Finding Database Packages on a New System

RootMason · 07-21-2013, 02:36 AM

Hello all!

I recently took on a client administering their Debian server. As I had feared the documentation is abysmal and the structure is, to put it nicely: funky. They are using a database for time sheets and various office-related data... and no one has any idea what is being used or how.

Any of my big brains in here have any thoughts on how I might go about finding what they are using and how they are using it? Their server is running Debian Squeeze 6.0.7.

Thanks in advance for your time! Much appreciated.

linosaurusroot · 07-21-2013, 07:40 PM

You could start by seeing how they interact with it and follow the trail ... maybe a webserver connects to the database. List the running processes. Etc etc. I have to support stuff I haven't seen before and it requires observation.

RootMason · 07-21-2013, 10:32 PM

Thanks for the reply, buddy! Sure do appreciate the ideas!

I have spent a bit of time while the office was closed watching top and I still couldn't find anything that I could link to a database program. I even went as far as using dpkg --get-selections and then rifling through the results this weekend without really finding anything. I also tried using a few grep ideas like 'data'. Is my problem perhaps in the fact that there is no traffic because they are closed? Maybe there is something else I should be looking for since the database may or may not reside on this server? It is altogether possible that it is running on their backup server (that they don't have the username or password to) or on the "mystery server" called Exchange1 that is serving DNS and DHCP but they couldn't even show me which physical server it was.

Any ideas you may have are gold to me! Thanks again for taking the time to help! Also, I would interested in any information you'd like to share with how you go about collecting information on these poorly documented clients, beyond just finding this lost (hiding?) database. Thanks, buddy!

Habitual · 08-01-2013, 12:29 PM

Quote:

Originally Posted by RootMason

They are using a database for time sheets and various office-related data

Since you didn't specify which, I will assume mysql so...

Subnet scanning with nmap?

Code:

nmap -v -sn 192.168.1.0/24 | grep -v down

then process the resulting IPs with

Code:

nmap <IP> -p 3306

and since anything could be using 3306, then test it with

Code:

echo "quit"| telnet <IP> 3306

results like:

Code:

Connected to ...something.something (<IP>).
Escape character is '^]'.
4
5.0.95A	Mf=9H?Af,a2uvqU4A.`{iConnection closed by foreign host.

MySQL v 5.0.95...

Please let us know and I hope this helps. (I really do)
Subscribed with interest...

Edit: It sounds like you know what host this db is on...?