Fix snort errormessage if no rules are present to check.
[ipfire-2.x.git] / src / initscripts / init.d / snort
CommitLineData
bd3a8a50 1#!/bin/sh
83843a1c
MT
2########################################################################
3# Begin $rc_base/init.d/snort
4#
5# Description : Snort Initscript
6#
7# Authors : Michael Tremer for ipfire.org - mitch@ipfire.org
8#
9# Version : 01.00
bd3a8a50 10#
83843a1c
MT
11# Notes :
12#
13########################################################################
14
15. /etc/sysconfig/rc
16. ${rc_functions}
bd3a8a50 17
1b73b07e
CS
18PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
19
bd3a8a50 20eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
83843a1c 21eval $(/usr/local/bin/readhash /var/ipfire/snort/settings)
bd3a8a50 22
83843a1c 23if [ "$ENABLE_SNORT_ORANGE" == "on" ]; then
1b73b07e
CS
24 HOME_NET+="$ORANGE_ADDRESS,"
25 DEVICES+="$ORANGE_DEV "
83843a1c 26fi
bd3a8a50 27
83843a1c 28if [ "$ENABLE_SNORT_GREEN" == "on" ]; then
1b73b07e
CS
29 HOME_NET+="$GREEN_ADDRESS,"
30 DEVICES+="$GREEN_DEV "
83843a1c 31fi
bd3a8a50 32
83843a1c 33if [ "$ENABLE_SNORT_BLUE" == "on" ]; then
1b73b07e
CS
34 HOME_NET+="$BLUE_ADDRESS,"
35 DEVICES+="$BLUE_DEV "
83843a1c 36fi
bd3a8a50 37
83843a1c 38if [ "$ENABLE_SNORT" == "on" ]; then
1b73b07e
CS
39 LOCAL_IP=`cat /var/ipfire/red/local-ipaddress`
40 if [ "$LOCAL_IP" ]; then
41 HOME_NET+="$LOCAL_IP,"
42 else
43 exit 1 ## Add error handling here
44 fi
45 DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null`
83843a1c 46fi
bd3a8a50 47
83843a1c
MT
48COUNT=`echo $HOME_NET | wc -m`
49HOME_NET=`echo $HOME_NET | cut -c $[$COUNT - 2]`
50
1b73b07e
CS
51echo "var HOME_NET [$HOME_NET]" > /etc/snort/vars
52echo "var EXTERNAL_NET ANY" >> /etc/snort/vars
bd3a8a50 53
e65dae7e
CS
54DNS1=`cat /var/ipfire/red/dns1 2>/dev/null`
55DNS2=`cat /var/ipfire/red/dns2 2>/dev/null`
83843a1c
MT
56
57if [ "$DNS2" ]; then
1b73b07e 58 echo "var DNS_SERVERS [$DNS1,$DNS2]" >> /etc/snort/vars
83843a1c 59else
1b73b07e 60 echo "var DNS_SERVERS $DNS1" >> /etc/snort/vars
83843a1c 61fi
bd3a8a50
RZ
62
63case "$1" in
1b73b07e 64 start)
ce0e83b3 65 # Disable incompatible rules
405401cb
AF
66 boot_mesg "Check/Fix Intrusion Detection rules..."
67 for file in $(ls /etc/snort/rules/*.rules 2>/dev/null); do
ce0e83b3
AF
68 sed -i 's|^alert.*!\[\$DNS_SERVERS|#&|g' $file
69 sed -i 's|^alert.*!\$SSH_PORTS|#&|g' $file
70 sed -i 's|^alert.*!\$HOME_NET|#&|g' $file
71 sed -i 's|^alert.*!\$SQL_SERVERS|#&|g' $file
72 done
405401cb 73 echo_ok
ce0e83b3 74
1b73b07e
CS
75 for DEVICE in $DEVICES; do
76 boot_mesg "Starting Intrusion Detection System on $DEVICE..."
77 /usr/sbin/snort -c /etc/snort/snort.conf -i $DEVICE -D -l /var/log/snort --create-pidfile --nolock-pidfile --pid-path /var/run/
78 evaluate_retval
0d7da887 79 sleep 1
1b73b07e
CS
80 chmod 644 /var/run/snort_$DEVICE.pid
81 done
82
83
84 if [ -r /var/ipfire/guardian/enable ]; then
85 IFACE=`/bin/cat /var/ipfire/red/iface 2>/dev/null | /usr/bin/tr -d '\012'`
86 sed -e "s/^Interface.*/Interface ${IFACE}/" /var/ipfire/guardian/guardian.conf > temp
87 mv temp /var/ipfire/guardian/guardian.conf
a61948ad 88 chown nobody.root /var/ipfire/guardian/guardian.conf
1b73b07e
CS
89
90 boot_mesg "Starting Guardian..."
91 loadproc /usr/local/bin/guardian.pl -c /var/ipfire/guardian/guardian.conf
92 fi
93 ;;
94
95 stop)
96 DEVICES=""
97 if [ -r /var/run/snort_$BLUE_DEV.pid ]; then
98 DEVICES+="$BLUE_DEV "
99 fi
100
101 if [ -r /var/run/snort_$GREEN_DEV.pid ]; then
102 DEVICES+="$GREEN_DEV "
103 fi
104
105 if [ -r /var/run/snort_$ORANGE_DEV.pid ]; then
106 DEVICES+="$ORANGE_DEV "
107 fi
cf29614f 108
1b73b07e
CS
109 RED=`cat /var/ipfire/red/iface 2>/dev/null`
110 if [ -r /var/run/snort_$RED.pid ]; then
111 DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null`
112 fi
ce8e4c83 113
1b73b07e
CS
114 for DEVICE in $DEVICES; do
115 boot_mesg "Stopping Intrusion Detection System on $DEVICE..."
116 killproc -p /var/run/snort_$DEVICE.pid /var/run
117 done
118
119 rm /var/run/snort_* >/dev/null 2>/dev/null
120
121 if [ -r /var/ipfire/guardian/enable ]; then
122 boot_mesg "Stopping Guardian..."
123 killproc /usr/local/bin/guardian.pl
124 fi
125 ;;
126
127 status)
128 statusproc /usr/sbin/snort
129 ;;
130
131 restart)
132 $0 stop
133 $0 start
134 ;;
135
136 *)
137 echo "Usage: $0 {start|stop|restart|status}"
138 exit 1
139 ;;
bd3a8a50
RZ
140esac
141
97bfe380 142chmod 644 /var/log/snort/* 2>/dev/null
9c0d99da 143
bd3a8a50 144# End $rc_base/init.d/snort