src/initscripts/init.d/snort

   1 #!/bin/sh
   2 ########################################################################
   3 # Begin $rc_base/init.d/snort
   4 #
   5 # Description : Snort Initscript
   6 #
   7 # Authors     : Michael Tremer for ipfire.org - mitch@ipfire.org
   8 #
   9 # Version     : 01.00
  10 #
  11 # Notes       :
  12 #
  13 ########################################################################
  14
  15 . /etc/sysconfig/rc
  16 . ${rc_functions}
  17
  18 PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
  19
  20 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  21 eval $(/usr/local/bin/readhash /var/ipfire/snort/settings)
  22
  23 case "$1" in
  24         start)
  25                 if [ "$BLUE_NETADDRESS" ]; then
  26                         BLUE_NET="$BLUE_NETADDRESS/$BLUE_NETMASK,"
  27                         BLUE_IP="$BLUE_ADDRESS,"
  28                 fi
  29
  30                 if [ "$ORANGE_NETADDRESS" ]; then
  31                         ORANGE_NET="$ORANGE_NETADDRESS/$ORANGE_NETMASK,"
  32                         ORANGE_IP="$ORANGE_ADDRESS,"
  33                 fi
  34
  35                 if [ "$ENABLE_SNORT_ORANGE" == "on" ]; then
  36                         DEVICES+="$ORANGE_DEV "
  37                         HOMENET+="$ORANGE_IP"
  38                 else
  39                         HOMENET+="$ORANGE_NET"
  40                 fi
  41
  42                 if [ "$ENABLE_SNORT_BLUE" == "on" ]; then
  43                         DEVICES+="$BLUE_DEV "
  44                         HOMENET+="$BLUE_IP"
  45                 else
  46                         HOMENET+="$BLUE_NET"
  47                 fi
  48
  49                 if [ "$ENABLE_SNORT_GREEN" == "on" ]; then
  50                         DEVICES+="$GREEN_DEV "
  51                         HOMENET+="$GREEN_ADDRESS,"
  52                 else
  53                         HOMENET+="$GREEN_NETADDRESS/$GREEN_NETMASK,"
  54                 fi
  55
  56                 if [ "$ENABLE_SNORT" == "on" ]; then
  57                         DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null`
  58                         LOCAL_IP=`cat /var/ipfire/red/local-ipaddress 2>/dev/null`
  59                         if [ "$LOCAL_IP" ]; then
  60                                 HOMENET+="$LOCAL_IP,"
  61                         fi
  62                 fi
  63                 HOMENET+="127.0.0.1"
  64                 echo "var HOME_NET [$HOMENET]" > /etc/snort/vars
  65
  66                 DNS1=`cat /var/ipfire/red/dns1 2>/dev/null`
  67                 DNS2=`cat /var/ipfire/red/dns2 2>/dev/null`
  68
  69                 if [ "$DNS2" ]; then
  70                         echo "var DNS_SERVERS [$DNS1,$DNS2]" >> /etc/snort/vars
  71                 else
  72                         echo "var DNS_SERVERS $DNS1" >> /etc/snort/vars
  73                 fi
  74
  75                 for DEVICE in $DEVICES; do
  76                         boot_mesg "Starting Intrusion Detection System on $DEVICE..."
  77                         /usr/sbin/snort -c /etc/snort/snort.conf -i $DEVICE -D -l /var/log/snort --create-pidfile --nolock-pidfile --pid-path /var/run/
  78                         evaluate_retval
  79                         sleep 1
  80                         chmod 644 /var/run/snort_$DEVICE.pid
  81                 done
  82
  83
  84                 if [ -r /var/ipfire/guardian/enable ]; then
  85                               IFACE=`/bin/cat /var/ipfire/red/iface 2>/dev/null | /usr/bin/tr -d '\012'`
  86                         sed -e "s/^Interface.*/Interface       ${IFACE}/" /var/ipfire/guardian/guardian.conf > temp
  87                         mv temp /var/ipfire/guardian/guardian.conf
  88                         chown nobody.root /var/ipfire/guardian/guardian.conf
  89
  90                   boot_mesg "Starting Guardian..."
  91                               loadproc /usr/local/bin/guardian.pl -c /var/ipfire/guardian/guardian.conf
  92                             fi
  93                     ;;
  94
  95         stop)
  96                DEVICES=""
  97                if [ -r /var/run/snort_$BLUE_DEV.pid ]; then
  98                  DEVICES+="$BLUE_DEV "
  99                fi
 100
 101                if [ -r /var/run/snort_$GREEN_DEV.pid ]; then
 102                  DEVICES+="$GREEN_DEV "
 103               fi
 104
 105               if [ -r /var/run/snort_$ORANGE_DEV.pid ]; then
 106                  DEVICES+="$ORANGE_DEV "
 107               fi
 108
 109               RED=`cat /var/ipfire/red/iface 2>/dev/null`
 110               if [ -r /var/run/snort_$RED.pid ]; then
 111                  DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null`
 112               fi
 113
 114               for DEVICE in $DEVICES; do
 115                  boot_mesg "Stopping Intrusion Detection System on $DEVICE..."
 116                  killproc -p /var/run/snort_$DEVICE.pid /var/run
 117               done
 118
 119               rm /var/run/snort_* >/dev/null 2>/dev/null
 120
 121               if [ -r /var/ipfire/guardian/enable ]; then
 122                           boot_mesg "Stopping Guardian..."
 123                           killproc /usr/local/bin/guardian.pl
 124                           fi
 125         ;;
 126
 127         status)
 128                 statusproc /usr/sbin/snort
 129                 ;;
 130
 131         restart)
 132                 $0 stop
 133                 $0 start
 134                 ;;
 135
 136         *)
 137                 echo "Usage: $0 {start|stop|restart|status}"
 138                 exit 1
 139                 ;;
 140 esac
 141
 142 chmod 644 /var/log/snort/* 2>/dev/null
 143
 144 # End $rc_base/init.d/snort