can be mitigated by adding -tt options under the ssh client.
If read-write access to the 'System Settings' is not allowed in the administrator profile for the remoteuser, the following error will be observed:
FAZ_742 $ get sys stat
No permission to 'get system.status'
Note: Command parameters are case sensitive. Quotes are always used around the parameters like in this example: 'my_Account'.
Related articles:
