WebSphere Automation "How To" Series #22 : How to list all servers vulnerable to a specific fix using APIs

View Only

WebSphere Automation "How To" Series #22 : How to list all servers vulnerable to a specific fix using APIs

By Brian Hanczaryk posted Mon March 06, 2023 11:31 AM

Like

WebSphere Automation "How To" Series #22 : How to list all servers vulnerable to a specific fix using APIs

This post will focus on how to list all servers vulnerable to a specific fix using APIs.

The WebSphere Automation REST APIs are technology preview in this release. IBM Docs directly related to WebSphere Automation REST API are located at https://www.ibm.com/docs/en/ws-automation?topic=technology-preview-viewing-rest-api.

To utilize WebSphere Automation REST APIs through CLI, we need the URL and token values. IBM Docs https://www.ibm.com/docs/en/ws-automation?topic=technology-preview-viewing-rest-api shows the following details on how to acquire the necessary token value for an authorized user profile.

Get the password for the administrator account.

oc -n WSA_INSTANCE_NAMESPACE get secret admin-user-details -o jsonpath='{.data.initial_admin_password}' | base64 -d && echo

WSA_INSTANCE_NAMESPACE is the namespace of the instance where WebSphere Automation is installed.

Replace <password> in the following command with the value returned from the command above, and use the correct value for WSA_INSTANCE_NAMESPACE.

curl -k -X POST -H 'Content-Type: application/json' -d '{"username":"admin","password":"<password>"}' https://$(oc get route -n WSA_INSTANCE_NAMESPACE -o jsonpath='{.items[?(@.spec.to.name=="ibm-nginx-svc")].spec.host}')/icp4d-api/v1/authorize | jq -r .token

To get the necessary URL value to use in the curl commands, we can append a prefix of 'https://' and a suffix of '/websphereauto/secvul/apis' around the result of the following command.

oc get route -n WSA_INSTANCE_NAMESPACE -o jsonpath='{.items[?(@.spec.to.name=="ibm-nginx-svc")].spec.host}'

To set a URL variable on Linux, we could use the following

URL=https://$(oc get route -n WSA_INSTANCE_NAMESPACE -o jsonpath='{.items[?(@.spec.to.name=="ibm-nginx-svc")].spec.host}')/websphereauto/secvul/apis

Now that we've captured the token and URL values, we can show how to utilize the WebSphere Automation REST APIs to retrieve fixes.

For this example, we've registered several WebSphere Application Server traditional servers with v8 ranging from v8.5.5.15 through v8.5.5.22 and v9 ranging from v9.0.5.4 through 9.0.5.14.

As referenced in a previous article, WebSphere Automation "How To" Series #20 : How to retrieve all fix names using APIs , we can list all available fix names using APIs. Also, as referenced in a previous article, WebSphere Automation "How To" Series #21 : How to list all registered hostnames and versions using APIs , we can list all registered hostnames and versions. Using these two pieces of information, we can utilize the APIs and scripting to generate a list of all servers vulnerable to a specific fix name.

Utilizing the script, listHostNameAndVersion.sh, shown in WebSphere Automation "How To" Series #21 : How to list all registered hostnames and versions using APIs , we can use the following shell script to generate a list of all servers vulnerable to a specific fix name. This is just one example of how APIs and scripting can be utilized to achieve this result. The following is an example shell script.

[root@XXX.ibm.com Demo]# cat listServersVulnerableToFix.sh 
#!/bin/sh

if [ $# -lt 1 ]
then
 echo "Must pass in fix name"
 exit 99
fi

./listHostNameAndVersion.sh
 
rm -f temp.txt
curl -k -X GET "${URL}/fixes?limit=1&name=${1}" -H "accept: application/json" -H "Authorization: Bearer $TOKEN" | jq . > temp.txt
clear

rm -f impacted.txt
touch impacted.txt
P=0
while read line
do
 Z=${line:1:17}
 #echo $Z

 if [ "$Z" == "," ]
 then 
  P=0
 fi

 if [ $P -eq 1 ]
 then 
  Y=$(echo "$line" | cut -d '"' -f2)
  echo "$Y" >> impacted.txt
 fi

 if [ "$Z" == "appliesToVersions" ]
 then 
  P=1
 fi

done < temp.txt
echo

while read line
do
 HN=$(echo $line | awk '{print $1}')
 VER=$(echo $line | awk '{print $2}')
 while read atv
 do
  if [ "$VER" == "$atv" ]
  then 
   echo $line
  fi 
 done < impacted.txt
done < hostNameAndVersion.txt

Future How-To articles in this series will detail how to update all servers vulnerable to a specific fix.

You can find more IBM Docs related to WebSphere Automation at https://www.ibm.com/docs/en/ws-automation.

#WebSphere #WebSphereAutomation #Automation

0 comments

65 views

IBM Application Runtimes Community

Come for answers, stay for best practices. All we're missing is you.

WebSphere Application Server & Liberty