Защищённый SMS Commander

#!/bin/sh

NRPETOOL="/usr/local/libexec/nagios/check_nrpe2"
IPMITOOL="/usr/local/bin/ipmitool"
FPINGTOOL="/usr/local/sbin/fping"
PARAMFILE="/usr/local/etc/smshandlers/param.list"
OPIEKEYBIN="/usr/bin/opiekey"
OPIESEED="HABROPIEProc"
OPIEPASS="StrongOPIEPassword"
OPIEUSEDSEED="/var/tmp/used.opie"
SMSDOUTSPOOL="/var/spool/sms/outgoing"

if [ ! -f ${OPIEUSEDSEED} ]; then
        echo "#USED SEEDS FILE. Do not EDIT" > ${OPIEUSEDSEED}
fi

if [ ! -w ${OPIEUSEDSEED} ]; then
        echo "file ${OPIEUSEDSEED} is not writable"
        exit
fi
if [ ! -r ${PARAMFILE} ]; then
        echo "file ${PARAMFILE} is not readable"
        exit
fi

IFS="
"
FOUNDNUM=""
NUMBER=""

# search any properties
search (){
# $1 - section [name] from param.list
# $2 - search string in section
SECTION=$1
SEARCHSTR=$2
shift
shift
OLDIFS=${IFS}
IFS="
"
        [ "X"${SEARCHSTR} == "X" ] && exit
        for i in ${PARAMS}; do
                # search section definition
                if [ `echo ${i} | grep -e "^\["` ]; then
                        CURSECTION=${i}
                        continue
                fi
                if [ "${CURSECTION}" == "["${SECTION}"]" ]; then
                        if [ `echo ${i} | grep -e "^\b${SEARCHSTR}\b:"` ]; then
                                echo ${i}
                                break
                        fi
                fi
        done
IFS=${OLDIFS}
}

cut_message_body (){
# split sms file to parts
# BSD buggy "grep -m 1 -A 10 -e '^$'" replacement
#
        FILE=$1
        NULLSTR=0
        for i in `cat -e $1`; do
                if [ "X"${i} == "X\$" ]; then
                        NULLSTR=1
                        continue
                fi
                if [ ${NULLSTR} -eq 1 ]; then
                        echo ${i}
                fi
        done
}

process_command () {
        CMD=$1
        shift
        CMDPARAM=$*
        oIFS=$IFS
        IFS=" "
        for host in ${CMDPARAM}; do
                HOSTACCOUNT=$( search hosts "${host}" )
                if [ "X"${HOSTACCOUNT} != "X" ]; then
                        ACCOUNT=`echo ${HOSTACCOUNT} | cut -d ":" -f 2-`
                        LOGINPW=$( search logins "${ACCOUNT}" )
                        if [ "X"${ACCOUNT} != "X" ]; then
                                if [ "${ACCOUNT}" != "null" ]; then
                                        USER=`echo ${LOGINPW} | cut -d ":" -f 2`
                                        PASSWORD=`echo ${LOGINPW} | cut -d ":" -f 3`
                                else
                                        USER="USER"
                                        PASSWORD="PASSWORD"
                                fi
                        else
                                echo "ACCOUNT ${ACCOUNT} NOT FOUND!"
                                break
                        fi
                else
                        echo "HOST ${host} NOT FOUND!"
                        continue
                fi
                opierequired=$( search commands_template "${CMD}" | cut -d ":" -f 2 )

                commandtemplate=$( search commands_template "${CMD}" | \
                                                                        cut -d ":" -f 3- | sed \
                                                                        -e "s@\%HOST\%@${host}@g" \
                                                                        -e "s@\%FPING\%@${FPINGTOOL}@g" \
                                                                        -e "s@%IPMITOOL%@${IPMITOOL}@g" \
                                                                        -e "s@%CHECK_NRPE%@${NRPETOOL}@g" \
                                                                        -e "s@%USER%@${USER}@g" \
                                                                        -e "s@%PASSWORD%@${PASSWORD}@g" )
                if [ "${opierequired}" -eq "1" ]; then
                        if [ "${OPIERES}" == "True" ]; then
                                echo "OPIE Success"
                                res=$( eval ${commandtemplate} )
                                sendsms ${NUMBER} ${host} ${res}
                        else
                                echo "OPIE Failed"
                                sendsms ${NUMBER} ${host} "OPIE Challenge failed"
                        fi
                else
                        res=$( eval ${commandtemplate} )
                        sendsms ${NUMBER} ${host} ${res}
                fi
        done
        IFS=$oIFS
}

sendsms () {
        NM=$1
        shift
        TMPFILE=`mktemp ${SMSDOUTSPOOL}/smscmd.XXXXXX` || exit 1
        echo "To: ${NM}" >> ${TMPFILE}
        echo >> ${TMPFILE}
        echo "$*" >> ${TMPFILE}
}

opiecheck () {
        OPIESEQ=`echo $* | cut -d " " -f 1 | sed -e 's/[^0-9]//g'`
        OPIESTR=`echo $* | cut -d " " -f 2-`
        if [ "X"${OPIESEQ} == "X" ]; then
                echo "OPIE SEQUENCE FOR NUMBER ${NUMBER} IS NOT SET!"
                OPIERES="False"
                break
        fi
        if [ `grep "^${OPIESEQ}$" ${OPIEUSEDSEED}` ]; then
                echo "USED OPIE SEQUENCE ${OPIESEQ} DETECTED"
                OPIERES="False"
                sendsms ${NUMBER} "OPIE SEQUENCE ${OPIESEQ} ALREADY USED"
                exit 1
        else
                echo ${OPIESEQ} >> ${OPIEUSEDSEED}
        fi
        OPIEGEN=`echo ${OPIEPASS} | ${OPIEKEYBIN} -5 -a ${OPIESEQ} ${OPIESEED} 2>/dev/null`
        if [ "X"${OPIESTR} != "X"${OPIEGEN} ]; then
                OPIERES="False"
        else
                OPIERES="True"
        fi
}


parse_commands () {
        for command in $*; do
                command=`echo ${command} | sed -e 's/\$$//g' -e 's/^\#//g'`
                CURCOMMAND=`echo ${command} | cut -d " " -f 1`
                CMDPARAM=`echo ${command} | cut -d " " -f 2-`
                        case "${CURCOMMAND}" in
                                "OPIE")
                                        opiecheck ${CMDPARAM}
                                        continue
                                        ;;
                                *)
                                        if [ `echo ${FOUNDNUM} | cut -d : -f 2 | grep "\b${CURCOMMAND}\b"` ]; then
                                                TMPMSG="ALLOWED COMMAND FOR NUMBER "${NUMBER}" - COMMAND: "${CURCOMMAND}" ARGS "${CMDPARAM}
                                                echo ${TMPMSG}
                                                process_command ${CURCOMMAND} ${CMDPARAM}
                                        else
                                                TMPMSG="DISALLOWED COMMAND FOR NUMBER "${NUMBER}" - COMMAND: "${CURCOMMAND}" ARGS  "${CMDPARAM}
                                                echo ${TMPMSG}
                                        fi
                                        ;;
                        esac
        done
}



PARAMS=`cat ${PARAMFILE} | grep -E -v '^#'`

if [ $1 == "RECEIVED" ]; then
        FILENAME=$2
        NUMBER=`grep 'From:' ${FILENAME} | sed -e 's/^From\:\ //g' -e 's/[^0-9]//g;'`
        FOUNDNUM=$( search phones ${NUMBER} )
        if [ "X"${FOUNDNUM} != "X"  ]; then
                commands=$( cut_message_body ${FILENAME} )
                parse_commands ${commands}
        fi
elif [ $1 == "SENT" ]; then
        echo $@
else
        echo "UNKNOWN STATUS $@"
fi

# ---------------------------------------
#
# ALLOWED PHONES
# PHONENUMBER:COMMAND,COMMAND,COMMAND
# ---------------------------------------
[phones]
79030000000:RESET,PWROFF,PWRON,REBOOT,SHUTDOWN,STOPSERVER,STARTSERVER,ALIVE,PWRSTAT
79160000000:ALIVE,PWRSTAT
79020000000:PWRON,STARTSERVER,ALIVE
# ---------------------------------------
#
# HOST LIST
# REAL_IP:IPMI_USER
# ---------------------------------------
[hosts]
192.168.55.2:ADMSM
192.168.54.2:null
192.168.55.5:ADMDEF
192.168.54.5:null
# ---------------------------------------
#
# IPMI LOGINS
# IPMI_ACCOUNT:IPMI_NAME:IPMI_PASSWORD
# ---------------------------------------
[logins]
ADMSM:ADMIN:PW1234
ADMDEF:ADMIN:ADMIN
ADMIBM:USERID:USERID
# ---------------------------------------
#
# COMMANDS TEMPLATE
# COMMAND:OPIE_CHECK:COMMAND_TEXT
# ---------------------------------------
[commands_template]
RESET:1:%IPMITOOL% -H %HOST% -U %USER% -P %PASSWORD% power reset
PWROFF:1:%IPMITOOL% -H %HOST% -U %USER% -P %PASSWORD% power off
PWRON:0:%IPMITOOL% -H %HOST% -U %USER% -P %PASSWORD% power on
PWRSTAT:0:%IPMITOOL% -H %HOST% -U %USER% -P %PASSWORD% power status
REBOOT:1:%CHECK_NRPE% -H %HOST% -p 5666 -c reboot
SHUTDOWN:1:%CHECK_NRPE% -H %HOST% -p 5666 -c shutdown
STOPSERVER:1:%CHECK_NRPE% -H %HOST% -p 5666 -c stop_server
STARTSERVER:0:%CHECK_NRPE% -H %HOST% -p 5666 -c start_server
ALIVE:0:%FPING% %HOST%