ssh2_auth_none returns true - php

I have a scenario where when i call ssh2_auth_none, it returns true. According to the documentation, it would seem to indicate that this means the switch is configured to allow login without authentication.
However, this is not the case. We are using passwords...
Here's what my code looks like:
<?php
$connection = ssh2_connect('10.124.123.45', 22);
$auth_methods = ssh2_auth_none($connection, 'username');
var_dump($auth_methods);
if (in_array('password', $auth_methods)) {
echo "Server supports password based authentication\n";
}
?>
Just wondering if you have any ideas or comments on what I can test or check to resolve this issue. Ultimately, I'd like to be able to call ssh2_connect and ssh2_auth_password() to login to this switch.
Thanks.

We had to change the way we connect to these types of switches - the root cause of the problem was that this switch has a very limited implementation of ssh and so popular libraries like phpseclib don't work.
here's our code that works - in case it helps anyone else out there who's trying to connect to CISCO's small business class switches.
<?php
$uname = 'myusername';
$pswd = 'mypassword';
$connection = ssh2_connect('123.123.123.123', 22);
//$authentication_methods = ssh2_auth_none($connection, 'user');
$stdio_stream = ssh2_shell($connection);
fwrite($stdio_stream,$uname."\n");
sleep(1);
fwrite($stdio_stream,$pswd."\n");
sleep(1);
echo "Results: " . stream_get_contents($stdio_stream);
echo 'sending show bonjour command:<br>';
fwrite($stdio_stream, "show bonjour".PHP_EOL);
sleep(1);
echo "<br>Results: " . stream_get_contents($stdio_stream);
?>

Related

Ldap connection failed in php?

HI Am trying to connect and unbind the server and port ldap connection using php.
Here is my code:
$hostname = 'ldaps://www.google.com';
$port = 636;
echo "ldap check";
$lp = ldap_connect($hostname,$port);
echo "servername";
echo $_SERVER['PHP_AUTH_USER'];
$username = $_SERVER['PHP_AUTH_USER'];
$password = $_SERVER['PHP_AUTH_PW'];
if ($bind = #ldap_bind($lp, $username.$hostname, $password)){
echo "Hello";
ldap_unbind($lp,$username,$password);
}
Failure:
But am not connecting with the ldap connection.PLease help me to fix the code.
When I read your code right, there are two issues:
The port you are giving will never be used in the ldap_connect. The docs clearly state that using the port as second argument to ldap_connect is deprecated and will only be used when you pass a servername or IP. But you are passing a URI, so that needs to include the port as well.
You are trying to bind as $username . $hostname. So you are tying to conntect 'someuser' as someuserldaps://www.google.com - I doubt that that will ever work. You probably want something like someuser#www.google.com...

How to secure DB configurations in php

I have a php api endpoint as below.
I need to make changes something like:
need to include all the configurations in the seperate file
validate API request using a server token to ensure to accept only genuine requests
Capture all the error logs in a seperate file, instead of showing in the browser
This is my code:
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
$data = json_decode(file_get_contents('php://input'), true);
if(!empty($data)):
header('Content-Type:text/plain');
/*MYSQL CREDENTIALS*/
$hostname = 'localhost';
$username = 'root';
$password = '';
$dbname = 'mydb';
$dbh = new PDO("mysql:host=$hostname;dbname=$dbname", $username, $password);
$arraykey=array_keys($data);
$array=$data[$arraykey[0]];
try
{
foreach($data as $array)
{
//MYSQL execute
$count = $dbh->exec("INSERT INTO gmr(version,visitorId,dwellTime,poiId,srId,zoneId,poiProximityConfidence,zoneProximityConfidence,poiPresenceConfidence,zonePresenceConfidence,normalizedTime) VALUES ('" . implode("', '", $array) . "')" ) or die(print_r($dbh->errorInfo(), true));
echo count($data);
echo 'Data Successfully inserted!!<br />';
}
//echo $data;
}
catch(PDOException $e)
{
echo $e->getMessage();
}
endif;
?>
For point 1) I have put all the configs in a seperate file like:
<?php
define (DB_USER, "root");
define (DB_PASSWORD, "");
define (DB_DATABASE, "mydb");
define (DB_HOST, "localhost");
?>
Need clarity on the better way to include this config file in my main file.
Since im sharing the API endpoint to client, the main file should be able to read my db config files.
So which is suggested to use:
require ("configuration.php");
OR
$config = parse_ini_file('../config.ini');
Suggestion required for other 2 points
Here are suggestion for another two points:
validate API request using a server token to ensure to accept only
genuine requests
For this you can use CSRF Token to check for valid request. you can find here important use of this.
List item Capture all the error logs in a separate file, instead of showing in the browser
By default PHP log everything in server side. in Ubuntu you can find /var/log/apache/error.log
Just you need to check your apache configuration is properly set for error logs
Read here for more info : Where does PHP store the error log? (php5, apache, fastcgi, cpanel)
if you don't want to show your error in browser then you can set error_reporting(0);
Hope this is what you need !!

PHP Imap_open with etodb class works on one server but not another

I am using a fairly straightforward php class emailtodb to import emails to a mysql database. Everything works perfectly as hoped when I use it to check email accounts on the local server. The issue is I took the connection script and put it on another server and now it cant connect. To summarize hopefully what im trying to say:
server1.com -accessing-> myemail#server1.com = works perfect
server2.com -accessing-> myemail#server1.com = Warning: imap_open() [function.imap-open]: Couldn't open stream
This is the code im using to connect to the server
$mysql_pconnect = mysql_pconnect($cfg["db_host"], $cfg["db_user"], $cfg["db_pass"]);
if(!$mysql_pconnect){echo "Connection Failed"; exit; }
$db = mysql_select_db($cfg["db_name"], $mysql_pconnect);
if(!$db){echo"DB Select Failed"; exit;}
$edb = new EMAIL_TO_DB();
$edb->connect('mail.MYSERVER.com', '/pop3:110/notls', $email, $pass);
$edb->do_action();
which actually goes to this function to actually connect (I believe)
function connect($host, $port, $login, $pass){
$this->IMAP_host = $host;
$this->IMAP_login = $login;
$this->link = imap_open("{". $host . $port."}INBOX", $login, $pass);
if($this->link) {
$this->status = 'Connected';
} else {
$this->error[] = imap_last_error();
$this->status = 'Not connected';
}
}
Finally I would say there is one major difference between the two servers, the new server has an SSL where the first does not so the new mail connection is going from HTTPS to HTTP but I dont know if that would have anything to do with it.
I was playing with this script just this evening. Have you tried something like this? (assuming you're switching from POP3 to IMAP with SSL)
$edb->connect('mail.server.com:993', '/imap/ssl/novalidate-cert', 'myname#server.com', 'password');
I discovered that my PHP environment didn't have PHP complied with IMAP-SSL (--with-imap-ssl in phpinfo() ), so that was causing some early problems for me too.

PHP ldap bind issue

I've been looking at a couple of guides (and the PHP manual) trying to validate AD users on an intranet site I'm about to make. This is the first time I've used ldap_connect, and I haven't had the best of luck.
Could anyone look at my code and see what I'm missing?
Thanks.
<?php
$user = "08jf1";
$password = "pass";
// Active Directory server
$ldap_host = "10.43.48.5";
// Active Directory DN
$ldap_dn = "OU=CSE-W7,OU=Students-W7,DC=server,DC=local";
// Domain, for purposes of constructing $user
$ldap_usr_domain = "#server.local";
// Connect to AD host
$ldapconn = ldap_connect("10.43.48.5");
if ($ldapconn) {
$bind = ldap_bind($ldap_host, $ldap_dn, $user . $ldap_usr_domain, $password);
if ($bind) {
echo "Verified user";
//$_SESSION['username'] = $session_username;
//$_SESSION['password'] = $session_password;
} else {
echo "User does not exist";
}
}
?>
Edit: I can confirm ldap is enabled though phpinfo!
Is that syntax of ldap_bind correct?. Isn't it ldap_bind($ldapconn,$rdn,$password) ?
Binding may need a elevated privilege or authbind wrapper. Refer to authbind for ldap. LDAP AuthBind
Take a look at this very simple example: How to use LDAP Active Directory Authentication with PHP

PHP ignoring mysql_connect requests

I'm new to PHP and have installed on Linux to boot (also a newbie).
Anyway, PHP is working...
<?
$myVar = "test";
echo($myVar);
?>
... works just fine.
But...
<?
$dbhost = "localhost";
$dbuser = "myuser";
$dbpass = "mypass";
$dbname = "mydb";
echo($dbhost . "-" . $dbuser . "-" . $dbpass . "-" . $dbname);
$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die("Unable to connect to MySQL");
print $conn;
mysql_close($conn);
phpInfo();
?>
... does nothing. Nor errors, nothing. Its as if the code isn't even there.
Any help?
Try to do the following:
First make sure display_errors is turned on in your php configuration file. Also set the level of error_reporting to show all errors, including strict (error_reporting = E_ALL|E_STRICT). After you make changes, restart your webserver.
Run phpinfo(), and check that the mysql extension is installed and working. If it isn't make sure that you uncommented it in the php configuration file (again, remember to restart apache after each change to the configuration file).
At this point MySQL should be loaded and working, and you should be able to tell from the error (if it persists) what's the problem.
Try also dumping the contents of the connection result ($conn) to see what it contains.
In general, I'd recommend using long php tags (<?php and not <?) since it is more portable (short tags are off by default in PHP 5 installations).
Try adding this to the top of your code:
error_reporting(E_ALL);
If it does nothing, doesn't that mean that it connected fine? What output do you expect out of that statement?
You could try
error_reporting(E_ALL);
$conn = mysql_connect("localhost", "myusername", "mypassword");
if(!$conn) {
echo 'Unable to connect';
} else {
echo 'Connected to database';
}
var_dump($conn);
edit: Addressing the comment saying that you have a mysql query setup, if you are not seeing "success" it means something is wrong with your query. Add to the above
$sth = mysql_query("SELECT * FROM tablename");
if(!$sth) {
echo 'unable to query: ' . mysql_error();
} else {
echo 'success';
}
Is there more code than you're showing us? The block you have just sets up a connection. You won't see anything at all if it succeeds, you have to use $conn to do something.
To confirm, try changing your password to a deliberately wrong value, and then see if you get an error. If you do, the code works just fine.
Connecting to a database with
$conn = mysql_connect("localhost", "myusername", "mypassword") or die("Unable to connect");
will have no (visible( results if the connection was made succesfully. However, once you run this statement, you can use the other mysql functions to make make queries to the database.
Connecting to a database tells your program "hey, I want to talk to this database".
This code is supposed to create a db connection, nothing else. What do you expect to see?
Try this
<?php
$conn = mysql_connect("localhost", "myusername", "mypassword")
or die("Unable to connect");
print("code sample");
print $conn;
?>
It should print you something like "resource #1"...
And then you may use that connection to communicate with db server

Categories