🚀 go-pugleaf

dbin@sce.de (David Binette) writes:

>Fine, i picked up lsof, its a well produced package with a good eye to
>security.

>Butwhat i really want to do is to find the IP address or name for the
> originator of a process...
>say for example a user is running process 16502 and i want to know the IP
> address of the rlogin/telnet/ftp/rexec/whatever that it comes from.

>does anyboddy have a non-perl solution for this?

Read the 00QUICKSTART documentation that comes with lsof.  Section
9, "Deciphering the Remote Login Trail," gives examples for several
UNIX dialects on how to identify remotely originated connection
processes when you know the originating Internet address, then
using that information to identify other processes initiated by
the connection process.

Reversing that sequence will go from a known process to the Internet
address of the incoming connection process.

Here's an example from SCO Release 3.0, taking three lsof probes.
Of course, with a Perl script (or AWK, if you don't like Perl) this
could be done in one probe.

This probe locates the tty name for the process.

dipper: 4 = lsof -p 25947 -ad0
COMMAND     PID     USER   FD   TYPE     DEVICE   SIZE/OFF      INODE NAME
ksh       25947      abe    0u   CHR    58,   0      0t951        596 /dev/ttyp0

This probe locates the rlogind process that has the pseudo tty
analog of /dev/ttyp0 open.

dipper: 5 = lsof /dev/ptyp0
COMMAND     PID     USER   FD   TYPE     DEVICE   SIZE/OFF      INODE NAME
rlogind   25946     root    3u   CHR    59,   0     0t1329        564 /dev/ptyp0

This probe shows the standard input file (an Internet file) open
by the rlogind process, thus identifying the host name of origin.

dipper: 6 = lsof -p25946 -ai -ad0
COMMAND     PID     USER   FD   TYPE     DEVICE   SIZE/OFF      INODE NAME
rlogind   25946     root    0u  inet 0xf1394384          0        TCP dipper.cc.purdue.edu:login->vic.cc.purdue.edu:1023

A Perl or AWK script could be used to access all open files at once
with lsof, saving their relevant information, and then selecting
for display the same information given in the above three probes.

Other UNIX dialects may require slightly different strategies,
depending on how pseudo and real tty files are associated, but the
basic techniques as described in lsof's 00QUICKSTART and its reversal
as described here are essentially the same.

Vic Abell <abe@purdue.edu>