Hacking into the Atlantis ILIO database

The (out-of-the-box or) default credentials of an Atlantis ILIO center machine is root/admin (username/password). The password of the root account (used for remote access via the management webpage) can easily be changed. There is no direct relation between the root user to gain access to the machine, and the root user of the ibert database. However the password of the root user in the ibert database is admin.

Access the database locally

Once you are connected to a console session (or via SSH) of the Atlantis ILIO center machine, gaining access to the ibert database is easy.

root@ilio: ~# mysql -u root -p ibert
Enter password: admin
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 644
Server version: 5.1.63-0ubuntu0.11.04.1 (Ubuntu)

Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

Knowing that getting access to the database is that ease might got you to think “Wow! So everyone can access my ILIO database just like that?!”. Well, that’s not entirely true. The mysql daemon is configured to bind only the 127.0.0.1 (or localhost) network, external networks are unable to (see or) connect to the mysql daemon.

Also, access to the ibert database is restricted to the user root logging in from the host localhost.

mysql> show grants;
+----------------------------------------------------------------------------------------------------------------------------------------+
| Grants for root@localhost                                                                                                              |
+----------------------------------------------------------------------------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY PASSWORD '*4ACFE3202A5FF5CF467898FC58AAB1D615029441' WITH GRANT OPTION |
+----------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

Access the database remotely

If we want to connect to the Atlantis ILIO database from a remote machine (probably with a GUI like MySQL Workbench) we need to re-configure.

my.cnf

First of all we need to enable the mysql daemon to bind to an external network. In the /etc/mysql/my.cnf file we need to change the bind-address from

bind-address	= 127.0.0.1

to

#bind-address	= 127.0.0.1

Tip: nano is an easy editor that is installed by default (easier than vi)

To propagate the changes the daemon needs to be restarted

/etc/init.d/mysql restart

Privileges

Now you can connect to the mysql server you need the privileges to access the ibert database from a remote host.

Although it would be possible to grant this privilege to the root account this implies a choice with two answers 1) use the default password admin and accept the consequences (insecure) or 2) change the password of the root user which results in breaking the system. Therefore its probably better to create a dedicated user for remote access with a more complex password.

This is done with the following command where we add a user iliouser with the password iliopassword.

CREATE USER 'iliouser'@'%' IDENTIFIED BY 'iliopassword';
GRANT ALL PRIVILEGES ON ibert. * TO 'iliouser'@'%';

followed by another command to propagate the changes

FLUSH PRIVILEGES;

ibert

And now you’re able to connect to the Atlantis ILIO center database from a remote machine

Where can I use it for?

So what kind of valuable information can we find in the database?

Basically everything you can see on the Atlantis ILIO Center admin page is stored in the database. This includes the configuration but also health status, alerts and resource usage. Having access to the database enables you to retrieve this information and (if reaaaaallly necessary) to change the content.

Entities

A good thing to start with is knowing what entities are. Each Atlantis ILIO session- or replication host is stored as a record in the [entities] table with a unique identifier (column id). The entity is used throughout the entire database to correlate the information with the machines.

The [entities] database contains the following columns

Monitoring

Atlantis ILIO Center has a built-in notification feature (configured via Setup > Alerts). A warning notification (CPU >90% or disk / memory / load > 80% ) and an error alert (CPU > 95% or memory / disk / load >90%) can be delivered to email and/or SNMP traps. A good basic feature

If you want more extensive information (on a per entity basis) to enhance the monitoring, or analyze trend. this can be retrieved from the database.  The following tables can be interesting:

Configuration

Getting an overview of the configuration can be useful, especially when the configuration is not working as expected or when manual cleanup activities are required.

The following tables can be interesting:

Comments

In this article I’ve shown how one can connect to the internal database of an Atlantis ILIO Center machine (called ibert), what information is stored in the database and how this might help you.

If you have any questions or remarks don’t hesitate to leave a comment below. Especially if you have additional information about the content of the database, yeahh….that would great!

Disclaimer: Changing the configuration of the machine and/or database could result in losing support from the vendor. I take no responsibility if you break the system and/or loose support.