X-Git-Url: http://git.ipfire.org/?a=blobdiff_plain;f=config%2Fsuricata%2Fconvert-snort;h=3e938137efe3c06e21b9069f22bc756f017a90b2;hb=8b58dbf32a1cd937b1ab66b9b88b17795abf968e;hp=ca650b149a212d9f0074297d78626fec96d8fd11;hpb=cc636c4741e7928276a1a5c7048b4fc0693c7f23;p=people%2Fpmueller%2Fipfire-2.x.git diff --git a/config/suricata/convert-snort b/config/suricata/convert-snort index ca650b149a..3e938137ef 100644 --- a/config/suricata/convert-snort +++ b/config/suricata/convert-snort @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2019 IPFire Development Team # +# Copyright (C) 2020 IPFire Development Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -34,7 +34,42 @@ my $snort_config_file = "/etc/snort/snort.conf"; my $snort_rules_tarball = "/var/tmp/snortrules.tar.gz"; # -## Step 1: Setup directory and file layout, if not present and set correct +## Step 1: Convert snort user and group to suricata if exist. +# + +# Check if the snort user exists. +if (getpwnam("snort")) { + # Change username. + my @command = ( + '/usr/sbin/usermod', + '-l', 'suricata', 'snort' + ); + + system(@command) == 0 or die "Could not change username: @command failed: $?\n"; + + # Adjust home directory. + @command = ( + '/usr/sbin/usermod', + '-d', "/var/log/suricata", + 'suricata' + ); + + system(@command) == 0 or die "Failed to adjust home directory: @command failed: $?\n"; +} + +# Check if the snort group exists. +if (getgrnam("snort")) { + # Change groupname + my @command = ( + '/usr/sbin/groupmod', + '-n', 'suricata', 'snort' + ); + + system(@command) == 0 or die "Could not rename groupname: @command failed: $?\n"; +} + +# +## Step 2: Setup directory and file layout, if not present and set correct ## ownership. The converter runs as a privileged user, but the files ## needs to be full access-able by the WUI user and group (nobody:nobody). # @@ -71,7 +106,7 @@ if (-z "$snort_settings_file") { } # -## Step 2: Import snort settings and convert to the required format for the new IDS +## Step 3: Import snort settings and convert to the required format for the new IDS ## (suricata). # @@ -135,7 +170,7 @@ if($snortsettings{"OINKCODE"}) { } # -## Step 3: Import guardian settings and whitelist if the addon is installed. +## Step 4: Import guardian settings and whitelist if the addon is installed. # # Pakfire meta file for owncloud. @@ -183,7 +218,7 @@ if (-f $guardian_meta) { } # -## Step 4: Save IDS and rules settings. +## Step 5: Save IDS and rules settings. # # Write IDS settings. @@ -193,27 +228,17 @@ if (-f $guardian_meta) { &General::writehash("$IDS::rules_settings_file", \%rulessettings); # -## Step 5: Generate and write the file to modify the ruleset. +## Step 6: Generate and write the file to modify the ruleset. # -# Converters default is to only monitor the traffic, so set the IDS action to -# "alert". -my $IDS_action = "alert"; - -# Check if the traffic only should be monitored. -if ($idssettings{"MONITOR_TRAFFIC_ONLY"} eq "off") { - # Swith IDS action to alert only. - $IDS_action = "drop"; -} - # Call subfunction and pass the desired IDS action. -&IDS::write_modify_sids_file($IDS_action); +&IDS::write_modify_sids_file(); # Set correct ownership. &IDS::set_ownership("$IDS::modify_sids_file"); # -## Step 6: Move rulestarball to its new location. +## Step 7: Move rulestarball to its new location. # # Check if a rulestarball has been downloaded yet. @@ -231,13 +256,16 @@ if (-f $snort_rules_tarball) { } else { # Check if enought disk space is available. if(&IDS::checkdiskspace()) { + # Print error message. + print "Could not download ruleset - Not enough free diskspace available.\n"; + } else { # Call the download function and grab the new ruleset. &IDS::downloadruleset(); } } # -## Step 7: Call oinkmaster to extract and setup the rules structures. +## Step 8: Call oinkmaster to extract and setup the rules structures. # # Check if a rulestarball is present. @@ -250,7 +278,47 @@ if (-f $IDS::rulestarball) { } # -## Step 8: Grab used ruleset files from snort config file and convert +## Step 9: Generate file for the HOME Net. +# + +# Call subfunction to generate the file. +&IDS::generate_home_net_file(); + +# Set correct ownership for the homenet file. +&IDS::set_ownership("$IDS::homenet_file"); + +# +## Step 10: Generate file for the DNS servers. +# + +# Call subfunction to generate the file. +&IDS::generate_dns_servers_file(); + +# Set correct ownership for the dns_servers_file. +&IDS::set_ownership("$IDS::dns_servers_file"); + +# +## Step 11: Generate file which contains the HTTP ports. +# + +# Call subfunction to generate the file. +&IDS::generate_http_ports_file(); + +# Set correct ownership for the http_ports_file. +&IDS::set_ownership("$IDS::http_ports_file"); + +# +## Step 12: Setup automatic ruleset updates. +# + +# Check if a ruleset is configured. +if($rulessettings{"RULES"}) { + # Call suricatactrl and setup the periodic update mechanism. + &IDS::call_suricatactrl("cron", $rulessettings{'AUTOUPDATE_INTERVAL'}); +} + +# +## Step 13: Grab used ruleset files from snort config file and convert ## them into the new format. # @@ -296,24 +364,7 @@ close(SNORTCONF); &IDS::write_used_rulefiles_file(@enabled_rule_files); # -## Step 9: Generate file for the HOME Net. -# - -# Call subfunction to generate the file. -&IDS::generate_home_net_file(); - -# -## Step 10: Setup automatic ruleset updates. -# - -# Check if a ruleset is configured. -if($rulessettings{"RULES"}) { - # Call suricatactrl and setup the periodic update mechanism. - &IDS::call_suricatactrl("cron", $rulessettings{'AUTOUPDATE_INTERVAL'}); -} - -# -## Step 11: Start the IDS if enabled. +## Step 14: Start the IDS if enabled. # # Check if the IDS should be started.