Script for controling agents

[limo]

Hi all,

we use thios script to control our labs. We can reboot or halt our lab computers by this script. If it is usefull for somebody, feel free to use...
I know this is off-topic , zabbix should be used for monitoring, not control but we put it together
You must have read/write rights for host to be controled.

Parameter for script is

labcontrol.php?grp=grpname&a=action

eg.

labcontrol.php?grp=lab1&a=halt

will semd halt command to all zabbix agents in host group lab1. If you will configure agents to run shutdown on these hosts when getting halt, you can shutdown all computers.

labcontrol.php?grp=lab1&a=system.uname

will show all system.uname from lab1 (not in db but realtime query)

<?
error_reporting(0);
ob_implicit_flush();

$page["title"]="S_ZABBIX_BIG";
$page["file"]="labcontrol";

include "include/config.inc.php";
include "include/forms.inc.php";

check_authorisation();
show_header($page["title"],0,0);

function zabbixcmd ($ip,$cmd) {
  $h=DBselect("select hostid from hosts where ip='$ip' or host='$ip'");
  $row=DBfetch($h);
  $hostid=$row["hostid"];
  if (check_right("Host","U",$hostid)) {
    echo "Sending command $cmd to $ip ($hostid)..";
    ob_flush();
    $s=fsockopen($ip, 10050, $errno, $errstr, 5);
    if ($s) {
      fputs($s,$cmd."\n");
      $ret=fgets($s,128);
      fclose($s);
      echo "OK ($ret)<br>";
      ob_flush();
    } else {
      echo " <b style='color: red'>unreachable</b><br>";
      ob_flush();
    }
  } else {
    echo "No rights to host $hostid. Exiting.";
  }
}

function get_hosts_in_group ($group)
{
  $g=DBselect("select h.hostid,h.host as host from hosts h,hosts_groups hg,groups g".
              " where g.groupid=hg.groupid and g.name='$group' and hg.hostid=h.hostid".
              " group by h.hostid,h.host order by h.host");
  $i=1;
  while ($row=dbfetch($g)) {
    $ret[$i++]=$row["host"];
  }
  return($ret);
}                                                                                                                             

if ($_GET["ip"]) {
  $ips=array(addslashes($_GET["ip"]));
} elseif ($_GET["uc"]) {
  $ips=get_hosts_in_group($_GET["grp"]);
}

foreach ($ips as $ip) {
  zabbixcmd($ip,$_GET["a"]);
}

echo "Hotovo. "

[Logicwrath]

Does this leave you open for some kind of code injection?

[limo]

Does this leave you open for some kind of code injection?

I am not security expert.. In Fact, I do not think that this code is safe but it is not so big problem for us. Bigest problem is that somebody will reboot some desktop pc ..