Multi-User login Vbscript, is anyone intrested?

bob5111
2013-02-24
2013-02-24
  • bob5111

    bob5111 - 2013-02-24

    I have created a vbscript for work that would allow for Multi-user setup with KeePass. This is crude scripting but it works and could be considered just as secure as if someone were typing in there passwords through command-line switches that keepass provides. I don't want to waste anyone time just wanted to know if anyone might be interested in this before i post it...

     
  • Paul

    Paul - 2013-02-24

    You are welcome to post it here. No doubt someone will give it a whirl.

    cheers, Paul

     
  • bob5111

    bob5111 - 2013-02-24

    Just want to be up front i am not a programmer and it will be very apparent im sure. OK so I will breakdown how i set this up before posting the script. You create X number of blank databases as well as a Master database, on a Network storage. Have AD permissions implemented and set on each database, allowing only two users to see the database. the domain admin and the user that will need access to the database. This seems to be typical of what i read around here. These databases need to be named according to the usernames of the individuals that will be accessing them. Note with a little tweaking this could be based on department or whatever you want really. I don't like doing it based on username but at the moment i don't know how else to do it (not a Programmer).... Ok once these databases are setup you implemented a master database that utilized that awesome plugin KeeAutoexec that only the DA could open which could open all other databases... So that is the setup now for the login script. I'm sure there is a much more secure language that this can be written it and i would be willing to try if i knew how... Anyways this script includes the fallowing a username prompt, a password prompt, it will create a log file for each day and will log what database is being accessed, when it was accessed, who is attempting to access it and from where. and it will also email or text if the master database is being accessed(note: you will need to tweak the email part as it will need the IP address of client access server. and email relay will need to be allowed or this will only work internally)

    NOTE: you will need to change the file paths to meet your needs.. i know this can be so much cleaner but i don't care so here you go ha..
    *****Copy Below this Line******
    dim strUser,strPass

    Call UserName (strUser)

    Function UserName(strUser)
    'get username which is also database name
    strUser = UserInput( "Enter your Network Login (all lower case):" )
    If IsEmpty(strUser) Then
    WScript.quit()
    ElseIf Len(strUser) = 0 Then
    MsgBox "You Clicked OK but left the Username blank. Please enter a Username!"
    call UserName(strUser)
    Else
    call Pwd(strPass)
    End If
    End Function

    Function Pwd(strPass)
    strPass = UserInput2( "Enter a Password:" )
    If IsEmpty(strPass) Then
    WScript.quit()
    ElseIf Len(strPass) = 0 Then
    MsgBox "You Clicked OK but left the Password field blank. Please enter a Password!"
    call Pwd(strPass)
    Else
    call Logfile(strUser)
    If strUser = "master" then
    Call SendEmailMessage(strFile)
    call StartProg(strUser,strPass)
    Else
    Call StartProg(strUser,strPass)
    End if
    End If
    end function

    Function StartProg( strUser,strPass )
    Dim objShell
    Set objShell = WScript.CreateObject( "WScript.Shell" )
    objShell.Run("C:\KeePass-2\KeePass.exe"&" "&"C:\KeePass-2\Database.0\"& strUser &".kdbx -pw:"& strPass)
    Set objShell = Nothing

    end Function

    Function UserInput( myPrompt )

    ' Check if the script runs in CSCRIPT.EXE
    If UCase( Right( WScript.FullName, 12 ) ) = "\CSCRIPT.EXE" Then
        ' If so, use StdIn and StdOut
        WScript.StdOut.Write myPrompt & " "
        UserInput = WScript.StdIn.ReadLine
    Else
        UserInput = InputBox( myPrompt,"Password Manager Login" )
    End If
    

    End Function

    Function UserInput2( myPrompt )

     If UCase( Right( WScript.FullName, 12 ) ) = "\CSCRIPT.EXE" Then
        WScript.StdOut.Write myPrompt & " "
        UserInput = WScript.StdIn.ReadLine
    Else
        UserInput2 = InputBox( myPrompt,"Password Manager Login" )
    End If
    

    End Function

    Function Logfile(strUser)

    myDateStr = replace(date, "/", "-")
    strDirectory = "C:\KeePass-2\Logs"
    strFile = "\Password_Manager_Logs_"& myDateStr &".txt"

    ' Create the File System Object
    Set objFSO = CreateObject("Scripting.FileSystemObject")

    ' Check that the strDirectory folder exists
    If objFSO.FolderExists(strDirectory) Then
    Set objFolder = objFSO.GetFolder(strDirectory)
    Else
    Set objFolder = objFSO.CreateFolder(strDirectory)
    'WScript.Echo "Just created " & strDirectory
    End If

    If objFSO.FileExists(strDirectory & strFile) Then
    Set objFolder = objFSO.GetFolder(strDirectory)
    Else
    Set objFile = objFSO.CreateTextFile(strDirectory & strFile)
    'Wscript.Echo "Just created " & strDirectory & strFile
    End If

    set objFile = nothing
    set objFolder = nothing
    ' OpenTextFile Method needs a Const value
    ' ForAppending = 8 ForReading = 1, ForWriting = 2
    Const ForAppending = 8

    Set objTextFile = objFSO.OpenTextFile _
    (strDirectory & strFile, ForAppending, True)

    'get info of current computer

    Set objShell = WScript.CreateObject( "WScript.Shell" )
    set oExec = objShell.Exec("cscript.exe WMIC ComputerSystem Get username" )

    strAccountOut = ""

    Do While Not oExec.StdOut.AtEndOfStream
    

    strAccountOut = strAccountOut & oExec.StdOut.ReadLine()
    Loop

    Set objShell = nothing
    Set oExec = nothing
    

    'Get PC name and send it to variable
    Set objShell = WScript.CreateObject( "WScript.Shell" )
    set oExec = objShell.Exec("cscript.exe WMIC ComputerSystem Get name")

    strPcOut = ""
    

    Do While Not oExec.StdOut.AtEndOfStream
    strPcOut = strPcOut & oExec.StdOut.ReadLine()
    Loop

    Set objShell = nothing
    set oExec = nothing
    
    'writes information to log file
    

    strTexts = vbTab &" The following database was accessed: "& strUser
    strTexts2 = vbTab &" This database was Accessed on: "& now
    strTexts3 = vbTab &" This database was Accessed from the following Account: "& Mid(strAccountOut,26,25) & " on the following Computer: "& Mid(strPcOut,11,10)
    strTexts4 = vbTab &" ************ "
    objTextFile.WriteLine(strTexts4)

    objTextFile.WriteLine(strTexts)
    objTextFile.WriteLine(strTexts2)
    objTextFile.WriteLine(strTexts3)
    
    objTextFile.WriteLine(strTexts4)
    'WScript.echo strText
    

    end function

    'this will send out an email and text message to anyone that accesses this database
    Function SendEmailMessage(strFile)
    Set objMessage = CreateObject("CDO.Message")
    objMessage.From = "Notifications@ABC.com"
    objMessage.To = "JSmith@ABC.com; cellnumber@vtext.com"
    objMessage.Subject = "Master database was accessed"
    objMessage.AddAttachment "C:\KeePass-2\Logs\"& strFile
    objMessage.Textbody = "The Master database was Accessed or was Attmpted to be Accessed please See Attached Log for more Details"
    objMessage.Configuration.Fields.Item
    ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
    objMessage.Configuration.Fields.Item

    ("http://schemas.microsoft.com/cdo/configuration/smtpserver") =
    "Client Access Server IP Address will Go in Here"
    objMessage.Configuration.Fields.Item

    ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
    objMessage.Configuration.Fields.Update
    objMessage.Send
    end Function

    WScript.quit()

    ******dont copy past this****

    So questions?

    1. I realize its somewhat insecure what language would i have to write it in to make it more secure.

    2. How can i make it better for you smart people out there. example i dont know how i can redirect the output of a objshell.run to a var. if i did I could make it so the cmd windows dont appear for a second becuase im using a objshell.exec.

    I hope someone can get some use out of it.... it was fun making

     
    Last edit: bob5111 2013-02-25

Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:





No, thanks