Replaced snort gpl community rules by emergingthreats.net rules.
[people/pmueller/ipfire-2.x.git] / src / initscripts / init.d / snort
1 #!/bin/sh
2 ########################################################################
3 # Begin $rc_base/init.d/snort
4 #
5 # Description : Snort Initscript
6 #
7 # Authors     : Michael Tremer for ipfire.org - mitch@ipfire.org
8 #
9 # Version     : 01.00
10 #
11 # Notes       :
12 #
13 ########################################################################
14
15 . /etc/sysconfig/rc
16 . ${rc_functions}
17
18 PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
19
20 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
21 eval $(/usr/local/bin/readhash /var/ipfire/snort/settings)
22
23 if [ "$ENABLE_SNORT_ORANGE" == "on" ]; then
24         HOME_NET+="$ORANGE_ADDRESS,"
25         DEVICES+="$ORANGE_DEV "
26 fi
27
28 if [ "$ENABLE_SNORT_GREEN" == "on" ]; then
29         HOME_NET+="$GREEN_ADDRESS,"
30         DEVICES+="$GREEN_DEV "
31 fi
32
33 if [ "$ENABLE_SNORT_BLUE" == "on" ]; then
34         HOME_NET+="$BLUE_ADDRESS,"
35         DEVICES+="$BLUE_DEV "
36 fi
37
38 if [ "$ENABLE_SNORT" == "on" ]; then
39         LOCAL_IP=`cat /var/ipfire/red/local-ipaddress`
40         if [ "$LOCAL_IP" ]; then
41                 HOME_NET+="$LOCAL_IP,"
42         else
43                 exit 1 ## Add error handling here
44         fi
45         DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null`
46 fi
47
48 COUNT=`echo $HOME_NET | wc -m`
49 HOME_NET=`echo $HOME_NET | cut -c $[$COUNT - 2]`
50  
51 echo "var HOME_NET [$HOME_NET]" >       /etc/snort/vars
52 echo "var EXTERNAL_NET ANY" >>          /etc/snort/vars
53
54 DNS1=`cat /var/ipfire/red/dns1 2>/dev/null`
55 DNS2=`cat /var/ipfire/red/dns2 2>/dev/null`
56
57 if [ "$DNS2" ]; then
58         echo "var DNS_SERVERS [$DNS1,$DNS2]" >> /etc/snort/vars
59 else
60         echo "var DNS_SERVERS $DNS1" >> /etc/snort/vars
61 fi 
62
63 case "$1" in
64         start)
65                 # Disable incompatible rules
66                 for file in $(ls /etc/snort/rules/*.rules); do
67                         sed -i 's|^alert.*!\[\$DNS_SERVERS|#&|g' $file
68                         sed -i 's|^alert.*!\$SSH_PORTS|#&|g' $file
69                         sed -i 's|^alert.*!\$HOME_NET|#&|g' $file
70                         sed -i 's|^alert.*!\$SQL_SERVERS|#&|g' $file
71                 done
72
73                 for DEVICE in $DEVICES; do
74                         boot_mesg "Starting Intrusion Detection System on $DEVICE..."
75                         /usr/sbin/snort -c /etc/snort/snort.conf -i $DEVICE -D -l /var/log/snort --create-pidfile --nolock-pidfile --pid-path /var/run/
76                         evaluate_retval
77                         sleep 1
78                         chmod 644 /var/run/snort_$DEVICE.pid
79                 done
80                 
81           
82                 if [ -r /var/ipfire/guardian/enable ]; then
83                               IFACE=`/bin/cat /var/ipfire/red/iface 2>/dev/null | /usr/bin/tr -d '\012'`
84                         sed -e "s/^Interface.*/Interface       ${IFACE}/" /var/ipfire/guardian/guardian.conf > temp
85                         mv temp /var/ipfire/guardian/guardian.conf
86                         chown nobody.root /var/ipfire/guardian/guardian.conf
87                       
88                   boot_mesg "Starting Guardian..."
89                               loadproc /usr/local/bin/guardian.pl -c /var/ipfire/guardian/guardian.conf
90                             fi
91                     ;;
92                 
93         stop)
94                DEVICES=""
95                if [ -r /var/run/snort_$BLUE_DEV.pid ]; then
96                  DEVICES+="$BLUE_DEV "
97                fi
98                
99                if [ -r /var/run/snort_$GREEN_DEV.pid ]; then
100                  DEVICES+="$GREEN_DEV "
101               fi
102              
103               if [ -r /var/run/snort_$ORANGE_DEV.pid ]; then
104                  DEVICES+="$ORANGE_DEV "
105               fi
106       
107               RED=`cat /var/ipfire/red/iface 2>/dev/null`
108               if [ -r /var/run/snort_$RED.pid ]; then
109                  DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null`
110               fi
111        
112               for DEVICE in $DEVICES; do
113                  boot_mesg "Stopping Intrusion Detection System on $DEVICE..."
114                  killproc -p /var/run/snort_$DEVICE.pid /var/run
115               done
116               
117               rm /var/run/snort_* >/dev/null 2>/dev/null
118                 
119               if [ -r /var/ipfire/guardian/enable ]; then
120                           boot_mesg "Stopping Guardian..."
121                           killproc /usr/local/bin/guardian.pl
122                           fi
123         ;;
124                 
125         status)
126                 statusproc /usr/sbin/snort
127                 ;;
128                 
129         restart)
130                 $0 stop
131                 $0 start
132                 ;;
133                 
134         *)
135                 echo "Usage: $0 {start|stop|restart|status}"
136                 exit 1
137                 ;;
138 esac
139
140 chmod 644 /var/log/snort/* 2>/dev/null
141
142 # End $rc_base/init.d/snort