Quick and dirty XML in shell

I found myself helping a colleague having fun trying to get various bits of XML data out of a WebSphere config file today, I knocked this up as a quick way to list the data and hopefully be adapted to his requirements. I'm sure theres better ways of doing this, and feel free to suggest improvements or links to other better ways to parse XML in shell (obviously there various ways with CPAN, or xmllint but as you may have gathered my current workplace is locked down with minimal amounts of useful tools!).

for each in $(cat ./test.xml | sed "s/</ </g;s/>/> /g" | tr -d "\n")
do
  #echo "INPUT: [$each]"
  # Create a plain text string version of each
  temp=$(echo $each | tr -d "<>")

  # Check if its an attrib or data, or an element name
  if [[ $(echo $each | cut -c 1-2) == "</" ]]; then
   #its an </end> tag
   echo "ELEMENT END: [$temp]"
  elif [[ $each == "/>" ]]; then
   #its a self contained <end /> tag
   echo "ELEMENT END: [$lastElement]"
  elif [[ $(echo $each | cut -c 1) == "<" ]]; then
   #if it starts with a < and isn't either of the above
   #then its a <begin> tag
   echo "ELEMENT BEGIN: [$temp]"
   lastElement=$temp
  else
   #its either data or an attribute
   attribValue=$(echo $temp | cut -d= -f2 )
   attribName=$(echo $temp | cut -d= -f1 )
   if [[ $attribValue != $attribName ]]; then
    #it must be an attribute on an element
    echo "AttribName: $attribName"
    echo "AttribVal : $attribValue"
   else
    #it must be data
    echo "Data: $each"
   fi
   unset attribName
   unset attribValue
  fi
done

Of course, if you do have tools like xmllint to hand...

To find a port in the server index file —

#!/bin/bash

WASBASE=${2:-"/opt/IBM/WebSphere"}


for each in $(find $WASBASE -name serverindex.xml | grep -iv Templates)
do
xmllint --shell $each <<<"xpath //specialEndpoints[contains(@endPointName,'$1')]/endPoint/@port" | grep "=" | cut -d"=" -f2
done

Decrypting WebSphere passwords

I've recently moved jobs to work on WebSphere so some of the posts here may stray from being about Unix (that said, with the Oracle posts already that was already happening).

I'm also working with an ex-work colleague to start another broader IT hints/tips blog at http://htfdidt.blogspot.co.uk.

The first joint article is Decrypting Websphere passwords. Enjoy it below or over on the new site.

---

By default, Websphere store passwords by XOR'ing by "_" which is possibly the IT industries worst kept secret. While passwords in files are often a necessary evil, the problem here is that they are easily and trivially decrypted.

This will show you how, and also how to encrypt your plain text password into the XOR'd format, the reason being my workplace still insert plaintext passwords and then run PropFilePasswordEncoder.sh on the updated files and I suspect we may not be the only place to do so.

So where can you find such files with these passwords?

Two such examples are:-

• /opt/IBM/WebSphere/AppServer/profiles/appsrv01/config/cells/appsrv01node01/security.xml 
• /opt/IBM/WebSphere/AppServer/profiles/appsrv01/properties/soap.client.props 

Lets take a look at the soap.client.props file in your profile properties directory as its easily parsed for our example (its not XML!). Assume you configure your SOAP login and password like the below, we'll run through encrypting it, and then how to recover it.

[root@wasadmin properties]# grep '^com.ibm.SOAP.login' ./soap.client.props

com.ibm.SOAP.loginUserid=wasadmin 
com.ibm.SOAP.loginPassword=wasadmin 
com.ibm.SOAP.loginSource=prompt 

So first you can see I'm using trivial and nonsense passwords and my WAS install is as root. If this reflects your production environment you're doing it wrong.

Lets at least make things better by encrypting the password.

[root@wasadmin properties]# ../bin/PropFilePasswordEncoder.sh ./soap.client.props com.ibm.SOAP.loginPassword

You can now see that the password is encrypted and no longer plain text.

[root@wasadmin properties]# grep '^com.ibm.SOAP.login' ./soap.client.props 

com.ibm.SOAP.loginUserid=wasadmin 
com.ibm.SOAP.loginPassword={xor}KD4sPjsyNjE= 
com.ibm.SOAP.loginSource=prompt

Now, what if you forget what that password is? Or what if you wanted to change it on a regular basis?

You could follow IBM advice here to switch off security.

You can even use Websphere itself to decode the passwords as detailed here.

Many of these don't appear to work for WAS 8 until I found this example that you can run from your plugins directory for your WAS installation, e.g. cd /opt/IBM/WebSphere/AppServer/plugins.

So using our ‘lost’ password from earlier..

[root@wasadmin plugins]# ../java/bin/java -Djava.ext.dirs=.:../lib com.ibm.ws.security.util.PasswordDecoder {xor}KD4sPjsyNjE= 

encoded password == "{xor}KD4sPjsyNjE=", decoded password == "wasadmin" 

Now, I did mention this article wasn't just about breaking in. What this does allow is to do is to pre-encrypt our passwords before we add them into the files. Lets say we wanted a default build password based on this ideology...

[root@wasadmin plugins]# ../java/bin/java -Djava.ext.dirs=.:../lib com.ibm.ws.security.util.PasswordEncoder "correct horse battery staple" 

decoded password == "correct horse battery staple", encoded password == "{xor}PDAtLTo8K383MC0sOn89PisrOi0mfywrPi8zOg=="