src/initscripts/init.d/snort

   1 #!/bin/sh
   2 ########################################################################
   3 # Begin $rc_base/init.d/snort
   4 #
   5 # Description : Snort Initscript
   6 #
   7 # Authors     : Michael Tremer for ipfire.org - mitch@ipfire.org
   8 #
   9 # Version     : 01.00
  10 #
  11 # Notes       :
  12 #
  13 ########################################################################
  14
  15 . /etc/sysconfig/rc
  16 . ${rc_functions}
  17
  18 PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
  19
  20 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  21 eval $(/usr/local/bin/readhash /var/ipfire/snort/settings)
  22
  23 if [ "$ENABLE_SNORT_ORANGE" == "on" ]; then
  24         HOME_NET+="$ORANGE_ADDRESS,"
  25         DEVICES+="$ORANGE_DEV "
  26 fi
  27
  28 if [ "$ENABLE_SNORT_GREEN" == "on" ]; then
  29         HOME_NET+="$GREEN_ADDRESS,"
  30         DEVICES+="$GREEN_DEV "
  31 fi
  32
  33 if [ "$ENABLE_SNORT_BLUE" == "on" ]; then
  34         HOME_NET+="$BLUE_ADDRESS,"
  35         DEVICES+="$BLUE_DEV "
  36 fi
  37
  38 if [ "$ENABLE_SNORT" == "on" ]; then
  39         LOCAL_IP=`cat /var/ipfire/red/local-ipaddress`
  40         if [ "$LOCAL_IP" ]; then
  41                 HOME_NET+="$LOCAL_IP,"
  42         else
  43                 exit 1 ## Add error handling here
  44         fi
  45         DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null`
  46 fi
  47
  48 COUNT=`echo $HOME_NET | wc -m`
  49 HOME_NET=`echo $HOME_NET | cut -c $[$COUNT - 2]`
  50
  51 echo "var HOME_NET [$HOME_NET]" >       /etc/snort/vars
  52 echo "var EXTERNAL_NET ANY" >>          /etc/snort/vars
  53
  54 DNS1=`cat /var/ipfire/red/dns1 2>/dev/null`
  55 DNS2=`cat /var/ipfire/red/dns2 2>/dev/null`
  56
  57 if [ "$DNS2" ]; then
  58         echo "var DNS_SERVERS [$DNS1,$DNS2]" >> /etc/snort/vars
  59 else
  60         echo "var DNS_SERVERS $DNS1" >> /etc/snort/vars
  61 fi
  62
  63 case "$1" in
  64         start)
  65                 # Disable incompatible rules
  66                 for file in $(ls /etc/snort/rules/*.rules); do
  67                         sed -i 's|^alert.*!\[\$DNS_SERVERS|#&|g' $file
  68                         sed -i 's|^alert.*!\$SSH_PORTS|#&|g' $file
  69                         sed -i 's|^alert.*!\$HOME_NET|#&|g' $file
  70                         sed -i 's|^alert.*!\$SQL_SERVERS|#&|g' $file
  71                 done
  72
  73                 for DEVICE in $DEVICES; do
  74                         boot_mesg "Starting Intrusion Detection System on $DEVICE..."
  75                         /usr/sbin/snort -c /etc/snort/snort.conf -i $DEVICE -D -l /var/log/snort --create-pidfile --nolock-pidfile --pid-path /var/run/
  76                         evaluate_retval
  77                         sleep 1
  78                         chmod 644 /var/run/snort_$DEVICE.pid
  79                 done
  80
  81
  82                 if [ -r /var/ipfire/guardian/enable ]; then
  83                               IFACE=`/bin/cat /var/ipfire/red/iface 2>/dev/null | /usr/bin/tr -d '\012'`
  84                         sed -e "s/^Interface.*/Interface       ${IFACE}/" /var/ipfire/guardian/guardian.conf > temp
  85                         mv temp /var/ipfire/guardian/guardian.conf
  86                         chown nobody.root /var/ipfire/guardian/guardian.conf
  87
  88                   boot_mesg "Starting Guardian..."
  89                               loadproc /usr/local/bin/guardian.pl -c /var/ipfire/guardian/guardian.conf
  90                             fi
  91                     ;;
  92
  93         stop)
  94                DEVICES=""
  95                if [ -r /var/run/snort_$BLUE_DEV.pid ]; then
  96                  DEVICES+="$BLUE_DEV "
  97                fi
  98
  99                if [ -r /var/run/snort_$GREEN_DEV.pid ]; then
 100                  DEVICES+="$GREEN_DEV "
 101               fi
 102
 103               if [ -r /var/run/snort_$ORANGE_DEV.pid ]; then
 104                  DEVICES+="$ORANGE_DEV "
 105               fi
 106
 107               RED=`cat /var/ipfire/red/iface 2>/dev/null`
 108               if [ -r /var/run/snort_$RED.pid ]; then
 109                  DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null`
 110               fi
 111
 112               for DEVICE in $DEVICES; do
 113                  boot_mesg "Stopping Intrusion Detection System on $DEVICE..."
 114                  killproc -p /var/run/snort_$DEVICE.pid /var/run
 115               done
 116
 117               rm /var/run/snort_* >/dev/null 2>/dev/null
 118
 119               if [ -r /var/ipfire/guardian/enable ]; then
 120                           boot_mesg "Stopping Guardian..."
 121                           killproc /usr/local/bin/guardian.pl
 122                           fi
 123         ;;
 124
 125         status)
 126                 statusproc /usr/sbin/snort
 127                 ;;
 128
 129         restart)
 130                 $0 stop
 131                 $0 start
 132                 ;;
 133
 134         *)
 135                 echo "Usage: $0 {start|stop|restart|status}"
 136                 exit 1
 137                 ;;
 138 esac
 139
 140 chmod 644 /var/log/snort/* 2>/dev/null
 141
 142 # End $rc_base/init.d/snort