Compare commits

..

8 Commits

5 changed files with 944 additions and 190 deletions
+13 -13
View File
@@ -5,7 +5,7 @@
|-|-|-|-|-| |-|-|-|-|-|
|Hard Drive (SATA)|SATA|5.25" 4x Bay 3.5" Enclosure > 4x SATA SAS Card > PCIe Slot A|Yes|| |Hard Drive (SATA)|SATA|5.25" 4x Bay 3.5" Enclosure > 4x SATA SAS Card > PCIe Slot A|Yes||
|Solid State Drive (SATA)|SATA|5.25" 4x Bay 2.5" Enclosure > 4x SATA SAS Card > PCIe Slot A|Yes|| |Solid State Drive (SATA)|SATA|5.25" 4x Bay 2.5" Enclosure > 4x SATA SAS Card > PCIe Slot A|Yes||
|Solid State Drive (NVMe)|PCIe/M.2|5.25" 4x Bay NVMe Enclosure > MiniSAS to M.2 > M.2 Slot A|No| Not showing up in BIOS| |Solid State Drive (NVMe)|PCIe/M.2|5.25" 4x Bay NVMe Enclosure > MiniSAS to M.2 > M.2 Slot A|Yes||
## Erasing ## Erasing
|Storage Type|Erase Type|Method|Implementation|Implemented?| |Storage Type|Erase Type|Method|Implementation|Implemented?|
@@ -17,16 +17,16 @@
## Logging ## Logging
|Info|Location|Log To:|Implemented?|Data|Notes| |Info|Location|Log To:|Implemented?|Data|Notes|
|-|-|-|-|-|-| |-|-|-|-|-|-|
|User|- Script Input|- Ticket<br>- Logfile|No|- Username|Probably can implement as part of the kerb auth| |User|- Script Input|- Ticket<br>- Logfile|Yes|- Username|Probably can implement as part of the kerb auth|
|Wipe Details|- Script Input|- Ticket<br>- Logfile|No|- Erase Level<br>- Device Type<br>- Device|| |Wipe Details|- Script Input|- Ticket<br>- Logfile|Yes|- Erase Level<br>- Device Type<br>- Device||
|Script Output|- Terminal Output|- Logfile|No|- All script output|Via transcribing or output redirection| |Script Output|- Terminal Output|- Logfile|Yes|- All script output|Via transcribing or output redirection|
|Machine Data|- Registry|- Ticket<br>- Logfile|No|- Machine Name<br>- Domain|HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ComputerName<br><br>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters| |Machine Data|- Registry|- Ticket<br>- Logfile|Yes|- Machine Name<br>- Domain|HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ComputerName<br><br>HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters|
|Local Users|- Registry<br>- Filesystem|- Logfile|No|- Local User List|HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList<br><br>c:/Users| |Local Users|- Registry<br>- Filesystem|- Logfile|Yes|- Local User List|HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList<br><br>c:/Users|
|Domain Users|- Registry<br>- Filesystem|- Ticket<br>- Logfile|No|- Domain User List|HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList<br><br>c:/Users| |Domain Users|- Registry<br>- Filesystem|- Ticket<br>- Logfile|Yes|- Domain User List|HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList<br><br>c:/Users|
|Last Logged On User|- Registry|- Ticket<br>- Logfile|No|- Username|HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI| |Last Logged On User|- Registry|- Ticket<br>- Logfile|Yes|- Username|HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI|
|Storage Info|- Other|- Ticket<br>- Logfile|No|- Serial Number<br>- SMART Data|smartctl| |Storage Info|- Other|- Ticket<br>- Logfile|Yes|- Serial Number<br>- SMART Data|smartctl|
|System Info|- Registry|- Logfile|No|- Manufacturer<br>- Model|HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS<br>Can't actually be done offline| |System Info|- Registry|- Logfile|Yes|- Manufacturer<br>- Model|HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS<br>Can't actually be done offline|
|Misc|- Misc|- Ticket<br>- Logfile|No|- Current Time<br>- Date|| |Misc|- Misc|- Ticket<br>- Logfile|Yes|- Current Time<br>- Date||
@@ -35,6 +35,6 @@
|-|-|-|-|-| |-|-|-|-|-|
Erasure Environment|Setup Alpine Linux Environment with SquashFS/No Persistence|Lightweight Linux Distro that can be loaded into RAM and be edited.<br>Avoids wiping USB but also can be used on any machine and customized.|Yes|| Erasure Environment|Setup Alpine Linux Environment with SquashFS/No Persistence|Lightweight Linux Distro that can be loaded into RAM and be edited.<br>Avoids wiping USB but also can be used on any machine and customized.|Yes||
|Scripted Erase Tool|Write a script to guide the erase process|Allows for ease of use, and ensures consistent workflow<br>Can also tie in user auth, logging, etc|Yes|Done via bash scripting in erase_drive.sh| |Scripted Erase Tool|Write a script to guide the erase process|Allows for ease of use, and ensures consistent workflow<br>Can also tie in user auth, logging, etc|Yes|Done via bash scripting in erase_drive.sh|
|User Authentication|Implement user authentication|For Auditing, Logging, connection to network shares, etc.|No|Probably kerb auth via krb5 |User Authentication|Implement user authentication|For Auditing, Logging, connection to network shares, etc.|Yes|Probably kerb auth via krb5
|Logging|Implement logging|For auditing purposes|No|Record user, drive serial, grab user list (if windows/unix drive), grab hostname, record script inputs| |Logging|Implement logging|For auditing purposes|Yes|Record user, drive serial, grab user list (if windows/unix drive), grab hostname, record script inputs|
|Ticket Notes|Add ticket note through script|To keep keyword searchable records associated with a ticket|No|Send email to Otobo with small details such as level, hostname, serial, etc<br>Might involve policy changes for when a ticket should be created.| |Ticket Notes|Add ticket note through script|To keep keyword searchable records associated with a ticket|No|Send email to Otobo with small details such as level, hostname, serial, etc<br>Might involve policy changes for when a ticket should be created.|
Binary file not shown.
+438 -146
View File
@@ -1,124 +1,207 @@
#!/bin/bash #!/bin/bash
#!/usr/bin/env bash #!/usr/bin/env bash
## Get NetID start_time="$(date '+%Y-%m-%d_%H.%M.%S')"
## Mount \\reinstallbackups logdir=/tmp
## Start logging log="$logdir"/log_"$start_time".log
## Get Ticket Number (optional) log_x="$logdir"/log_x_"$start_time".log
### Check if Directory with Ticket Number exists exec 3>&1 1>>"$log_x" 2>&1
#### Warn User if it doesn't set -x
##
exec 3>&1 1>"$LOGFILE" 2>&1 print="false"
offline="false"
while getopts ":p:o" opt; do
case ${opt} in
p ) print="true" ;;
o ) offline="true" ;;
\? ) echo "Invalid option: -$OPTARG" ;;
: ) echo "Option -$OPTARG requires an argument." ;;
esac
done
cleanup () { loginput() {
echo "SPECIAL EXIT" echo "$*" >&3;
pcie_disable echo "[INPUT] $(date '+%H:%M:%S') $*" >> "$log";
trap - INT
kill -INT "$$"
} }
trap cleanup SIGINT logresponse() {
echo "[RESPONSE] $(date '+%H:%M:%S') $*" >> "$log";
}
loginfo() {
echo "$*" >&3;
echo "[INFO] $(date '+%H:%M:%S') $*" >> "$log";
}
logwarn() {
echo "$*" >&3;
echo "[WARNING] $(date '+%H:%M:%S') $*" >> "$log";
}
logerror() {
echo "$*" >&3;
echo "[ERROR] $(date '+%H:%M:%S') $*" >> "$log";
}
confirm_message () { confirm_message () {
local typed= local typed=
while [[ ! $typed = "$2" ]]; while [[ ! $typed = "$2" ]];
do do
echo "$1" loginput "$1"
read -r typed read -r typed
logresponse "$typed"
done done
} }
# shellcheck disable=SC2329
catch_sigint () {
logwarn "Signal Interrupt initiated. Stopping script."
cleanup
kill -INT "$$"
}
# shellcheck disable=SC2329
catch_exit () {
cleanup
kill -INT "$$"
}
# shellcheck disable=SC2329
cleanup () {
loginfo "Cleaning up."
pcie_disable
loginfo "Unmounting drives."
exec 1>/dev/null 2>&1
if [[ ! $offline = "true" ]];
then
umount "/mnt/reinstallbackups"
umount "/mnt/decs"
fi
umount /mnt/"$ticket_number"
rm /tmp/"$ticket_number"/SOFTWARE
rm /tmp/"$ticket_number"/SYSTEM
trap - EXIT
trap - INT
}
trap catch_sigint SIGINT
trap catch_exit EXIT
get_netid () { get_netid () {
netid= netid=
while [[ $netid =~ ^\s*$ ]]; while [[ $netid =~ ^\s*$ ]];
do do
echo "Enter netid: " loginput "Enter account netid: "
read -r netid read -r netid
logresponse "$netid"
if [[ $netid =~ ^\s*$ ]]; if [[ $netid =~ ^\s*$ ]];
then then
echo "Your netid cannot be blank. Enter netid: " logwarn "Your netid cannot be blank."
else else
authenticate_egr local ret_value=$(kinit "$netid"@EGR.MSU.EDU >&3; echo $?)
fi
done
clear
}
authenticate_egr (){
kinit "$netid"
local ret_value="$?"
if [[ ! $ret_value = "0" ]] if [[ ! $ret_value = "0" ]]
then then
kdestroy
netid= netid=
case $ret_value in logwarn "Error when authenticating netid $netid."
"1") else
echo "Error when authenticating. Please see above issue, and try again." clear
;; loginfo "Authenticated as user $netid."
*)
echo "Unspecified error."
;;
esac
fi fi
fi
done
} }
get_ticket () { get_ticket () {
ticket_number= ticket_number=
echo "Enter ticket number: " loginput "Enter ticket number: "
read -r ticket_number read -r ticket_number
logresponse "$ticket_number"
if [[ ! $ticket_number =~ ^\s*$ ]]; if [[ ! $ticket_number =~ ^\s*$ ]];
then then
local ret_value=$(ls | grep -q -E "^$ticket_number"; echo $?) if [[ ! $offline = "true" ]];
if [[ ! $ret_value = "0" ]];
then then
printf "WARNING: Backup does not exist in \\\\reinstallbackups\reinstallbackups\\$ticket_number!\n" mkdir -p /mnt/reinstallbackups
if ! mount -t cifs -o user="$netid",sec=krb5i "//reinstallbackups/reinstallbackups" /mnt/reinstallbackups
then
logwarn "Failed to mount reinstallbackups, cannot check ticket status."
else
if ! ls /mnt/reinstallbackups | grep -q -E "^$ticket_number"
then
logwarn "Backup does not exist in //reinstallbackups/reinstallbackups/$ticket_number!"
fi
umount /mnt/reinstallbackups
fi
fi fi
else else
sleep 1 ticket_number="UNKNWN"
logwarn "Starting with no ticket number specified."
logwarn "Cannot check for backup in //reinstallbackups/reinstallbackups."
fi fi
} }
mount_drive () { mount_remote () {
sleep 1 mkdir -p /mnt/decs
if mount -t cifs -o user="$netid",sec=krb5i "//decs/decs/support/dban_logs" /mnt/decs
then
if ! mkdir -p /mnt/decs/"$ticket_number"; then
logerror "Insufficient permissions to write in //decs/decs/support/dban_logs"
exit
else
logdir=/mnt/decs/"$ticket_number"
cp "$log" "$logdir"/log_"$ticket_number"_"$start_time".log
cp "$log_x" "$logdir"/log_x_"$ticket_number"_"$start_time".log
log="$logdir"/log_"$ticket_number"_"$start_time".log
log_x="$logdir"/log_x_"$ticket_number"_"$start_time".log
exec 1>>"$log_x" 2>&1
set -x
fi
else
logerror "Failed to mount remote DECS drive. Stopping"
exit
fi
} }
get_eraselevel () { get_eraselevel () {
eraselevel= eraselevel=
echo "What level of erase are you performing on the drive? (0 = baseline, 1 = secure erase, 2 = decommission):" loginput "What level of erase are you performing on the drive? (0 = baseline, 1 = secure erase, 2 = decommission):"
echo "Type 'help' for an explanation of each level." loginfo "Type 'help' for an explanation of each level."
read -r eraselevel read -r eraselevel
logresponse "$eraselevel"
while [[ ! $eraselevel = "0" ]] && [[ ! $eraselevel = "1" ]] && [[ ! $eraselevel = "2" ]]; while [[ ! $eraselevel = "0" ]] && [[ ! $eraselevel = "1" ]] && [[ ! $eraselevel = "2" ]];
do do
echo "$eraselevel"
if [[ $eraselevel = "help" ]]; if [[ $eraselevel = "help" ]];
then then
echo "Level 0 / Baseline: clears the partitions of the drive. Data can still be recovered but this is the optimal level for simple reuse." loginfo "Level 0 / Baseline: clears the partitions of the drive. Data can still be recovered but this is the optimal level for simple reuse."
echo "Level 1 / Secure Erase: HDD: Scrambles the data on the drive over 3 passes. SSD: Sends a signal to the drive to forget the encryption key, making it unread -rable." loginfo "Level 1 / Secure Erase: HDD: Scrambles the data on the drive over 3 passes. SSD: Sends a signal to the drive to forget the encryption key, making it unreadrable."
echo "Level 2 / decommission: Scrambles the data on the drive over 7 passes. Afterward, put the drive in the bin near the Hardware office to have it destroyed." loginfo "Level 2 / decommission: Scrambles the data on the drive over 7 passes. Afterward, put the drive in the bin near the Hardware office to have it destroyed."
else else
echo "Invalid level, correct values can be 0, 1, or 2" logwarn "Invalid level, correct values can be 0, 1, or 2"
fi fi
read -r eraselevel read -r eraselevel
logresponse "$eraselevel"
done done
} }
get_devicetype () { get_devicetype () {
devicetype= devicetype=
echo "What is the device type? (0 = HDD_SATA, 1 = SSD_NVME, 2 = SSD_SATA):" loginput "What is the device type? (0 = HDD_SATA, 1 = SSD_NVME, 2 = SSD_SATA):"
echo "Type 'help' for an explanation of each type." loginfo "Type 'help' for an explanation of each type."
read -r devicetype read -r devicetype
logresponse "$devicetype"
while [[ ! $devicetype = "0" ]] && [[ ! $devicetype = "1" ]] && [[ ! $devicetype = "2" ]]; while [[ ! $devicetype = "0" ]] && [[ ! $devicetype = "1" ]] && [[ ! $devicetype = "2" ]];
do do
if [[ $devicetype = "help" ]]; if [[ $devicetype = "help" ]];
then then
echo "HDD_SATA: Spinning disk platters on a SATA connection. Typically 3.5 in or 2.5 in." loginfo "HDD_SATA: Spinning disk platters on a SATA connection. Typically 3.5 in or 2.5 in."
echo "SSD_SATA: Solid State drive on a SATA connection. Typically 2.5 in." loginfo "SSD_SATA: Solid State drive on a SATA connection. Typically 2.5 in."
echo "SSD_NVME: Solid State drive on a M.2 connection. Looks like a small PCB." loginfo "SSD_NVME: Solid State drive on a M.2 connection. Looks like a small PCB."
else else
echo "Invalid type, correct values can be 0 = HDD_SATA, 1 = SSD_NVME, 2 = SSD_SATA." logwarn "Invalid type, correct values can be 0 = HDD_SATA, 1 = SSD_NVME, 2 = SSD_SATA."
fi fi
read -r devicetype read -r devicetype
logresponse "$devicetype"
done done
case $devicetype in case $devicetype in
"0") "0")
@@ -134,108 +217,300 @@ get_devicetype () {
;; ;;
*) *)
echo "Unspecified error." logerror "Unspecified error when getting device."
exit
;; ;;
esac esac
} }
get_device () { get_device () {
device= device=
pcie_enable echo "- - -" | sudo tee /sys/class/scsi_host/host*/scan >/dev/null
echo "Printing current attached devices..."
echo "" loginfo "Listing current attached devices..."
loginfo ""
if [[ $devicetype = "HDD_SATA" ]] || [[ $devicetype = "SSD_SATA" ]]; if [[ $devicetype = "HDD_SATA" ]] || [[ $devicetype = "SSD_SATA" ]];
then then
lsblk | grep -E '^NAME|^sd' echo 1 | sudo tee /sys/class/block/sd?/device/rescan >/dev/null
loginfo "$(lsblk -o NAME,SIZE,MODEL,VENDOR,ROTA | grep -E '^NAME|sd[a-z]')"
elif [[ $devicetype = "SSD_NVME" ]]; elif [[ $devicetype = "SSD_NVME" ]];
then then
lsblk | grep -E '^NAME|^nvme' pcie_enable
echo 1 | sudo tee /sys/class/block/nvme?/device/rescan >/dev/null
loginfo "$(lsblk -o NAME,SIZE,MODEL,VENDOR,ROTA | grep -E '^NAME|nvme[0-9]')"
fi fi
echo "" loginfo ""
echo "Which is the device from this list? (Type 'help' for help.)" loginput "Which is the device from this list? (Type 'help' for help.)"
while [[ $device =~ ^\s*$ ]]; while [[ $device =~ ^\s*$ ]];
do do
verify_device
done
}
verify_device (){
read -r device read -r device
logresponse "$device"
while [[ ! $device =~ ^sd[a-z]$ ]] && [[ ! $device =~ ^nvme0n[0-9]$ ]]; while [[ ! $device =~ ^sd[a-z]$ ]] && [[ ! $device =~ ^nvme0n[0-9]$ ]];
do do
if [[ $device = "help" ]]; if [[ $device = "help" ]];
then then
echo "The UNIX filesystem thinks of storage devices as directories, which are under /dev/" loginfo "The UNIX filesystem thinks of storage devices as directories, which are under /dev/"
echo "If you have a SATA connection, you will be looking for sd{a-z}." loginfo "If you have a SATA connection, you will be looking for sd{a-z}."
echo "If you have a NVME connection, you will be looking for nvme0n{0-9}." loginfo "If you have a NVME connection, you will be looking for nvme0n{0-9}."
else else
echo "Invalid format, device should follow naming conventions. (i.e. sd{a-z}, nvme0n{0-9})" logwarn "Invalid format, device should follow naming conventions. (i.e. sd{a-z}, nvme0n{0-9})"
fi fi
read -r device read -r device
logresponse "$device"
done done
if [[ $devicetype = "HDD_SATA" ]] || [[ $devicetype = "SSD_SATA" ]]; if [[ $devicetype = "HDD_SATA" ]] || [[ $devicetype = "SSD_SATA" ]];
then then
if [[ $device =~ ^nvme0n[0-9]$ ]]; if [[ $device =~ ^nvme0n[0-9]$ ]];
then then
echo "Device was specified to be a SATA HDD or SSD, but a NVME device was chosen." logwarn "Device was specified to be a SATA HDD or SSD, but a NVME device was chosen."
device= device=
fi fi
elif [[ $devicetype = "SSD_NVME" ]]; elif [[ $devicetype = "SSD_NVME" ]];
then then
if [[ $device =~ ^sd[a-z]$ ]]; if [[ $device =~ ^sd[a-z]$ ]];
then then
echo "Device was specified to be a NVME SSD, but a SATA device was chosen. Please ensure the device is plugged into the motherboard via PCIe slot and not SATA." logwarn "Device was specified to be a NVME SSD, but a SATA device was chosen. Please ensure the device is plugged into the motherboard via PCIe slot and not SATA."
device= device=
fi fi
fi fi
if [ -e "/dev/${device}" ]; then if [ -e /dev/"$device" ];
echo "Picking device /dev/${device}." then
else if [[ $devicetype = "HDD_SATA" ]] || [[ $devicetype = "SSD_SATA" ]];
echo "/dev/${device} does not exist, please ensure you are typing the device name correctly." then
if [[ $devicetype = "HDD_SATA" ]] && [[ $(cat /sys/block/"$device"/queue/rotational) = "0" ]];
then
logwarn "Device was specified to be a SATA HDD, but a SATA SSD device was chosen."
device= device=
elif [[ $devicetype = "SSD_SATA" ]] && [[ $(cat /sys/block/"$device"/queue/rotational) = "1" ]];
then
logwarn "Device was specified to be a SATA SSD, but a SATA HDD device was chosen."
device=
else
loginfo "Picking device /dev/$device."
fi
fi
else
logwarn "/dev/$device does not exist, please ensure you are typing the device name correctly."
device=
fi
done
}
make_infolog () {
loginfo "Reading drive to create a log."
infolog="$logdir"/info_"$ticket_number"_"$start_time".log
{
echo "DETAILS"
echo "Start Time: $start_time"
echo "NetID: $netid"
echo "Ticket number: $ticket_number"
echo ""
echo "ERASE DETAILS"
echo "Type/Device: $devicetype : $device"
echo "Erase Level: $eraselevel"
echo ""
echo "DEVICE DETAILS"
lsblk -o NAME,LABEL,PARTLABEL,FSTYPE,SIZE,MODEL,VENDOR,UUID,SERIAL | grep "NAME\|$device"
echo ""
smartctl -i -A /dev/"$device"
echo ""
echo "PARTITION DETAILS"
echo "Count: $(lsblk -n -l -o TYPE /dev/"$device" | grep -c "part")"
} >> "$infolog"
if [[ ! "$(lsblk -n -l -o TYPE /dev/"$device" | grep -c "part")" = 0 ]];
then
local fstype=
for i in $(seq 1 "$(lsblk -n -l -o TYPE /dev/"$device" | grep -c "part")");
do
fstype=$(lsblk -n -o FSTYPE /dev/"$device""$i")
loginfo "Reading $device$i : $fstype."
echo "" >> "$infolog"
echo "$device$i : $fstype" >> "$infolog"
case $fstype in
"ext4"|"ext3"|"ext2"|"xfs"|"btrfs")
mkdir -p /mnt/"$ticket_number"
if mount -t "$fstype" /dev/"$device""$i" /mnt/"$ticket_number"
then
if find /mnt/"$ticket_number" -maxdepth 3 -ipath "*/etc/os-release" | grep "."
then
loginfo "Linux install detected on $device$i."
echo "Linux install detected on $device$i." >> "$infolog"
echo "" >> "$infolog"
{
echo "LINUX DETAILS"
cat "$(find /mnt/"$ticket_number" -maxdepth 3 -ipath "*/etc/os-release")"
echo "Hostname: $(cat "$(find /mnt/"$ticket_number" -maxdepth 3 -ipath "*/etc/hostname")")"
cat "$(find /mnt/"$ticket_number" -maxdepth 3 -ipath "*/etc/passwd")" | grep -E '.+:x:[0-9]{4,}:[0-9]{4,}:.+,,,.*' | sed -E 's/.+:x:[0-9]{4,}:[0-9]{4,}:(.+),,,.*/User: \1/'
echo ""
tree -r -a -t -L 1 -D "$(find /mnt/"$ticket_number" -maxdepth 3 -type d -ipath "*/home")"
echo ""
} >> "$infolog"
else
echo "Non Linux Unix partition detected on $device$i." >> "$infolog"
loginfo "Non Linux Unix partition detected on $device$i."
tree -a -L 2 -D /mnt/"$ticket_number" >> "$infolog"
fi
umount /mnt/"$ticket_number"
else
echo "Failed to mount $device$i." >> "$infolog"
logwarn "There was an issue mounting $device$i."
fi
;;
"zfs")
echo "zfs filesystem detected, this cannot be mounted." >> "$infolog"
logwarn "zfs filesystem detected on $device$i, this cannot be mounted."
;;
"ntfs")
mkdir -p /tmp/"$ticket_number"
mkdir -p /mnt/"$ticket_number"
if mount -t "$fstype" /dev/"$device""$i" /mnt/"$ticket_number"
then
if find /mnt/"$ticket_number" -maxdepth 3 -ipath "*System32/config" -not -ipath "*Windows.old*" | grep "."
then
winpath=$(find /mnt/"$ticket_number" -maxdepth 3 -ipath "*System32/config" -not -ipath "*Windows.old*")
loginfo "Windows install detected on $device$i."
echo "Windows install detected on $device$i." >> "$infolog"
echo "" >> "$infolog"
winsoftwarepath=$(find "$winpath" -maxdepth 2 -ipath "*System32/config/SOFTWARE" -not -ipath "*Windows.old*")
winsystempath=$(find "$winpath" -maxdepth 2 -ipath "*System32/config/SYSTEM" -not -ipath "*Windows.old*")
cp "$winsoftwarepath" /tmp/"$ticket_number"/SOFTWARE
cp "$winsystempath" /tmp/"$ticket_number"/SYSTEM
CurrentVersion=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/"$ticket_number"/SOFTWARE '\Microsoft\Windows NT\CurrentVersion')
ComputerName=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SYSTEM /tmp/"$ticket_number"/SYSTEM '\ControlSet001\Control\ComputerName\ComputerName')
Parameters=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SYSTEM /tmp/"$ticket_number"/SYSTEM '\ControlSet001\Services\Tcpip\Parameters')
LogonUI=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/"$ticket_number"/SOFTWARE '\Microsoft\Windows\CurrentVersion\Authentication\LogonUI')
ProfileList=$(hivexregedit --export --unsafe-printable-strings --max-depth 2 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/"$ticket_number"/SOFTWARE '\Microsoft\Windows NT\CurrentVersion\ProfileList')
{
echo "WINDOWS DETAILS"
echo ""
echo "$ComputerName" | grep -E '"ComputerName"=str\(1\):".+"' | sed -E 's/"ComputerName"=str\(1\):"(.+)"/Host Name: \1/'
echo "$CurrentVersion" | grep -E '"DisplayVersion"=str\(1\):".+"' | sed -E 's/"DisplayVersion"=str\(1\):"(.+)"/Windows Version: \1/'
echo "$CurrentVersion" | grep -E '"CurrentBuild"=str\(1\):".+"' | sed -E 's/"CurrentBuild"=str\(1\):"(.+)"/Current Build: \1/'
echo "$CurrentVersion" | grep -E '"EditionID"=str\(1\):".+"' | sed -E 's/"EditionID"=str\(1\):"(.+)"/Windows Edition: \1/'
echo "$CurrentVersion" | grep -E '"ProductName"=str\(1\):".+"' | sed -E 's/"ProductName"=str\(1\):"(.+)"/Product Name: \1/'
echo "$CurrentVersion" | grep -E '"RegisteredOrganization"=str\(1\):".+"' | sed -E 's/"RegisteredOrganization"=str\(1\):"(.+)"/Registered Organization: \1/'
echo "$CurrentVersion" | grep -E '"RegisteredOwner"=str\(1\):".+"' | sed -E 's/"RegisteredOwner"=str\(1\):"(.+)"/Registered Owner: \1/'
echo "$Parameters" | grep -E '"Domain"=str\(1\):".+"' | sed -E 's/"Domain"=str\(1\):"(.+)"/Domain: \1/'
echo "$LogonUI" | grep -E '"LastLoggedOnUser"=str\(1\):".+"' | sed -E 's/"LastLoggedOnUser"=str\(1\):"(.+)"/Last Logged On User: \1/'
echo "$LogonUI" | grep -E '"LastLoggedOnDisplayName"=str\(1\):".+"' | sed -E 's/"LastLoggedOnDisplayName"=str\(1\):"(.+)"/Last Logged On User: \1/'
echo "$ProfileList" | grep -E '"ProfileImagePath"=str\(2\):".+"' | sed -E 's/"ProfileImagePath"=str\(2\):"(.+)"/User: \1/'
echo ""
if find /mnt/UNKNWN -maxdepth 2 -type d -ipath "*/Users" -not -ipath "*Windows.old*" | grep "."
then
tree -r -a -t -L 1 -D "$(find /mnt/UNKNWN/ -maxdepth 2 -type d -ipath "*/Users" -not -ipath "*Windows.old*" | head -1)"
fi
if find /mnt/UNKNWN -maxdepth 2 -type d -ipath "*/Documents and Settings" -not -ipath "*Windows.old*" | grep "."
then
tree -r -a -t -L 1 -D "$(find /mnt/UNKNWN/ -maxdepth 2 -type d -ipath "*/Documents and Settings" -not -ipath "*Windows.old*" | head -1)"
fi
echo ""
} >> "$infolog"
rm /tmp/"$ticket_number"/SOFTWARE
rm /tmp/"$ticket_number"/SYSTEM
else
loginfo "Non Windows NTFS partition detected on $device$i."
echo "Non Windows NTFS partition detected on $device$i." >> "$infolog"
tree -a -L 2 -D /mnt/"$ticket_number" >> "$infolog"
fi
umount /mnt/"$ticket_number"
else
echo "Failed to mount $device$i." >> "$infolog"
logwarn "There was an issue mounting $device$i."
fi
;;
"apfs")
mkdir -p /mnt/"$ticket_number"
loginfo "Apple install detected on $device$i."
echo "Apple install detected on $device$i." >> "$infolog"
if mount -t "$fstype" /dev/"$device""$i" /mnt/"$ticket_number"
then
echo "¯\_(ツ)_/¯" >> "$infolog"
tree -a -L 1 -D /mnt/"$ticket_number"/Users >> "$infolog"
umount /mnt/"$ticket_number"
else
echo "Failed to mount $device$i." >> "$infolog"
logwarn "There was an issue mounting $device$i."
fi
;;
"vfat"|"fat32")
loginfo "Boot/Recovery partition detected."
echo "Boot/Recovery partition detected." >> "$infolog"
mkdir -p /mnt/"$ticket_number"
if mount -t "$fstype" /dev/"$device""$i" /mnt/"$ticket_number"
then
tree -a -R -D /mnt/"$ticket_number" >> "$infolog"
umount /mnt/"$ticket_number"
else
echo "Failed to mount $device$i." >> "$infolog"
logwarn "There was an issue mounting $device$i."
fi
;;
*)
logwarn "Unknown partition type '$fstype'."
echo "Unknown partition type '$fstype'." >> "$infolog"
;;
esac
done
else
logwarn "No partitions detected, device is likely empty."
fi
echo "END OF LOG" >> "$infolog"
if [[ $print = "true" ]];
then
echo "" >&3
cat "$infolog" >&3
echo "" >&3
fi fi
} }
erase_device_lv0 () { erase_device_lv0 () {
echo "Wiping partition tables of ${devicetype} : ${device}." loginfo "Wiping partition tables of $devicetype : $device."
local ret_value=$(sgdisk -g -Z /dev/"$device" &> /dev/null; echo $?) local ret_value=$(sgdisk -g -Z /dev/"$device" &> /dev/null; echo $?)
if [[ ! $ret_value = "0" ]] if [[ ! $ret_value = "0" ]]
then then
case $ret_value in case $ret_value in
"1") "1")
echo "There was an issue with the argument. Ensure you typed the drive name correctly." logerror "There was an issue with the argument. Ensure you typed the drive name correctly."
;; ;;
"2") "2")
echo "An error occurred while read -ring the partition table." logerror "An error occurred while reading the partition table."
;; ;;
"3") "3")
echo "Non-GPT disk detected and no -g option, but operation requires a write action." logerror "Non-GPT disk detected and no -g option, but operation requires a write action."
;; ;;
"4") "4")
echo "An error prevented saving changes." logerror "An error prevented saving changes."
;; ;;
"5") "5")
echo "An error occurred while read -ring standard input." logerror "An error occurred while readring standard input."
;; ;;
"8") "8")
echo "Disk replication operation (-R) failed." logerror "Disk replication operation (-R) failed."
;; ;;
*) *)
echo "Unspecified error." logerror "Unspecified error."
;; ;;
esac esac
exit
else else
echo "Partition tables wiped. Device is read -ry for reuse." loginfo "Partition tables wiped. Device is ready for reuse."
fi fi
} }
@@ -245,135 +520,137 @@ erase_device_lv1 () {
#SSD NVMe = nvme secure erase #SSD NVMe = nvme secure erase
if [[ $devicetype = "HDD_SATA" ]] && [[ ! $eraselevel = "2" ]]; if [[ $devicetype = "HDD_SATA" ]] && [[ ! $eraselevel = "2" ]];
then then
echo "Running 3-Pass DOD Short on ${devicetype} : ${device}." loginfo "Running 3-Pass DOD Short on ${devicetype} : ${device}."
echo "This may take a while!" loginfo "This may take a while!"
local ret_value=$(nwipe -m dodshort --autonuke --nogui /dev/"$device" &> /dev/null; echo $?) local ret_value=$(nwipe -m dodshort --autonuke --nogui /dev/"$device" &> /dev/null; echo $?)
if [[ ! $ret_value = "0" ]] if [[ ! $ret_value = "0" ]]
then then
case $ret_value in case $ret_value in
"-1") "-1")
echo "Unspecified error while nwiping disk." logerror "Unspecified error while nwiping disk."
;; ;;
*) *)
echo "Unspecified error while nwiping disk." logerror "Unspecified error while nwiping disk."
;; ;;
esac esac
exit
else else
echo "Finished wiping data with nwipe." loginfo "Finished wiping data with nwipe."
fi fi
elif [[ $devicetype = "SSD_SATA" ]]; elif [[ $devicetype = "SSD_SATA" ]];
then then
echo "Running hdparm format on ${devicetype} : ${device}." loginfo "Running hdparm format on $devicetype : $device."
echo "Setting security pass to NULL." loginfo "Setting security pass to NULL."
#Set the password of the drive to NULL #Set the password of the drive to NULL
local ret_value=$(hdparm --user-master m --security-set-pass NULL /dev/"$device" &> /dev/null; echo $?) local ret_value=$(hdparm --user-master m --security-set-pass NULL /dev/"$device" &> /dev/null; echo $?)
if [[ ! $ret_value = "0" ]]; if [[ ! $ret_value = "0" ]];
then then
hdparm_check_error "${ret_value}" hdparm_check_error "$ret_value"
echo "Failed to set password of drive. Attempting to continue." logwarn "Failed to set password of drive. Attempting to continue."
else else
echo "Set password of drive to NULL." loginfo "Set password of drive to NULL."
fi fi
#Attempt a secure erase. #Attempt a secure erase.
local ret_value=$(hdparm --user-master m --security-erase-enhanced NULL /dev/"$device" &> /dev/null; echo $?) local ret_value=$(hdparm --user-master m --security-erase-enhanced NULL /dev/"$device" &> /dev/null; echo $?)
if [[ ! $ret_value = "0" ]]; if [[ ! $ret_value = "0" ]];
then then
hdparm_check_error "${ret_value}" hdparm_check_error "$ret_value"
else logwarn "Enhanced Secure Erase failed. This is not unexpected depending on the drive type."
echo "Enhanced secure erase failed. This is not unexpected depending on the drive type." loginfo "Attempting Secure Erase instead."
echo "Attempting normal erase instead."
#Attempt a secure erase, less enhanced. #Attempt a secure erase, less enhanced.
local ret_value=$(hdparm --user-master m --security-erase NULL /dev/"$device" &> /dev/null; echo $?) local ret_value2=$(hdparm --user-master m --security-erase NULL /dev/"$device" &> /dev/null; echo $?)
if [[ ! $ret_value2 = "0" ]];
if [[ ! $ret_value = "0" ]];
then then
hdparm_check_error "${ret_value}" hdparm_check_error "$ret_value2"
logerror "Failed to Secure Erase. Please contact your supervisor."
exit
else else
echo "Failed to secure erase. Please contact your supervisor." loginfo "Secure Erase success."
fi fi
else
loginfo "Enhanced Secure Erase success."
fi fi
elif [[ $devicetype = "SSD_NVME" ]]; elif [[ $devicetype = "SSD_NVME" ]];
then then
echo "Running nvme_cli format on ${devicetype} : ${device}." loginfo "Running nvme_cli format on $devicetype : $device."
#Erase using nvme cli to send secure erase command to drop the crypto stuff. #Erase using nvme cli to send secure erase command to drop the crypto stuff.
local ret_value=$(nvme format --force -r -s 2 /dev/"$device" &> /dev/null; echo $?) local ret_value=$(nvme format --force -r -s 2 /dev/"$device" &> /dev/null; echo $?)
if [[ ! $ret_value = "0" ]] if [[ ! $ret_value = "0" ]]
then then
echo "Failed to cryptographically erase drive, blanket erasing instead." logwarn "Failed to cryptographically erase drive, blanket erasing instead."
#Sad, can't do it. Blank out drive instead using the drive controller. #Sad, can't do it. Blank out drive instead using the drive controller.
local ret_value=$(nvme format --force -r -s 1 /dev/"$device" &> /dev/null; echo $?) local ret_value=$(nvme format --force -r -s 1 /dev/"$device" &> /dev/null; echo $?)
if [[ ! $ret_value = "0" ]] if [[ ! $ret_value = "0" ]]
then then
echo "Failed to cryptographically erase or blanket erase. Please contact your supervisor." logerror "Failed to cryptographically erase or blanket erase. Please contact your supervisor."
exit
else else
echo "Blanket erased drive." loginfo "Blanket erased drive."
fi fi
else else
echo "Cryptographically erased drive." loginfo "Cryptographically erased drive."
fi fi
else else
echo "There was an issue with the device type: ${devicetype}. Ensure you typed the drive name correctly." logerror "There was an issue with the device type: $devicetype. Ensure you typed the drive name correctly."
exit
fi fi
} }
erase_device_lv2 () { erase_device_lv2 () {
#7-Pass DOD Wipe through nwipe. #7-Pass DOD Wipe through nwipe.
echo "Running 7-Pass DOD on ${devicetype} : ${device}." loginfo "Running 7-Pass DOD on $devicetype : $device."
echo "This may take a while!" loginfo "This may take a while!"
local ret_value=$(nwipe -m dod --autonuke --nogui /dev/"$device" &> /dev/null; echo $?) local ret_value=$(nwipe -m dod --autonuke --nogui /dev/"$device" &> /dev/null; echo $?)
if [[ ! $ret_value = "0" ]] if [[ ! $ret_value = "0" ]]
then then
case $ret_value in case $ret_value in
"-1") "-1")
echo "Unspecified error while nwiping disk." logerror "Unspecified error while nwiping disk."
;; ;;
*) *)
echo "Unspecified error while nwiping disk." logerror "Unspecified error while nwiping disk."
;; ;;
esac esac
exit
else else
echo "Finished wiping data with nwipe." loginfo "Finished wiping data with nwipe."
echo "Please put device in decommission bin in the hardware room." loginfo "Please put device in decommission bin in the hardware room."
fi fi
} }
hdparm_check_error () { hdparm_check_error () {
case $1 in case $1 in
"1") "1")
echo "Operation not permitted." logerror "Operation not permitted."
;; ;;
"2") "2")
echo "No such file or directory." logerror "No such file or directory."
;; ;;
"5") "5")
echo "I/O error." logerror "I/O error."
;; ;;
"16") "16")
echo "Device or resource busy." logerror "Device or resource busy."
;; ;;
"22") "22")
echo "Invalid argument." logerror "Invalid argument."
;; ;;
*) *)
echo "Unspecified error." logerror "Unspecified error."
;; ;;
esac esac
} }
@@ -381,41 +658,55 @@ hdparm_check_error () {
#Rescan for PCIe devices #Rescan for PCIe devices
pcie_enable (){ pcie_enable (){
echo 1 > /sys/bus/pci/rescan echo 1 > /sys/bus/pci/rescan
echo "Enabled PCIe card, sleeping for 5 seconds." loginfo "Enabled PCIe card, sleeping for 5 seconds."
sleep 5 sleep 5
} }
#Remove the PCIe NVMe read -rer #Remove the PCIe NVMe readrer
# shellcheck disable=SC2329
pcie_disable (){ pcie_disable (){
echo 1 > /sys/bus/pci/devices/0000:02:00.0/remove echo 1 > /sys/bus/pci/devices/0000:02:00.0/remove
echo "Disabled PCIe card." echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove
loginfo "Disabled PCIe card."
} }
main (){ main (){
if [[ ! $offline = "true" ]];
then
get_netid get_netid
get_ticket_number loginfo ""
check_backup fi
echo "By running this script, you are confirming that it has been two weeks past the date written on the slip attached to the storage device. DO NOT erase the device before two weeks have passed." get_ticket
loginfo ""
confirm_message "Please type 'confirm' to acknowledge you have read -r this and that it has been two weeks." "confirm" if [[ ! $offline = "true" ]];
then
mount_remote
loginfo ""
fi
get_eraselevel #sets $eraselevel to 0-2 based on how to erase. Higher levels include lower levels. get_eraselevel #sets $eraselevel to 0-2 based on how to erase. Higher levels include lower levels.
loginfo ""
get_devicetype #sets $devicetype to HDD_SATA/SSD_SATA/SSD_NVME get_devicetype #sets $devicetype to HDD_SATA/SSD_SATA/SSD_NVME
loginfo ""
get_device #sets $device to one of the /dev/xyz devices. get_device #sets $device to one of the /dev/xyz devices.
loginfo ""
clear make_infolog #Logs a bunch of details to a info log file from the system.
loginfo ""
echo "Starting process for erasing ${devicetype} : ${device} with erase level ${eraselevel}." loginfo "Starting process for erasing $devicetype : $device with erase level $eraselevel."
if [[ $eraselevel = "1" ]] || [[ $eraselevel = "2" ]]; if [[ $eraselevel = "1" ]] || [[ $eraselevel = "2" ]];
then then
local randomconf=$(shuf -i 10000-99999 -n 1) local randomconf=$(shuf -i 10000-99999 -n 1)
confirm_message "This level is destructive and irreversible. Please type ${randomconf} to continue" "${randomconf}" confirm_message "This level is destructive and irreversible. Please type $randomconf to continue" "$randomconf"
else else
confirm_message "Please type 'confirm' to begin." "confirm" confirm_message "Please type 'confirm' to begin." "confirm"
fi fi
loginfo ""
case $eraselevel in case $eraselevel in
"0") "0")
@@ -428,21 +719,22 @@ main (){
;; ;;
"2") "2")
erase_device_lv1 #Secure Erase (skips nwipe) erase_device_lv1 #Secure Erase (skips nwipe for HDDs)
erase_device_lv2 #7-Pass nwipe erase_device_lv2 #7-Pass nwipe
erase_device_lv0 #Wipe partition erase_device_lv0 #Wipe partition
;; ;;
*) *)
echo "Invalid Erase Level" logerror "Invalid Erase Level"
exit
;; ;;
esac esac
sleep 3 loginfo ""
loginfo "Finished erasing $devicetype : $device with erase level $eraselevel."
loginfo ""
echo "Finished erasing ${devicetype} : ${device} with erase level ${eraselevel}." cleanup
pcie_disable
} }
main main
+443
View File
@@ -0,0 +1,443 @@
#!/bin/bash
#!/usr/bin/env bash
start_time="$(date '+%Y-%m-%d_%H.%M.%S')"
logdir=/tmp
log="$logdir"/log_"$start_time".log
log_x="$logdir"/log_x_"$start_time".log
exec 3>&1 1>>"$log_x" 2>&1
set -x
logtofile="false"
while getopts ":l" opt; do
case ${opt} in
l ) logtofile="true" ;;
\? ) echo "Invalid option: -$OPTARG" ;;
: ) echo "Option -$OPTARG requires an argument." ;;
esac
done
loginput() {
echo "$*" >&3;
echo "[INPUT] $(date '+%H:%M:%S') $*" >> "$log";
}
logresponse() {
echo "[RESPONSE] $(date '+%H:%M:%S') $*" >> "$log";
}
loginfo() {
echo "$*" >&3;
echo "[INFO] $(date '+%H:%M:%S') $*" >> "$log";
}
logwarn() {
echo "$*" >&3;
echo "[WARNING] $(date '+%H:%M:%S') $*" >> "$log";
}
logerror() {
echo "$*" >&3;
echo "[ERROR] $(date '+%H:%M:%S') $*" >> "$log";
}
# shellcheck disable=SC2329
catch_sigint () {
logwarn "Signal Interrupt initiated. Stopping script."
cleanup
kill -INT "$$"
}
# shellcheck disable=SC2329
catch_exit () {
cleanup
kill -INT "$$"
}
# shellcheck disable=SC2329
cleanup () {
loginfo "Cleaning up."
pcie_disable
loginfo "Unmounting drives."
exec 1>/dev/null 2>&1
if [[ $logtofile = "true" ]];
then
umount "/mnt/decs"
fi
umount "/mnt/UNKNWN"
rm /tmp/UNKNWN/SOFTWARE
rm /tmp/UNKNWN/SYSTEM
trap - EXIT
trap - INT
}
trap catch_sigint SIGINT
trap catch_exit EXIT
get_netid () {
netid=
while [[ $netid =~ ^\s*$ ]];
do
loginput "Enter netid: "
read -r netid
logresponse "$netid"
if [[ $netid =~ ^\s*$ ]];
then
logwarn "Your netid cannot be blank."
else
local ret_value=$(kinit "$netid"@EGR.MSU.EDU >&3; echo $?)
if [[ ! $ret_value = "0" ]]
then
kdestroy
netid=
logwarn "Error when authenticating netid $netid."
else
clear
loginfo "Authenticated as user $netid."
fi
fi
done
}
mount_remote () {
mkdir -p /mnt/decs
if mount -t cifs -o user="$netid",sec=krb5i "//decs/decs/support/dban_logs" /mnt/decs
then
if ! mkdir -p /mnt/decs/UNKNWN; then
logerror "Insufficient permissions to write in //decs/decs/support/dban_logs"
exit
else
logdir=/mnt/decs/UNKNWN
cp "$log" "$logdir"/log_UNKNWN_"$start_time".log
cp "$log_x" "$logdir"/log_x_UNKNWN_"$start_time".log
log="$logdir"/log_UNKNWN_"$start_time".log
log_x="$logdir"/log_x_UNKNWN_"$start_time".log
exec 1>>"$log_x" 2>&1
set -x
fi
else
logerror "Failed to mount remote DECS drive. Stopping"
exit
fi
}
get_devicetype () {
devicetype=
loginput "What is the device type? (0 = HDD_SATA, 1 = SSD_NVME, 2 = SSD_SATA):"
loginfo "Type 'help' for an explanation of each type."
read -r devicetype
logresponse "$devicetype"
while [[ ! $devicetype = "0" ]] && [[ ! $devicetype = "1" ]] && [[ ! $devicetype = "2" ]];
do
if [[ $devicetype = "help" ]];
then
loginfo "HDD_SATA: Spinning disk platters on a SATA connection. Typically 3.5 in or 2.5 in."
loginfo "SSD_SATA: Solid State drive on a SATA connection. Typically 2.5 in."
loginfo "SSD_NVME: Solid State drive on a M.2 connection. Looks like a small PCB."
else
logwarn "Invalid type, correct values can be 0 = HDD_SATA, 1 = SSD_NVME, 2 = SSD_SATA."
fi
read -r devicetype
logresponse "$devicetype"
done
case $devicetype in
"0")
devicetype="HDD_SATA"
;;
"1")
devicetype="SSD_NVME"
;;
"2")
devicetype="SSD_SATA"
;;
*)
logerror "Unspecified error when getting device."
exit
;;
esac
}
get_device () {
device=
echo "- - -" | sudo tee /sys/class/scsi_host/host*/scan >/dev/null
loginfo "Listing current attached devices..."
loginfo ""
if [[ $devicetype = "HDD_SATA" ]] || [[ $devicetype = "SSD_SATA" ]];
then
echo 1 | sudo tee /sys/class/block/sd?/device/rescan >/dev/null
loginfo "$(lsblk -o NAME,SIZE,MODEL,VENDOR,ROTA | grep -E '^NAME|sd[a-z]')"
elif [[ $devicetype = "SSD_NVME" ]];
then
pcie_enable
echo 1 | sudo tee /sys/class/block/nvme?/device/rescan >/dev/null
loginfo "$(lsblk -o NAME,SIZE,MODEL,VENDOR,ROTA | grep -E '^NAME|nvme[0-9]')"
fi
loginfo ""
loginput "Which is the device from this list? (Type 'help' for help.)"
while [[ $device =~ ^\s*$ ]];
do
read -r device
logresponse "$device"
while [[ ! $device =~ ^sd[a-z]$ ]] && [[ ! $device =~ ^nvme0n[0-9]$ ]];
do
if [[ $device = "help" ]];
then
loginfo "The UNIX filesystem thinks of storage devices as directories, which are under /dev/"
loginfo "If you have a SATA connection, you will be looking for sd{a-z}."
loginfo "If you have a NVME connection, you will be looking for nvme0n{0-9}."
else
logwarn "Invalid format, device should follow naming conventions. (i.e. sd{a-z}, nvme0n{0-9})"
fi
read -r device
logresponse "$device"
done
if [[ $devicetype = "HDD_SATA" ]] || [[ $devicetype = "SSD_SATA" ]];
then
if [[ $device =~ ^nvme0n[0-9]$ ]];
then
logwarn "Device was specified to be a SATA HDD or SSD, but a NVME device was chosen."
device=
fi
elif [[ $devicetype = "SSD_NVME" ]];
then
if [[ $device =~ ^sd[a-z]$ ]];
then
logwarn "Device was specified to be a NVME SSD, but a SATA device was chosen. Please ensure the device is plugged into the motherboard via PCIe slot and not SATA."
device=
fi
fi
if [ -e /dev/"$device" ];
then
if [[ $devicetype = "HDD_SATA" ]] || [[ $devicetype = "SSD_SATA" ]];
then
if [[ $devicetype = "HDD_SATA" ]] && [[ $(cat /sys/block/"$device"/queue/rotational) = "0" ]];
then
logwarn "Device was specified to be a SATA HDD, but a SATA SSD device was chosen."
device=
elif [[ $devicetype = "SSD_SATA" ]] && [[ $(cat /sys/block/"$device"/queue/rotational) = "1" ]];
then
logwarn "Device was specified to be a SATA SSD, but a SATA HDD device was chosen."
device=
else
loginfo "Picking device /dev/$device."
fi
fi
else
logwarn "/dev/$device does not exist, please ensure you are typing the device name correctly."
device=
fi
done
}
make_infolog () {
loginfo "Reading drive to create a log."
infolog="$logdir"/info_UNKNWN_"$start_time".log
{
echo "DETAILS"
echo "Start Time: $start_time"
echo "NetID: $netid"
echo "Type/Device: $devicetype : $device"
echo ""
echo "DEVICE DETAILS"
lsblk -o NAME,LABEL,PARTLABEL,FSTYPE,SIZE,MODEL,VENDOR,UUID,SERIAL | grep "NAME\|$device"
echo ""
smartctl -i -A /dev/"$device"
echo ""
echo "PARTITION DETAILS"
echo "Count: $(lsblk -n -l -o TYPE /dev/"$device" | grep -c "part")"
} >> "$infolog"
if [[ ! "$(lsblk -n -l -o TYPE /dev/"$device" | grep -c "part")" = 0 ]];
then
local fstype=
for i in $(seq 1 "$(lsblk -n -l -o TYPE /dev/"$device" | grep -c "part")");
do
fstype=$(lsblk -n -o FSTYPE /dev/"$device""$i")
loginfo "Reading $device$i : $fstype."
echo "" >> "$infolog"
echo "$device$i : $fstype" >> "$infolog"
case $fstype in
"ext4"|"ext3"|"ext2"|"xfs"|"btrfs")
mkdir -p /mnt/UNKNWN
if mount -t "$fstype" /dev/"$device""$i" /mnt/UNKNWN
then
if find /mnt/UNKNWN -maxdepth 3 -ipath "*/etc/os-release" | grep "."
then
loginfo "Linux install detected on $device$i."
echo "Linux install detected on $device$i." >> "$infolog"
echo "" >> "$infolog"
{
echo "LINUX DETAILS"
cat "$(find /mnt/UNKNWN -maxdepth 3 -ipath "*/etc/os-release")"
echo "Hostname: $(cat "$(find /mnt/UNKNWN -maxdepth 3 -ipath "*/etc/hostname")")"
cat "$(find /mnt/UNKNWN -maxdepth 3 -ipath "*/etc/passwd")" | grep -E '.+:x:[0-9]{4,}:[0-9]{4,}:.+,,,.*' | sed -E 's/.+:x:[0-9]{4,}:[0-9]{4,}:(.+),,,.*/User: \1/'
echo ""
tree -r -a -t -L 1 -D "$(find /mnt/UNKNWN -maxdepth 3 -type d -ipath "*/home")"
echo ""
} >> "$infolog"
else
echo "Non Linux Unix partition detected on $device$i." >> "$infolog"
loginfo "Non Linux Unix partition detected on $device$i."
tree -a -L 2 -D /mnt/UNKNWN/ >> "$infolog"
fi
umount /mnt/UNKNWN
else
echo "Failed to mount $device$i." >> "$infolog"
logwarn "There was an issue mounting $device$i."
fi
;;
"zfs")
echo "zfs filesystem detected, this cannot be mounted." >> "$infolog"
logwarn "zfs filesystem detected on $device$i, this cannot be mounted."
;;
"ntfs")
mkdir -p /tmp/UNKNWN
mkdir -p /mnt/UNKNWN
if mount -t "$fstype" /dev/"$device""$i" /mnt/UNKNWN
then
if find /mnt/UNKNWN -maxdepth 3 -ipath "*System32/config" -not -ipath "*Windows.old*" | grep "."
then
winpath=$(find /mnt/UNKNWN -maxdepth 3 -ipath "*System32/config" -not -ipath "*Windows.old*")
loginfo "Windows install detected on $device$i."
echo "Windows install detected on $device$i." >> "$infolog"
echo "" >> "$infolog"
winsoftwarepath=$(find "$winpath" -maxdepth 2 -ipath "*System32/config/SOFTWARE" -not -ipath "*Windows.old*")
winsystempath=$(find "$winpath" -maxdepth 2 -ipath "*System32/config/SYSTEM" -not -ipath "*Windows.old*")
cp "$winsoftwarepath" /tmp/UNKNWN/SOFTWARE
cp "$winsystempath" /tmp/UNKNWN/SYSTEM
CurrentVersion=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/UNKNWN/SOFTWARE '\Microsoft\Windows NT\CurrentVersion')
ComputerName=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SYSTEM /tmp/UNKNWN/SYSTEM '\ControlSet001\Control\ComputerName\ComputerName')
Parameters=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SYSTEM /tmp/UNKNWN/SYSTEM '\ControlSet001\Services\Tcpip\Parameters')
LogonUI=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/UNKNWN/SOFTWARE '\Microsoft\Windows\CurrentVersion\Authentication\LogonUI')
ProfileList=$(hivexregedit --export --unsafe-printable-strings --max-depth 2 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/UNKNWN/SOFTWARE '\Microsoft\Windows NT\CurrentVersion\ProfileList')
{
echo "WINDOWS DETAILS"
echo ""
echo "$ComputerName" | grep -E '"ComputerName"=str\(1\):".+"' | sed -E 's/"ComputerName"=str\(1\):"(.+)"/Host Name: \1/'
echo "$CurrentVersion" | grep -E '"DisplayVersion"=str\(1\):".+"' | sed -E 's/"DisplayVersion"=str\(1\):"(.+)"/Windows Version: \1/'
echo "$CurrentVersion" | grep -E '"CurrentBuild"=str\(1\):".+"' | sed -E 's/"CurrentBuild"=str\(1\):"(.+)"/Current Build: \1/'
echo "$CurrentVersion" | grep -E '"EditionID"=str\(1\):".+"' | sed -E 's/"EditionID"=str\(1\):"(.+)"/Windows Edition: \1/'
echo "$CurrentVersion" | grep -E '"ProductName"=str\(1\):".+"' | sed -E 's/"ProductName"=str\(1\):"(.+)"/Product Name: \1/'
echo "$CurrentVersion" | grep -E '"RegisteredOrganization"=str\(1\):".+"' | sed -E 's/"RegisteredOrganization"=str\(1\):"(.+)"/Registered Organization: \1/'
echo "$CurrentVersion" | grep -E '"RegisteredOwner"=str\(1\):".+"' | sed -E 's/"RegisteredOwner"=str\(1\):"(.+)"/Registered Owner: \1/'
echo "$Parameters" | grep -E '"Domain"=str\(1\):".+"' | sed -E 's/"Domain"=str\(1\):"(.+)"/Domain: \1/'
echo "$LogonUI" | grep -E '"LastLoggedOnUser"=str\(1\):".+"' | sed -E 's/"LastLoggedOnUser"=str\(1\):"(.+)"/Last Logged On User: \1/'
echo "$LogonUI" | grep -E '"LastLoggedOnDisplayName"=str\(1\):".+"' | sed -E 's/"LastLoggedOnDisplayName"=str\(1\):"(.+)"/Last Logged On User: \1/'
echo "$ProfileList" | grep -E '"ProfileImagePath"=str\(2\):".+"' | sed -E 's/"ProfileImagePath"=str\(2\):"(.+)"/User: \1/'
echo ""
if find /mnt/UNKNWN -maxdepth 2 -type d -ipath "*/Users" -not -ipath "*Windows.old*" | grep "."
then
tree -r -a -t -L 1 -D "$(find /mnt/UNKNWN/ -maxdepth 2 -type d -ipath "*/Users" -not -ipath "*Windows.old*" | head -1)"
fi
if find /mnt/UNKNWN -maxdepth 2 -type d -ipath "*/Documents and Settings" -not -ipath "*Windows.old*" | grep "."
then
tree -r -a -t -L 1 -D "$(find /mnt/UNKNWN/ -maxdepth 2 -type d -ipath "*/Documents and Settings" -not -ipath "*Windows.old*" | head -1)"
fi
echo ""
} >> "$infolog"
rm /tmp/UNKNWN/SOFTWARE
rm /tmp/UNKNWN/SYSTEM
else
loginfo "Non Windows NTFS partition detected on $device$i."
echo "Non Windows NTFS partition detected on $device$i." >> "$infolog"
tree -a -L 2 -D /mnt/UNKNWN/ >> "$infolog"
fi
umount /mnt/UNKNWN
else
echo "Failed to mount $device$i." >> "$infolog"
logwarn "There was an issue mounting $device$i."
fi
;;
"apfs")
mkdir -p /mnt/UNKNWN
loginfo "Apple install detected on $device$i."
echo "Apple install detected on $device$i." >> "$infolog"
if mount -t "$fstype" /dev/"$device""$i" /mnt/UNKNWN
then
echo "¯\_(ツ)_/¯" >> "$infolog"
tree -a -L 1 -D /mnt/UNKNWN/Users >> "$infolog"
umount /mnt/UNKNWN
else
echo "Failed to mount $device$i." >> "$infolog"
logwarn "There was an issue mounting $device$i."
fi
;;
"vfat"|"fat32")
loginfo "Boot/Recovery partition detected."
echo "Boot/Recovery partition detected." >> "$infolog"
mkdir -p /mnt/UNKNWN
if mount -t "$fstype" /dev/"$device""$i" /mnt/UNKNWN
then
tree -a -R -D /mnt/UNKNWN >> "$infolog"
umount /mnt/UNKNWN
else
echo "Failed to mount $device$i." >> "$infolog"
logwarn "There was an issue mounting $device$i."
fi
;;
*)
logwarn "Unknown partition type '$fstype'."
echo "Unknown partition type '$fstype'." >> "$infolog"
;;
esac
done
else
logwarn "No partitions detected, device is likely empty."
fi
echo "END OF LOG" >> "$infolog"
if [[ ! $logtofile = "true" ]]
then
echo "" >&3
cat "$infolog" >&3
echo "" >&3
fi
}
#Rescan for PCIe devices
pcie_enable (){
echo 1 > /sys/bus/pci/rescan
loginfo "Enabled PCIe card, sleeping for 5 seconds."
sleep 5
}
#Remove the PCIe NVMe readrer
# shellcheck disable=SC2329
pcie_disable (){
echo 1 > /sys/bus/pci/devices/0000:02:00.0/remove
echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove
loginfo "Disabled PCIe card."
}
main (){
if [[ $logtofile = "true" ]];
then
get_netid
mount_remote
loginfo ""
fi
get_devicetype #sets $devicetype to HDD_SATA/SSD_SATA/SSD_NVME
loginfo ""
get_device #sets $device to one of the /dev/xyz devices.
loginfo ""
make_infolog #Logs a bunch of details to a info log file from the system.
loginfo ""
loginfo "Finished gathering logs of $devicetype : $device."
cleanup
}
main
+19
View File
@@ -0,0 +1,19 @@
#!/bin/bash
#!/usr/bin/env bash
netid=
echo "Enter netid: "
read -r netid
while [[ $netid =~ ^\s*$ ]];
do
echo "Your netid cannot be blank."
echo "Enter netid: "
done
if ! kinit "$netid"@EGR.MSU.MSU
then
exit
fi
mkdir /mnt/decs
mount -t cifs -o user="$netid",sec=krb5i "//decs/decs/support/dban_logs" /mnt/decs
echo "test" > "/mnt/decs/test.txt"