Subject: [netatalk-admins] Netatalk users (nu PERL script)

From: Erik Ohlin <[email-masked]>
Date: Tue, 02 Mar 1999 08:47:47 -0800

Does anyone know of any way to report the IP address or MAC (IEEE) address of the users logged into afpd? I didn't see any options in ps that returned this info. Would it be possible to grep that from the syslog?

Here is the nu PERL script we use to return the username, but I need more info since we use the same 'macuser' account on multiple machines.

# nu - by Anders Brownworth   [email-masked]
#      modified by Ambrose Li <[email-masked]>
#
# shows netatalk users logged on
#
# usage: nu

open(USERS, "-|") || exec("/bin/ps", "anucx");

while (<USERS>) {
   push(@users, $1) if /^\s*(\d+)\s.*\bafpd\b/;
}

close USERS;

print "Netatalk users:\n---------------\n";

foreach $user (@users)
{
  if ($user) {  # not root
    ($name,$_,$_,$_,$_,$_,$gcos) = getpwuid($user);
    print(defined $gcos && $gcos =~ /^([^,]+)/? $1: $name, "\n");
  }
}

---
<------------------------------------------------------------->
| Erik Ohlin   mailto:[email-masked]   (760)438-8933 |
| Pacific Color http://www.pacificcolor.com fax:(760)438-8414 |
|    1916 Palomar Oaks Way, Suite 100, Carlsbad, CA  92008    |
<------------------------------------------------------------->

---

From: Jamie Biggar <[email-masked]>
Date: Wed, 3 Mar 1999 10:46:13 -0500 (EST)

At 8:47am on Tue, 2 Mar 1999, Erik Ohlin wrote:

> Does anyone know of any way to report the IP address or MAC (IEEE)
> address of the users logged into afpd? I didn't see any options in ps
> that returned this info. Would it be possible to grep that from the
> syslog?

I tried doing something with 'netstat -et | grep afpovertcp' but it was
difficult to pair those with process numbers (thus usernames from 'ps
-aux') unless frequent reboots "ensured" you never rolled over with port
numbers or PIDs meaning sort order would be maintained.  It also assumed
everyone was using TCP not DDP.

I briefly investigated doing something with 'lsof', but I decided that my
own occassional needs were well enough met by just manually using netstat
and ps and didn't justify spending any more time.  If your needs are more
pressing, I think that lsof would give you the socket-to-pid matching
you'd need to know who from where.

Adrian, have you considered setting argv[0] as some FTPd children do to
indicate UID/remote address information?  Is it difficult and/or
considered a security risk?

-Jamie