Secure PHP Development- P124 pdf

This script requires the netgeo.php class. It works as follows: ◆ It gets a list of IP addresses or host names from the command line using the getHostList() function. ◆ For each given IP or host name, it performs netgeo lookup using findLocation(), which prints the geographic data available for the given IP or host name. Note that not all IP addresses or host names are in the netgeo database, so a result might not always be available. Here are some example runs of this script: $ ./geolocator.php www.yahoo.com www.yahoo.com: Approximate location: City : SUNNYVALE State :CALIFORNIA Country :US Longitude:122degree West Latitude:37.4degree North You can see that www.yahoo.com appears to be located in Sunnyvale, CA, U.S. Following is another example: $./geolocator.php www.amazon.com www.amazon.com:Approximate location: City : SEATTLE State :WASHINGTON Country :US Longitude:122.31degree West Latitude:47.55degree North In the preceding example, you can see that www.amazon.com appears to be located in Seattle, Washington, U.S. One last example: $./geolocator.php www.csus.edu www.csus.edu: Approximate location: City : SACRAMENTO State :CALIFORNIA Country :US Longitude:121.44degree West Latitude:38.57degree North 586 Part IV: Using PHP for Sysadmin Tasks 21 549669 ch16.qxd 4/4/03 9:27 AM Page 586 You can see www.csus.com (California State University, Sacramento) appears to be located in Sacramento, CA, U.S., which makes sense. This script should be used from the command line as needed. However, if you wish to make it available to everyone, you can install it in /usr/bin, which is typi- cally in any user’s path. Here is how: 1. Make a directory called /usr/local/src/php/gelocator and copy the netgeo.php class into that directory. Make sure the directory is r+x by all users. In addition, make sure netgeo.php is readable by all users, but nei- ther should be writable. 2. Copy geolocator.php into /usr/bin as geolocator. We remove the php extension because executable scripts typically do not need extensions. 3. Modify /usr/bin/geolocator such that require_once(“netgeo.php”) now is require_once(“/usr/local/src/php/geolocator/netgeo.php”). This will ensure that when users run geolocator from the command line, the /usr/bin/geolocator script will find the netgeo.php class. Now you and your users can run geolocator from anywhere. Note that the geolocator script is fairly accurate, but its output should not be used as a final (and perhaps critical) determination of a particular host’s location. Building a Hard Disk Usage Monitoring Utility Now we will develop a hard disk usage monitoring tool that uses Linux proc file system information to determine hard disk usage, and if usage for a given mounted file system exceeds a specified percentage, the utility sends an e-mail message to the administrator. The script we will develop here requires the classLinux.inc.php and com- mon_functions.php classes from the phpSysInfo project, which is located at http://phpsysinfo.sourceforge.net/project. Download the phpSysInfo project and you will find the common_ functions.php in the main distribution directory; the class.Linux. inc.php can be found in the os subdirectory within the includes directory. Chapter 16: Command-Line PHP Utilities 587 21 549669 ch16.qxd 4/4/03 9:27 AM Page 587 Listing 16-10 shows an example configuration file for this script. Listing 16-10: hdmonitor.conf <?php define(DEBUG, FALSE); // Send email when mounted filesystem reaches // percentage or more as given here $MAXSIZE[‘/’] = 30; $MAXSIZE[‘/usr’] = 50; $MAXSIZE[‘/mnt/win’] = 90; $MAIL_TEMPLATE = ‘hdmonitor_mail.txt’; ?> Defined in the $MAXSIZE array are three mount points (partitions), which can be also written as follows: $MAXSIZE = array ( ‘/’ => 30, ‘/usr’ => 50, ‘/mnt/win’ => 90 ); These three mount points will be monitored by the script when it is run daily via cron. Whenever any of these mount points exceed the usage percentage stated here, the $MAIL_TEMPLATE file is used to send mail to the e-mail addresses listed in this mail template. Listing 16-11 shows the monitoring script called hdmonitor.php. Listing 16-11: hdmonitor.php #!/usr/bin/php -q <?php require_once(‘hdmonitor.conf’); require_once(‘class.Linux.inc.php’); require_once(‘common_functions.php’); $alertInfo = array(); $system = new sysinfo; $alertInfo[‘/<%HOST%>/’] = $system->chostname(); $alertInfo[‘/<%IP_ADDR%>/’] = $system->ip_addr(); $alertInfo[‘/<%KERNEL%>/’] = $system->kernel(); $alertInfo[‘/<%TODAY%>/’] = date(‘M-d-Y h:i:s A’); 588 Part IV: Using PHP for Sysadmin Tasks 21 549669 ch16.qxd 4/4/03 9:27 AM Page 588 $diskInfo = getDiskInfo($system->filesystems()); $alert = 0; foreach ($diskInfo as $mount => $currentPercent) { if (!empty($MAXSIZE[$mount]) && $MAXSIZE[$mount] <= $currentPercent ) { $alert++; $alertInfo[‘/<%DISK_STATUS%>/’] .= “Filesystem: $mount exceeds limit. “ . “Currently used: $currentPercent%\n”; if (DEBUG) echo “Filesystem: $mount exceeds limits.\n”; } } if ($alert) sendAlert($alertInfo); exit; function sendAlert($info = null) { $lines = file($GLOBALS[‘MAIL_TEMPLATE’]); $contentTypeSet = FALSE; $message = array(); $headers = array(); foreach ($lines as $str) { $index++; if (preg_match(‘/To:\s*(.+)/i’, $str, $match)) { $to = $match[1]; } else if (preg_match(‘/From:\s*(.+)/i’, $str, $match)) Continued Chapter 16: Command-Line PHP Utilities 589 21 549669 ch16.qxd 4/4/03 9:27 AM Page 589 Listing 16-11 (Continued) { array_push($headers, “From: $match[1] \r\n”); } else if (preg_match(‘/Subject:\s*(.+)/i’, $str, $match)) { $subject = $match[1]; } else if (preg_match(‘/^CC:\s*(.+)/i’, $str, $match)) { array_push($headers, “Cc: $match[1] \r\n”); } else if (preg_match(‘/Bcc:\s*(.+)/i’, $str, $match)) { array_push($headers, “Bcc: $match[1] \r\n”); } else if (preg_match(‘/Content-Type:\s*(.+)/i’, $str, $match)) { if (preg_match(‘/html/’, $match[1])) { array_push($headers, “Content-Type: text/html\r\n”); } else { array_push($headers, “Content-Type: text/plain\n”); } $contentTypeSet = TRUE; } else if (preg_match(‘/MIME-Version:\s*(.+)/i’, $str, $match)) { array_push($headers, “MIME-Version: $match[1] \r\n”); } else { array_push($message, $str); } } if (! $contentTypeSet) 590 Part IV: Using PHP for Sysadmin Tasks 21 549669 ch16.qxd 4/4/03 9:27 AM Page 590 . called hdmonitor .php. Listing 16-11: hdmonitor .php #!/usr/bin /php -q < ?php require_once(‘hdmonitor.conf’); require_once(‘class.Linux.inc .php ); require_once(‘common_functions .php ); $alertInfo. requires the classLinux.inc .php and com- mon_functions .php classes from the phpSysInfo project, which is located at http://phpsysinfo.sourceforge.net/project. Download the phpSysInfo project and you. require_once(“/usr/local/src /php/ geolocator/netgeo .php ). This will ensure that when users run geolocator from the command line, the /usr/bin/geolocator script will find the netgeo .php class. Now you and