ossec-local.sh

   1 #!/bin/sh
   2 # ossec-control        This shell script takes care of starting
   3 #                      or stopping ossec-hids
   4 # Author: Daniel B. Cid <daniel.cid@gmail.com>
   5
   6
   7 # Getting where we are installed
   8 LOCAL=`dirname $0`;
   9 cd ${LOCAL}
  10 PWD=`pwd`
  11 DIR=`dirname $PWD`;
  12 PLIST=${DIR}/bin/.process_list;
  13
  14
  15 ###  Do not modify bellow here ###
  16
  17 # Getting additional processes
  18 ls -la ${PLIST} > /dev/null 2>&1
  19 if [ $? = 0 ]; then
  20 . ${PLIST};
  21 fi
  22
  23
  24 NAME="OSSEC HIDS"
  25 VERSION="v2.8.3"
  26 AUTHOR="Trend Micro Inc."
  27 DAEMONS="ossec-monitord ossec-logcollector ossec-syscheckd ossec-analysisd ossec-maild ossec-execd ${DB_DAEMON} ${CSYSLOG_DAEMON} ${AGENTLESS_DAEMON}"
  28
  29
  30 ## Locking for the start/stop
  31 LOCK="${DIR}/var/start-script-lock"
  32 LOCK_PID="${LOCK}/pid"
  33
  34
  35 # This number should be more than enough (even if it is
  36 # started multiple times together). It will try for up
  37 # to 10 attempts (or 10 seconds) to execute.
  38 MAX_ITERATION="10"
  39
  40
  41
  42 # Check pid
  43 checkpid()
  44 {
  45     for i in ${DAEMONS}; do
  46         for j in `cat ${DIR}/var/run/${i}*.pid 2>/dev/null`; do
  47             ps -p $j |grep ossec >/dev/null 2>&1
  48             if [ ! $? = 0 ]; then
  49                 echo "Deleting PID file '${DIR}/var/run/${i}-${j}.pid' not used..."
  50                 rm ${DIR}/var/run/${i}-${j}.pid
  51             fi
  52         done
  53     done
  54 }
  55
  56
  57
  58 # Lock function
  59 lock()
  60 {
  61     i=0;
  62
  63     # Providing a lock.
  64     while [ 1 ]; do
  65         mkdir ${LOCK} > /dev/null 2>&1
  66         MSL=$?
  67         if [ "${MSL}" = "0" ]; then
  68             # Lock aquired (setting the pid)
  69             echo "$$" > ${LOCK_PID}
  70             return;
  71         fi
  72
  73         # Waiting 1 second before trying again
  74         sleep 1;
  75         i=`expr $i + 1`;
  76
  77         # If PID is not present, speed things a bit.
  78         kill -0 `cat ${LOCK_PID}` >/dev/null 2>&1
  79         if [ ! $? = 0 ]; then
  80             # Pid is not present.
  81             i=`expr $i + 1`;
  82         fi
  83
  84         # We tried 10 times to acquire the lock.
  85         if [ "$i" = "${MAX_ITERATION}" ]; then
  86             # Unlocking and executing
  87             unlock;
  88             mkdir ${LOCK} > /dev/null 2>&1
  89             echo "$$" > ${LOCK_PID}
  90             return;
  91         fi
  92     done
  93 }
  94
  95
  96 # Unlock function
  97 unlock()
  98 {
  99     rm -rf ${LOCK}
 100 }
 101
 102
 103 # Help message
 104 help()
 105 {
 106     # Help message
 107     echo ""
 108     echo "Usage: $0 {start|stop|restart|status|enable|disable}";
 109     exit 1;
 110 }
 111
 112
 113 # Enables/disables additional daemons
 114 enable()
 115 {
 116     if [ "X$2" = "X" ]; then
 117         echo ""
 118         echo "Enable options: database, client-syslog, agentless, debug"
 119         echo "Usage: $0 enable [database|client-syslog|agentless|debug]"
 120         exit 1;
 121     fi
 122
 123     if [ "X$2" = "Xdatabase" ]; then
 124         echo "DB_DAEMON=ossec-dbd" >> ${PLIST};
 125     elif [ "X$2" = "Xclient-syslog" ]; then
 126         echo "CSYSLOG_DAEMON=ossec-csyslogd" >> ${PLIST};
 127     elif [ "X$2" = "Xagentless" ]; then
 128         echo "AGENTLESS_DAEMON=ossec-agentlessd" >> ${PLIST};
 129     elif [ "X$2" = "Xdebug" ]; then
 130         echo "DEBUG_CLI=\"-d\"" >> ${PLIST};
 131     else
 132         echo ""
 133         echo "Invalid enable option."
 134         echo ""
 135         echo "Enable options: database, client-syslog, agentless, debug"
 136         echo "Usage: $0 enable [database|client-syslog|agentless|debug]"
 137         exit 1;
 138     fi
 139
 140
 141 }
 142
 143
 144
 145 # Enables/disables additional daemons
 146 disable()
 147 {
 148     if [ "X$2" = "X" ]; then
 149         echo ""
 150         echo "Disable options: database, client-syslog, agentless, debug"
 151         echo "Usage: $0 disable [database|client-syslog|agentless,debug]"
 152         exit 1;
 153     fi
 154
 155     if [ "X$2" = "Xdatabase" ]; then
 156         echo "DB_DAEMON=\"\"" >> ${PLIST};
 157     elif [ "X$2" = "Xclient-syslog" ]; then
 158         echo "CSYSLOG_DAEMON=\"\"" >> ${PLIST};
 159     elif [ "X$2" = "Xagentless" ]; then
 160         echo "AGENTLESS_DAEMON=\"\"" >> ${PLIST};
 161     elif [ "X$2" = "Xdebug" ]; then
 162         echo "DEBUG_CLI=\"\"" >> ${PLIST};
 163     else
 164         echo ""
 165         echo "Invalid disable option."
 166         echo ""
 167         echo "Disable options: database, client-syslog, agentless, debug"
 168         echo "Usage: $0 disable [database|client-syslog|agentless|debug]"
 169         exit 1;
 170     fi
 171
 172
 173 }
 174
 175
 176
 177 # Status function
 178 status()
 179 {
 180     RETVAL=0
 181     for i in ${DAEMONS}; do
 182         pstatus ${i};
 183         if [ $? = 0 ]; then
 184             RETVAL=1
 185             echo "${i} not running..."
 186         else
 187             echo "${i} is running..."
 188         fi
 189     done
 190     exit $RETVAL
 191 }
 192
 193 testconfig()
 194 {
 195     # We first loop to check the config.
 196     for i in ${SDAEMONS}; do
 197         ${DIR}/bin/${i} -t ${DEBUG_CLI};
 198         if [ $? != 0 ]; then
 199             echo "${i}: Configuration error. Exiting"
 200             unlock;
 201             exit 1;
 202         fi
 203     done
 204 }
 205
 206
 207 # Start function
 208 start()
 209 {
 210     SDAEMONS="${DB_DAEMON} ${CSYSLOG_DAEMON} ${AGENTLESS_DAEMON} ossec-maild ossec-execd ossec-analysisd ossec-logcollector ossec-syscheckd ossec-monitord"
 211
 212     echo "Starting $NAME $VERSION (by $AUTHOR)..."
 213     echo | ${DIR}/bin/ossec-logtest > /dev/null 2>&1;
 214     if [ ! $? = 0 ]; then
 215         echo "ossec-analysisd: Configuration error. Exiting."
 216         exit 1;
 217     fi
 218
 219     lock;
 220     checkpid;
 221
 222
 223     # We actually start them now.
 224     for i in ${SDAEMONS}; do
 225         pstatus ${i};
 226         if [ $? = 0 ]; then
 227             ${DIR}/bin/${i} ${DEBUG_CLI};
 228             if [ $? != 0 ]; then
 229                 echo "${i} did not start correctly.";
 230                 unlock;
 231                 exit 1;
 232             fi
 233
 234             echo "Started ${i}..."
 235         else
 236             echo "${i} already running..."
 237         fi
 238
 239     done
 240
 241     # After we start we give 2 seconds for the daemons
 242     # to internally create their PID files.
 243     sleep 2;
 244     unlock;
 245
 246     ls -la "${DIR}/ossec-agent/" >/dev/null 2>&1
 247     if [ $? = 0 ]; then
 248         echo ""
 249         echo "Starting sub agent directory (for hybrid mode)"
 250         ${DIR}/ossec-agent/bin/ossec-control start
 251     fi
 252
 253     echo "Completed."
 254 }
 255
 256 # Process status
 257 pstatus()
 258 {
 259     pfile=$1;
 260
 261     # pfile must be set
 262     if [ "X${pfile}" = "X" ]; then
 263         return 0;
 264     fi
 265
 266     ls ${DIR}/var/run/${pfile}*.pid > /dev/null 2>&1
 267     if [ $? = 0 ]; then
 268         for j in `cat ${DIR}/var/run/${pfile}*.pid 2>/dev/null`; do
 269             ps -p $j |grep ossec >/dev/null 2>&1
 270             if [ ! $? = 0 ]; then
 271                 echo "${pfile}: Process $j not used by ossec, removing .."
 272                 rm -f ${DIR}/var/run/${pfile}-$j.pid
 273                 continue;
 274             fi
 275
 276             kill -0 $j > /dev/null 2>&1
 277             if [ $? = 0 ]; then
 278                 return 1;
 279             fi
 280         done
 281     fi
 282
 283     return 0;
 284 }
 285
 286
 287 # Stop all
 288 stopa()
 289 {
 290     lock;
 291     checkpid;
 292     for i in ${DAEMONS}; do
 293         pstatus ${i};
 294         if [ $? = 1 ]; then
 295             echo "Killing ${i} .. ";
 296
 297             kill `cat ${DIR}/var/run/${i}*.pid`;
 298         else
 299             echo "${i} not running ..";
 300         fi
 301
 302         rm -f ${DIR}/var/run/${i}*.pid
 303
 304      done
 305
 306     unlock;
 307
 308     ls -la "${DIR}/ossec-agent/" >/dev/null 2>&1
 309     if [ $? = 0 ]; then
 310         echo ""
 311         echo "Stopping sub agent directory (for hybrid mode)"
 312         ${DIR}/ossec-agent/bin/ossec-control stop
 313     fi
 314     echo "$NAME $VERSION Stopped"
 315 }
 316
 317
 318 ### MAIN HERE ###
 319
 320 case "$1" in
 321   start)
 322     testconfig
 323         start
 324         ;;
 325   stop)
 326         stopa
 327         ;;
 328   restart)
 329     testconfig
 330         stopa
 331         sleep 1;
 332         start
 333         ;;
 334   status)
 335     status
 336         ;;
 337   help)
 338     help
 339     ;;
 340   enable)
 341     enable $1 $2;
 342     ;;
 343   disable)
 344     disable $1 $2;
 345     ;;
 346   *)
 347     help
 348 esac