X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;f=debian%2Fpostinst;h=801d23fd566fcb322188afbc6e49621614099a02;hb=5d904390482bcc78d2f43ff3c99dd87f159179e3;hp=eb8c4f2ac5c0547ba1a19f3b46f8eee94ac0613c;hpb=ad6aedb9016c5ab9dbc0ac73830206dc71025930;p=ossec-hids-cn.git

diff --git a/debian/postinst b/debian/postinst
index eb8c4f2..801d23f 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -31,7 +31,9 @@ esac
 . /usr/share/carnet-tools/functions.sh
 
 # get installation directory
-. /etc/ossec-init.conf
+if [ -e /etc/ossec-init.conf ]; then
+  . /etc/ossec-init.conf
+fi
 if [ "X${DIRECTORY}" = "X" ]; then
     DIRECTORY="/var/ossec"
 fi
@@ -49,7 +51,7 @@ script='
 BEGIN {
     FS = "\""
 }
-/^[ \t]*<rule id="[[:digit:]]+" .*>/ {
+/<rule id="[0-9]*".*>/ {
     if (max < $2)
         max = $2
 }
@@ -57,10 +59,12 @@ END {
     print max
 };
 '
-sid=100000
 if [ -e "$local_rules" ]; then
     sid=$(awk "$script" "$local_rules")
 fi
+if [ -z "$sid" ]; then
+    sid=100000
+fi
 
 # update local rules with our policy
 if [ -e "$local_rules" ]; then
@@ -71,40 +75,48 @@ fi
 
 cp-update --comment '<!--' --comment-end '-->' \
     ossec-hids-cn "$local_rules.$$" <<EOF
-<group name="syslog,errors,local">
+<group name="local">
  <rule id="$(expr "$sid" + 1)" level="0">
    <if_sid>1002</if_sid>
    <match>rsync</match>
    <description>Events ignored</description>
  </rule>
 
- <rule id="$(expr "$sid" + 1)" level="0">
+ <rule id="$(expr "$sid" + 2)" level="0">
    <if_sid>1002</if_sid>
    <program_name>^sophie|^smartd</program_name>
-   <description>Events ignored</description>
+   <description>Ignore Sophie/SMARTd</description>
  </rule>
-</group>
 
-<group name="syslog,postfix,local">
- <rule id="$(expr "$sid" + 1)" level="0">
+ <rule id="$(expr "$sid" + 3)" level="0">
    <if_sid>3303</if_sid>
    <description>Events ignored</description>
  </rule>
 
- <rule id="$(expr "$sid" + 1)" level="0">
-  <if_sid>3356</if_sid>
-  <description>Ignore blacklisted mail...</description>
+ <rule id="$(expr "$sid" + 4)" level="0">
+   <if_sid>3356</if_sid>
+   <description>Ignore blacklisted mail</description>
  </rule>
+
+ <rule id="$(expr "$sid" + 5)" level="0">
+   <if_sid>1002</if_sid>
+   <match>cache</match>
+   <program_name>^named</program_name>
+   <description>Ignore BIND cache warnings</description>
+ </rule> 
+
+ <rule id="$(expr "$sid" + 6)" level="0">
+   <if_sid>2933</if_sid>
+   <match>Updated timestamp for job</match>
+   <program_name>^anacron</program_name>
+   <description>Ignore Anacron warnings</description>
+ </rule> 
 </group>
 EOF
 cp_mv "$local_rules.$$" "$local_rules"
 
 # and restart the service
-if [ -x /usr/sbin/invoke-rc.d ]; then
-    invoke-rc.d ossec-hids restart
-else
-    /etc/init.d/ossec-hids restart
-fi
+service ossec-hids restart || true
 
 # dh_installdeb will replace this with shell code automatically
 # generated by other debhelper scripts.