]>
git.ipfire.org Git - people/teissler/ipfire-2.x.git/blob - src/initscripts/init.d/snort
2 ########################################################################
3 # Begin $rc_base/init.d/snort
5 # Description : Snort Initscript
7 # Authors : Michael Tremer for ipfire.org - mitch@ipfire.org
13 ########################################################################
18 PATH
=/usr
/local
/sbin
:/usr
/local
/bin
:/bin
:/usr
/bin
:/sbin
:/usr
/sbin
; export PATH
20 eval $
(/usr
/local
/bin
/readhash
/var
/ipfire
/ethernet
/settings
)
21 eval $
(/usr
/local
/bin
/readhash
/var
/ipfire
/snort
/settings
)
23 if [ "$ENABLE_SNORT_ORANGE" == "on" ]; then
24 HOME_NET
+="$ORANGE_ADDRESS,"
25 DEVICES
+="$ORANGE_DEV "
28 if [ "$ENABLE_SNORT_GREEN" == "on" ]; then
29 HOME_NET
+="$GREEN_ADDRESS,"
30 DEVICES
+="$GREEN_DEV "
33 if [ "$ENABLE_SNORT_BLUE" == "on" ]; then
34 HOME_NET
+="$BLUE_ADDRESS,"
38 if [ "$ENABLE_SNORT" == "on" ]; then
39 LOCAL_IP
=`cat /var/ipfire/red/local-ipaddress`
40 if [ "$LOCAL_IP" ]; then
41 HOME_NET
+="$LOCAL_IP,"
43 exit 1 ## Add error handling here
45 DEVICES
+=`cat /var/ipfire/red/iface 2>/dev/null`
48 COUNT
=`echo $HOME_NET | wc -m`
49 HOME_NET
=`echo $HOME_NET | cut -c $[$COUNT - 2]`
51 echo "var HOME_NET [$HOME_NET]" > /etc
/snort
/vars
52 echo "var EXTERNAL_NET ANY" >> /etc
/snort
/vars
54 DNS1
=`cat /var/ipfire/red/dns1 2>/dev/null`
55 DNS2
=`cat /var/ipfire/red/dns2 2>/dev/null`
58 echo "var DNS_SERVERS [$DNS1,$DNS2]" >> /etc
/snort
/vars
60 echo "var DNS_SERVERS $DNS1" >> /etc
/snort
/vars
65 # Disable incompatible rules
66 boot_mesg
"Check/Fix Intrusion Detection rules..."
67 for file in $
(ls /etc
/snort
/rules
/*.rules
2>/dev
/null
); do
68 sed -i 's|^alert.*!\[\$DNS_SERVERS|#&|g' $file
69 sed -i 's|^alert.*!\$SSH_PORTS|#&|g' $file
70 sed -i 's|^alert.*!\$HOME_NET|#&|g' $file
71 sed -i 's|^alert.*!\$SQL_SERVERS|#&|g' $file
75 for DEVICE
in $DEVICES; do
76 boot_mesg
"Starting Intrusion Detection System on $DEVICE..."
77 /usr
/sbin
/snort
-c /etc
/snort
/snort.conf
-i $DEVICE -D -l /var
/log
/snort
--create-pidfile --nolock-pidfile --pid-path /var
/run
/
80 chmod 644 /var
/run
/snort_
$DEVICE.pid
84 if [ -r /var
/ipfire
/guardian
/enable ]; then
85 IFACE
=`/bin/cat /var/ipfire/red/iface 2>/dev/null | /usr/bin/tr -d '\012'`
86 sed -e "s/^Interface.*/Interface ${IFACE}/" /var
/ipfire
/guardian
/guardian.conf
> temp
87 mv temp
/var
/ipfire
/guardian
/guardian.conf
88 chown nobody.root
/var
/ipfire
/guardian
/guardian.conf
90 boot_mesg
"Starting Guardian..."
91 loadproc
/usr
/local
/bin
/guardian.pl
-c /var
/ipfire
/guardian
/guardian.conf
97 if [ -r /var
/run
/snort_
$BLUE_DEV.pid
]; then
101 if [ -r /var
/run
/snort_
$GREEN_DEV.pid
]; then
102 DEVICES
+="$GREEN_DEV "
105 if [ -r /var
/run
/snort_
$ORANGE_DEV.pid
]; then
106 DEVICES
+="$ORANGE_DEV "
109 RED
=`cat /var/ipfire/red/iface 2>/dev/null`
110 if [ -r /var
/run
/snort_
$RED.pid
]; then
111 DEVICES
+=`cat /var/ipfire/red/iface 2>/dev/null`
114 for DEVICE
in $DEVICES; do
115 boot_mesg
"Stopping Intrusion Detection System on $DEVICE..."
116 killproc
-p /var
/run
/snort_
$DEVICE.pid
/var
/run
119 rm /var
/run
/snort_
* >/dev
/null
2>/dev
/null
121 if [ -r /var
/ipfire
/guardian
/enable ]; then
122 boot_mesg
"Stopping Guardian..."
123 killproc
/usr
/local
/bin
/guardian.pl
128 statusproc
/usr
/sbin
/snort
137 echo "Usage: $0 {start|stop|restart|status}"
142 chmod 644 /var
/log
/snort
/* 2>/dev
/null
144 # End $rc_base/init.d/snort