install.sh

   1 #!/bin/sh
   2 # Installation script for the OSSEC
   3 # Author: Daniel B. Cid <daniel.cid@gmail.com>
   4 # Last modification: Aug 30, 2012
   5
   6 # Changelog 19/03/2006 - Rafael M. Capovilla <under@underlinux.com.br>
   7 # New function AddWhite to allow users to add more Ips in the white_list
   8 # Minor *echos* modifications to better look
   9 # Bug fix - When email address is blank
  10 # Bug fix - delete INSTALLDIR - Default is yes but if the user just press enter the script wasn't deleting it as it should
  11 # Changelog 15/07/2006 - Rafael M. Capovilla <under@underlinux.com.br>
  12 # New function AddTable to add support for OpenBSD pf rules in firewall-drop active response
  13
  14 # Changelog 29 March 2012 - Adding hybrid mode (standalone + agent)
  15
  16
  17
  18 ### Looking up for the execution directory
  19 cd `dirname $0`
  20
  21
  22 ### Looking for echo -n
  23 ECHO="echo -n"
  24 hs=`echo -n "a"`
  25 if [ ! "X$hs" = "Xa" ]; then
  26     ls "/usr/ucb/echo" > /dev/null 2>&1
  27     if [ $? = 0 ]; then
  28         ECHO="/usr/ucb/echo -n"
  29     else
  30         ECHO=echo
  31     fi
  32 fi
  33
  34 # For solaris
  35 echo "xxxx" | grep -E "xxx" > /dev/null 2>&1
  36 if [ ! $? = 0 ]; then
  37     ls "/usr/xpg4/bin/grep" > /dev/null 2>&1
  38     if [ $? = 0 ]; then
  39         PATH=/usr/xpg4/bin:$PATH
  40     fi
  41 fi
  42
  43 # Initializing vars
  44 SET_DEBUG=""
  45
  46 # Checking for command line arguments
  47 for i in $*; do
  48     if [ "X$i" = "Xdebug" ]; then
  49         SET_DEBUG="debug"
  50     elif [ "X$i" = "Xbinary-install" ]; then
  51         USER_BINARYINSTALL="yes"
  52     elif [ "X$i" = "Xhelp" ]; then
  53         echo "$0 debug"
  54         echo "$0 binary-install"
  55         exit 1;
  56     fi
  57 done
  58
  59
  60
  61 ##########
  62 # install()
  63 ##########
  64 Install()
  65 {
  66         echo ""
  67         echo "5- ${installing}"
  68
  69         echo "DIR=\"${INSTALLDIR}\"" > ${LOCATION}
  70
  71     # Changing Config.OS with the new C flags
  72     # Checking if debug is enabled
  73     if [ "X${SET_DEBUG}" = "Xdebug" ]; then
  74         CEXTRA="${CEXTRA} -DDEBUGAD"
  75     fi
  76
  77     echo "CEXTRA=${CEXTRA}" >> ./src/Config.OS
  78
  79     # Makefile
  80         echo " - ${runningmake}"
  81     cd ./src
  82
  83     # Binary install will use the previous generated code.
  84     if [ "X${USER_BINARYINSTALL}" = "X" ]; then
  85         make all
  86         if [ $? != 0 ]; then
  87             cd ../
  88             catError "0x5-build"
  89         fi
  90
  91         # Building everything
  92         make build
  93         if [ $? != 0 ]; then
  94             cd ../
  95             catError "0x5-build"
  96         fi
  97     fi
  98
  99     # If update, stop ossec
 100     if [ "X${update_only}" = "Xyes" ]; then
 101         UpdateStopOSSEC
 102     fi
 103
 104     # Making the right installation type
 105         if [ "X$INSTYPE" = "Xserver" ]; then
 106         ./InstallServer.sh
 107
 108     elif [ "X$INSTYPE" = "Xagent" ]; then
 109         ./InstallAgent.sh
 110
 111     elif [ "X$INSTYPE" = "Xlocal" ]; then
 112         ./InstallServer.sh local
 113         fi
 114
 115     cd ../
 116
 117
 118     # Generate the /etc/ossec-init.conf
 119     VERSION_FILE="./src/VERSION"
 120     VERSION=`cat ${VERSION_FILE}`
 121     chmod 700 ${OSSEC_INIT} > /dev/null 2>&1
 122     echo "DIRECTORY=\"${INSTALLDIR}\"" > ${OSSEC_INIT}
 123     echo "VERSION=\"${VERSION}\"" >> ${OSSEC_INIT}
 124     echo "DATE=\"`date`\"" >> ${OSSEC_INIT}
 125     echo "TYPE=\"${INSTYPE}\"" >> ${OSSEC_INIT}
 126     chmod 600 ${OSSEC_INIT}
 127     cp -pr ${OSSEC_INIT} ${INSTALLDIR}${OSSEC_INIT}
 128     chmod 640 ${INSTALLDIR}${OSSEC_INIT}
 129
 130
 131     # If update_rules is set, we need to tweak
 132     # ossec.conf to read the new signatures.
 133     if [ "X${update_rules}" = "Xyes" ]; then
 134         UpdateOSSECRules
 135     fi
 136
 137     # If update, start OSSEC
 138     if [ "X${update_only}" = "Xyes" ]; then
 139         UpdateStartOSSEC
 140     fi
 141
 142     # Calling the init script  to start ossec hids during boot
 143     if [ "X${update_only}" = "X" ]; then
 144         runInit
 145         if [ $? = 1 ]; then
 146             notmodified="yes"
 147         fi
 148     fi
 149
 150 }
 151
 152
 153
 154
 155 ##########
 156 # UseSyscheck()
 157 ##########
 158 UseSyscheck()
 159 {
 160
 161     # Integrity check config
 162     echo ""
 163     $ECHO "  3.2- ${runsyscheck} ($yes/$no) [$yes]: "
 164     if [ "X${USER_ENABLE_SYSCHECK}" = "X" ]; then
 165         read AS
 166     else
 167         AS=${USER_ENABLE_SYSCHECK}
 168     fi
 169     echo ""
 170     case $AS in
 171         $nomatch)
 172             echo "   - ${nosyscheck}."
 173             ;;
 174         *)
 175             SYSCHECK="yes"
 176             echo "   - ${yessyscheck}."
 177             ;;
 178     esac
 179
 180     # Adding to the config file
 181     if [ "X$SYSCHECK" = "Xyes" ]; then
 182         cat ${SYSCHECK_TEMPLATE} >> $NEWCONFIG
 183     fi
 184 }
 185
 186
 187
 188
 189 ##########
 190 # UseRootcheck()
 191 ##########
 192 UseRootcheck()
 193 {
 194
 195     # Rootkit detection configuration
 196     echo ""
 197     $ECHO "  3.3- ${runrootcheck} ($yes/$no) [$yes]: "
 198
 199     if [ "X${USER_ENABLE_ROOTCHECK}" = "X" ]; then
 200         read ES
 201     else
 202         ES=${USER_ENABLE_ROOTCHECK}
 203     fi
 204
 205     echo ""
 206     case $ES in
 207         $nomatch)
 208             echo "   - ${norootcheck}."
 209             ;;
 210         *)
 211             ROOTCHECK="yes"
 212             echo "   - ${yesrootcheck}."
 213             ;;
 214     esac
 215
 216
 217     # Adding to the config file
 218     if [ "X$ROOTCHECK" = "Xyes" ]; then
 219         echo "" >> $NEWCONFIG
 220         echo "  <rootcheck>" >> $NEWCONFIG
 221         echo "    <rootkit_files>$INSTALLDIR/etc/shared/rootkit_files.txt</rootkit_files>" >> $NEWCONFIG
 222         echo "    <rootkit_trojans>$INSTALLDIR/etc/shared/rootkit_trojans.txt</rootkit_trojans>" >> $NEWCONFIG
 223         echo "    <system_audit>$INSTALLDIR/etc/shared/system_audit_rcl.txt</system_audit>" >> $NEWCONFIG
 224         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_debian_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 225         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_rhel_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 226         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_rhel5_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 227         echo "  </rootcheck>" >> $NEWCONFIG
 228     else
 229       echo "" >> $NEWCONFIG
 230       echo "  <rootcheck>" >> $NEWCONFIG
 231         echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 232       echo "  </rootcheck>" >> $NEWCONFIG
 233     fi
 234 }
 235
 236
 237
 238
 239 ##########
 240 # SetupLogs()
 241 ##########
 242 SetupLogs()
 243 {
 244     if [ "x${USER_CLEANINSTALL}" = "xy" ]; then
 245         OPENDIR=`dirname $INSTALLDIR`
 246         echo "" >> $NEWCONFIG
 247         echo "  <localfile>" >> $NEWCONFIG
 248         echo "    <log_format>ossecalert</log_format>" >> $NEWCONFIG
 249         echo "    <location>$OPENDIR/logs/alerts/alerts.log</location>" >>$NEWCONFIG
 250         echo "  </localfile>" >> $NEWCONFIG
 251         echo "" >> $NEWCONFIG
 252         return;
 253     fi
 254
 255     NB=$1
 256     echo ""
 257     echo "  $NB- ${readlogs}"
 258
 259     echo "  <!-- Files to monitor (localfiles) -->" >> $NEWCONFIG
 260     LOG_FILES=`cat ${SYSLOG_TEMPLATE}`
 261     for i in ${LOG_FILES}; do
 262         # If log file present, add it
 263         ls $i > /dev/null 2>&1
 264         if [ $? = 0 ]; then
 265             echo "    -- $i"
 266                 echo "" >> $NEWCONFIG
 267                 echo "  <localfile>" >> $NEWCONFIG
 268             echo "    <log_format>syslog</log_format>" >> $NEWCONFIG
 269                 echo "    <location>$i</location>" >>$NEWCONFIG
 270                 echo "  </localfile>" >> $NEWCONFIG
 271         fi
 272     done
 273
 274
 275     # Getting snort files
 276     SNORT_FILES=`cat ${SNORT_TEMPLATE}`
 277     for i in ${SNORT_FILES}; do
 278         ls $i > /dev/null 2>&1
 279         if [ $? = 0 ]; then
 280             echo "" >> $NEWCONFIG
 281             echo "  <localfile>" >> $NEWCONFIG
 282
 283             head -n 1 $i|grep "\[**\] "|grep -v "Classification:" > /dev/null
 284             if [ $? = 0 ]; then
 285                 echo "    <log_format>snort-full</log_format>" >> $NEWCONFIG
 286                 echo "    -- $i (snort-full file)"
 287             else
 288                 echo "    <log_format>snort-fast</log_format>" >> $NEWCONFIG
 289                 echo "    -- $i (snort-fast file)"
 290             fi
 291             echo "    <location>$i</location>" >>$NEWCONFIG
 292             echo "  </localfile>" >> $NEWCONFIG
 293         fi
 294     done
 295
 296     # Getting apache logs
 297     APACHE_FILES=`cat ${APACHE_TEMPLATE}`
 298     for i in ${APACHE_FILES}; do
 299         ls $i > /dev/null 2>&1
 300         if [ $? = 0 ]; then
 301           echo "" >> $NEWCONFIG
 302           echo "  <localfile>" >> $NEWCONFIG
 303           echo "    <log_format>apache</log_format>" >> $NEWCONFIG
 304           echo "    <location>$i</location>" >>$NEWCONFIG
 305           echo "  </localfile>" >> $NEWCONFIG
 306
 307           echo "    -- $i (apache log)"
 308         fi
 309     done
 310
 311     # Getting postgresql logs
 312     PGSQL_FILES=`cat ${PGSQL_TEMPLATE}`
 313     for i in ${PGSQL_FILES}; do
 314         ls $i > /dev/null 2>&1
 315         if [ $? = 0 ]; then
 316           echo "" >> $NEWCONFIG
 317           echo "  <localfile>" >> $NEWCONFIG
 318           echo "    <log_format>postgresql_log</log_format>" >> $NEWCONFIG
 319           echo "    <location>$i</location>" >>$NEWCONFIG
 320           echo "  </localfile>" >> $NEWCONFIG
 321
 322           echo "    -- $i (postgresql log)"
 323         fi
 324     done
 325
 326    if [ "X$NUNAME" = "XLinux" ]; then
 327       echo "" >> $NEWCONFIG
 328       echo "  <localfile>" >> $NEWCONFIG
 329       echo "    <log_format>command</log_format>" >> $NEWCONFIG
 330       echo "    <command>df -h</command>" >> $NEWCONFIG
 331       echo "  </localfile>" >> $NEWCONFIG
 332       echo "" >> $NEWCONFIG
 333       echo "  <localfile>" >> $NEWCONFIG
 334       echo "    <log_format>full_command</log_format>" >> $NEWCONFIG
 335       echo "    <command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command>" >> $NEWCONFIG
 336       echo "  </localfile>" >> $NEWCONFIG
 337       echo "" >> $NEWCONFIG
 338       echo "  <localfile>" >> $NEWCONFIG
 339       echo "    <log_format>full_command</log_format>" >> $NEWCONFIG
 340       echo "    <command>last -n 5</command>" >> $NEWCONFIG
 341       echo "  </localfile>" >> $NEWCONFIG
 342    fi
 343
 344
 345
 346
 347     echo ""
 348     catMsg "0x106-logs"
 349
 350
 351     if [ "X$USER_NO_STOP" = "X" ]; then
 352         read ANY
 353     fi
 354 }
 355
 356
 357
 358 # install.sh
 359
 360 ##########
 361 # ConfigureClient()
 362 ##########
 363 ConfigureClient()
 364 {
 365         echo ""
 366         echo "3- ${configuring} $NAME."
 367         echo ""
 368
 369     if [ "X${USER_AGENT_SERVER_IP}" = "X" -a "X${USER_AGENT_SERVER_NAME}" = "X" ]; then
 370         # Looping and asking for server ip or hostname
 371         while [ 1 ]; do
 372             $ECHO "  3.1- ${serveraddr}: "
 373                 read ADDRANSWER
 374             # Is it an IP?
 375             echo $ADDRANSWER | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" > /dev/null 2>&1
 376             if [ $? = 0 ]; then
 377                     echo ""
 378                 IP=$ADDRANSWER
 379                     echo "   - ${addingip} $IP"
 380                 break;
 381             # Must be a name
 382             elif [ $? != 0 ]; then
 383                     echo ""
 384                 HNAME=$ADDRANSWER
 385                     echo "   - ${addingname} $HNAME"
 386                 break;
 387             fi
 388         done
 389     else
 390         IP=${USER_AGENT_SERVER_IP}
 391         HNAME=${USER_AGENT_SERVER_NAME}
 392     fi
 393
 394     echo "<ossec_config>" > $NEWCONFIG
 395     echo "  <client>" >> $NEWCONFIG
 396     if [ "X${IP}" != "X" ]; then
 397         echo "    <server-ip>$IP</server-ip>" >> $NEWCONFIG
 398     elif [ "X${HNAME}" != "X" ]; then
 399         echo "    <server-hostname>$HNAME</server-hostname>" >> $NEWCONFIG
 400     fi
 401     echo "  </client>" >> $NEWCONFIG
 402     echo "" >> $NEWCONFIG
 403
 404     # Syscheck?
 405     UseSyscheck
 406
 407     # Rootcheck?
 408     UseRootcheck
 409
 410     echo ""
 411     $ECHO "  3.4 - ${enable_ar} ($yes/$no) [$yes]: "
 412
 413     if [ "X${USER_ENABLE_ACTIVE_RESPONSE}" = "X" ]; then
 414         read ANY
 415     else
 416         ANY=${USER_ENABLE_ACTIVE_RESPONSE}
 417     fi
 418
 419     case $ANY in
 420         $nomatch)
 421             echo ""
 422             echo "   - ${noactive}."
 423             echo "" >> $NEWCONFIG
 424             echo "  <active-response>" >> $NEWCONFIG
 425             echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 426             echo "  </active-response>" >> $NEWCONFIG
 427             echo "" >> $NEWCONFIG
 428             ;;
 429         *)
 430             ACTIVERESPONSE="yes"
 431             echo ""
 432             ;;
 433     esac
 434
 435     # Set up the log files
 436     SetupLogs "3.5"
 437
 438     echo "</ossec_config>" >> $NEWCONFIG
 439 }
 440
 441
 442
 443
 444 ##########
 445 # ConfigureServer()
 446 ##########
 447 ConfigureServer()
 448 {
 449         echo ""
 450         echo "3- ${configuring} $NAME."
 451
 452
 453     # Configuring e-mail notification
 454         echo ""
 455         $ECHO "  3.1- ${mailnotify} ($yes/$no) [$yes]: "
 456
 457     if [ "X${USER_ENABLE_EMAIL}" = "X" ]; then
 458         read ANSWER
 459     else
 460         ANSWER=${USER_ENABLE_EMAIL}
 461     fi
 462
 463         case $ANSWER in
 464                 $nomatch)
 465             echo ""
 466                         echo "   --- ${nomail}."
 467                         EMAILNOTIFY="no"
 468                         ;;
 469                 *)
 470                         EMAILNOTIFY="yes"
 471                         $ECHO "   - ${whatsemail} "
 472             if [ "X${USER_EMAIL_ADDRESS}" = "X" ]; then
 473
 474                 read EMAIL
 475                 echo "${EMAIL}" | grep -E "^[a-zA-Z0-9_.-]{1,36}@[a-zA-Z0-9_.-]{1,54}$" > /dev/null 2>&1 ;RVAL=$?;
 476                 # Ugly e-mail validation
 477                             while [ "$EMAIL" = "" -o ! ${RVAL} = 0 ] ; do
 478                                     $ECHO "   - ${whatsemail} "
 479                                     read EMAIL
 480                     echo "${EMAIL}" | grep -E "^[a-zA-Z0-9_.-]{1,36}@[a-zA-Z0-9_.-]{1,54}$" > /dev/null 2>&1 ;RVAL=$?;
 481                             done
 482             else
 483                 EMAIL=${USER_EMAIL_ADDRESS}
 484             fi
 485
 486             ls ${HOST_CMD} > /dev/null 2>&1
 487             if [ $? = 0 ]; then
 488               HOSTTMP=`${HOST_CMD} -W 5 -t mx ossec.net 2>/dev/null`
 489               if [ $? = 1 ]; then
 490                  # Trying without the -W
 491                  HOSTTMP=`${HOST_CMD} -t mx ossec.net 2>/dev/null`
 492               fi
 493               echo "x$HOSTTMP" | grep "ossec.net mail is handled" > /dev/null 2>&1
 494               if [ $? = 0 ]; then
 495                  # Breaking down the user e-mail
 496                  EMAILHOST=`echo ${EMAIL} | cut -d "@" -f 2`
 497                  if [ "X${EMAILHOST}" = "Xlocalhost" ]; then
 498                     SMTPHOST="127.0.0.1"
 499                  else
 500                     HOSTTMP=`${HOST_CMD} -W 5 -t mx ${EMAILHOST}`
 501                     SMTPHOST=`echo ${HOSTTMP} | cut -d " " -f 7`
 502                  fi
 503               fi
 504             fi
 505
 506             if [ "X${USER_EMAIL_SMTP}" = "X" ]; then
 507                 if [ "X${SMTPHOST}" != "X" ]; then
 508                     echo ""
 509                     echo "   - ${yoursmtp}: ${SMTPHOST}"
 510                     $ECHO "   - ${usesmtp} ($yes/$no) [$yes]: "
 511                     read EMAIL2
 512                     case ${EMAIL2} in
 513                         $nomatch)
 514                         echo ""
 515                         SMTP=""
 516                         ;;
 517                     *)
 518                         SMTP=${SMTPHOST}
 519                         echo ""
 520                         echo "   --- ${usingsmtp} ${SMTP}"
 521                         ;;
 522                     esac
 523                 fi
 524
 525                 if [ "X${SMTP}" = "X" ]; then
 526                                 $ECHO "   - ${whatsmtp} "
 527                     read SMTP
 528                 fi
 529             else
 530                 SMTP=${USER_EMAIL_SMTP}
 531             fi
 532         ;;
 533         esac
 534
 535
 536         # Writting global parameters
 537     echo "<ossec_config>" > $NEWCONFIG
 538         echo "  <global>" >> $NEWCONFIG
 539         if [ "$EMAILNOTIFY" = "yes" ]; then
 540                 echo "    <email_notification>yes</email_notification>" >> $NEWCONFIG
 541                 echo "    <email_to>$EMAIL</email_to>" >> $NEWCONFIG
 542                 echo "    <smtp_server>$SMTP</smtp_server>" >> $NEWCONFIG
 543                 echo "    <email_from>ossecm@${HOST}</email_from>" >> $NEWCONFIG
 544         else
 545                 echo "    <email_notification>no</email_notification>" >> $NEWCONFIG
 546         fi
 547
 548     echo "  </global>" >> $NEWCONFIG
 549         echo "" >> $NEWCONFIG
 550
 551         # Writting rules configuration
 552     cat ${RULES_TEMPLATE} >> $NEWCONFIG
 553         echo "" >> $NEWCONFIG
 554
 555
 556     # Checking if syscheck should run
 557     UseSyscheck
 558
 559     # Checking if rootcheck should run
 560     UseRootcheck
 561
 562
 563     # Active response
 564     catMsg "0x107-ar"
 565     $ECHO "   - ${enable_ar} ($yes/$no) [$yes]: "
 566
 567     if [ "X${USER_ENABLE_ACTIVE_RESPONSE}" = "X" ]; then
 568         read AR
 569     else
 570         AR=${USER_ENABLE_ACTIVE_RESPONSE}
 571     fi
 572
 573     case $AR in
 574         $nomatch)
 575             echo ""
 576             echo "     - ${noactive}."
 577             echo "" >> $NEWCONFIG
 578             echo "  <active-response>" >> $NEWCONFIG
 579             echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 580             echo "  </active-response>" >> $NEWCONFIG
 581             echo "" >> $NEWCONFIG
 582             ;;
 583         *)
 584             ACTIVERESPONSE="yes"
 585             echo ""
 586             catMsg "0x108-ar-enabled"
 587
 588             echo ""
 589             $ECHO "   - ${firewallar} ($yes/$no) [$yes]: "
 590
 591             if [ "X${USER_ENABLE_FIREWALL_RESPONSE}" = "X" ]; then
 592                 read HD2
 593             else
 594                 HD2=${USER_ENABLE_FIREWALL_RESPONSE}
 595             fi
 596
 597             echo ""
 598             case $HD2 in
 599                 $nomatch)
 600                     echo "     - ${nofirewall}"
 601                     ;;
 602                 *)
 603                     echo "     - ${yesfirewall}"
 604                     FIREWALLDROP="yes"
 605                     ;;
 606             esac
 607             echo "" >> $NEWCONFIG
 608             echo "  <global>" >> $NEWCONFIG
 609             echo "    <white_list>127.0.0.1</white_list>" >> $NEWCONFIG
 610             echo "    <white_list>^localhost.localdomain$</white_list>">>$NEWCONFIG
 611             echo ""
 612             echo "   - ${defaultwhitelist}"
 613             for ip in ${NAMESERVERS} ${NAMESERVERS2};
 614             do
 615             if [ ! "X${ip}" = "X" ]; then
 616                 echo "      - ${ip}"
 617                 echo "    <white_list>${ip}</white_list>" >>$NEWCONFIG
 618             fi
 619             done
 620             AddWhite
 621
 622             # If Openbsd or Freebsd with pf enable, ask about
 623             # automatically setting it up.
 624             # Commenting it out in case I change my mind about it
 625             # later.
 626             #if [ "X`sh ./src/init/fw-check.sh`" = "XPF" ]; then
 627             #    echo ""
 628             #    $ECHO "   - ${pfenable} ($yes/$no) [$yes]: "
 629             #    if [ "X${USER_ENABLE_PF}" = "X" ]; then
 630             #        read PFENABLE
 631             #    else
 632             #        PFENABLE=${USER_ENABLE_PF}
 633             #    fi
 634             #
 635             #    echo ""
 636             #    case $PFENABLE in
 637             #        $nomatch)
 638             #            echo "     - ${nopf}"
 639             #            ;;
 640             #        *)
 641             #            AddPFTable
 642             #            ;;
 643             #    esac
 644             #fi
 645
 646             echo "  </global>" >> $NEWCONFIG
 647             ;;
 648     esac
 649
 650
 651     if [ "X$INSTYPE" = "Xserver" ]; then
 652       # Configuring remote syslog
 653           echo ""
 654           $ECHO "  3.5- ${syslog} ($yes/$no) [$yes]: "
 655
 656       if [ "X${USER_ENABLE_SYSLOG}" = "X" ]; then
 657             read ANSWER
 658       else
 659         ANSWER=${USER_ENABLE_SYSLOG}
 660       fi
 661
 662       echo ""
 663       case $ANSWER in
 664                 $nomatch)
 665                         echo "   --- ${nosyslog}."
 666                         ;;
 667                 *)
 668                         echo "   - ${yessyslog}."
 669                         RLOG="yes"
 670                         ;;
 671           esac
 672
 673           # Configuring remote connections
 674       SLOG="yes"
 675         fi
 676
 677
 678
 679         if [ "X$RLOG" = "Xyes" ]; then
 680         echo "" >> $NEWCONFIG
 681         echo "  <remote>" >> $NEWCONFIG
 682         echo "    <connection>syslog</connection>" >> $NEWCONFIG
 683         echo "  </remote>" >> $NEWCONFIG
 684         fi
 685
 686         if [ "X$SLOG" = "Xyes" ]; then
 687         echo "" >> $NEWCONFIG
 688         echo "  <remote>" >> $NEWCONFIG
 689         echo "    <connection>secure</connection>" >> $NEWCONFIG
 690         echo "  </remote>" >> $NEWCONFIG
 691         fi
 692
 693
 694         # Email/log alerts
 695         echo "" >> $NEWCONFIG
 696         echo "  <alerts>" >> $NEWCONFIG
 697     echo "    <log_alert_level>1</log_alert_level>" >> $NEWCONFIG
 698     if [ "$EMAILNOTIFY" = "yes" ]; then
 699         echo "    <email_alert_level>7</email_alert_level>">> $NEWCONFIG
 700         fi
 701         echo "  </alerts>" >> $NEWCONFIG
 702
 703
 704     if [ "X$ACTIVERESPONSE" = "Xyes" ]; then
 705         # Add commands in here
 706         echo "" >> $NEWCONFIG
 707         cat ${HOST_DENY_TEMPLATE} >> $NEWCONFIG
 708         echo "" >> $NEWCONFIG
 709         cat ${FIREWALL_DROP_TEMPLATE} >> $NEWCONFIG
 710         echo "" >> $NEWCONFIG
 711         cat ${DISABLE_ACCOUNT_TEMPLATE} >> $NEWCONFIG
 712         echo "" >> $NEWCONFIG
 713         cat ${ROUTENULL_TEMPLATE} >> $NEWCONFIG
 714         echo "" >> $NEWCONFIG
 715
 716         if [ "X$FIREWALLDROP" = "Xyes" ]; then
 717             echo "" >> $NEWCONFIG
 718             cat ${ACTIVE_RESPONSE_TEMPLATE} >> $NEWCONFIG
 719             echo "" >> $NEWCONFIG
 720         fi
 721     fi
 722
 723     # Setting up the logs
 724     SetupLogs "3.6"
 725     echo "</ossec_config>" >> $NEWCONFIG
 726 }
 727
 728
 729
 730
 731 ##########
 732 # setEnv()
 733 ##########
 734 setEnv()
 735 {
 736     echo ""
 737     echo "2- ${settingupenv}."
 738
 739     echo ""
 740     if [ "X${USER_DIR}" = "X" ]; then
 741         while [ 1 ]; do
 742             $ECHO " - ${wheretoinstall} [$INSTALLDIR]: "
 743             read ANSWER
 744             if [ ! "X$ANSWER" = "X" ]; then
 745                 echo $ANSWER |grep -E "^/[a-zA-Z0-9./_-]{3,128}$">/dev/null 2>&1
 746                 if [ $? = 0 ]; then
 747                     INSTALLDIR=$ANSWER;
 748                     break;
 749                 fi
 750             else
 751                 break;
 752             fi
 753         done
 754     else
 755         INSTALLDIR=${USER_DIR}
 756     fi
 757
 758
 759     CEXTRA="$CEXTRA -DDEFAULTDIR=\\\"${INSTALLDIR}\\\""
 760
 761     echo ""
 762     echo "    - ${installat} ${INSTALLDIR} ."
 763
 764
 765     if [ "X$INSTYPE" = "Xagent" ]; then
 766         CEXTRA="$CEXTRA -DCLIENT"
 767     elif [ "X$INSTYPE" = "Xlocal" ]; then
 768         CEXTRA="$CEXTRA -DLOCAL"
 769     fi
 770
 771     ls $INSTALLDIR >/dev/null 2>&1
 772     if [ $? = 0 ]; then
 773         if [ "X${USER_DELETE_DIR}" = "X" ]; then
 774             echo ""
 775             $ECHO "    - ${deletedir} ($yes/$no) [$yes]: "
 776             read ANSWER
 777         else
 778             ANSWER=${USER_DELETE_DIR}
 779         fi
 780
 781         case $ANSWER in
 782             $yesmatch)
 783                 rm -rf $INSTALLDIR
 784                 if [ ! $? = 0 ]; then
 785                     exit 2;
 786                 fi
 787                 ;;
 788         esac
 789     fi
 790 }
 791
 792
 793
 794
 795 ##########
 796 # checkDependencies()
 797 # Thanks to gabriel@macacos.org
 798 ##########
 799 checkDependencies()
 800 {
 801     echo ""
 802     OLDOPATH=$PATH
 803     if [ "X$NUNAME" = "XSunOS" ]; then
 804         PATH=$PATH:/usr/ccs/bin:/usr/xpg4/bin:/opt/csw/gcc3/bin:/opt/csw/bin:/usr/sfw/bin
 805         export  PATH
 806     elif [ "X$NUNAME" = "XAIX" ]; then
 807         PATH=$PATH:/usr/vac/bin
 808         export  PATH
 809     fi
 810
 811     PATH=$OLDOPATH
 812     export PATH
 813 }
 814
 815 ##########
 816 # AddWhite()
 817 ##########
 818 AddWhite()
 819 {
 820         while [ 1 ]
 821         do
 822         echo ""
 823                 $ECHO "   - ${addwhite} ($yes/$no)? [$no]: "
 824
 825         # If white list is set, we don't need to ask it here.
 826         if [ "X${USER_WHITE_LIST}" = "X" ]; then
 827                     read ANSWER
 828         else
 829             ANSWER=$yes
 830         fi
 831
 832                 if [ "X${ANSWER}" = "X" ] ; then
 833                         ANSWER=$no
 834                 fi
 835
 836                 case $ANSWER in
 837                         $no)
 838                                 break;
 839                                 ;;
 840                         *)
 841                                 $ECHO "   - ${ipswhite}"
 842                 if [ "X${USER_WHITE_LIST}" = "X" ]; then
 843                                     read IPS
 844                                 else
 845                     IPS=${USER_WHITE_LIST}
 846                 fi
 847
 848                                 for ip in ${IPS};
 849                                 do
 850                                         if [ ! "X${ip}" = "X" ]; then
 851                         echo $ip | grep -E "^[0-9./]{5,20}$" > /dev/null 2>&1
 852                         if [ $? = 0 ]; then
 853                                                 echo "    <white_list>${ip}</white_list>" >>$NEWCONFIG
 854                         fi
 855                                         fi
 856                                 done
 857
 858                                 break;
 859                                 ;;
 860                 esac
 861         done
 862 }
 863
 864
 865 ##########
 866 # AddPFTable()
 867 ##########
 868 AddPFTable()
 869 {
 870     #default pf rules
 871     TABLE="ossec_fwtable"
 872
 873     # Add table to the first line
 874     echo ""
 875     echo "   - ${pfmessage}:"
 876     echo "     ${moreinfo}"
 877     echo "     http://www.ossec.net/en/manual.html#active-response-tools"
 878
 879     echo ""
 880     echo ""
 881     echo "      table <${TABLE}> persist #$TABLE "
 882     echo "      block in quick from <${TABLE}> to any"
 883     echo "      block out quick from any to <${TABLE}>"
 884     echo ""
 885     echo ""
 886
 887 }
 888
 889 ##########
 890 # main()
 891 ##########
 892 main()
 893 {
 894     LG="en"
 895     LANGUAGE="en"
 896     . ./src/init/shared.sh
 897     . ./src/init/functions.sh
 898
 899     # Reading pre-defined file
 900     if [ ! `isFile ${PREDEF_FILE}` = "${FALSE}" ]; then
 901         . ${PREDEF_FILE}
 902     fi
 903
 904     # If user language is not set
 905
 906     if [ "X${USER_LANGUAGE}" = "X" ]; then
 907
 908         # Choosing the language.
 909         while [ 1 ]; do
 910         echo ""
 911         for i in `ls ${TEMPLATE}`; do
 912             # ignore CVS (should not be there anyways and config)
 913             if [ "$i" = "CVS" -o "$i" = "config" ]; then continue; fi
 914             cat "${TEMPLATE}/$i/language.txt"
 915             if [ ! "$i" = "en" ]; then
 916                 LG="${LG}/$i"
 917             fi
 918         done
 919         $ECHO "  (${LG}) [en]: "
 920         read USER_LG;
 921
 922         if [ "X${USER_LG}" = "X" ]; then
 923             USER_LG="en"
 924         fi
 925
 926         ls "${TEMPLATE}/${USER_LG}" > /dev/null 2>&1
 927         if [ $? = 0 ]; then
 928             break;
 929         fi
 930         done;
 931
 932         LANGUAGE=${USER_LG}
 933
 934     else
 935
 936         # If provided language is not valid, default to english
 937         ls "${TEMPLATE}/${USER_LANGUAGE}" > /dev/null 2>&1
 938         if [ $? = 0 ]; then
 939             LANGUAGE=${USER_LANGUAGE}
 940         else
 941             LANGUAGE="en"
 942         fi
 943
 944     fi # for USER_LANGUAGE
 945
 946
 947     . ./src/init/shared.sh
 948     . ./src/init/language.sh
 949     . ./src/init/functions.sh
 950     . ./src/init/init.sh
 951     . ${TEMPLATE}/${LANGUAGE}/messages.txt
 952
 953
 954     # Must be executed as ./install.sh
 955     if [ `isFile ${VERSION_FILE}` = "${FALSE}" ]; then
 956         catError "0x1-location";
 957     fi
 958
 959     # Must be root
 960     if [ ! "X$ME" = "Xroot" ]; then
 961         catError "0x2-beroot";
 962     fi
 963
 964     # Checking dependencies
 965     checkDependencies
 966
 967     clear
 968
 969
 970     # Initial message
 971     echo " $NAME $VERSION ${installscript} - http://www.ossec.net"
 972
 973     catMsg "0x101-initial"
 974
 975     echo "  - $system: $UNAME"
 976     echo "  - $user: $ME"
 977     echo "  - $host: $HOST"
 978     echo ""
 979     echo ""
 980     echo "  -- $hitanyorabort --"
 981
 982     if [ "X$USER_NO_STOP" = "X" ]; then
 983         read ANY
 984     fi
 985
 986     . ./src/init/update.sh
 987     # Is this an update?
 988     if [ "`isUpdate`" = "${TRUE}" -a "x${USER_CLEANINSTALL}" = "x" ]; then
 989         echo ""
 990         ct="1"
 991         while [ $ct = "1" ]; do
 992             ct="0"
 993             $ECHO " - ${wanttoupdate} ($yes/$no): "
 994             if [ "X${USER_UPDATE}" = "X" ]; then
 995                 read ANY
 996             else
 997                 ANY=$yes
 998             fi
 999
1000             case $ANY in
1001                 $yes)
1002                     update_only="yes"
1003                     break;
1004                     ;;
1005                 $no)
1006                     break;
1007                     ;;
1008                   *)
1009                     ct="1"
1010                     ;;
1011             esac
1012         done
1013
1014
1015         # Do some of the update steps.
1016         if [ "X${update_only}" = "Xyes" ]; then
1017             . ./src/init/update.sh
1018
1019             if [ "`doUpdatecleanup`" = "${FALSE}" ]; then
1020                 # Disabling update
1021                 echo ""
1022                 echo "${unabletoupdate}"
1023                 sleep 5;
1024                 update_only=""
1025             else
1026                 # Get update
1027                 USER_INSTALL_TYPE=`getPreinstalled`
1028                 USER_DIR=`getPreinstalledDir`
1029                 USER_DELETE_DIR="$nomatch"
1030             fi
1031
1032             ct="1"
1033
1034             # We dont need to update the rules on agent installs
1035             if [ "X${USER_INSTALL_TYPE}" = "Xagent" ]; then
1036                 ct="0"
1037             fi
1038
1039             while [ $ct = "1" ]; do
1040                 ct="0"
1041                 $ECHO " - ${updaterules} ($yes/$no): "
1042                 if [ "X${USER_UPDATE_RULES}" = "X" ]; then
1043                     read ANY
1044                 else
1045                     ANY=$yes
1046                 fi
1047
1048                 case $ANY in
1049                     $yes)
1050                         update_rules="yes"
1051                         break;
1052                         ;;
1053                     $no)
1054                         break;
1055                         ;;
1056                     *)
1057                         ct="1"
1058                         ;;
1059                 esac
1060             done
1061         fi
1062         echo ""
1063     fi
1064
1065     hybrid="hybrid"
1066     HYBID=""
1067     hybridm=`echo ${hybrid} | cut -b 1`
1068     serverm=`echo ${server} | cut -b 1`
1069     localm=`echo ${local} | cut -b 1`
1070     agentm=`echo ${agent} | cut -b 1`
1071     helpm=`echo ${help} | cut -b 1`
1072
1073     # If user install type is not set, ask for it.
1074     if [ "X${USER_INSTALL_TYPE}" = "X" ]; then
1075
1076         # Loop for the installation options
1077         while [ 1 ]
1078         do
1079             echo ""
1080             $ECHO "1- ${whattoinstall} "
1081
1082             read ANSWER
1083             case $ANSWER in
1084
1085                 ${helpm}|${help})
1086                 catMsg "0x102-installhelp"
1087                     ;;
1088
1089                 ${server}|${serverm})
1090                 echo ""
1091                     echo "  - ${serverchose}."
1092                     INSTYPE="server"
1093                     break;
1094                     ;;
1095
1096                 ${agent}|${agentm})
1097                 echo ""
1098                     echo "  - ${clientchose}."
1099                     INSTYPE="agent"
1100                     break;
1101                     ;;
1102
1103                 ${hybrid}|${hybridm})
1104                 echo ""
1105                     echo "  - ${serverchose} (hybrid)."
1106                     INSTYPE="server"
1107                     HYBID="go"
1108                     break;
1109                     ;;
1110                 ${local}|${localm})
1111                 echo ""
1112                 echo "  - ${localchose}."
1113                 INSTYPE="local"
1114                 break;
1115                 ;;
1116             esac
1117         done
1118
1119     else
1120         INSTYPE=${USER_INSTALL_TYPE}
1121     fi
1122
1123
1124     # Setting up the environment
1125     setEnv
1126
1127
1128     # Configuring the system (based on the installation type)
1129     if [ "X${update_only}" = "X" ]; then
1130         if [ "X$INSTYPE" = "Xserver" ]; then
1131             ConfigureServer
1132         elif [ "X$INSTYPE" = "Xagent" ]; then
1133             ConfigureClient
1134         elif [ "X$INSTYPE" = "Xlocal" ]; then
1135             ConfigureServer
1136         else
1137             catError "0x4-installtype"
1138         fi
1139     fi
1140
1141     # Installing (calls the respective script
1142     # -- InstallAgent.sh or InstallServer.sh
1143     Install
1144
1145     # User messages
1146     echo ""
1147     echo " - ${configurationdone}."
1148     echo ""
1149     echo " - ${tostart}:"
1150     echo "              $INSTALLDIR/bin/ossec-control start"
1151     echo ""
1152     echo " - ${tostop}:"
1153     echo "              $INSTALLDIR/bin/ossec-control stop"
1154     echo ""
1155     echo " - ${configat} $INSTALLDIR/etc/ossec.conf"
1156     echo ""
1157
1158
1159     catMsg "0x103-thanksforusing"
1160
1161
1162     if [ "X${update_only}" = "Xyes" ]; then
1163         # Message for the update
1164         if [ "X`sh ./src/init/fw-check.sh`" = "XPF" -a "X${ACTIVERESPONSE}" = "Xyes" ]; then
1165             if [ "X$USER_NO_STOP" = "X" ]; then
1166                 read ANY
1167             fi
1168             AddPFTable
1169         fi
1170         echo ""
1171         echo " - ${updatecompleted}"
1172         echo ""
1173         exit 0;
1174     fi
1175
1176
1177     if [ "X$USER_NO_STOP" = "X" ]; then
1178         read ANY
1179     fi
1180
1181
1182     # PF firewall message
1183     if [ "X`sh ./src/init/fw-check.sh`" = "XPF" -a "X${ACTIVERESPONSE}" = "Xyes" ]; then
1184         AddPFTable
1185     fi
1186
1187
1188     if [ "X$INSTYPE" = "Xserver" ]; then
1189         echo ""
1190         echo " - ${addserveragent}"
1191         echo "   ${runma}:"
1192         echo ""
1193         echo "   $INSTALLDIR/bin/manage_agents"
1194         echo ""
1195         echo "   ${moreinfo}"
1196         echo "   http://www.ossec.net/en/manual.html#ma"
1197         echo ""
1198
1199     elif [ "X$INSTYPE" = "Xagent" ]; then
1200         catMsg "0x104-client"
1201         echo "   $INSTALLDIR/bin/manage_agents"
1202         echo ""
1203         echo "   ${moreinfo}"
1204         echo "   http://www.ossec.net/en/manual.html#ma"
1205         echo ""
1206     fi
1207
1208     if [ "X$notmodified" = "Xyes" ]; then
1209         catMsg "0x105-noboot"
1210         echo "          $INSTALLDIR/bin/ossec-control start"
1211         echo ""
1212     fi
1213 }
1214
1215 _f_cfg="./install.cfg.sh"
1216
1217 if [ -f $_f_cfg ]; then
1218   . $_f_cfg
1219 fi
1220
1221 ### Calling main function where everything happens
1222 main
1223
1224
1225 if [ "x$HYBID" = "xgo" ]; then
1226     echo "   --------------------------------------------"
1227     echo "   Finishing Hybrid setup (agent configuration)"
1228     echo "   --------------------------------------------"
1229     echo 'USER_LANGUAGE="en"' > ./etc/preloaded-vars.conf
1230     echo "" >> ./etc/preloaded-vars.conf
1231     echo 'USER_NO_STOP="y"' >> ./etc/preloaded-vars.conf
1232     echo "" >> ./etc/preloaded-vars.conf
1233     echo 'USER_INSTALL_TYPE="agent"' >> ./etc/preloaded-vars.conf
1234     echo "" >> ./etc/preloaded-vars.conf
1235     echo "USER_DIR=\"$INSTALLDIR/ossec-agent\"" >> ./etc/preloaded-vars.conf
1236     echo "" >> ./etc/preloaded-vars.conf
1237     echo 'USER_ENABLE_ROOTCHECK="n"' >> ./etc/preloaded-vars.conf
1238     echo "" >> ./etc/preloaded-vars.conf
1239     echo 'USER_ENABLE_SYSCHECK="n"' >> ./etc/preloaded-vars.conf
1240     echo "" >> ./etc/preloaded-vars.conf
1241     echo 'USER_ENABLE_ACTIVE_RESPONSE="n"' >> ./etc/preloaded-vars.conf
1242     echo "" >> ./etc/preloaded-vars.conf
1243     echo 'USER_UPDATE="n"' >> ./etc/preloaded-vars.conf
1244     echo "" >> ./etc/preloaded-vars.conf
1245     echo 'USER_UPDATE_RULES="n"' >> ./etc/preloaded-vars.conf
1246     echo "" >> ./etc/preloaded-vars.conf
1247     echo 'USER_CLEANINSTALL="y"' >> ./etc/preloaded-vars.conf
1248     echo "" >> ./etc/preloaded-vars.conf
1249    ./install.sh
1250 fi
1251
1252
1253 exit 0
1254
1255
1256
1257 #### exit ? ###