【发布时间】:2020-08-15 22:20:15
【问题描述】:
所以。一个有趣的问题。
我正在构建一个主脚本来评估数百台服务器上的一些 powershell 输出,希望节省研究这些大量文本文件以评估服务器配置的时间。为此,脚本的这一部分检查日志文件设置的输出(下面的示例数据):
System_GroupPolicyResults:: Audit Policy
System_GroupPolicyResults:: ------------
System_GroupPolicyResults:: GPO: Default Domain Policy
System_GroupPolicyResults:: Policy: AuditObjectAccess
System_GroupPolicyResults:: Computer Setting: Failure
System_GroupPolicyResults::
System_GroupPolicyResults:: GPO: Logging - Auditing
System_GroupPolicyResults:: Policy: AuditPolicyChange
System_GroupPolicyResults:: Computer Setting: Success, Failure
System_GroupPolicyResults::
System_GroupPolicyResults:: GPO: Logging - Auditing
System_GroupPolicyResults:: Policy: AuditObjectAccess
System_GroupPolicyResults:: Computer Setting: Success, Failure
这一点 perlscript 负责分解并报告这些字段——我真正要做的就是读取一个正则表达式,获取一些值,并注意服务器是否达到我们的预期(在这种情况下,我们应该看到所有这些设置的“成功,失败”(嘿,PCI 审计。就是这样)..然后在表格中格式化输出。
while ($serverdata =~ /System_GroupPolicyResults::\s+Policy:\s+(Audit\w+)\n.*Compu.*:\s+(.*\w)/g) {
$logsettings{$1} = $2;
$setflag = $1;
if ($logsettings{$setflag} =~ /Success,/) {
$logcheck{$setflag} = "Good";
} else {
$logcheck{$setflag} = "FAIL";
if ($caughtflag == 0) {
push @FailedAuditGPO, $srvname;
$caughtflag++;
}
}
}
#Let's report this:
#First, let's clean up the bad setting that creeps in:
delete $logsettings{AuditPrivilege};
print "\tGPO Audit Settings - $auditsettingsGPO:\n";
printf ("%-20s %-20s %-10s\n","Audit Value:","Current Setting:","Status:");
foreach $type (keys %logsettings) {
printf ("%-20s %-20s %-10s \n", $type, $logsettings{$type}, $logcheck{$type});
}
事情就是这样。如果在一系列文件上运行(我们经常一次在数百个文件上运行这些文件) - 第一个输出看起来很好:
Found Audit GPO: Default Domain Policy
GPO Audit Settings - Default Domain Policy:
Audit Value: Current Setting: Status:
AuditAccountLogon Success, Failure Good
AuditLogonEvents Success, Failure Good
AuditProcessTracking Failure FAIL
AuditSystemEvents Success, Failure Good
AuditDSAccess Failure FAIL
AuditPolicyChange Success, Failure Good
AuditAccountManage Success, Failure Good
AuditPrivilegeUse Failure FAIL
AuditObjectAccess Failure FAIL
但是后面的表都有-一个愚蠢的失败行-:
Found Audit GPO: Default Domain Policy
GPO Audit Settings - Default Domain Policy:
Audit Value: Current Setting: Status:
AuditProcessTracking Failure
AuditLogonEvents Success, Failure Good
AuditAccountLogon Success, Failure Good
AuditDSAccess Failure FAIL
AuditSystemEvents Failure FAIL
AuditAccountManage Success, Failure Good
AuditPrivilegeUse Success, Failure Good
AuditObjectAccess Failure FAIL
AuditPolicyChange Success, Failure Good
这里出了什么问题?有什么提示吗?我不知道为什么会这样。我的代码在这里可能不够优雅(并且可能有更好的方法——我是 perl 用户,而不是僧侣),但我通常可以找出算法或问题。这个让我彻底迷失了。
提前谢谢各位!
编辑:在设置每个值时添加一个小的调试打印语句来打印 %logcheck;它没有显示状态,它没有被设置。这是唯一项未被设置的项目。
【问题讨论】: