debian/ossec-hids/var/ossec/active-response/bin/restart-ossec.sh

   1 #!/bin/sh
   2 # Restarts ossec.
   3 # Requirements: none
   4 # Author: Daniel B. Cid
   5
   6 ACTION=$1
   7 USER=$2
   8 IP=$3
   9
  10 LOCAL=`dirname $0`;
  11 cd $LOCAL
  12 cd ../
  13 PWD=`pwd`
  14 UNAME=`uname`
  15
  16
  17 # Logging the call
  18 echo "`date` $0 $1 $2 $3 $4 $5" >> ${PWD}/../logs/active-responses.log
  19
  20
  21
  22 # Adding the ip to hosts.deny
  23 if [ "x${ACTION}" = "xadd" ]; then
  24    ${PWD}/../bin/ossec-control restart
  25    exit 0;
  26
  27
  28 # Deleting from hosts.deny
  29 elif [ "x${ACTION}" = "xdelete" ]; then
  30    exit 0;
  31
  32
  33 # Invalid action
  34 else
  35    echo "$0: invalid action: ${ACTION}"
  36 fi
  37
  38 exit 1;