Reply
Thread Tools
Posts: 60 | Thanked: 17 times | Joined on Feb 2008
#1
I modified a bash script from here

http://snippets.dzone.com/search/get_results?q=callhome

By having crond run this script hourly, it will make your Nokia "call home" by securely copying a file with its current IP address and other info to a site of your choosing that is set up to accept ssh connections. This is useful in case your Nokia gets stolen; you can track it down by it's current IP if the thief manages to connect to the internet.

You will need to have installed and functioning correctly
bash shell
sed
wget
traceroute
ssh
crond
whois
ifconfig
who <--- not really necessary - can be cut from script

The script below should be modified with the correct paths to the various files. You can change the base directory for various files as well as the name of the file that gets sent via scp in the first two lines of code.

The last line of the script does a secure copy to send the information to your site. It assumes that you have set up ssh to work without the need for a password by using a private-public keypair.

Replace the parts of the script between the [...] with relevant variables for your situation (and REMOVE the brackets []). If it works correctly, you should find the hidden file ~/.locate-laptop at your ssh receiving site, updated hourly with your wayward Nokia's current IP address.


Jim



#!/bin/bash
#script to have nokia tablet "call home" hourly with its current ip address
#"calling home" means securely copying a file with ip info to a computer set up to receive this file

base="/home/user/"
rfile=".locate-laptop"
rm -f $base$rfile
date > $base$rfile
who >> $base$rfile
ipnameit=$(wget -q -O - checkip.dyndns.org|sed -e 's/.*Current IP Address: //' -e 's/<.*$//')
echo "My IP address is $ipnameit" >> $base$rfile
/usr/local/bin/whois $ipnameit | egrep -A 8 'OrgName|Email' 2>&1 >> $base$rfile
/sbin/ifconfig -a 2>&1 >> $base$rfile
/usr/sbin/traceroute [put a known, static ip address here] 2>&1 | head -15 >> $base$rfile
scp -q -i $base.ssh/[path to private key] $base$rfile [username]@[ssh receiving ip address]:~

#make this script executable <gain root then chmod +x> and put it into /etc/cron.hourly
#I hope you never have to use it...
 

The Following 6 Users Say Thank You to dannemil For This Useful Post:
Posts: 566 | Thanked: 150 times | Joined on Dec 2007
#2
Looks useful! Would be nice if we had an automatic 'mugshot' funtion as well.
 

The Following User Says Thank You to iamthewalrus For This Useful Post:
Posts: 1,224 | Thanked: 1,763 times | Joined on Jul 2007
#3
It can be done easier by using the fact that sshd (and httpd) record the addresses whence connections originate. So most of your script can be replaced by a simple ssh (or wget) to a server that you can read its logs.
 

The Following 2 Users Say Thank You to Matan For This Useful Post:
Mara's Avatar
Posts: 1,310 | Thanked: 820 times | Joined on Mar 2006 @ Irving, TX
#4
In case of N810, the GPS last known position might be useful information. Doesn't the A-GPS save the coordinates to some file that could be read and reported back?
 
Posts: 100 | Thanked: 38 times | Joined on Apr 2008
#5
Originally Posted by Mara View Post
In case of N810, the GPS last known position might be useful information. Doesn't the A-GPS save the coordinates to some file that could be read and reported back?
Awesome, I was just about to suggest the same thing. GPS coordiantes would be a really nice add-on for n810 users. This is a great idea by the way. I agree that I hope I never have to use it.

Good job!
 
Posts: 60 | Thanked: 17 times | Joined on Feb 2008
#6
Originally Posted by Mara View Post
In case of N810, the GPS last known position might be useful information. Doesn't the A-GPS save the coordinates to some file that could be read and reported back?
Great idea! I will look into that and try to implement it.
 
Posts: 60 | Thanked: 17 times | Joined on Feb 2008
#7
Originally Posted by Matan View Post
It can be done easier by using the fact that sshd (and httpd) record the addresses whence connections originate. So most of your script can be replaced by a simple ssh (or wget) to a server that you can read its logs.
Thanks. You're right - Simpler is better. I thought that it would be useful to have all of that information in the file that arrives via ssh so you could get to work immediately tracking the thing down.
 
IcelandDreams's Avatar
Posts: 228 | Thanked: 30 times | Joined on Mar 2008 @ Ontario & Iceland
#8
I think it would be torturous to have the IP of my stolen NIT but unable to do a thing about it. Don't say that you could inform the authorities, ya right. Perhaps if you could set a flag at the server end that when set would do something useful on the NIT when it phoned home. The NIT ssh connection could be setup to allow that to happen securely. I can think of a lot of things but I'll leave that to your imagination.
 

The Following User Says Thank You to IcelandDreams For This Useful Post:
Posts: 60 | Thanked: 17 times | Joined on Feb 2008
#9
Originally Posted by iamthewalrus View Post
Looks useful! Would be nice if we had an automatic 'mugshot' funtion as well.
Ha! I'll have to think about that - get the camera to take a picture of the scoundrel and send it along with the other file.

BTW: here is an example of the info that gets sent when the script executes:

Fri Jul 11 15:27:01 CDT 2008
USER TTY IDLE TIME HOST
My IP address is 168.7.209.45
OrgName: Rice University-Sesquinet
OrgID: SESQ
Address: Networking MS 119
Address: 6100 Main Street
City: Houston
StateProv: TX
PostalCode: 77005
Country: US

--
RAbuseEmail: ipadmin@rice.edu

RNOCHandle: RUH-ORG-ARIN
RNOCName: Rice University Networking
RNOCPhone: +1-713-348-4989
RNOCEmail: ipadmin@rice.edu

RTechHandle: RUH-ORG-ARIN
RTechName: Rice University Networking
RTechPhone: +1-713-348-4989
RTechEmail: ipadmin@rice.edu

OrgAbuseHandle: RUH-ORG-ARIN
OrgAbuseName: Rice University Networking
OrgAbusePhone: +1-713-348-4989
OrgAbuseEmail: ipadmin@rice.edu

OrgNOCHandle: RUH-ORG-ARIN
OrgNOCName: Rice University Networking
OrgNOCPhone: +1-713-348-4989
OrgNOCEmail: ipadmin@rice.edu

OrgTechHandle: RUH-ORG-ARIN
OrgTechName: Rice University Networking
OrgTechPhone: +1-713-348-4989
OrgTechEmail: ipadmin@rice.edu

# ARIN WHOIS database, last updated 2008-07-10 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:41832 errors:0 dropped:0 overruns:0 frame:0
TX packets:41832 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2099431 (2.0 MiB) TX bytes:2099431 (2.0 MiB)

wlan0 Link encap:Ethernet HWaddr xxxxxxxxxxxxxx
inet addr:172.16.31.233 Bcast:172.16.31.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6212 errors:0 dropped:0 overruns:0 frame:0
TX packets:4447 errors:5 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:971277 (948.5 KiB) TX bytes:729225 (712.1 KiB)

traceroute to 128.42.206.11 (128.42.206.11), 64 hops max, 40 byte packets
1 10.72.65.253 (10.72.65.253) 7 ms 7 ms 7 ms
2 172.16.48.233 (172.16.48.233) [MPLS: Label 329 Exp 0] More labels 8 ms More labels 8 ms More labels 8 ms
3 172.16.0.246 (172.16.0.246) [MPLS: Label 357 Exp 0] More labels 8 ms More labels 8 ms More labels 8 ms
4 128.42.206.254 (128.42.206.254) 8 ms 7 ms 7 ms
5 128.42.206.11 (128.42.206.11) 7 ms 7 ms 7 ms

Last edited by dannemil; 2008-07-11 at 20:50.
 

The Following User Says Thank You to dannemil For This Useful Post:
Posts: 60 | Thanked: 17 times | Joined on Feb 2008
#10
Originally Posted by IcelandDreams View Post
I think it would be torturous to have the IP of my stolen NIT but unable to do a thing about it. Don't say that you could inform the authorities, ya right. Perhaps if you could set a flag at the server end that when set would do something useful on the NIT when it phoned home. The NIT ssh connection could be setup to allow that to happen securely. I can think of a lot of things but I'll leave that to your imagination.
Now that's a good idea. Perhaps a poison pill that somehow locks or disables the NIT once that file arrives.

You know this suggests a simpler solution: password protect the NIT so that you have to login to use it. At least that way, the thief would have to work hard to be able to do anything with it.
 
Reply


 
Forum Jump


All times are GMT. The time now is 03:27.