install.sh

   1 #!/bin/sh
   2 # Installation script for the OSSEC
   3 # Author: Daniel B. Cid <daniel.cid@gmail.com>
   4 # Last modification: Aug 30, 2012
   5
   6 # Changelog 19/03/2006 - Rafael M. Capovilla <under@underlinux.com.br>
   7 # New function AddWhite to allow users to add more Ips in the white_list
   8 # Minor *echos* modifications to better look
   9 # Bug fix - When email address is blank
  10 # Bug fix - delete INSTALLDIR - Default is yes but if the user just press enter the script wasn't deleting it as it should
  11 # Changelog 15/07/2006 - Rafael M. Capovilla <under@underlinux.com.br>
  12 # New function AddTable to add support for OpenBSD pf rules in firewall-drop active response
  13
  14 # Changelog 29 March 2012 - Adding hybrid mode (standalone + agent)
  15
  16
  17
  18 ### Looking up for the execution directory
  19 cd `dirname $0`
  20
  21
  22 ### Looking for echo -n
  23 ECHO="echo -n"
  24 hs=`echo -n "a"`
  25 if [ ! "X$hs" = "Xa" ]; then
  26     ls "/usr/ucb/echo" > /dev/null 2>&1
  27     if [ $? = 0 ]; then
  28         ECHO="/usr/ucb/echo -n"
  29     else
  30         ECHO=echo
  31     fi
  32 fi
  33
  34 # For solaris
  35 echo "xxxx" | grep -E "xxx" > /dev/null 2>&1
  36 if [ ! $? = 0 ]; then
  37     ls "/usr/xpg4/bin/grep" > /dev/null 2>&1
  38     if [ $? = 0 ]; then
  39         PATH=/usr/xpg4/bin:$PATH
  40     fi
  41 fi
  42
  43 # Initializing vars
  44 SET_DEBUG=""
  45
  46 # Checking for command line arguments
  47 for i in $*; do
  48     if [ "X$i" = "Xdebug" ]; then
  49         SET_DEBUG="debug"
  50     elif [ "X$i" = "Xbinary-install" ]; then
  51         USER_BINARYINSTALL="yes"
  52     elif [ "X$i" = "Xhelp" ]; then
  53         echo "$0 debug"
  54         echo "$0 binary-install"
  55         exit 1;
  56     fi
  57 done
  58
  59
  60
  61 ##########
  62 # install()
  63 ##########
  64 Install()
  65 {
  66         echo ""
  67         echo "5- ${installing}"
  68
  69         echo "DIR=\"${INSTALLDIR}\"" > ${LOCATION}
  70     echo "CC=${CC}" >> ${LOCATION}
  71     echo "GCC=${CC}" >> ${LOCATION}
  72     echo "CLANG=clang" >> ${LOCATION}
  73
  74     # Changing Config.OS with the new C flags
  75     # Checking if debug is enabled
  76     if [ "X${SET_DEBUG}" = "Xdebug" ]; then
  77         CEXTRA="${CEXTRA} -DDEBUGAD"
  78     fi
  79
  80     echo "CEXTRA=${CEXTRA}" >> ./src/Config.OS
  81
  82     # Makefile
  83         echo " - ${runningmake}"
  84     cd ./src
  85
  86     # Binary install will use the previous generated code.
  87     if [ "X${USER_BINARYINSTALL}" = "X" ]; then
  88         make all
  89         if [ $? != 0 ]; then
  90             cd ../
  91             catError "0x5-build"
  92         fi
  93
  94         # Building everything
  95         make build
  96         if [ $? != 0 ]; then
  97             cd ../
  98             catError "0x5-build"
  99         fi
 100     fi
 101
 102     # If update, stop ossec
 103     if [ "X${update_only}" = "Xyes" ]; then
 104         UpdateStopOSSEC
 105     fi
 106
 107     # Making the right installation type
 108         if [ "X$INSTYPE" = "Xserver" ]; then
 109         ./InstallServer.sh
 110
 111     elif [ "X$INSTYPE" = "Xagent" ]; then
 112         ./InstallAgent.sh
 113
 114     elif [ "X$INSTYPE" = "Xlocal" ]; then
 115         ./InstallServer.sh local
 116         fi
 117
 118     cd ../
 119
 120
 121     # Generate the /etc/ossec-init.conf
 122     VERSION_FILE="./src/VERSION"
 123     VERSION=`cat ${VERSION_FILE}`
 124     chmod 700 ${OSSEC_INIT} > /dev/null 2>&1
 125     echo "DIRECTORY=\"${INSTALLDIR}\"" > ${OSSEC_INIT}
 126     echo "VERSION=\"${VERSION}\"" >> ${OSSEC_INIT}
 127     echo "DATE=\"`date`\"" >> ${OSSEC_INIT}
 128     echo "TYPE=\"${INSTYPE}\"" >> ${OSSEC_INIT}
 129     chmod 600 ${OSSEC_INIT}
 130     cp -pr ${OSSEC_INIT} ${INSTALLDIR}${OSSEC_INIT}
 131     chmod 640 ${INSTALLDIR}${OSSEC_INIT}
 132
 133
 134     # If update_rules is set, we need to tweak
 135     # ossec.conf to read the new signatures.
 136     if [ "X${update_rules}" = "Xyes" ]; then
 137         UpdateOSSECRules
 138     fi
 139
 140     # If update, start OSSEC
 141     if [ "X${update_only}" = "Xyes" ]; then
 142         UpdateStartOSSEC
 143     fi
 144
 145     # Calling the init script  to start ossec hids during boot
 146     if [ "X${update_only}" = "X" ]; then
 147         runInit
 148         if [ $? = 1 ]; then
 149             notmodified="yes"
 150         fi
 151     fi
 152
 153 }
 154
 155
 156
 157
 158 ##########
 159 # UseSyscheck()
 160 ##########
 161 UseSyscheck()
 162 {
 163
 164     # Integrity check config
 165     echo ""
 166     $ECHO "  3.2- ${runsyscheck} ($yes/$no) [$yes]: "
 167     if [ "X${USER_ENABLE_SYSCHECK}" = "X" ]; then
 168         read AS
 169     else
 170         AS=${USER_ENABLE_SYSCHECK}
 171     fi
 172     echo ""
 173     case $AS in
 174         $nomatch)
 175             echo "   - ${nosyscheck}."
 176             ;;
 177         *)
 178             SYSCHECK="yes"
 179             echo "   - ${yessyscheck}."
 180             ;;
 181     esac
 182
 183     # Adding to the config file
 184     if [ "X$SYSCHECK" = "Xyes" ]; then
 185         cat ${SYSCHECK_TEMPLATE} >> $NEWCONFIG
 186     fi
 187 }
 188
 189
 190
 191
 192 ##########
 193 # UseRootcheck()
 194 ##########
 195 UseRootcheck()
 196 {
 197
 198     # Rootkit detection configuration
 199     echo ""
 200     $ECHO "  3.3- ${runrootcheck} ($yes/$no) [$yes]: "
 201
 202     if [ "X${USER_ENABLE_ROOTCHECK}" = "X" ]; then
 203         read ES
 204     else
 205         ES=${USER_ENABLE_ROOTCHECK}
 206     fi
 207
 208     echo ""
 209     case $ES in
 210         $nomatch)
 211             echo "   - ${norootcheck}."
 212             ;;
 213         *)
 214             ROOTCHECK="yes"
 215             echo "   - ${yesrootcheck}."
 216             ;;
 217     esac
 218
 219
 220     # Adding to the config file
 221     if [ "X$ROOTCHECK" = "Xyes" ]; then
 222         echo "" >> $NEWCONFIG
 223         echo "  <rootcheck>" >> $NEWCONFIG
 224         echo "    <rootkit_files>$INSTALLDIR/etc/shared/rootkit_files.txt</rootkit_files>" >> $NEWCONFIG
 225         echo "    <rootkit_trojans>$INSTALLDIR/etc/shared/rootkit_trojans.txt</rootkit_trojans>" >> $NEWCONFIG
 226         echo "    <system_audit>$INSTALLDIR/etc/shared/system_audit_rcl.txt</system_audit>" >> $NEWCONFIG
 227         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_debian_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 228         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_rhel_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 229         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_rhel5_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 230         echo "  </rootcheck>" >> $NEWCONFIG
 231     else
 232       echo "" >> $NEWCONFIG
 233       echo "  <rootcheck>" >> $NEWCONFIG
 234         echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 235       echo "  </rootcheck>" >> $NEWCONFIG
 236     fi
 237 }
 238
 239
 240
 241
 242 ##########
 243 # SetupLogs()
 244 ##########
 245 SetupLogs()
 246 {
 247     if [ "x${USER_CLEANINSTALL}" = "xy" ]; then
 248         OPENDIR=`dirname $INSTALLDIR`
 249         echo "" >> $NEWCONFIG
 250         echo "  <localfile>" >> $NEWCONFIG
 251         echo "    <log_format>ossecalert</log_format>" >> $NEWCONFIG
 252         echo "    <location>$OPENDIR/logs/alerts/alerts.log</location>" >>$NEWCONFIG
 253         echo "  </localfile>" >> $NEWCONFIG
 254         echo "" >> $NEWCONFIG
 255         return;
 256     fi
 257
 258     NB=$1
 259     echo ""
 260     echo "  $NB- ${readlogs}"
 261
 262     echo "  <!-- Files to monitor (localfiles) -->" >> $NEWCONFIG
 263     LOG_FILES=`cat ${SYSLOG_TEMPLATE}`
 264     for i in ${LOG_FILES}; do
 265         # If log file present, add it
 266         ls $i > /dev/null 2>&1
 267         if [ $? = 0 ]; then
 268             echo "    -- $i"
 269                 echo "" >> $NEWCONFIG
 270                 echo "  <localfile>" >> $NEWCONFIG
 271             echo "    <log_format>syslog</log_format>" >> $NEWCONFIG
 272                 echo "    <location>$i</location>" >>$NEWCONFIG
 273                 echo "  </localfile>" >> $NEWCONFIG
 274         fi
 275     done
 276
 277
 278     # Getting snort files
 279     SNORT_FILES=`cat ${SNORT_TEMPLATE}`
 280     for i in ${SNORT_FILES}; do
 281         ls $i > /dev/null 2>&1
 282         if [ $? = 0 ]; then
 283             echo "" >> $NEWCONFIG
 284             echo "  <localfile>" >> $NEWCONFIG
 285
 286             head -n 1 $i|grep "\[**\] "|grep -v "Classification:" > /dev/null
 287             if [ $? = 0 ]; then
 288                 echo "    <log_format>snort-full</log_format>" >> $NEWCONFIG
 289                 echo "    -- $i (snort-full file)"
 290             else
 291                 echo "    <log_format>snort-fast</log_format>" >> $NEWCONFIG
 292                 echo "    -- $i (snort-fast file)"
 293             fi
 294             echo "    <location>$i</location>" >>$NEWCONFIG
 295             echo "  </localfile>" >> $NEWCONFIG
 296         fi
 297     done
 298
 299     # Getting apache logs
 300     APACHE_FILES=`cat ${APACHE_TEMPLATE}`
 301     for i in ${APACHE_FILES}; do
 302         ls $i > /dev/null 2>&1
 303         if [ $? = 0 ]; then
 304           echo "" >> $NEWCONFIG
 305           echo "  <localfile>" >> $NEWCONFIG
 306           echo "    <log_format>apache</log_format>" >> $NEWCONFIG
 307           echo "    <location>$i</location>" >>$NEWCONFIG
 308           echo "  </localfile>" >> $NEWCONFIG
 309
 310           echo "    -- $i (apache log)"
 311         fi
 312     done
 313
 314     # Getting postgresql logs
 315     PGSQL_FILES=`cat ${PGSQL_TEMPLATE}`
 316     for i in ${PGSQL_FILES}; do
 317         ls $i > /dev/null 2>&1
 318         if [ $? = 0 ]; then
 319           echo "" >> $NEWCONFIG
 320           echo "  <localfile>" >> $NEWCONFIG
 321           echo "    <log_format>postgresql_log</log_format>" >> $NEWCONFIG
 322           echo "    <location>$i</location>" >>$NEWCONFIG
 323           echo "  </localfile>" >> $NEWCONFIG
 324
 325           echo "    -- $i (postgresql log)"
 326         fi
 327     done
 328
 329    if [ "X$NUNAME" = "XLinux" ]; then
 330       echo "" >> $NEWCONFIG
 331       echo "  <localfile>" >> $NEWCONFIG
 332       echo "    <log_format>command</log_format>" >> $NEWCONFIG
 333       echo "    <command>df -h</command>" >> $NEWCONFIG
 334       echo "  </localfile>" >> $NEWCONFIG
 335       echo "" >> $NEWCONFIG
 336       echo "  <localfile>" >> $NEWCONFIG
 337       echo "    <log_format>full_command</log_format>" >> $NEWCONFIG
 338       echo "    <command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command>" >> $NEWCONFIG
 339       echo "  </localfile>" >> $NEWCONFIG
 340       echo "" >> $NEWCONFIG
 341       echo "  <localfile>" >> $NEWCONFIG
 342       echo "    <log_format>full_command</log_format>" >> $NEWCONFIG
 343       echo "    <command>last -n 5</command>" >> $NEWCONFIG
 344       echo "  </localfile>" >> $NEWCONFIG
 345    fi
 346
 347
 348
 349
 350     echo ""
 351     catMsg "0x106-logs"
 352
 353
 354     if [ "X$USER_NO_STOP" = "X" ]; then
 355         read ANY
 356     fi
 357 }
 358
 359
 360
 361 # install.sh
 362
 363 ##########
 364 # ConfigureClient()
 365 ##########
 366 ConfigureClient()
 367 {
 368         echo ""
 369         echo "3- ${configuring} $NAME."
 370         echo ""
 371
 372     if [[ "X${USER_AGENT_SERVER_IP}" = "X" && "X${USER_AGENT_SERVER_NAME}" = "X" ]]; then
 373         # Looping and asking for server ip or hostname
 374         while [ 1 ]; do
 375             $ECHO "  3.1- ${serveraddr}: "
 376                 read ADDRANSWER
 377             # Is it an IP?
 378             echo $ADDRANSWER | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" > /dev/null 2>&1
 379             if [ $? = 0 ]; then
 380                     echo ""
 381                 IP=$ADDRANSWER
 382                     echo "   - ${addingip} $IP"
 383                 break;
 384             # Must be a name
 385             elif [ $? != 0 ]; then
 386                     echo ""
 387                 HNAME=$ADDRANSWER
 388                     echo "   - ${addingname} $HNAME"
 389                 break;
 390             fi
 391         done
 392     else
 393         IP=${USER_AGENT_SERVER_IP}
 394         HNAME=${USER_AGENT_SERVER_NAME}
 395     fi
 396
 397     echo "<ossec_config>" > $NEWCONFIG
 398     echo "  <client>" >> $NEWCONFIG
 399     if [ "X${IP}" != "X" ]; then
 400         echo "    <server-ip>$IP</server-ip>" >> $NEWCONFIG
 401     elif [ "X${HNAME}" != "X" ]; then
 402         echo "    <server-hostname>$HNAME</server-hostname>" >> $NEWCONFIG
 403     fi
 404     echo "  </client>" >> $NEWCONFIG
 405     echo "" >> $NEWCONFIG
 406
 407     # Syscheck?
 408     UseSyscheck
 409
 410     # Rootcheck?
 411     UseRootcheck
 412
 413     echo ""
 414     $ECHO "  3.4 - ${enable_ar} ($yes/$no) [$yes]: "
 415
 416     if [ "X${USER_ENABLE_ACTIVE_RESPONSE}" = "X" ]; then
 417         read ANY
 418     else
 419         ANY=${USER_ENABLE_ACTIVE_RESPONSE}
 420     fi
 421
 422     case $ANY in
 423         $nomatch)
 424             echo ""
 425             echo "   - ${noactive}."
 426             echo "" >> $NEWCONFIG
 427             echo "  <active-response>" >> $NEWCONFIG
 428             echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 429             echo "  </active-response>" >> $NEWCONFIG
 430             echo "" >> $NEWCONFIG
 431             ;;
 432         *)
 433             ACTIVERESPONSE="yes"
 434             echo ""
 435             ;;
 436     esac
 437
 438     # Set up the log files
 439     SetupLogs "3.5"
 440
 441     echo "</ossec_config>" >> $NEWCONFIG
 442 }
 443
 444
 445
 446
 447 ##########
 448 # ConfigureServer()
 449 ##########
 450 ConfigureServer()
 451 {
 452         echo ""
 453         echo "3- ${configuring} $NAME."
 454
 455
 456     # Configuring e-mail notification
 457         echo ""
 458         $ECHO "  3.1- ${mailnotify} ($yes/$no) [$yes]: "
 459
 460     if [ "X${USER_ENABLE_EMAIL}" = "X" ]; then
 461         read ANSWER
 462     else
 463         ANSWER=${USER_ENABLE_EMAIL}
 464     fi
 465
 466         case $ANSWER in
 467                 $nomatch)
 468             echo ""
 469                         echo "   --- ${nomail}."
 470                         EMAILNOTIFY="no"
 471                         ;;
 472                 *)
 473                         EMAILNOTIFY="yes"
 474                         $ECHO "   - ${whatsemail} "
 475             if [ "X${USER_EMAIL_ADDRESS}" = "X" ]; then
 476
 477                 read EMAIL
 478                 echo "${EMAIL}" | grep -E "^[a-zA-Z0-9_.-]{1,36}@[a-zA-Z0-9_.-]{1,54}$" > /dev/null 2>&1 ;RVAL=$?;
 479                 # Ugly e-mail validation
 480                             while [ "$EMAIL" = "" -o ! ${RVAL} = 0 ] ; do
 481                                     $ECHO "   - ${whatsemail} "
 482                                     read EMAIL
 483                     echo "${EMAIL}" | grep -E "^[a-zA-Z0-9_.-]{1,36}@[a-zA-Z0-9_.-]{1,54}$" > /dev/null 2>&1 ;RVAL=$?;
 484                             done
 485             else
 486                 EMAIL=${USER_EMAIL_ADDRESS}
 487             fi
 488
 489             ls ${HOST_CMD} > /dev/null 2>&1
 490             if [ $? = 0 ]; then
 491               HOSTTMP=`${HOST_CMD} -W 5 -t mx ossec.net 2>/dev/null`
 492               if [ $? = 1 ]; then
 493                  # Trying without the -W
 494                  HOSTTMP=`${HOST_CMD} -t mx ossec.net 2>/dev/null`
 495               fi
 496               echo "x$HOSTTMP" | grep "ossec.net mail is handled" > /dev/null 2>&1
 497               if [ $? = 0 ]; then
 498                  # Breaking down the user e-mail
 499                  EMAILHOST=`echo ${EMAIL} | cut -d "@" -f 2`
 500                  if [ "X${EMAILHOST}" = "Xlocalhost" ]; then
 501                     SMTPHOST="127.0.0.1"
 502                  else
 503                     HOSTTMP=`${HOST_CMD} -W 5 -t mx ${EMAILHOST}`
 504                     SMTPHOST=`echo ${HOSTTMP} | cut -d " " -f 7`
 505                  fi
 506               fi
 507             fi
 508
 509             if [ "X${USER_EMAIL_SMTP}" = "X" ]; then
 510                 if [ "X${SMTPHOST}" != "X" ]; then
 511                     echo ""
 512                     echo "   - ${yoursmtp}: ${SMTPHOST}"
 513                     $ECHO "   - ${usesmtp} ($yes/$no) [$yes]: "
 514                     read EMAIL2
 515                     case ${EMAIL2} in
 516                         $nomatch)
 517                         echo ""
 518                         SMTP=""
 519                         ;;
 520                     *)
 521                         SMTP=${SMTPHOST}
 522                         echo ""
 523                         echo "   --- ${usingsmtp} ${SMTP}"
 524                         ;;
 525                     esac
 526                 fi
 527
 528                 if [ "X${SMTP}" = "X" ]; then
 529                                 $ECHO "   - ${whatsmtp} "
 530                     read SMTP
 531                 fi
 532             else
 533                 SMTP=${USER_EMAIL_SMTP}
 534             fi
 535         ;;
 536         esac
 537
 538
 539         # Writting global parameters
 540     echo "<ossec_config>" > $NEWCONFIG
 541         echo "  <global>" >> $NEWCONFIG
 542         if [ "$EMAILNOTIFY" = "yes" ]; then
 543                 echo "    <email_notification>yes</email_notification>" >> $NEWCONFIG
 544                 echo "    <email_to>$EMAIL</email_to>" >> $NEWCONFIG
 545                 echo "    <smtp_server>$SMTP</smtp_server>" >> $NEWCONFIG
 546                 echo "    <email_from>ossecm@${HOST}</email_from>" >> $NEWCONFIG
 547         else
 548                 echo "    <email_notification>no</email_notification>" >> $NEWCONFIG
 549         fi
 550
 551     echo "  </global>" >> $NEWCONFIG
 552         echo "" >> $NEWCONFIG
 553
 554         # Writting rules configuration
 555     cat ${RULES_TEMPLATE} >> $NEWCONFIG
 556         echo "" >> $NEWCONFIG
 557
 558
 559     # Checking if syscheck should run
 560     UseSyscheck
 561
 562     # Checking if rootcheck should run
 563     UseRootcheck
 564
 565
 566     # Active response
 567     catMsg "0x107-ar"
 568     $ECHO "   - ${enable_ar} ($yes/$no) [$yes]: "
 569
 570     if [ "X${USER_ENABLE_ACTIVE_RESPONSE}" = "X" ]; then
 571         read AR
 572     else
 573         AR=${USER_ENABLE_ACTIVE_RESPONSE}
 574     fi
 575
 576     case $AR in
 577         $nomatch)
 578             echo ""
 579             echo "     - ${noactive}."
 580             echo "" >> $NEWCONFIG
 581             echo "  <active-response>" >> $NEWCONFIG
 582             echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 583             echo "  </active-response>" >> $NEWCONFIG
 584             echo "" >> $NEWCONFIG
 585             ;;
 586         *)
 587             ACTIVERESPONSE="yes"
 588             echo ""
 589             catMsg "0x108-ar-enabled"
 590
 591             echo ""
 592             $ECHO "   - ${firewallar} ($yes/$no) [$yes]: "
 593
 594             if [ "X${USER_ENABLE_FIREWALL_RESPONSE}" = "X" ]; then
 595                 read HD2
 596             else
 597                 HD2=${USER_ENABLE_FIREWALL_RESPONSE}
 598             fi
 599
 600             echo ""
 601             case $HD2 in
 602                 $nomatch)
 603                     echo "     - ${nofirewall}"
 604                     ;;
 605                 *)
 606                     echo "     - ${yesfirewall}"
 607                     FIREWALLDROP="yes"
 608                     ;;
 609             esac
 610             echo "" >> $NEWCONFIG
 611             echo "  <global>" >> $NEWCONFIG
 612             echo "    <white_list>127.0.0.1</white_list>" >> $NEWCONFIG
 613             echo "    <white_list>^localhost.localdomain$</white_list>">>$NEWCONFIG
 614             echo ""
 615             echo "   - ${defaultwhitelist}"
 616             for ip in ${NAMESERVERS} ${NAMESERVERS2};
 617             do
 618             if [ ! "X${ip}" = "X" ]; then
 619                 echo "      - ${ip}"
 620                 echo "    <white_list>${ip}</white_list>" >>$NEWCONFIG
 621             fi
 622             done
 623             AddWhite
 624
 625             # If Openbsd or Freebsd with pf enable, ask about
 626             # automatically setting it up.
 627             # Commenting it out in case I change my mind about it
 628             # later.
 629             #if [ "X`sh ./src/init/fw-check.sh`" = "XPF" ]; then
 630             #    echo ""
 631             #    $ECHO "   - ${pfenable} ($yes/$no) [$yes]: "
 632             #    if [ "X${USER_ENABLE_PF}" = "X" ]; then
 633             #        read PFENABLE
 634             #    else
 635             #        PFENABLE=${USER_ENABLE_PF}
 636             #    fi
 637             #
 638             #    echo ""
 639             #    case $PFENABLE in
 640             #        $nomatch)
 641             #            echo "     - ${nopf}"
 642             #            ;;
 643             #        *)
 644             #            AddPFTable
 645             #            ;;
 646             #    esac
 647             #fi
 648
 649             echo "  </global>" >> $NEWCONFIG
 650             ;;
 651     esac
 652
 653
 654     if [ "X$INSTYPE" = "Xserver" ]; then
 655       # Configuring remote syslog
 656           echo ""
 657           $ECHO "  3.5- ${syslog} ($yes/$no) [$yes]: "
 658
 659       if [ "X${USER_ENABLE_SYSLOG}" = "X" ]; then
 660             read ANSWER
 661       else
 662         ANSWER=${USER_ENABLE_SYSLOG}
 663       fi
 664
 665       echo ""
 666       case $ANSWER in
 667                 $nomatch)
 668                         echo "   --- ${nosyslog}."
 669                         ;;
 670                 *)
 671                         echo "   - ${yessyslog}."
 672                         RLOG="yes"
 673                         ;;
 674           esac
 675
 676           # Configuring remote connections
 677       SLOG="yes"
 678         fi
 679
 680
 681
 682         if [ "X$RLOG" = "Xyes" ]; then
 683         echo "" >> $NEWCONFIG
 684         echo "  <remote>" >> $NEWCONFIG
 685         echo "    <connection>syslog</connection>" >> $NEWCONFIG
 686         echo "  </remote>" >> $NEWCONFIG
 687         fi
 688
 689         if [ "X$SLOG" = "Xyes" ]; then
 690         echo "" >> $NEWCONFIG
 691         echo "  <remote>" >> $NEWCONFIG
 692         echo "    <connection>secure</connection>" >> $NEWCONFIG
 693         echo "  </remote>" >> $NEWCONFIG
 694         fi
 695
 696
 697         # Email/log alerts
 698         echo "" >> $NEWCONFIG
 699         echo "  <alerts>" >> $NEWCONFIG
 700     echo "    <log_alert_level>1</log_alert_level>" >> $NEWCONFIG
 701     if [ "$EMAILNOTIFY" = "yes" ]; then
 702         echo "    <email_alert_level>7</email_alert_level>">> $NEWCONFIG
 703         fi
 704         echo "  </alerts>" >> $NEWCONFIG
 705
 706
 707     if [ "X$ACTIVERESPONSE" = "Xyes" ]; then
 708         # Add commands in here
 709         echo "" >> $NEWCONFIG
 710         cat ${HOST_DENY_TEMPLATE} >> $NEWCONFIG
 711         echo "" >> $NEWCONFIG
 712         cat ${FIREWALL_DROP_TEMPLATE} >> $NEWCONFIG
 713         echo "" >> $NEWCONFIG
 714         cat ${DISABLE_ACCOUNT_TEMPLATE} >> $NEWCONFIG
 715         echo "" >> $NEWCONFIG
 716         cat ${ROUTENULL_TEMPLATE} >> $NEWCONFIG
 717         echo "" >> $NEWCONFIG
 718
 719         if [ "X$FIREWALLDROP" = "Xyes" ]; then
 720             echo "" >> $NEWCONFIG
 721             cat ${ACTIVE_RESPONSE_TEMPLATE} >> $NEWCONFIG
 722             echo "" >> $NEWCONFIG
 723         fi
 724     fi
 725
 726     # Setting up the logs
 727     SetupLogs "3.6"
 728     echo "</ossec_config>" >> $NEWCONFIG
 729 }
 730
 731
 732
 733
 734 ##########
 735 # setEnv()
 736 ##########
 737 setEnv()
 738 {
 739     echo ""
 740     echo "2- ${settingupenv}."
 741
 742     echo ""
 743     if [ "X${USER_DIR}" = "X" ]; then
 744         while [ 1 ]; do
 745             $ECHO " - ${wheretoinstall} [$INSTALLDIR]: "
 746             read ANSWER
 747             if [ ! "X$ANSWER" = "X" ]; then
 748                 echo $ANSWER |grep -E "^/[a-zA-Z0-9./_-]{3,128}$">/dev/null 2>&1
 749                 if [ $? = 0 ]; then
 750                     INSTALLDIR=$ANSWER;
 751                     break;
 752                 fi
 753             else
 754                 break;
 755             fi
 756         done
 757     else
 758         INSTALLDIR=${USER_DIR}
 759     fi
 760
 761
 762     CEXTRA="$CEXTRA -DDEFAULTDIR=\\\"${INSTALLDIR}\\\""
 763
 764     echo ""
 765     echo "    - ${installat} ${INSTALLDIR} ."
 766
 767
 768     if [ "X$INSTYPE" = "Xagent" ]; then
 769         CEXTRA="$CEXTRA -DCLIENT"
 770     elif [ "X$INSTYPE" = "Xlocal" ]; then
 771         CEXTRA="$CEXTRA -DLOCAL"
 772     fi
 773
 774     ls $INSTALLDIR >/dev/null 2>&1
 775     if [ $? = 0 ]; then
 776         if [ "X${USER_DELETE_DIR}" = "X" ]; then
 777             echo ""
 778             $ECHO "    - ${deletedir} ($yes/$no) [$yes]: "
 779             read ANSWER
 780         else
 781             ANSWER=${USER_DELETE_DIR}
 782         fi
 783
 784         case $ANSWER in
 785             $yesmatch)
 786                 rm -rf $INSTALLDIR
 787                 if [ ! $? = 0 ]; then
 788                     exit 2;
 789                 fi
 790                 ;;
 791         esac
 792     fi
 793 }
 794
 795
 796
 797
 798 ##########
 799 # checkDependencies()
 800 # Thanks to gabriel@macacos.org
 801 ##########
 802 checkDependencies()
 803 {
 804     echo ""
 805     OLDOPATH=$PATH
 806     if [ "X$NUNAME" = "XSunOS" ]; then
 807         PATH=$PATH:/usr/ccs/bin:/usr/xpg4/bin:/opt/csw/gcc3/bin:/opt/csw/bin:/usr/sfw/bin
 808         export  PATH
 809     elif [ "X$NUNAME" = "XAIX" ]; then
 810         PATH=$PATH:/usr/vac/bin
 811         export  PATH
 812     fi
 813
 814     ls "`which gcc`" > /dev/null 2>&1
 815     if [ ! $? = 0 ]; then
 816         ls "`which cc`" > /dev/null 2>&1
 817         if [ ! $? = 0 ]; then
 818             if [ "X${USER_BINARYINSTALL}" = "X" ]; then
 819                 catError "0x3-dependencies"
 820             fi
 821         fi
 822         CC="cc"
 823     else
 824         CC="gcc"
 825     fi
 826
 827     PATH=$OLDOPATH
 828     export PATH
 829 }
 830
 831 ##########
 832 # AddWhite()
 833 ##########
 834 AddWhite()
 835 {
 836         while [ 1 ]
 837         do
 838         echo ""
 839                 $ECHO "   - ${addwhite} ($yes/$no)? [$no]: "
 840
 841         # If white list is set, we don't need to ask it here.
 842         if [ "X${USER_WHITE_LIST}" = "X" ]; then
 843                     read ANSWER
 844         else
 845             ANSWER=$yes
 846         fi
 847
 848                 if [ "X${ANSWER}" = "X" ] ; then
 849                         ANSWER=$no
 850                 fi
 851
 852                 case $ANSWER in
 853                         $no)
 854                                 break;
 855                                 ;;
 856                         *)
 857                                 $ECHO "   - ${ipswhite}"
 858                 if [ "X${USER_WHITE_LIST}" = "X" ]; then
 859                                     read IPS
 860                                 else
 861                     IPS=${USER_WHITE_LIST}
 862                 fi
 863
 864                                 for ip in ${IPS};
 865                                 do
 866                                         if [ ! "X${ip}" = "X" ]; then
 867                         echo $ip | grep -E "^[0-9./]{5,20}$" > /dev/null 2>&1
 868                         if [ $? = 0 ]; then
 869                                                 echo "    <white_list>${ip}</white_list>" >>$NEWCONFIG
 870                         fi
 871                                         fi
 872                                 done
 873
 874                                 break;
 875                                 ;;
 876                 esac
 877         done
 878 }
 879
 880
 881 ##########
 882 # AddPFTable()
 883 ##########
 884 AddPFTable()
 885 {
 886     #default pf rules
 887     TABLE="ossec_fwtable"
 888
 889     # Add table to the first line
 890     echo ""
 891     echo "   - ${pfmessage}:"
 892     echo "     ${moreinfo}"
 893     echo "     http://www.ossec.net/en/manual.html#active-response-tools"
 894
 895     echo ""
 896     echo ""
 897     echo "      table <${TABLE}> persist #$TABLE "
 898     echo "      block in quick from <${TABLE}> to any"
 899     echo "      block out quick from any to <${TABLE}>"
 900     echo ""
 901     echo ""
 902
 903 }
 904
 905 ##########
 906 # main()
 907 ##########
 908 main()
 909 {
 910     LG="en"
 911     LANGUAGE="en"
 912     . ./src/init/shared.sh
 913     . ./src/init/functions.sh
 914
 915     # Reading pre-defined file
 916     if [ ! `isFile ${PREDEF_FILE}` = "${FALSE}" ]; then
 917         . ${PREDEF_FILE}
 918     fi
 919
 920     # If user language is not set
 921
 922     if [ "X${USER_LANGUAGE}" = "X" ]; then
 923
 924         # Choosing the language.
 925         while [ 1 ]; do
 926         echo ""
 927         for i in `ls ${TEMPLATE}`; do
 928             # ignore CVS (should not be there anyways and config)
 929             if [ "$i" = "CVS" -o "$i" = "config" ]; then continue; fi
 930             cat "${TEMPLATE}/$i/language.txt"
 931             if [ ! "$i" = "en" ]; then
 932                 LG="${LG}/$i"
 933             fi
 934         done
 935         $ECHO "  (${LG}) [en]: "
 936         read USER_LG;
 937
 938         if [ "X${USER_LG}" = "X" ]; then
 939             USER_LG="en"
 940         fi
 941
 942         ls "${TEMPLATE}/${USER_LG}" > /dev/null 2>&1
 943         if [ $? = 0 ]; then
 944             break;
 945         fi
 946         done;
 947
 948         LANGUAGE=${USER_LG}
 949
 950     else
 951
 952         # If provided language is not valid, default to english
 953         ls "${TEMPLATE}/${USER_LANGUAGE}" > /dev/null 2>&1
 954         if [ $? = 0 ]; then
 955             LANGUAGE=${USER_LANGUAGE}
 956         else
 957             LANGUAGE="en"
 958         fi
 959
 960     fi # for USER_LANGUAGE
 961
 962
 963     . ./src/init/shared.sh
 964     . ./src/init/language.sh
 965     . ./src/init/functions.sh
 966     . ./src/init/init.sh
 967     . ${TEMPLATE}/${LANGUAGE}/messages.txt
 968
 969
 970     # Must be executed as ./install.sh
 971     if [ `isFile ${VERSION_FILE}` = "${FALSE}" ]; then
 972         catError "0x1-location";
 973     fi
 974
 975     # Must be root
 976     if [ ! "X$ME" = "Xroot" ]; then
 977         catError "0x2-beroot";
 978     fi
 979
 980     # Checking dependencies
 981     checkDependencies
 982
 983     clear
 984
 985
 986     # Initial message
 987     echo " $NAME $VERSION ${installscript} - http://www.ossec.net"
 988
 989     catMsg "0x101-initial"
 990
 991     echo "  - $system: $UNAME"
 992     echo "  - $user: $ME"
 993     echo "  - $host: $HOST"
 994     echo ""
 995     echo ""
 996     echo "  -- $hitanyorabort --"
 997
 998     if [ "X$USER_NO_STOP" = "X" ]; then
 999         read ANY
1000     fi
1001
1002     . ./src/init/update.sh
1003     # Is this an update?
1004     if [ "`isUpdate`" = "${TRUE}" -a "x${USER_CLEANINSTALL}" = "x" ]; then
1005         echo ""
1006         ct="1"
1007         while [ $ct = "1" ]; do
1008             ct="0"
1009             $ECHO " - ${wanttoupdate} ($yes/$no): "
1010             if [ "X${USER_UPDATE}" = "X" ]; then
1011                 read ANY
1012             else
1013                 ANY=$yes
1014             fi
1015
1016             case $ANY in
1017                 $yes)
1018                     update_only="yes"
1019                     break;
1020                     ;;
1021                 $no)
1022                     break;
1023                     ;;
1024                   *)
1025                     ct="1"
1026                     ;;
1027             esac
1028         done
1029
1030
1031         # Do some of the update steps.
1032         if [ "X${update_only}" = "Xyes" ]; then
1033             . ./src/init/update.sh
1034
1035             if [ "`doUpdatecleanup`" = "${FALSE}" ]; then
1036                 # Disabling update
1037                 echo ""
1038                 echo "${unabletoupdate}"
1039                 sleep 5;
1040                 update_only=""
1041             else
1042                 # Get update
1043                 USER_INSTALL_TYPE=`getPreinstalled`
1044                 USER_DIR=`getPreinstalledDir`
1045                 USER_DELETE_DIR="$nomatch"
1046             fi
1047
1048             ct="1"
1049
1050             # We dont need to update the rules on agent installs
1051             if [ "X${USER_INSTALL_TYPE}" = "Xagent" ]; then
1052                 ct="0"
1053             fi
1054
1055             while [ $ct = "1" ]; do
1056                 ct="0"
1057                 $ECHO " - ${updaterules} ($yes/$no): "
1058                 if [ "X${USER_UPDATE_RULES}" = "X" ]; then
1059                     read ANY
1060                 else
1061                     ANY=$yes
1062                 fi
1063
1064                 case $ANY in
1065                     $yes)
1066                         update_rules="yes"
1067                         break;
1068                         ;;
1069                     $no)
1070                         break;
1071                         ;;
1072                     *)
1073                         ct="1"
1074                         ;;
1075                 esac
1076             done
1077         fi
1078         echo ""
1079     fi
1080
1081     hybrid="hybrid"
1082     HYBID=""
1083     hybridm=`echo ${hybrid} | cut -b 1`
1084     serverm=`echo ${server} | cut -b 1`
1085     localm=`echo ${local} | cut -b 1`
1086     agentm=`echo ${agent} | cut -b 1`
1087     helpm=`echo ${help} | cut -b 1`
1088
1089     # If user install type is not set, ask for it.
1090     if [ "X${USER_INSTALL_TYPE}" = "X" ]; then
1091
1092         # Loop for the installation options
1093         while [ 1 ]
1094         do
1095             echo ""
1096             $ECHO "1- ${whattoinstall} "
1097
1098             read ANSWER
1099             case $ANSWER in
1100
1101                 ${helpm}|${help})
1102                 catMsg "0x102-installhelp"
1103                     ;;
1104
1105                 ${server}|${serverm})
1106                 echo ""
1107                     echo "  - ${serverchose}."
1108                     INSTYPE="server"
1109                     break;
1110                     ;;
1111
1112                 ${agent}|${agentm})
1113                 echo ""
1114                     echo "  - ${clientchose}."
1115                     INSTYPE="agent"
1116                     break;
1117                     ;;
1118
1119                 ${hybrid}|${hybridm})
1120                 echo ""
1121                     echo "  - ${localchose} (hybrid)."
1122                     INSTYPE="local"
1123                     HYBID="go"
1124                     break;
1125                     ;;
1126                 ${local}|${localm})
1127                 echo ""
1128                 echo "  - ${localchose}."
1129                 INSTYPE="local"
1130                 break;
1131                 ;;
1132             esac
1133         done
1134
1135     else
1136         INSTYPE=${USER_INSTALL_TYPE}
1137     fi
1138
1139
1140     # Setting up the environment
1141     setEnv
1142
1143
1144     # Configuring the system (based on the installation type)
1145     if [ "X${update_only}" = "X" ]; then
1146         if [ "X$INSTYPE" = "Xserver" ]; then
1147             ConfigureServer
1148         elif [ "X$INSTYPE" = "Xagent" ]; then
1149             ConfigureClient
1150         elif [ "X$INSTYPE" = "Xlocal" ]; then
1151             ConfigureServer
1152         else
1153             catError "0x4-installtype"
1154         fi
1155     fi
1156
1157     # Installing (calls the respective script
1158     # -- InstallAgent.sh or InstallServer.sh
1159     Install
1160
1161     # User messages
1162     echo ""
1163     echo " - ${configurationdone}."
1164     echo ""
1165     echo " - ${tostart}:"
1166     echo "              $INSTALLDIR/bin/ossec-control start"
1167     echo ""
1168     echo " - ${tostop}:"
1169     echo "              $INSTALLDIR/bin/ossec-control stop"
1170     echo ""
1171     echo " - ${configat} $INSTALLDIR/etc/ossec.conf"
1172     echo ""
1173
1174
1175     catMsg "0x103-thanksforusing"
1176
1177
1178     if [ "X${update_only}" = "Xyes" ]; then
1179         # Message for the update
1180         if [ "X`sh ./src/init/fw-check.sh`" = "XPF" -a "X${ACTIVERESPONSE}" = "Xyes" ]; then
1181             if [ "X$USER_NO_STOP" = "X" ]; then
1182                 read ANY
1183             fi
1184             AddPFTable
1185         fi
1186         echo ""
1187         echo " - ${updatecompleted}"
1188         echo ""
1189         exit 0;
1190     fi
1191
1192
1193     if [ "X$USER_NO_STOP" = "X" ]; then
1194         read ANY
1195     fi
1196
1197
1198     # PF firewall message
1199     if [ "X`sh ./src/init/fw-check.sh`" = "XPF" -a "X${ACTIVERESPONSE}" = "Xyes" ]; then
1200         AddPFTable
1201     fi
1202
1203
1204     if [ "X$INSTYPE" = "Xserver" ]; then
1205         echo ""
1206         echo " - ${addserveragent}"
1207         echo "   ${runma}:"
1208         echo ""
1209         echo "   $INSTALLDIR/bin/manage_agents"
1210         echo ""
1211         echo "   ${moreinfo}"
1212         echo "   http://www.ossec.net/en/manual.html#ma"
1213         echo ""
1214
1215     elif [ "X$INSTYPE" = "Xagent" ]; then
1216         catMsg "0x104-client"
1217         echo "   $INSTALLDIR/bin/manage_agents"
1218         echo ""
1219         echo "   ${moreinfo}"
1220         echo "   http://www.ossec.net/en/manual.html#ma"
1221         echo ""
1222     fi
1223
1224     if [ "X$notmodified" = "Xyes" ]; then
1225         catMsg "0x105-noboot"
1226         echo "          $INSTALLDIR/bin/ossec-control start"
1227         echo ""
1228     fi
1229 }
1230
1231 _f_cfg="./install.cfg.sh"
1232
1233 if [ -f $_f_cfg ]; then
1234   . $_f_cfg
1235 fi
1236
1237 ### Calling main function where everything happens
1238 main
1239
1240
1241 if [ "x$HYBID" = "xgo" ]; then
1242     echo "   --------------------------------------------"
1243     echo "   Finishing Hybrid setup (agent configuration)"
1244     echo "   --------------------------------------------"
1245     echo 'USER_LANGUAGE="en"' > ./etc/preloaded-vars.conf
1246     echo "" >> ./etc/preloaded-vars.conf
1247     echo 'USER_NO_STOP="y"' >> ./etc/preloaded-vars.conf
1248     echo "" >> ./etc/preloaded-vars.conf
1249     echo 'USER_INSTALL_TYPE="agent"' >> ./etc/preloaded-vars.conf
1250     echo "" >> ./etc/preloaded-vars.conf
1251     echo "USER_DIR=\"$INSTALLDIR/ossec-agent\"" >> ./etc/preloaded-vars.conf
1252     echo "" >> ./etc/preloaded-vars.conf
1253     echo 'USER_ENABLE_ROOTCHECK="n"' >> ./etc/preloaded-vars.conf
1254     echo "" >> ./etc/preloaded-vars.conf
1255     echo 'USER_ENABLE_SYSCHECK="n"' >> ./etc/preloaded-vars.conf
1256     echo "" >> ./etc/preloaded-vars.conf
1257     echo 'USER_ENABLE_ACTIVE_RESPONSE="n"' >> ./etc/preloaded-vars.conf
1258     echo "" >> ./etc/preloaded-vars.conf
1259     echo 'USER_UPDATE="n"' >> ./etc/preloaded-vars.conf
1260     echo "" >> ./etc/preloaded-vars.conf
1261     echo 'USER_UPDATE_RULES="n"' >> ./etc/preloaded-vars.conf
1262     echo "" >> ./etc/preloaded-vars.conf
1263     echo 'USER_CLEANINSTALL="y"' >> ./etc/preloaded-vars.conf
1264     echo "" >> ./etc/preloaded-vars.conf
1265    ./install.sh
1266 fi
1267
1268
1269 exit 0
1270
1271
1272
1273 #### exit ? ###