src/initscripts/init.d/snort

   1 #!/bin/sh
   2 ########################################################################
   3 # Begin $rc_base/init.d/snort
   4 #
   5 # Description : Snort Initscript
   6 #
   7 # Authors     : Michael Tremer for ipfire.org - mitch@ipfire.org
   8 #
   9 # Version     : 01.00
  10 #
  11 # Notes       :
  12 #
  13 ########################################################################
  14
  15 . /etc/sysconfig/rc
  16 . ${rc_functions}
  17
  18 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  19 eval $(/usr/local/bin/readhash /var/ipfire/snort/settings)
  20
  21 if [ "$ENABLE_SNORT_ORANGE" == "on" ]; then
  22         HOME_NET+="$ORANGE_ADDRESS,"
  23         DEVICES+="$ORANGE_DEV "
  24 fi
  25
  26 if [ "$ENABLE_SNORT_GREEN" == "on" ]; then
  27         HOME_NET+="$GREEN_ADDRESS,"
  28         DEVICES+="$GREEN_DEV "
  29 fi
  30
  31 if [ "$ENABLE_SNORT_BLUE" == "on" ]; then
  32         HOME_NET+="$BLUE_ADDRESS,"
  33         DEVICES+="$BLUE_DEV "
  34 fi
  35
  36 if [ "$ENABLE_SNORT" == "on" ]; then
  37         LOCAL_IP=`cat /var/ipfire/red/local-ipaddress`
  38         if [ "$LOCAL_IP" ]; then
  39                 HOME_NET+="$LOCAL_IP,"
  40         else
  41                 exit 1 ## Add error handling here
  42         fi
  43         DEVICES+=`cat /var/ipfire/red/iface`
  44 fi
  45
  46 COUNT=`echo $HOME_NET | wc -m`
  47 HOME_NET=`echo $HOME_NET | cut -c $[$COUNT - 2]`
  48
  49 echo "var HOME_NET [$HOME_NET]" >       /etc/snort/vars
  50 echo "var EXTERNAL_NET ANY" >>          /etc/snort/vars
  51
  52 DNS1=`cat /var/ipfire/red/dns1`
  53 DNS2=`cat /var/ipfire/red/dns2`
  54
  55 if [ "$DNS2" ]; then
  56         echo "var DNS_SERVERS [$DNS1,$DNS2]" >> /etc/snort/vars
  57 else
  58         echo "var DNS_SERVERS $DNS1" >> /etc/snort/vars
  59 fi
  60
  61 case "$1" in
  62         start)
  63                 for DEVICE in $DEVICES; do
  64                         boot_mesg "Starting Intrusion Detection System on $DEVICE..."
  65                         /usr/sbin/snort -c /etc/snort/snort.conf -i $DEVICE -D -l /var/log/snort --create-pidfile --nolock-pidfile --pid-path /var/run/
  66                         evaluate_retval
  67                         chmod 644 /var/run/snort_$DEVICE.pid
  68                 done
  69                 ;;
  70
  71         stop)
  72              DEVICES=""
  73              if [ -r /var/run/snort_$BLUE_DEV.pid ]; then
  74                  DEVICES+="$BLUE_DEV "
  75        fi
  76              if [ -r /var/run/snort_$GREEN_DEV.pid ]; then
  77                  DEVICES+="$GREEN_DEV "
  78        fi
  79              if [ -r /var/run/snort_$ORANGE_DEV.pid ]; then
  80                  DEVICES+="$ORANGE_DEV "
  81        fi
  82
  83        RED=`cat /var/ipfire/red/iface`
  84        if [ -r /var/run/snort_$RED.pid ]; then
  85                  DEVICES+=`cat /var/ipfire/red/iface`
  86        fi
  87
  88     for DEVICE in $DEVICES; do
  89                         boot_mesg "Stopping Intrusion Detection System on $DEVICE..."
  90                         killproc -p /var/run/snort_$DEVICE.pid /var/run
  91                 done
  92
  93                 rm /var/run/snort_*
  94                 ;;
  95
  96         status)
  97                 statusproc /usr/sbin/snort
  98                 ;;
  99
 100         restart)
 101                 $0 stop
 102                 $0 start
 103                 ;;
 104
 105         *)
 106                 echo "Usage: $0 {start|stop|restart|status}"
 107                 exit 1
 108                 ;;
 109 esac
 110
 111 # End $rc_base/init.d/snort