<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7653.38">
<TITLE>AW: [rancid] fortinet problem</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>I think this prompt was for fortios version < 2<BR>
most devices are probably running on ver 3 know<BR>
and this is covered by Diegos patch<BR>
<BR>
will the patch be added to the main code?<BR>
BR<BR>
<BR>
<BR>
<BR>
-----Ursprüngliche Nachricht-----<BR>
Von: john heasley [<A HREF="mailto:heas@shrubbery.net">mailto:heas@shrubbery.net</A>]<BR>
Gesendet: Sa 02.10.2010 16:38<BR>
An: Fürtbauer Wolfgang<BR>
Cc: john heasley; rancid-discuss@shrubbery.net; diego.ercolani@ssis.sm<BR>
Betreff: Re: [rancid] fortinet problem<BR>
<BR>
Sat, Oct 02, 2010 at 08:39:40AM +0200, F?rtbauer Wolfgang:<BR>
> Dear John,<BR>
><BR>
> I finally found the patch:<BR>
> <A HREF="http://www.shrubbery.net/pipermail/rancid-discuss/2009-June/004005.html">http://www.shrubbery.net/pipermail/rancid-discuss/2009-June/004005.html</A><BR>
> and applied it (manually) against my rancid-2.3.4.<BR>
> It's working! Thanks a lot Diego!<BR>
><BR>
> Probalby this patch could be added to the main code?!<BR>
><BR>
> to answer your question John: the prompt ends with a '#' for readonly-users<BR>
> and a '$' for read-write users<BR>
<BR>
Thanks. When did this change from '->'? is there a need to support the<BR>
old prompt?<BR>
<BR>
> BR<BR>
> Wolfgang<BR>
><BR>
><BR>
><BR>
> Wolfgang F?rtbauer<BR>
> Leitung IT<BR>
><BR>
> ASAMER Holding AG<BR>
> Unterthalham Strasse 2<BR>
> 4694 Ohlsdorf<BR>
> AUSTRIA<BR>
> tel +43 50 799 - 2500<BR>
> fax +43 7612 799 - 9526<BR>
> mobile +43 664 8332326<BR>
> w.fuertbauer@asamer.at<BR>
> www.asamer.at<BR>
><BR>
><BR>
> This message is confidential. It may not be disclosed to, or used by, anyone other than the addressee. If you receive this<BR>
> message by mistake, please advise the sender.<BR>
><BR>
><BR>
><BR>
> -----Urspr?ngliche Nachricht-----<BR>
> Von: john heasley [<A HREF="mailto:heas@shrubbery.net">mailto:heas@shrubbery.net</A>]<BR>
> Gesendet: Fr 01.10.2010 17:56<BR>
> An: F?rtbauer Wolfgang<BR>
> Cc: john heasley; rancid-discuss@shrubbery.net<BR>
> Betreff: Re: [rancid] fortinet problem<BR>
> <BR>
> Fri, Oct 01, 2010 at 09:34:15AM +0200, F?rtbauer Wolfgang:<BR>
> > Dear John,<BR>
> ><BR>
> > Output of nlogin is:<BR>
> ><BR>
> > rancid@aohmonitoring01:~> nlogin <fortinet><BR>
> > <fortinet><BR>
> > spawn ssh -c 3des -x -l monitoring <fortinet><BR>
> > monitoring@<fortinet>'s password:<BR>
> > FGT50A3906508751 #<BR>
> > FGT50A3906508751 # Timeout<BR>
><BR>
> wie geht es. nlogin looks for the prompt to end with "-> "; why is it "#"<BR>
> here? ISTR someone saying that the format had changed and trying to<BR>
> understand when and under what circumstances, but not being able to verify.<BR>
><BR>
<BR>
<BR>
<BR>
Content-Description: rancid-2.3.4_fortigate_2x-3x.patch<BR>
> --- rancid-2.3.4/bin/Makefile.in 2010-10-02 08:31:22.000000000 +0200<BR>
> +++ rancid-patch/bin/Makefile.in 2010-10-02 08:29:48.000000000 +0200<BR>
> @@ -54,7 +54,7 @@<BR>
> $(srcdir)/hlogin.in $(srcdir)/hrancid.in $(srcdir)/htlogin.in \<BR>
> $(srcdir)/htrancid.in $(srcdir)/jerancid.in \<BR>
> $(srcdir)/jlogin.in $(srcdir)/jrancid.in $(srcdir)/mrancid.in \<BR>
> - $(srcdir)/mrvlogin.in $(srcdir)/mrvrancid.in \<BR>
> + $(srcdir)/mrvlogin.in $(srcdir)/mrvrancid.in $(srcdir)/fnlogin.in \<BR>
> $(srcdir)/nlogin.in $(srcdir)/nrancid.in $(srcdir)/nslogin.in \<BR>
> $(srcdir)/nsrancid.in $(srcdir)/nxrancid.in $(srcdir)/par.in \<BR>
> $(srcdir)/prancid.in $(srcdir)/rancid-fe.in \<BR>
> @@ -75,7 +75,7 @@<BR>
> arancid arrancid avologin avorancid blogin brancid cat5rancid \<BR>
> clogin rancid cssrancid elogin erancid f5rancid f10rancid \<BR>
> flogin francid fnrancid hlogin hrancid htlogin htrancid jlogin \<BR>
> - jrancid jerancid mrancid mrvlogin mrvrancid nlogin nrancid \<BR>
> + jrancid jerancid mrancid mrvlogin mrvrancid fnlogin nlogin nrancid \<BR>
> nslogin nsrancid nxrancid prancid rivlogin rivrancid rrancid \<BR>
> srancid tlogin tntlogin tntrancid trancid xrancid xrrancid \<BR>
> zrancid<BR>
> @@ -247,7 +247,7 @@<BR>
> blogin brancid cat5rancid clogin control_rancid cssrancid \<BR>
> elogin erancid f5rancid f10rancid flogin fnrancid francid \<BR>
> hlogin hrancid htlogin htrancid jerancid jlogin jrancid \<BR>
> - mrancid mrvlogin mrvrancid nlogin nrancid nslogin nsrancid \<BR>
> + mrancid mrvlogin mrvrancid fnlogin nlogin nrancid nslogin nsrancid \<BR>
> nxrancid par prancid rancid-fe rancid rivlogin rivrancid \<BR>
> rrancid srancid tlogin tntlogin tntrancid trancid xrancid \<BR>
> xrrancid zrancid lg.cgi lgform.cgi rancid-cvs rancid-run<BR>
> @@ -383,6 +383,8 @@<BR>
> cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@<BR>
> mrvrancid: $(top_builddir)/config.status $(srcdir)/mrvrancid.in<BR>
> cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@<BR>
> +fnlogin: $(top_builddir)/config.status $(srcdir)/fnlogin.in<BR>
> + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@<BR>
> nlogin: $(top_builddir)/config.status $(srcdir)/nlogin.in<BR>
> cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@<BR>
> nrancid: $(top_builddir)/config.status $(srcdir)/nrancid.in<BR>
> --- rancid-2.3.4/bin/fnlogin.in 1970-01-01 01:00:00.000000000 +0100<BR>
> +++ rancid-patch/bin/fnlogin.in 2010-10-02 08:29:48.000000000 +0200<BR>
> @@ -0,0 +1,591 @@<BR>
> +#! @EXPECT_PATH@ --<BR>
> +##<BR>
> +## $Id: fnlogin.in,v 1.51 2009/04/16 21:22:58 heas Exp $<BR>
> +## patched to accomplish fortinet from nlogin<BR>
> +## by: Daniel G. Epstein <dan at rootlike.com><BR>
> +## adapted by: Diego Ercolani <diego.ercolani at ssis.sm><BR>
> +##<BR>
> +## @PACKAGE@ @VERSION@<BR>
> +## Copyright (c) 1997-2009 by Terrapin Communications, Inc.<BR>
> +## All rights reserved.<BR>
> +##<BR>
> +## This code is derived from software contributed to and maintained by<BR>
> +## Terrapin Communications, Inc. by Henry Kilmer, John Heasley, Andrew Partan,<BR>
> +## Pete Whiting, Austin Schutz, and Andrew Fort.<BR>
> +##<BR>
> +## Redistribution and use in source and binary forms, with or without<BR>
> +## modification, are permitted provided that the following conditions<BR>
> +## are met:<BR>
> +## 1. Redistributions of source code must retain the above copyright<BR>
> +## notice, this list of conditions and the following disclaimer.<BR>
> +## 2. Redistributions in binary form must reproduce the above copyright<BR>
> +## notice, this list of conditions and the following disclaimer in the<BR>
> +## documentation and/or other materials provided with the distribution.<BR>
> +## 3. All advertising materials mentioning features or use of this software<BR>
> +## must display the following acknowledgement:<BR>
> +## This product includes software developed by Terrapin Communications,<BR>
> +## Inc. and its contributors for RANCID.<BR>
> +## 4. Neither the name of Terrapin Communications, Inc. nor the names of its<BR>
> +## contributors may be used to endorse or promote products derived from<BR>
> +## this software without specific prior written permission.<BR>
> +## 5. It is requested that non-binding fixes and modifications be contributed<BR>
> +## back to Terrapin Communications, Inc.<BR>
> +##<BR>
> +## THIS SOFTWARE IS PROVIDED BY Terrapin Communications, INC. AND CONTRIBUTORS<BR>
> +## ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED<BR>
> +## TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR<BR>
> +## PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COMPANY OR CONTRIBUTORS<BR>
> +## BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR<BR>
> +## CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF<BR>
> +## SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS<BR>
> +## INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN<BR>
> +## CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)<BR>
> +## ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE<BR>
> +## POSSIBILITY OF SUCH DAMAGE.<BR>
> +#<BR>
> +# The expect login scripts were based on Erik Sherk's gwtn, by permission.<BR>
> +#<BR>
> +# Netscreen hacks implemented by Stephen Gill <gillsr@yahoo.com>.<BR>
> +# Fortinet hacks by Daniel G. Epstein <dan at rootlike.com><BR>
> +#<BR>
> +# fnlogin - fortinet login<BR>
> +#<BR>
> +# Most options are intuitive for logging into a netscreen firewall.<BR>
> +#<BR>
> +# Misc notes<BR>
> +# netscreen does not have the concept of "enable", once logged in, a<BR>
> +# users permissions can not change.<BR>
> +<BR>
> +# Usage line<BR>
> +set usage "Usage: $argv0 \[-dSV\] \[-c command\] \[-Evar=x\] \<BR>
> +\[-f cloginrc-file\] \[-p user-password\] \<BR>
> +\[-s script-file\] \[-t timeout\] \[-u username\] \<BR>
> +\[-v vty-password\] \[-x command-file\] \<BR>
> +\[-y ssh_cypher_type\] router \[router...\]\n"<BR>
> +<BR>
> +# env(CLOGIN) may contain:<BR>
> +# x == do not set xterm banner or name<BR>
> +<BR>
> +# Password file<BR>
> +set password_file $env(HOME)/.cloginrc<BR>
> +# Default is to login to the firewall<BR>
> +set do_command 0<BR>
> +set do_script 0<BR>
> +# The default is to look in the password file to find the passwords. This<BR>
> +# tracks if we receive them on the command line.<BR>
> +set do_passwd 1<BR>
> +set do_enapasswd 1<BR>
> +# Save config, if prompted<BR>
> +set do_saveconfig 0<BR>
> +<BR>
> +# Find the user in the ENV, or use the unix userid.<BR>
> +if {[ info exists env(CISCO_USER) ]} {<BR>
> + set default_user $env(CISCO_USER)<BR>
> +} elseif {[ info exists env(USER) ]} {<BR>
> + set default_user $env(USER)<BR>
> +} elseif {[ info exists env(LOGNAME) ]} {<BR>
> + set default_user $env(LOGNAME)<BR>
> +} else {<BR>
> + # This uses "id" which I think is portable. At least it has existed<BR>
> + # (without options) on all machines/OSes I've been on recently -<BR>
> + # unlike whoami or id -nu.<BR>
> + if [ catch {exec id} reason ] {<BR>
> + send_error "\nError: could not exec id: $reason\n"<BR>
> + exit 1<BR>
> + }<BR>
> + regexp {\(([^)]*)} "$reason" junk default_user<BR>
> +}<BR>
> +if {[ info exists env(CLOGINRC) ]} {<BR>
> + set password_file $env(CLOGINRC)<BR>
> +}<BR>
> +<BR>
> +# Sometimes firewall take awhile to answer (the default is 10 sec)<BR>
> +set timeout 45<BR>
> +<BR>
> +# Process the command line<BR>
> +for {set i 0} {$i < $argc} {incr i} {<BR>
> + set arg [lindex $argv $i]<BR>
> +<BR>
> + switch -glob -- $arg {<BR>
> + # Expect debug mode<BR>
> + -d* {<BR>
> + exp_internal 1<BR>
> + # Username<BR>
> + } -u* {<BR>
> + if {! [ regexp .\[uU\](.+) $arg ignore user]} {<BR>
> + incr i<BR>
> + set username [ lindex $argv $i ]<BR>
> + }<BR>
> + # VTY Password<BR>
> + } -p* {<BR>
> + if {! [ regexp .\[pP\](.+) $arg ignore userpasswd]} {<BR>
> + incr i<BR>
> + set userpasswd [ lindex $argv $i ]<BR>
> + }<BR>
> + set do_passwd 0<BR>
> + # Environment variable to pass to -s scripts<BR>
> + } -E* {<BR>
> + if {[ regexp .\[E\](.+)=(.+) $arg ignore varname varvalue]} {<BR>
> + set E$varname $varvalue<BR>
> + } else {<BR>
> + send_user "\nError: invalid format for -E in $arg\n"<BR>
> + exit 1<BR>
> + }<BR>
> + # Command to run.<BR>
> + } -c* {<BR>
> + if {! [ regexp .\[cC\](.+) $arg ignore command]} {<BR>
> + incr i<BR>
> + set command [ lindex $argv $i ]<BR>
> + }<BR>
> + set do_command 1<BR>
> + # Expect script to run.<BR>
> + } -s* {<BR>
> + if {! [ regexp .\[sS\](.+) $arg ignore sfile]} {<BR>
> + incr i<BR>
> + set sfile [ lindex $argv $i ]<BR>
> + }<BR>
> + if { ! [ file readable $sfile ] } {<BR>
> + send_user "\nError: Can't read $sfile\n"<BR>
> + exit 1<BR>
> + }<BR>
> + set do_script 1<BR>
> + # save config on exit<BR>
> + } -S* {<BR>
> + set do_saveconfig 1<BR>
> + # cypher type<BR>
> + } -y* {<BR>
> + if {! [ regexp .\[eE\](.+) $arg ignore cypher]} {<BR>
> + incr i<BR>
> + set cypher [ lindex $argv $i ]<BR>
> + }<BR>
> + # alternate cloginrc file<BR>
> + } -f* {<BR>
> + if {! [ regexp .\[fF\](.+) $arg ignore password_file]} {<BR>
> + incr i<BR>
> + set password_file [ lindex $argv $i ]<BR>
> + }<BR>
> + } -t* {<BR>
> + incr i<BR>
> + set timeout [ lindex $argv $i ]<BR>
> + } -x* {<BR>
> + if {! [ regexp .\[xX\](.+) $arg ignore cmd_file]} {<BR>
> + incr i<BR>
> + set cmd_file [ lindex $argv $i ]<BR>
> + }<BR>
> + if [ catch {set cmd_fd [open $cmd_file r]} reason ] {<BR>
> + send_user "\nError: $reason\n"<BR>
> + exit 1<BR>
> + }<BR>
> + set cmd_text [read $cmd_fd]<BR>
> + close $cmd_fd<BR>
> + set command [join [split $cmd_text \n] \;]<BR>
> + set do_command 1<BR>
> + # Version string<BR>
> + } -V* {<BR>
> + send_user "@PACKAGE@ @VERSION@\n"<BR>
> + exit 0<BR>
> + # Does tacacs automatically enable us?<BR>
> + } -autoenable {<BR>
> + # ignore autoenable<BR>
> + } -* {<BR>
> + send_user "\nError: Unknown argument! $arg\n"<BR>
> + send_user $usage<BR>
> + exit 1<BR>
> + } default {<BR>
> + break<BR>
> + }<BR>
> + }<BR>
> +}<BR>
> +# Process firewalls...no firewalls listed is an error.<BR>
> +if { $i == $argc } {<BR>
> + send_user "\nError: $usage"<BR>
> +}<BR>
> +<BR>
> +# Only be quiet if we are running a script (it can log its output<BR>
> +# on its own)<BR>
> +if { $do_script } {<BR>
> + log_user 0<BR>
> +} else {<BR>
> + log_user 1<BR>
> +}<BR>
> +<BR>
> +#<BR>
> +# Done configuration/variable setting. Now run with it...<BR>
> +#<BR>
> +<BR>
> +# Sets Xterm title if interactive...if its an xterm and the user cares<BR>
> +proc label { host } {<BR>
> + global env<BR>
> + # if CLOGIN has an 'x' in it, don't set the xterm name/banner<BR>
> + if [info exists env(CLOGIN)] {<BR>
> + if {[string first "x" $env(CLOGIN)] != -1} { return }<BR>
> + }<BR>
> + # take host from ENV(TERM)<BR>
> + if [info exists env(TERM)] {<BR>
> + if [regexp \^(xterm|vs) $env(TERM) ignore ] {<BR>
> + send_user "\033]1;[lindex [split $host "."] 0]\a"<BR>
> + send_user "\033]2;$host\a"<BR>
> + }<BR>
> + }<BR>
> +}<BR>
> +<BR>
> +# This is a helper function to make the password file easier to<BR>
> +# maintain. Using this the password file has the form:<BR>
> +# add password sl* pete cow<BR>
> +# add password at* steve<BR>
> +# add password * hanky-pie<BR>
> +proc add {var args} { global int_$var ; lappend int_$var $args}<BR>
> +proc include {args} {<BR>
> + global env<BR>
> + regsub -all "(^{|}$)" $args {} args<BR>
> + if { [ regexp "^/" $args ignore ] == 0 } {<BR>
> + set args $env(HOME)/$args<BR>
> + }<BR>
> + source_password_file $args<BR>
> +}<BR>
> +<BR>
> +proc find {var router} {<BR>
> + upvar int_$var list<BR>
> + if { [info exists list] } {<BR>
> + foreach line $list {<BR>
> + if { [string match [lindex $line 0] $router ] } {<BR>
> + return [lrange $line 1 end]<BR>
> + }<BR>
> + }<BR>
> + }<BR>
> + return {}<BR>
> +}<BR>
> +<BR>
> +# Loads the password file. Note that as this file is tcl, and that<BR>
> +# it is sourced, the user better know what to put in there, as it<BR>
> +# could install more than just password info... I will assume however,<BR>
> +# that a "bad guy" could just as easy put such code in the clogin<BR>
> +# script, so I will leave .cloginrc as just an extention of that script<BR>
> +proc source_password_file { password_file } {<BR>
> + global env<BR>
> + if { ! [file exists $password_file] } {<BR>
> + send_user "\nError: password file ($password_file) does not exist\n"<BR>
> + exit 1<BR>
> + }<BR>
> + file stat $password_file fileinfo<BR>
> + if { [expr ($fileinfo(mode) & 007)] != 0000 } {<BR>
> + send_user "\nError: $password_file must not be world readable/writable\n"<BR>
> + exit 1<BR>
> + }<BR>
> + if [ catch {source $password_file} reason ] {<BR>
> + send_user "\nError: $reason\n"<BR>
> + exit 1<BR>
> + }<BR>
> +}<BR>
> +<BR>
> +# Log into the firewall.<BR>
> +# returns: 0 on success, 1 on failure<BR>
> +proc login { router user userpswd passwd enapasswd prompt cmethod cyphertype } {<BR>
> + global spawn_id in_proc do_command do_script sshcmd<BR>
> + set in_proc 1<BR>
> + set uprompt_seen 0<BR>
> +<BR>
> + # Telnet to the firewall & try to login.<BR>
> + set progs [llength $cmethod]<BR>
> + foreach prog [lrange $cmethod 0 end] {<BR>
> + incr progs -1<BR>
> + if [string match "telnet*" $prog] {<BR>
> + regexp {telnet(:([^[:space:]]+))*} $prog command suffix port<BR>
> + if {"$port" == ""} {<BR>
> + set retval [ catch {spawn telnet $router} reason ]<BR>
> + } else {<BR>
> + set retval [ catch {spawn telnet $router $port} reason ]<BR>
> + }<BR>
> + if { $retval } {<BR>
> + send_user "\nError: telnet failed: $reason\n"<BR>
> + return 1<BR>
> + }<BR>
> + } elseif [string match "ssh*" $prog] {<BR>
> + regexp {ssh(:([^[:space:]]+))*} $prog methcmd suffix port<BR>
> + if {"$port" == ""} {<BR>
> + set cmd [join [lindex $sshcmd 0] " "]<BR>
> + set retval [ catch {eval spawn [split "$cmd -c $cyphertype -x -l $user $router" { }]} reason ]<BR>
> + } else {<BR>
> + set cmd [join [lindex $sshcmd 0] " "]<BR>
> + set retval [ catch {eval spawn [split "$cmd -c $cyphertype -x -l $user -p $port $router" { }]} reason ]<BR>
> + }<BR>
> + if { $retval } {<BR>
> + send_user "\nError: $sshcmd failed: $reason\n"<BR>
> + return 1<BR>
> + }<BR>
> + } elseif ![string compare $prog "rsh"] {<BR>
> + send_error "\nError: unsupported method: rsh\n"<BR>
> + if { $progs == 0 } {<BR>
> + return 1<BR>
> + }<BR>
> + continue;<BR>
> + } else {<BR>
> + send_user "\nError: unknown connection method: $prog\n"<BR>
> + return 1<BR>
> + }<BR>
> +<BR>
> + sleep 0.3<BR>
> +<BR>
> + # This helps cleanup each expect clause.<BR>
> + expect_after {<BR>
> + timeout {<BR>
> + send_user "\nError: TIMEOUT reached\n"<BR>
> + catch {close}; catch {wait};<BR>
> + if { $in_proc} {<BR>
> + return 1<BR>
> + } else {<BR>
> + continue<BR>
> + }<BR>
> + } eof {<BR>
> + send_user "\nError: EOF received\n"<BR>
> + catch {close}; catch {wait};<BR>
> + if { $in_proc} {<BR>
> + return 1<BR>
> + } else {<BR>
> + continue<BR>
> + }<BR>
> + }<BR>
> + }<BR>
> +<BR>
> + # Here we get a little tricky. There are several possibilities:<BR>
> + # the firewall can ask for a username and passwd and then<BR>
> + # talk to the TACACS server to authenticate you, or if the<BR>
> + # TACACS server is not working, then it will use the enable<BR>
> + # passwd. Or, the firewall might not have TACACS turned on,<BR>
> + # then it will just send the passwd.<BR>
> + # if telnet fails with connection refused, try ssh<BR>
> + expect {<BR>
> + -re "(Connection refused|Secure connection \[^\n\r]+ refused)" {<BR>
> + catch {close}; catch {wait};<BR>
> + if !$progs {<BR>
> + send_user "\nError: Connection Refused ($prog): $router\n"<BR>
> + return 1<BR>
> + }<BR>
> + }<BR>
> + -re "(Connection closed by|Connection to \[^\n\r]+ closed)" {<BR>
> + catch {close}; catch {wait};<BR>
> + if !$progs {<BR>
> + send_user "\nError: Connection closed ($prog): $router\n"<BR>
> + return 1<BR>
> + }<BR>
> + }<BR>
> + eof { send_user "\nError: Couldn't login: $router\n"; wait; return 1 }<BR>
> + -nocase "unknown host\r" {<BR>
> + send_user "\nError: Unknown host $router\n";<BR>
> + catch {close}; catch {wait};<BR>
> + return 1<BR>
> + }<BR>
> + "Host is unreachable" {<BR>
> + send_user "\nError: Host Unreachable: $router\n";<BR>
> + catch {close}; catch {wait};<BR>
> + return 1<BR>
> + }<BR>
> + "No address associated with name" {<BR>
> + send_user "\nError: Unknown host $router\n";<BR>
> + catch {close}; catch {wait};<BR>
> + return 1<BR>
> + }<BR>
> + -re "(Host key not found |The authenticity of host .* be established).*\(yes\/no\)\?" {<BR>
> + send "yes\r"<BR>
> + send_user "\nHost $router added to the list of known hosts.\n"<BR>
> + exp_continue }<BR>
> + -re "HOST IDENTIFICATION HAS CHANGED.* \(yes\/no\)\?" {<BR>
> + send "no\r"<BR>
> + send_user "\nError: The host key for $router has changed. Update the SSH known_hosts file accordingly.\n"<BR>
> + catch {close}; catch {wait};<BR>
> + return 1<BR>
> + }<BR>
> + -re "Offending key for .* \(yes\/no\)\?" {<BR>
> + send "no\r"<BR>
> + send_user "\nError: host key mismatch for $router. Update the SSH known_hosts file accordingly.\n"<BR>
> + catch {close}; catch {wait};<BR>
> + return 1<BR>
> + }<BR>
> + -re "(denied|Sorry)" {<BR>
> + send_user "\nError: Check your passwd for $router\n"<BR>
> + catch {close}; catch {wait}; return 1<BR>
> + }<BR>
> + "Login failed" {<BR>
> + send_user "\nError: Check your passwd for $router\n";<BR>
> + catch {close}; catch {wait}; return 1<BR>
> + }<BR>
> + -re "(login:)" {<BR>
> + sleep 1;<BR>
> + send -- "$user\r"<BR>
> + set uprompt_seen 1<BR>
> + exp_continue<BR>
> + }<BR>
> + -re "@\[^\r\n]+\[Pp]assword:" {<BR>
> + # ssh pwd prompt<BR>
> + sleep 1<BR>
> + send -- "$userpswd\r"<BR>
> + exp_continue<BR>
> + }<BR>
> + "\[Pp]assword:" {<BR>
> + sleep 1;<BR>
> + if {$uprompt_seen == 1} {<BR>
> + send -- "$userpswd\r"<BR>
> + } else {<BR>
> + send -- "$passwd\r"<BR>
> + }<BR>
> + exp_continue<BR>
> + }<BR>
> + -- "$prompt" { break; }<BR>
> + }<BR>
> + }<BR>
> + set in_proc 0<BR>
> + return 0<BR>
> +}<BR>
> +<BR>
> +# Run commands given on the command line.<BR>
> +proc run_commands { prompt command } {<BR>
> + global in_proc<BR>
> + set in_proc 1<BR>
> +<BR>
> + # Disable output paging.<BR>
> + send -- "config system console\r"<BR>
> + expect -re $prompt; send -- "set output standard\r"<BR>
> + expect -re $prompt; send -- "end\r"<BR>
> + expect -re $prompt;<BR>
> +<BR>
> + set commands [split $command \;]<BR>
> + set num_commands [llength $commands]<BR>
> + for {set i 0} {$i < $num_commands} { incr i} {<BR>
> + send -- "[subst [lindex $commands $i]]\r"<BR>
> +# send_user "**************** [subst [lindex $commands $i]] ************\n"<BR>
> + expect {<BR>
> + -re "$prompt" { send "\r"<BR>
> + sleep 0.5<BR>
> + }<BR>
> + -gl "--More--" { send " "<BR>
> + exp_continue<BR>
> + -re "\[\n\r]+" { exp_continue }<BR>
> + }<BR>
> + }<BR>
> + } <BR>
> +# send_user "******* fuori da ciclo for *******\n"<BR>
> + expect {<BR>
> + -re "$prompt$" {<BR>
> + send "exit\r"<BR>
> + sleep 0.5<BR>
> + exp_continue<BR>
> + }<BR>
> + -re "\[\n\r]+" { exp_continue }<BR>
> + -gl "Configuration modified, save?" {<BR>
> + send "n\r"<BR>
> + exp_continue<BR>
> + }<BR>
> + timeout { catch {close}; catch {wait};<BR>
> + return 0<BR>
> + }<BR>
> + eof { return 0 }<BR>
> + }<BR>
> + set in_proc 0<BR>
> +}<BR>
> +<BR>
> +#<BR>
> +# For each firewall... (this is main loop)<BR>
> +#<BR>
> +source_password_file $password_file<BR>
> +set in_proc 0<BR>
> +set exitval 0<BR>
> +foreach router [lrange $argv $i end] {<BR>
> + set router [string tolower $router]<BR>
> + send_user "$router\n"<BR>
> +<BR>
> + # FortiOS 2.x prompts can end in either '#' or '$'<BR>
> + set prompt "\[#\\$] "<BR>
> +<BR>
> + # Figure out passwords<BR>
> + if { $do_passwd || $do_enapasswd } {<BR>
> + set pswd [find password $router]<BR>
> + if { [llength $pswd] == 0 } {<BR>
> + send_user "\nError: no password for $router in $password_file.\n"<BR>
> + continue<BR>
> + }<BR>
> + set passwd [join [lindex $pswd 0] ""]<BR>
> + set enapasswd [join [lindex $pswd 1] ""]<BR>
> + } else {<BR>
> + set passwd $userpasswd<BR>
> + set enapasswd $enapasswd<BR>
> + }<BR>
> +<BR>
> + # Figure out username<BR>
> + if {[info exists username]} {<BR>
> + # command line username<BR>
> + set ruser $username<BR>
> + } else {<BR>
> + set ruser [join [find user $router] ""]<BR>
> + if { "$ruser" == "" } { set ruser $default_user }<BR>
> + }<BR>
> +<BR>
> + # Figure out username's password (if different from the vty password)<BR>
> + if {[info exists userpasswd]} {<BR>
> + # command line username<BR>
> + set userpswd $userpasswd<BR>
> + } else {<BR>
> + set userpswd [join [find userpassword $router] ""]<BR>
> + if { "$userpswd" == "" } { set userpswd $passwd }<BR>
> + }<BR>
> +<BR>
> +<BR>
> + # Figure out cypher type<BR>
> + if {[info exists cypher]} {<BR>
> + # command line cypher type<BR>
> + set cyphertype $cypher<BR>
> + } else {<BR>
> + set cyphertype [find cyphertype $router]<BR>
> + if { "$cyphertype" == "" } { set cyphertype "3des" }<BR>
> + }<BR>
> +<BR>
> + # Figure out connection method<BR>
> + set cmethod [find method $router]<BR>
> + if { "$cmethod" == "" } { set cmethod {{telnet} {ssh}} }<BR>
> +<BR>
> + # Figure out the SSH executable name<BR>
> + set sshcmd [find sshcmd $router]<BR>
> + if { "$sshcmd" == "" } { set sshcmd {ssh} }<BR>
> +<BR>
> + # Login to the router<BR>
> + if {[login $router $ruser $userpswd $passwd $enapasswd $prompt $cmethod $cyphertype]} {<BR>
> + incr exitval<BR>
> + continue<BR>
> + }<BR>
> +<BR>
> + # we are logged in, now figure out the full prompt based on what the device sends us.<BR>
> + send "\r"<BR>
> + expect {<BR>
> + -re "\[\r\n]+" { exp_continue; }<BR>
> + -re "^(.+$prompt)" { set junk $expect_out(0,string); }<BR>
> + if {[$junk = "(^\\$ $)"]} {<BR>
> + set prompt $junk;<BR>
> + } else {<BR>
> + if {[$junk = "(^# $)"]} { set prompt $junk ; }<BR>
> + };<BR>
> + }<BR>
> +<BR>
> + if { $do_command } {<BR>
> + if {[run_commands $prompt $command]} {<BR>
> + incr exitval<BR>
> + continue<BR>
> + }<BR>
> + } elseif { $do_script } {<BR>
> + # Disable output paging.<BR>
> + send "config system console\r"<BR>
> + send "set output standard\r"<BR>
> + send "end\r"<BR>
> + expect -re $prompt {}<BR>
> + source $sfile<BR>
> + catch {close};<BR>
> + } else {<BR>
> + label $router<BR>
> + log_user 1<BR>
> + interact<BR>
> + }<BR>
> +<BR>
> + # End of for each firewall<BR>
> + catch {wait};<BR>
> + sleep 0.3<BR>
> +}<BR>
> +exit $exitval<BR>
> +<BR>
> --- rancid-2.3.4/bin/fnrancid.in 2010-10-02 08:31:34.000000000 +0200<BR>
> +++ rancid-patch/bin/fnrancid.in 2010-10-02 08:29:48.000000000 +0200<BR>
> @@ -48,6 +48,7 @@<BR>
> # usage: rancid [-dV] [-l] [-f filename | hostname]<BR>
> #<BR>
> use Getopt::Std;<BR>
> +use Data::Dumper;<BR>
> getopts('dflV');<BR>
> if ($opt_V) {<BR>
> print "@PACKAGE@ @VERSION@\n";<BR>
> @@ -59,10 +60,11 @@<BR>
> $file = $opt_f;<BR>
> $host = $ARGV[0];<BR>
> $found_end = 0;<BR>
> -$timeo = 90; # nlogin timeout in seconds<BR>
> +$timeo = 90; # fnlogin timeout in seconds<BR>
> <BR>
> my(@commandtable, %commands, @commands);# command lists<BR>
> my($aclsort) = ("ipsort"); # ACL sorting mode<BR>
> +$aclsort = ""; # disable sort<BR>
> my($filter_commstr); # SNMP community string filtering<BR>
> my($filter_pwds); # password filtering mode<BR>
> <BR>
> @@ -174,10 +176,35 @@<BR>
> tr/\015//d;<BR>
> next if /^\s*$/;<BR>
> last if (/$prompt/);<BR>
> -<BR>
> next if (/^System Time:/);<BR>
> next if (/^FortiClient application signature package:/);<BR>
> - ProcessHistory("","","","$_");<BR>
> + if(/^\s*(System time:) (.*)/) {<BR>
> + ProcessHistory("System time","","","$1 ****removed****");<BR>
> + #print STDERR "!$1 ****removed****\n";<BR>
> + next;<BR>
> + }<BR>
> + if(/^\s*(Virus-DB:) (.*)/) {<BR>
> + ProcessHistory("$1","","","$1 ****removed****\n");<BR>
> + #print STDERR "!$1 ****removed****\n";<BR>
> + next;<BR>
> + }<BR>
> + if(/^\s*(Extended DB:) (.*)/) {<BR>
> + ProcessHistory("$1","","","$1 ****removed****\n");<BR>
> + #print STDERR "!$1 ****removed****\n";<BR>
> + next;<BR>
> + }<BR>
> + if(/^\s*(IPS-DB:) (.*)/) {<BR>
> + ProcessHistory("$1","","","$1 ****removed****\n");<BR>
> + #print STDERR "!$1 ****removed****\n";<BR>
> + next;<BR>
> + }<BR>
> + if(/^get system status/) {<BR>
> + # sometimes compare on the console so filter out<BR>
> + next;<BR>
> + }<BR>
> + # - Comment system info in file with '!'.<BR>
> + ProcessHistory("","","","!$_");<BR>
> +<BR>
> }<BR>
> ProcessHistory("SYSTEM","","","\n");<BR>
> return(0);<BR>
> @@ -197,11 +224,22 @@<BR>
> while (<INPUT>) {<BR>
> tr/\015//d;<BR>
> next if /^\s*$/;<BR>
> + next if(/^\s*!System time:/); # System time is fortigate extraction time so remove it<BR>
> + # remove occurrances of conf_file_ver<BR>
> + if ( /^\s*(#conf_file_ver=)([0-9]+)(.*)/i && $filter_pwds >0 ) {<BR>
> + #print STDERR "removed serial number -->!$1$2$3\n";<BR>
> + ProcessHistory("conf_file_ver","","","!$1**removed**$3\n");<BR>
> + next;<BR>
> + }<BR>
> last if (/$prompt/);<BR>
> <BR>
> next if (/^conf_file_ver=/);<BR>
> - if (/(^set.*)('Enc .*')(.*)/) {<BR>
> - ProcessHistory("ENC","","","!$1 'Enc **encoding removed**' $3\n");<BR>
> + # Remove all the variability from the configuration versions<BR>
> + # if filter_pwds is enabled, filter out also variabilities between configurations<BR>
> + # password encription is different between extraction so filtering out encoding<BR>
> + if ( /^\s*(set [^\s]*)\s(Enc\s[^\s]+)(.*)/i && $filter_pwds >0 ) {<BR>
> + # print STDERR "removed password-->!$1 ENC **encoding removed** $3\n";<BR>
> + ProcessHistory("ENC","","","!$1 ENC **encoding removed**' $3\n");<BR>
> next;<BR>
> }<BR>
> ProcessHistory("","","","$_");<BR>
> @@ -216,7 +254,7 @@<BR>
> # Main<BR>
> @commandtable = (<BR>
> {'get system status' => 'GetSystem'},<BR>
> - {'get conf' => 'GetConf'}<BR>
> + {'show full-configuration' => 'GetConf'}<BR>
> );<BR>
> # Use an array to preserve the order of the commands and a hash for mapping<BR>
> # commands to the subroutine and track commands that have been completed.<BR>
> @@ -245,13 +283,13 @@<BR>
> print STDOUT "opening file $host\n" if ($log);<BR>
> open(INPUT,"<$host") || die "open failed for $host: $!\n";<BR>
> } else {<BR>
> - print STDERR "executing nlogin -t $timeo -c\"$cisco_cmds\" $host\n" if ($debug);<BR>
> - print STDOUT "executing nlogin -t $timeo -c\"$cisco_cmds\" $host\n" if ($log);<BR>
> + print STDERR "executing fnlogin -t $timeo -c\"$cisco_cmds\" $host\n" if ($debug);<BR>
> + print STDOUT "executing fnlogin -t $timeo -c\"$cisco_cmds\" $host\n" if ($log);<BR>
> if (defined($ENV{NOPIPE})) {<BR>
> - system "nlogin -t $timeo -c \"$cisco_cmds\" $host </dev/null > $host.raw 2>&1" || die "nlogin failed for $host: $!\n";<BR>
> + system "fnlogin -t $timeo -c \"$cisco_cmds\" $host </dev/null > $host.raw 2>&1" || die "nlogin failed for $host: $!\n";<BR>
> open(INPUT, "< $host.raw") || die "nlogin failed for $host: $!\n";<BR>
> } else {<BR>
> - open(INPUT,"nlogin -t $timeo -c \"$cisco_cmds\" $host </dev/null |") || die "nlogin failed for $host: $!\n";<BR>
> + open(INPUT,"fnlogin -t $timeo -c \"$cisco_cmds\" $host </dev/null |") || die "nlogin failed for $host: $!\n";<BR>
> }<BR>
> }<BR>
> <BR>
> @@ -279,14 +317,34 @@<BR>
> TOP: while(<INPUT>) {<BR>
> tr/\015//d;<BR>
> if (/^Error:/) {<BR>
> - print STDOUT ("$host nlogin error: $_");<BR>
> - print STDERR ("$host nlogin error: $_") if ($debug);<BR>
> + print STDOUT ("$host fnlogin error: $_");<BR>
> + print STDERR ("$host fnlogin error: $_") if ($debug);<BR>
> last;<BR>
> }<BR>
> - while (/>\s*($cmds_regexp)\s*$/) {<BR>
> - $cmd = $1;<BR>
> - if (!defined($prompt)) { $prompt = " >\s*"; }<BR>
> - print STDERR ("HIT COMMAND:$_") if ($debug);<BR>
> + while (/^.+(#|\$)\s*($cmds_regexp)\s*$/) {<BR>
> + $cmd = $2;<BR>
> + # - FortiGate prompts end with either '#' or '$'. Further, they may<BR>
> + # be prepended with a '~' if the hostname is too long. Therefore,<BR>
> + # we need to figure out what our prompt really is.<BR>
> + if (!defined($prompt)) {<BR>
> + if ( $_ =~ m/^.+\~\$/ ) {<BR>
> + $prompt = '\~\$ .*' ;<BR>
> + } else {<BR>
> + if ( $_ =~ m/^.+\$/ ) {<BR>
> + $prompt = ' \$ .*' ;<BR>
> + } else {<BR>
> + if ( $_ =~ m/^.+\~#/ ) {<BR>
> + $prompt = '\~# .*' ;<BR>
> + } else {<BR>
> + if ( $_ =~ m/^.+#/ ) {<BR>
> + $prompt = ' # .*' ;<BR>
> + }<BR>
> + }<BR>
> + }<BR>
> + }<BR>
> + }<BR>
> + print STDERR ("HIT COMMAND:$_") if ($debug);<BR>
> +<BR>
> if (!defined($commands{$cmd})) {<BR>
> print STDERR "$host: found unexpected command - \"$cmd\"\n";<BR>
> last TOP;<BR>
> --- rancid-2.3.4/configure 2010-10-02 08:31:58.000000000 +0200<BR>
> +++ rancid-patch/configure 2010-10-02 08:29:49.000000000 +0200<BR>
> @@ -6042,7 +6042,7 @@<BR>
> <BR>
> ac_config_files="$ac_config_files bin/flogin bin/francid"<BR>
> <BR>
> -ac_config_files="$ac_config_files bin/fnrancid"<BR>
> +ac_config_files="$ac_config_files bin/fnlogin bin/fnrancid"<BR>
> <BR>
> ac_config_files="$ac_config_files bin/hlogin bin/hrancid"<BR>
> <BR>
<BR>
<BR>
</FONT>
</P>
<BR><BR>
<FONT FACE="Arial" SIZE="2">Wolfgang</FONT> <FONT FACE="Arial" SIZE="2">Fürtbauer</FONT><BR>
<FONT FACE="Arial" SIZE="2">Leitung IT</FONT>
<BR><BR>
<IMG SRC="cid:107c-0b8b29b1@3e2f210d.01cb6253">
<BR>
<FONT FACE="Arial" SIZE="2">ASAMER Holding AG<BR>
Unterthalham Strasse 2<BR>
4694 Ohlsdorf<BR>
AUSTRIA<BR>
<FONT FACE="Arial" SIZE="2" COLOR="#808080"><STRONG>tel </STRONG></FONT> +43 50 799 - 2500<BR>
<FONT FACE="Arial" SIZE="2" COLOR="#808080"><STRONG>fax </STRONG></FONT> +43 7612 799 - 9526<BR>
<FONT FACE="Arial" SIZE="2" COLOR="#808080"><STRONG>mobile </STRONG></FONT> +43 664 8332326<BR></FONT>
<FONT FACE="Arial" SIZE="2" COLOR="#808080"><STRONG>email </STRONG></FONT> <a href="mailto:w.fuertbauer@asamer.at"><FONT FACE="Arial" SIZE="2">w.fuertbauer@asamer.at</FONT></a><BR>
<a href="http://www.asamer.at"><FONT FACE="Arial" SIZE="2" COLOR="#808080"><STRONG>www.asamer.at</STRONG></FONT></a><BR>
<BR>
<BR>
<P ALIGN="justify"><FONT FACE="Arial" COLOR="#808080" SIZE="1">This message is confidential. It may not be disclosed to, or used by, anyone other than the addressee. If you receive this
message by mistake, please advise the sender.</FONT></P></FONT>
<BR>
</BODY>
</HTML>