Snort scripts and config update.
[ipfire-2.x.git] / src / initscripts / init.d / snort
1 #!/bin/sh
2 ########################################################################
3 # Begin $rc_base/init.d/snort
4 #
5 # Description : Snort Initscript
6 #
7 # Authors     : Michael Tremer for ipfire.org - mitch@ipfire.org
8 #
9 # Version     : 01.00
10 #
11 # Notes       :
12 #
13 ########################################################################
14
15 . /etc/sysconfig/rc
16 . ${rc_functions}
17
18 PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
19
20 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
21 eval $(/usr/local/bin/readhash /var/ipfire/snort/settings)
22
23 case "$1" in
24         start)
25                 if [ "$BLUE_NETADDRESS" ]; then
26                         BLUE_NET="$BLUE_NETADDRESS/$BLUE_NETMASK,"
27                         BLUE_IP="$BLUE_ADDRESS,"
28                 fi
29
30                 if [ "$ORANGE_NETADDRESS" ]; then
31                         ORANGE_NET="$ORANGE_NETADDRESS/$ORANGE_NETMASK,"
32                         ORANGE_IP="$ORANGE_ADDRESS,"
33                 fi
34
35                 if [ "$ENABLE_SNORT_ORANGE" == "on" ]; then
36                         DEVICES+="$ORANGE_DEV "
37                         HOMENET+="$ORANGE_IP"
38                 else
39                         HOMENET+="$ORANGE_NET"
40                 fi
41
42                 if [ "$ENABLE_SNORT_BLUE" == "on" ]; then
43                         DEVICES+="$BLUE_DEV "
44                         HOMENET+="$BLUE_IP"
45                 else
46                         HOMENET+="$BLUE_NET"
47                 fi
48
49                 if [ "$ENABLE_SNORT_GREEN" == "on" ]; then
50                         DEVICES+="$GREEN_DEV "
51                         HOMENET+="$GREEN_ADDRESS,"
52                 else
53                         HOMENET+="$GREEN_NETADDRESS/$GREEN_NETMASK,"
54                 fi
55
56                 if [ "$ENABLE_SNORT" == "on" ]; then
57                         DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null`
58                         LOCAL_IP=`cat /var/ipfire/red/local-ipaddress 2>/dev/null`
59                         if [ "$LOCAL_IP" ]; then
60                                 HOMENET+="$LOCAL_IP,"
61                         fi
62                 fi
63                 HOMENET+="127.0.0.1"
64                 echo "var HOME_NET [$HOMENET]" > /etc/snort/vars
65
66                 DNS1=`cat /var/ipfire/red/dns1 2>/dev/null`
67                 DNS2=`cat /var/ipfire/red/dns2 2>/dev/null`
68
69                 if [ "$DNS2" ]; then
70                         echo "var DNS_SERVERS [$DNS1,$DNS2]" >> /etc/snort/vars
71                 else
72                         echo "var DNS_SERVERS $DNS1" >> /etc/snort/vars
73                 fi
74
75                 for DEVICE in $DEVICES; do
76                         boot_mesg "Starting Intrusion Detection System on $DEVICE..."
77                         /usr/sbin/snort -c /etc/snort/snort.conf -i $DEVICE -D -l /var/log/snort --create-pidfile --nolock-pidfile --pid-path /var/run/
78                         evaluate_retval
79                         sleep 1
80                         chmod 644 /var/run/snort_$DEVICE.pid
81                 done
82                 
83           
84                 if [ -r /var/ipfire/guardian/enable ]; then
85                               IFACE=`/bin/cat /var/ipfire/red/iface 2>/dev/null | /usr/bin/tr -d '\012'`
86                         sed -e "s/^Interface.*/Interface       ${IFACE}/" /var/ipfire/guardian/guardian.conf > temp
87                         mv temp /var/ipfire/guardian/guardian.conf
88                         chown nobody.root /var/ipfire/guardian/guardian.conf
89                       
90                   boot_mesg "Starting Guardian..."
91                               loadproc /usr/local/bin/guardian.pl -c /var/ipfire/guardian/guardian.conf
92                             fi
93                     ;;
94                 
95         stop)
96                DEVICES=""
97                if [ -r /var/run/snort_$BLUE_DEV.pid ]; then
98                  DEVICES+="$BLUE_DEV "
99                fi
100                
101                if [ -r /var/run/snort_$GREEN_DEV.pid ]; then
102                  DEVICES+="$GREEN_DEV "
103               fi
104              
105               if [ -r /var/run/snort_$ORANGE_DEV.pid ]; then
106                  DEVICES+="$ORANGE_DEV "
107               fi
108       
109               RED=`cat /var/ipfire/red/iface 2>/dev/null`
110               if [ -r /var/run/snort_$RED.pid ]; then
111                  DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null`
112               fi
113        
114               for DEVICE in $DEVICES; do
115                  boot_mesg "Stopping Intrusion Detection System on $DEVICE..."
116                  killproc -p /var/run/snort_$DEVICE.pid /var/run
117               done
118               
119               rm /var/run/snort_* >/dev/null 2>/dev/null
120                 
121               if [ -r /var/ipfire/guardian/enable ]; then
122                           boot_mesg "Stopping Guardian..."
123                           killproc /usr/local/bin/guardian.pl
124                           fi
125         ;;
126                 
127         status)
128                 statusproc /usr/sbin/snort
129                 ;;
130                 
131         restart)
132                 $0 stop
133                 $0 start
134                 ;;
135                 
136         *)
137                 echo "Usage: $0 {start|stop|restart|status}"
138                 exit 1
139                 ;;
140 esac
141
142 chmod 644 /var/log/snort/* 2>/dev/null
143
144 # End $rc_base/init.d/snort