
#include <includes.h>



#define NAME "rusersd service"
#define DESCRIPTION "\
The rusers service provides gives away\n\
valid logins names, and can be used by\n\
an intruder to find out how used is the\n\
target machine and who are its usual users.\n\
You should not keep this service.\n\
Risk factor : low/medium"
#define COPYRIGHT "no copyright"
#define SUMMARY "warns the user that the rusers service is running"

#define RPC_PROG 100002



PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
  plug_set_name(desc, NAME);
  plug_set_description(desc, DESCRIPTION);
  plug_set_summary(desc, SUMMARY);
  plug_set_copyright(desc, COPYRIGHT);
  plug_set_category(desc, ACT_ATTACK);
  plug_set_family(desc, "RPC programs");
  plug_set_timeout(desc, 5);
  return(0);
}

PlugExport int plugin_run(struct arglist * env);
PlugExport int plugin_run(struct arglist * env)
{
  int port = 0;
  int tcp = 0;
  if(plug_get_key(env, "rpc/portmapper")&&
     (strlen(plug_get_key(env, "rpc/portmapper"))<3))return(0);
  port = getrpcport(plug_get_hostname(env), RPC_PROG, -1, IPPROTO_UDP);
  if(!port){
   port = getrpcport(plug_get_hostname(env), RPC_PROG, -1, IPPROTO_TCP);
   tcp++;
   }
  if(port)
    {
    char * report = "the rusers RPC service is running.\n\
It will give away too many informations\n\
to an intruder, so you should disable it.\n\
Fix : comment out the rusersd line in /etc/inetd.conf";
    if(!tcp)post_info_udp(env, port,report);
    else post_info(env, port, report);
    }
  return(0);
}
 



