install.sh

   1 #!/bin/sh
   2 # Installation script for the OSSEC
   3 # Author: Daniel B. Cid <daniel.cid@gmail.com>
   4 # Last modification: Mar 02, 2006
   5
   6 # Changelog 19/03/2006 - Rafael M. Capovilla <under@underlinux.com.br>
   7 # New function AddWhite to allow users to add more Ips in the white_list
   8 # Minor *echos* modifications to better look
   9 # Bug fix - When email address is blank
  10 # Bug fix - delete INSTALLDIR - Default is yes but if the user just press enter the script wasn't deleting it as it should
  11 # Changelog 15/07/2006 - Rafael M. Capovilla <under@underlinux.com.br>
  12 # New function AddTable to add support for OpenBSD pf rules in firewall-drop active response
  13
  14
  15
  16 ### Looking up for the execution directory
  17 cd `dirname $0`
  18
  19
  20 ### Looking for echo -n
  21 ECHO="echo -n"
  22 hs=`echo -n "a"`
  23 if [ ! "X$hs" = "Xa" ]; then
  24     ls "/usr/ucb/echo" > /dev/null 2>&1
  25     if [ $? = 0 ]; then
  26         ECHO="/usr/ucb/echo -n"
  27     else
  28         ECHO=echo
  29     fi
  30 fi
  31
  32 # For solaris
  33 echo "xxxx" | grep -E "xxx" > /dev/null 2>&1
  34 if [ ! $? = 0 ]; then
  35     ls "/usr/xpg4/bin/grep" > /dev/null 2>&1
  36     if [ $? = 0 ]; then
  37         PATH=/usr/xpg4/bin:$PATH
  38     fi
  39 fi
  40
  41 # Initializing vars
  42 SET_DEBUG=""
  43
  44 # Checking for command line arguments
  45 for i in $*; do
  46     if [ "X$i" = "Xdebug" ]; then
  47         SET_DEBUG="debug"
  48     elif [ "X$i" = "Xbinary-install" ]; then
  49         USER_BINARYINSTALL="yes"
  50     elif [ "X$i" = "Xhelp" ]; then
  51         echo "$0 debug"
  52         echo "$0 binary-install"
  53         exit 1;
  54     fi
  55 done
  56
  57
  58
  59 ##########
  60 # install()
  61 ##########
  62 Install()
  63 {
  64         echo ""
  65         echo "5- ${installing}"
  66
  67         echo "DIR=\"${INSTALLDIR}\"" > ${LOCATION}
  68     echo "CC=${CC}" >> ${LOCATION}
  69
  70     # Changing Config.OS with the new C flags
  71     # Checking if debug is enabled
  72     if [ "X${SET_DEBUG}" = "Xdebug" ]; then
  73         CEXTRA="${CEXTRA} -DDEBUGAD"
  74     fi
  75
  76     echo "CEXTRA=${CEXTRA}" >> ./src/Config.OS
  77
  78     # Makefile
  79         echo " - ${runningmake}"
  80     cd ./src
  81
  82     # Binary install will use the previous generated code.
  83     if [ "X${USER_BINARYINSTALL}" = "X" ]; then
  84         make all
  85         if [ $? != 0 ]; then
  86             cd ../
  87             catError "0x5-build"
  88         fi
  89
  90         # Building everything
  91         make build
  92         if [ $? != 0 ]; then
  93             cd ../
  94             catError "0x5-build"
  95         fi
  96     fi
  97
  98     # If update, stop ossec
  99     if [ "X${update_only}" = "Xyes" ]; then
 100         UpdateStopOSSEC
 101     fi
 102
 103     # Making the right installation type
 104         if [ "X$INSTYPE" = "Xserver" ]; then
 105         ./InstallServer.sh
 106
 107     elif [ "X$INSTYPE" = "Xagent" ]; then
 108         ./InstallAgent.sh
 109
 110     elif [ "X$INSTYPE" = "Xlocal" ]; then
 111         ./InstallServer.sh local
 112         fi
 113
 114     cd ../
 115
 116
 117     # Generate the /etc/ossec-init.conf
 118     VERSION_FILE="./src/VERSION"
 119     VERSION=`cat ${VERSION_FILE}`
 120     chmod 700 ${OSSEC_INIT} > /dev/null 2>&1
 121     echo "DIRECTORY=\"${INSTALLDIR}\"" > ${OSSEC_INIT}
 122     echo "VERSION=\"${VERSION}\"" >> ${OSSEC_INIT}
 123     echo "DATE=\"`date`\"" >> ${OSSEC_INIT}
 124     echo "TYPE=\"${INSTYPE}\"" >> ${OSSEC_INIT}
 125     chmod 600 ${OSSEC_INIT}
 126     cp -pr ${OSSEC_INIT} ${INSTALLDIR}${OSSEC_INIT}
 127     chmod 644 ${INSTALLDIR}${OSSEC_INIT}
 128
 129
 130     # If update_rules is set, we need to tweak
 131     # ossec.conf to read the new signatures.
 132     if [ "X${update_rules}" = "Xyes" ]; then
 133         UpdateOSSECRules
 134     fi
 135
 136     # If update, start OSSEC
 137     if [ "X${update_only}" = "Xyes" ]; then
 138         UpdateStartOSSEC
 139     fi
 140
 141     # Calling the init script  to start ossec hids during boot
 142     if [ "X${update_only}" = "X" ]; then
 143         runInit
 144         if [ $? = 1 ]; then
 145             notmodified="yes"
 146         fi
 147     fi
 148
 149 }
 150
 151
 152
 153
 154 ##########
 155 # UseSyscheck()
 156 ##########
 157 UseSyscheck()
 158 {
 159
 160     # Integrity check config
 161     echo ""
 162     $ECHO "  3.2- ${runsyscheck} ($yes/$no) [$yes]: "
 163     if [ "X${USER_ENABLE_SYSCHECK}" = "X" ]; then
 164         read AS
 165     else
 166         AS=${USER_ENABLE_SYSCHECK}
 167     fi
 168     echo ""
 169     case $AS in
 170         $nomatch)
 171             echo "   - ${nosyscheck}."
 172             ;;
 173         *)
 174             SYSCHECK="yes"
 175             echo "   - ${yessyscheck}."
 176             ;;
 177     esac
 178
 179     # Adding to the config file
 180     if [ "X$SYSCHECK" = "Xyes" ]; then
 181         cat ${SYSCHECK_TEMPLATE} >> $NEWCONFIG
 182     fi
 183 }
 184
 185
 186
 187
 188 ##########
 189 # UseRootcheck()
 190 ##########
 191 UseRootcheck()
 192 {
 193
 194     # Rootkit detection configuration
 195     echo ""
 196     $ECHO "  3.3- ${runrootcheck} ($yes/$no) [$yes]: "
 197
 198     if [ "X${USER_ENABLE_ROOTCHECK}" = "X" ]; then
 199         read ES
 200     else
 201         ES=${USER_ENABLE_ROOTCHECK}
 202     fi
 203
 204     echo ""
 205     case $ES in
 206         $nomatch)
 207             echo "   - ${norootcheck}."
 208             ;;
 209         *)
 210             ROOTCHECK="yes"
 211             echo "   - ${yesrootcheck}."
 212             ;;
 213     esac
 214
 215
 216     # Adding to the config file
 217     if [ "X$ROOTCHECK" = "Xyes" ]; then
 218         echo "" >> $NEWCONFIG
 219         echo "  <rootcheck>" >> $NEWCONFIG
 220         echo "    <rootkit_files>$INSTALLDIR/etc/shared/rootkit_files.txt</rootkit_files>" >> $NEWCONFIG
 221         echo "    <rootkit_trojans>$INSTALLDIR/etc/shared/rootkit_trojans.txt</rootkit_trojans>" >> $NEWCONFIG
 222         echo "    <system_audit>$INSTALLDIR/etc/shared/system_audit_rcl.txt</system_audit>" >> $NEWCONFIG
 223         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_debian_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 224         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_rhel_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 225         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_rhel5_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 226         echo "  </rootcheck>" >> $NEWCONFIG
 227     else
 228       echo "" >> $NEWCONFIG
 229       echo "  <rootcheck>" >> $NEWCONFIG
 230         echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 231       echo "  </rootcheck>" >> $NEWCONFIG
 232     fi
 233 }
 234
 235
 236
 237
 238 ##########
 239 # SetupLogs()
 240 ##########
 241 SetupLogs()
 242 {
 243
 244     NB=$1
 245     echo ""
 246     echo "  $NB- ${readlogs}"
 247
 248     echo "  <!-- Files to monitor (localfiles) -->" >> $NEWCONFIG
 249     LOG_FILES=`cat ${SYSLOG_TEMPLATE}`
 250     for i in ${LOG_FILES}; do
 251         # If log file present, add it
 252         ls $i > /dev/null 2>&1
 253         if [ $? = 0 ]; then
 254             echo "    -- $i"
 255                 echo "" >> $NEWCONFIG
 256                 echo "  <localfile>" >> $NEWCONFIG
 257             echo "    <log_format>syslog</log_format>" >> $NEWCONFIG
 258                 echo "    <location>$i</location>" >>$NEWCONFIG
 259                 echo "  </localfile>" >> $NEWCONFIG
 260         fi
 261     done
 262
 263     # Getting snort files
 264     SNORT_FILES=`cat ${SNORT_TEMPLATE}`
 265     for i in ${SNORT_FILES}; do
 266         ls $i > /dev/null 2>&1
 267         if [ $? = 0 ]; then
 268             echo "" >> $NEWCONFIG
 269             echo "  <localfile>" >> $NEWCONFIG
 270
 271             head -n 1 $i|grep "\[**\] "|grep -v "Classification:" > /dev/null
 272             if [ $? = 0 ]; then
 273                 echo "    <log_format>snort-full</log_format>" >> $NEWCONFIG
 274                 echo "    -- $i (snort-full file)"
 275             else
 276                 echo "    <log_format>snort-fast</log_format>" >> $NEWCONFIG
 277                 echo "    -- $i (snort-fast file)"
 278             fi
 279             echo "    <location>$i</location>" >>$NEWCONFIG
 280             echo "  </localfile>" >> $NEWCONFIG
 281         fi
 282     done
 283
 284     # Getting apache logs
 285     APACHE_FILES=`cat ${APACHE_TEMPLATE}`
 286     for i in ${APACHE_FILES}; do
 287         ls $i > /dev/null 2>&1
 288         if [ $? = 0 ]; then
 289           echo "" >> $NEWCONFIG
 290           echo "  <localfile>" >> $NEWCONFIG
 291           echo "    <log_format>apache</log_format>" >> $NEWCONFIG
 292           echo "    <location>$i</location>" >>$NEWCONFIG
 293           echo "  </localfile>" >> $NEWCONFIG
 294
 295           echo "    -- $i (apache log)"
 296         fi
 297     done
 298
 299     # Getting postgresql logs
 300     PGSQL_FILES=`cat ${PGSQL_TEMPLATE}`
 301     for i in ${PGSQL_FILES}; do
 302         ls $i > /dev/null 2>&1
 303         if [ $? = 0 ]; then
 304           echo "" >> $NEWCONFIG
 305           echo "  <localfile>" >> $NEWCONFIG
 306           echo "    <log_format>postgresql_log</log_format>" >> $NEWCONFIG
 307           echo "    <location>$i</location>" >>$NEWCONFIG
 308           echo "  </localfile>" >> $NEWCONFIG
 309
 310           echo "    -- $i (postgresql log)"
 311         fi
 312     done
 313
 314
 315     echo ""
 316     catMsg "0x106-logs"
 317
 318
 319     if [ "X$USER_NO_STOP" = "X" ]; then
 320         read ANY
 321     fi
 322 }
 323
 324
 325
 326
 327 ##########
 328 # ConfigureClient()
 329 ##########
 330 ConfigureClient()
 331 {
 332         echo ""
 333         echo "3- ${configuring} $NAME."
 334         echo ""
 335
 336     if [ "X${USER_AGENT_SERVER_IP}" = "X" ]; then
 337         # Looping and asking for server ip
 338         while [ 1 ]; do
 339             $ECHO "  3.1- ${serverip}: "
 340                 read IPANSWER
 341             echo $IPANSWER | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" > /dev/null 2>&1
 342             if [ $? = 0 ]; then
 343                     echo ""
 344                 IP=$IPANSWER
 345                     echo "   - ${addingip} $IP"
 346                 break;
 347             fi
 348         done
 349     else
 350         IP=${USER_AGENT_SERVER_IP}
 351     fi
 352
 353     echo "<ossec_config>" > $NEWCONFIG
 354     echo "  <client>" >> $NEWCONFIG
 355         echo "    <server-ip>$IP</server-ip>" >> $NEWCONFIG
 356         echo "  </client>" >> $NEWCONFIG
 357     echo "" >> $NEWCONFIG
 358
 359     # Syscheck?
 360     UseSyscheck
 361
 362     # Rootcheck?
 363     UseRootcheck
 364
 365     echo ""
 366     $ECHO "  3.4 - ${enable_ar} ($yes/$no) [$yes]: "
 367
 368     if [ "X${USER_ENABLE_ACTIVE_RESPONSE}" = "X" ]; then
 369         read ANY
 370     else
 371         ANY=${USER_ENABLE_ACTIVE_RESPONSE}
 372     fi
 373
 374     case $ANY in
 375         $nomatch)
 376             echo ""
 377             echo "   - ${noactive}."
 378             echo "" >> $NEWCONFIG
 379             echo "  <active-response>" >> $NEWCONFIG
 380             echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 381             echo "  </active-response>" >> $NEWCONFIG
 382             echo "" >> $NEWCONFIG
 383             ;;
 384         *)
 385             ACTIVERESPONSE="yes"
 386             echo ""
 387             ;;
 388     esac
 389
 390     # Set up the log files
 391     SetupLogs "3.5"
 392
 393     echo "</ossec_config>" >> $NEWCONFIG
 394 }
 395
 396
 397
 398
 399 ##########
 400 # ConfigureServer()
 401 ##########
 402 ConfigureServer()
 403 {
 404         echo ""
 405         echo "3- ${configuring} $NAME."
 406
 407
 408     # Configuring e-mail notification
 409         echo ""
 410         $ECHO "  3.1- ${mailnotify} ($yes/$no) [$yes]: "
 411
 412     if [ "X${USER_ENABLE_EMAIL}" = "X" ]; then
 413         read ANSWER
 414     else
 415         ANSWER=${USER_ENABLE_EMAIL}
 416     fi
 417
 418         case $ANSWER in
 419                 $nomatch)
 420             echo ""
 421                         echo "   --- ${nomail}."
 422                         EMAILNOTIFY="no"
 423                         ;;
 424                 *)
 425                         EMAILNOTIFY="yes"
 426                         $ECHO "   - ${whatsemail} "
 427             if [ "X${USER_EMAIL_ADDRESS}" = "X" ]; then
 428
 429                 read EMAIL
 430                 echo "${EMAIL}" | grep -E "^[a-zA-Z0-9_.-]{1,36}@[a-zA-Z0-9_.-]{1,54}$" > /dev/null 2>&1 ;RVAL=$?;
 431                 # Ugly e-mail validation
 432                             while [ "$EMAIL" = "" -o ! ${RVAL} = 0 ] ; do
 433                                     $ECHO "   - ${whatsemail} "
 434                                     read EMAIL
 435                     echo "${EMAIL}" | grep -E "^[a-zA-Z0-9_.-]{1,36}@[a-zA-Z0-9_.-]{1,54}$" > /dev/null 2>&1 ;RVAL=$?;
 436                             done
 437             else
 438                 EMAIL=${USER_EMAIL_ADDRESS}
 439             fi
 440
 441             ls ${HOST_CMD} > /dev/null 2>&1
 442             if [ $? = 0 ]; then
 443               HOSTTMP=`${HOST_CMD} -W 5 -t mx devmail.ossec.net 2>/dev/null`
 444               if [ $? = 1 ]; then
 445                  # Trying without the -W
 446                  HOSTTMP=`${HOST_CMD} -t mx devmail.ossec.net 2>/dev/null`
 447               fi
 448               if [ "X$HOSTTMP" = "X${OSSECMX}" -o "X$HOSTTMP" = "X${OSSECMX2}" -o "X$HOSTTMP" = "X${OSSECMX3}" ];then
 449                  # Breaking down the user e-mail
 450                  EMAILHOST=`echo ${EMAIL} | cut -d "@" -f 2`
 451                  if [ "X${EMAILHOST}" = "Xlocalhost" ]; then
 452                     SMTPHOST="127.0.0.1"
 453                  else
 454                     HOSTTMP=`${HOST_CMD} -W 5 -t mx ${EMAILHOST}`
 455                     SMTPHOST=`echo ${HOSTTMP} | cut -d " " -f 7`
 456                  fi
 457               fi
 458             fi
 459
 460             if [ "X${USER_EMAIL_SMTP}" = "X" ]; then
 461                 if [ "X${SMTPHOST}" != "X" ]; then
 462                     echo ""
 463                     echo "   - ${yoursmtp}: ${SMTPHOST}"
 464                     $ECHO "   - ${usesmtp} ($yes/$no) [$yes]: "
 465                     read EMAIL2
 466                     case ${EMAIL2} in
 467                         $nomatch)
 468                         echo ""
 469                         SMTP=""
 470                         ;;
 471                     *)
 472                         SMTP=${SMTPHOST}
 473                         echo ""
 474                         echo "   --- ${usingsmtp} ${SMTP}"
 475                         ;;
 476                     esac
 477                 fi
 478
 479                 if [ "X${SMTP}" = "X" ]; then
 480                                 $ECHO "   - ${whatsmtp} "
 481                     read SMTP
 482                 fi
 483             else
 484                 SMTP=${USER_EMAIL_SMTP}
 485             fi
 486         ;;
 487         esac
 488
 489
 490         # Writting global parameters
 491     echo "<ossec_config>" > $NEWCONFIG
 492         echo "  <global>" >> $NEWCONFIG
 493         if [ "$EMAILNOTIFY" = "yes" ]; then
 494                 echo "    <email_notification>yes</email_notification>" >> $NEWCONFIG
 495                 echo "    <email_to>$EMAIL</email_to>" >> $NEWCONFIG
 496                 echo "    <smtp_server>$SMTP</smtp_server>" >> $NEWCONFIG
 497                 echo "    <email_from>ossecm@${HOST}</email_from>" >> $NEWCONFIG
 498         else
 499                 echo "    <email_notification>no</email_notification>" >> $NEWCONFIG
 500         fi
 501
 502     echo "  </global>" >> $NEWCONFIG
 503         echo "" >> $NEWCONFIG
 504
 505         # Writting rules configuration
 506     cat ${RULES_TEMPLATE} >> $NEWCONFIG
 507         echo "" >> $NEWCONFIG
 508
 509
 510     # Checking if syscheck should run
 511     UseSyscheck
 512
 513     # Checking if rootcheck should run
 514     UseRootcheck
 515
 516
 517     # Active response
 518     catMsg "0x107-ar"
 519     $ECHO "   - ${enable_ar} ($yes/$no) [$yes]: "
 520
 521     if [ "X${USER_ENABLE_ACTIVE_RESPONSE}" = "X" ]; then
 522         read AR
 523     else
 524         AR=${USER_ENABLE_ACTIVE_RESPONSE}
 525     fi
 526
 527     case $AR in
 528         $nomatch)
 529             echo ""
 530             echo "     - ${noactive}."
 531             echo "" >> $NEWCONFIG
 532             echo "  <active-response>" >> $NEWCONFIG
 533             echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 534             echo "  </active-response>" >> $NEWCONFIG
 535             echo "" >> $NEWCONFIG
 536             ;;
 537         *)
 538             ACTIVERESPONSE="yes"
 539             echo ""
 540             catMsg "0x108-ar-enabled"
 541
 542             echo ""
 543             $ECHO "   - ${firewallar} ($yes/$no) [$yes]: "
 544
 545             if [ "X${USER_ENABLE_FIREWALL_RESPONSE}" = "X" ]; then
 546                 read HD2
 547             else
 548                 HD2=${USER_ENABLE_FIREWALL_RESPONSE}
 549             fi
 550
 551             echo ""
 552             case $HD2 in
 553                 $nomatch)
 554                     echo "     - ${nofirewall}"
 555                     ;;
 556                 *)
 557                     echo "     - ${yesfirewall}"
 558                     FIREWALLDROP="yes"
 559                     ;;
 560             esac
 561             echo "" >> $NEWCONFIG
 562             echo "  <global>" >> $NEWCONFIG
 563             echo "    <white_list>127.0.0.1</white_list>" >> $NEWCONFIG
 564             echo "    <white_list>^localhost.localdomain$</white_list>">>$NEWCONFIG
 565             echo ""
 566             echo "   - ${defaultwhitelist}"
 567             for ip in ${NAMESERVERS} ${NAMESERVERS2};
 568             do
 569             if [ ! "X${ip}" = "X" ]; then
 570                 echo "      - ${ip}"
 571                 echo "    <white_list>${ip}</white_list>" >>$NEWCONFIG
 572             fi
 573             done
 574             AddWhite
 575
 576             # If Openbsd or Freebsd with pf enable, ask about
 577             # automatically setting it up.
 578             # Commenting it out in case I change my mind about it
 579             # later.
 580             #if [ "X`sh ./src/init/fw-check.sh`" = "XPF" ]; then
 581             #    echo ""
 582             #    $ECHO "   - ${pfenable} ($yes/$no) [$yes]: "
 583             #    if [ "X${USER_ENABLE_PF}" = "X" ]; then
 584             #        read PFENABLE
 585             #    else
 586             #        PFENABLE=${USER_ENABLE_PF}
 587             #    fi
 588             #
 589             #    echo ""
 590             #    case $PFENABLE in
 591             #        $nomatch)
 592             #            echo "     - ${nopf}"
 593             #            ;;
 594             #        *)
 595             #            AddPFTable
 596             #            ;;
 597             #    esac
 598             #fi
 599
 600             echo "  </global>" >> $NEWCONFIG
 601             ;;
 602     esac
 603
 604
 605     if [ "X$INSTYPE" = "Xserver" ]; then
 606       # Configuring remote syslog
 607           echo ""
 608           $ECHO "  3.5- ${syslog} ($yes/$no) [$yes]: "
 609
 610       if [ "X${USER_ENABLE_SYSLOG}" = "X" ]; then
 611             read ANSWER
 612       else
 613         ANSWER=${USER_ENABLE_SYSLOG}
 614       fi
 615
 616       echo ""
 617       case $ANSWER in
 618                 $nomatch)
 619                         echo "   --- ${nosyslog}."
 620                         ;;
 621                 *)
 622                         echo "   - ${yessyslog}."
 623                         RLOG="yes"
 624                         ;;
 625           esac
 626
 627           # Configuring remote connections
 628       SLOG="yes"
 629         fi
 630
 631
 632
 633         if [ "X$RLOG" = "Xyes" ]; then
 634         echo "" >> $NEWCONFIG
 635         echo "  <remote>" >> $NEWCONFIG
 636         echo "    <connection>syslog</connection>" >> $NEWCONFIG
 637         echo "  </remote>" >> $NEWCONFIG
 638         fi
 639
 640         if [ "X$SLOG" = "Xyes" ]; then
 641         echo "" >> $NEWCONFIG
 642         echo "  <remote>" >> $NEWCONFIG
 643         echo "    <connection>secure</connection>" >> $NEWCONFIG
 644         echo "  </remote>" >> $NEWCONFIG
 645         fi
 646
 647
 648         # Email/log alerts
 649         echo "" >> $NEWCONFIG
 650         echo "  <alerts>" >> $NEWCONFIG
 651     echo "    <log_alert_level>1</log_alert_level>" >> $NEWCONFIG
 652     if [ "$EMAILNOTIFY" = "yes" ]; then
 653         echo "    <email_alert_level>7</email_alert_level>">> $NEWCONFIG
 654         fi
 655         echo "  </alerts>" >> $NEWCONFIG
 656
 657
 658     if [ "X$ACTIVERESPONSE" = "Xyes" ]; then
 659         # Add commands in here
 660         echo "" >> $NEWCONFIG
 661         cat ${HOST_DENY_TEMPLATE} >> $NEWCONFIG
 662         echo "" >> $NEWCONFIG
 663         cat ${FIREWALL_DROP_TEMPLATE} >> $NEWCONFIG
 664         echo "" >> $NEWCONFIG
 665         cat ${DISABLE_ACCOUNT_TEMPLATE} >> $NEWCONFIG
 666         echo "" >> $NEWCONFIG
 667         cat ${ROUTENULL_TEMPLATE} >> $NEWCONFIG
 668         echo "" >> $NEWCONFIG
 669
 670         if [ "X$FIREWALLDROP" = "Xyes" ]; then
 671             echo "" >> $NEWCONFIG
 672             cat ${ACTIVE_RESPONSE_TEMPLATE} >> $NEWCONFIG
 673             echo "" >> $NEWCONFIG
 674         fi
 675     fi
 676
 677     # Setting up the logs
 678     SetupLogs "3.6"
 679     echo "</ossec_config>" >> $NEWCONFIG
 680 }
 681
 682
 683
 684
 685 ##########
 686 # setEnv()
 687 ##########
 688 setEnv()
 689 {
 690     echo ""
 691     echo "2- ${settingupenv}."
 692
 693     echo ""
 694     if [ "X${USER_DIR}" = "X" ]; then
 695         while [ 1 ]; do
 696             $ECHO " - ${wheretoinstall} [$INSTALLDIR]: "
 697             read ANSWER
 698             if [ ! "X$ANSWER" = "X" ]; then
 699                 echo $ANSWER |grep -E "^/[a-zA-Z0-9./_-]{3,128}$">/dev/null 2>&1
 700                 if [ $? = 0 ]; then
 701                     INSTALLDIR=$ANSWER;
 702                     break;
 703                 fi
 704             else
 705                 break;
 706             fi
 707         done
 708     else
 709         INSTALLDIR=${USER_DIR}
 710     fi
 711
 712
 713     CEXTRA="$CEXTRA -DDEFAULTDIR=\\\"${INSTALLDIR}\\\""
 714
 715     echo ""
 716     echo "    - ${installat} ${INSTALLDIR} ."
 717
 718
 719     if [ "X$INSTYPE" = "Xagent" ]; then
 720         CEXTRA="$CEXTRA -DCLIENT"
 721     elif [ "X$INSTYPE" = "Xlocal" ]; then
 722         CEXTRA="$CEXTRA -DLOCAL"
 723     fi
 724
 725     ls $INSTALLDIR >/dev/null 2>&1
 726     if [ $? = 0 ]; then
 727         if [ "X${USER_DELETE_DIR}" = "X" ]; then
 728             echo ""
 729             $ECHO "    - ${deletedir} ($yes/$no) [$yes]: "
 730             read ANSWER
 731         else
 732             ANSWER=${USER_DELETE_DIR}
 733         fi
 734
 735         case $ANSWER in
 736             $yesmatch)
 737                 rm -rf $INSTALLDIR
 738                 if [ ! $? = 0 ]; then
 739                     exit 2;
 740                 fi
 741                 ;;
 742         esac
 743     fi
 744 }
 745
 746
 747
 748
 749 ##########
 750 # checkDependencies()
 751 # Thanks to gabriel@macacos.org
 752 ##########
 753 checkDependencies()
 754 {
 755     echo ""
 756     OLDOPATH=$PATH
 757     if [ "X$NUNAME" = "XSunOS" ]; then
 758         PATH=$PATH:/usr/ccs/bin:/usr/xpg4/bin:/opt/csw/gcc3/bin:/opt/csw/bin:/usr/sfw/bin
 759         export  PATH
 760     elif [ "X$NUNAME" = "XAIX" ]; then
 761         PATH=$PATH:/usr/vac/bin
 762         export  PATH
 763     fi
 764
 765     ls "`which gcc`" > /dev/null 2>&1
 766     if [ ! $? = 0 ]; then
 767         ls "`which cc`" > /dev/null 2>&1
 768         if [ ! $? = 0 ]; then
 769             if [ "X${USER_BINARYINSTALL}" = "X" ]; then
 770                 catError "0x3-dependencies"
 771             fi
 772         fi
 773         CC="cc"
 774     else
 775         CC="gcc"
 776     fi
 777
 778     PATH=$OLDOPATH
 779     export PATH
 780 }
 781
 782 ##########
 783 # AddWhite()
 784 ##########
 785 AddWhite()
 786 {
 787         while [ 1 ]
 788         do
 789         echo ""
 790                 $ECHO "   - ${addwhite} ($yes/$no)? [$no]: "
 791
 792         # If white list is set, we don't need to ask it here.
 793         if [ "X${USER_WHITE_LIST}" = "X" ]; then
 794                     read ANSWER
 795         else
 796             ANSWER=$yes
 797         fi
 798
 799                 if [ "X${ANSWER}" = "X" ] ; then
 800                         ANSWER=$no
 801                 fi
 802
 803                 case $ANSWER in
 804                         $no)
 805                                 break;
 806                                 ;;
 807                         *)
 808                                 $ECHO "   - ${ipswhite}"
 809                 if [ "X${USER_WHITE_LIST}" = "X" ]; then
 810                                     read IPS
 811                                 else
 812                     IPS=${USER_WHITE_LIST}
 813                 fi
 814
 815                                 for ip in ${IPS};
 816                                 do
 817                                         if [ ! "X${ip}" = "X" ]; then
 818                         echo $ip | grep -E "^[0-9./]{5,20}$" > /dev/null 2>&1
 819                         if [ $? = 0 ]; then
 820                                                 echo "    <white_list>${ip}</white_list>" >>$NEWCONFIG
 821                         fi
 822                                         fi
 823                                 done
 824
 825                                 break;
 826                                 ;;
 827                 esac
 828         done
 829 }
 830
 831
 832 ##########
 833 # AddPFTable()
 834 ##########
 835 AddPFTable()
 836 {
 837     #default pf rules
 838     TABLE="ossec_fwtable"
 839
 840     # Add table to the first line
 841     echo ""
 842     echo "   - ${pfmessage}:"
 843     echo "     ${moreinfo}"
 844     echo "     http://www.ossec.net/en/manual.html#active-response-tools"
 845
 846     echo ""
 847     echo ""
 848     echo "      table <${TABLE}> persist #$TABLE "
 849     echo "      block in quick from <${TABLE}> to any"
 850     echo "      block out quick from any to <${TABLE}>"
 851     echo ""
 852     echo ""
 853
 854 }
 855
 856 ##########
 857 # main()
 858 ##########
 859 main()
 860 {
 861     LG="en"
 862     LANGUAGE="en"
 863     . ./src/init/shared.sh
 864     . ./src/init/functions.sh
 865
 866     # Reading pre-defined file
 867     if [ ! `isFile ${PREDEF_FILE}` = "${FALSE}" ]; then
 868         . ${PREDEF_FILE}
 869     fi
 870
 871     # If user language is not set
 872
 873     if [ "X${USER_LANGUAGE}" = "X" ]; then
 874
 875         # Choosing the language.
 876         while [ 1 ]; do
 877         echo ""
 878         for i in `ls ${TEMPLATE}`; do
 879             # ignore CVS (should not be there anyways and config)
 880             if [ "$i" = "CVS" -o "$i" = "config" ]; then continue; fi
 881             cat "${TEMPLATE}/$i/language.txt"
 882             if [ ! "$i" = "en" ]; then
 883                 LG="${LG}/$i"
 884             fi
 885         done
 886         $ECHO "  (${LG}) [en]: "
 887         read USER_LG;
 888
 889         if [ "X${USER_LG}" = "X" ]; then
 890             USER_LG="en"
 891         fi
 892
 893         ls "${TEMPLATE}/${USER_LG}" > /dev/null 2>&1
 894         if [ $? = 0 ]; then
 895             break;
 896         fi
 897         done;
 898
 899         LANGUAGE=${USER_LG}
 900
 901     else
 902
 903         # If provided language is not valid, default to english
 904         ls "${TEMPLATE}/${USER_LANGUAGE}" > /dev/null 2>&1
 905         if [ $? = 0 ]; then
 906             LANGUAGE=${USER_LANGUAGE}
 907         else
 908             LANGUAGE="en"
 909         fi
 910
 911     fi # for USER_LANGUAGE
 912
 913
 914     . ./src/init/shared.sh
 915     . ./src/init/language.sh
 916     . ./src/init/functions.sh
 917     . ./src/init/init.sh
 918     . ${TEMPLATE}/${LANGUAGE}/messages.txt
 919
 920
 921     # Must be executed as ./install.sh
 922     if [ `isFile ${VERSION_FILE}` = "${FALSE}" ]; then
 923         catError "0x1-location";
 924     fi
 925
 926     # Must be root
 927     if [ ! "X$ME" = "Xroot" ]; then
 928         catError "0x2-beroot";
 929     fi
 930
 931     # Checking dependencies
 932     checkDependencies
 933
 934     clear
 935
 936
 937     # Initial message
 938     echo " $NAME $VERSION ${installscript} - http://www.ossec.net"
 939
 940     catMsg "0x101-initial"
 941
 942     echo "  - $system: $UNAME"
 943     echo "  - $user: $ME"
 944     echo "  - $host: $HOST"
 945     echo ""
 946     echo ""
 947     echo "  -- $hitanyorabort --"
 948
 949     if [ "X$USER_NO_STOP" = "X" ]; then
 950         read ANY
 951     fi
 952
 953     . ./src/init/update.sh
 954     # Is this an update?
 955     if [ "`isUpdate`" = "${TRUE}" ]; then
 956         echo ""
 957         ct="1"
 958         while [ $ct = "1" ]; do
 959             ct="0"
 960             $ECHO " - ${wanttoupdate} ($yes/$no): "
 961             if [ "X${USER_UPDATE}" = "X" ]; then
 962                 read ANY
 963             else
 964                 ANY=$yes
 965             fi
 966
 967             case $ANY in
 968                 $yes)
 969                     update_only="yes"
 970                     break;
 971                     ;;
 972                 $no)
 973                     break;
 974                     ;;
 975                   *)
 976                     ct="1"
 977                     ;;
 978             esac
 979         done
 980
 981
 982         # Do some of the update steps.
 983         if [ "X${update_only}" = "Xyes" ]; then
 984             . ./src/init/update.sh
 985
 986             if [ "`doUpdatecleanup`" = "${FALSE}" ]; then
 987                 # Disabling update
 988                 echo ""
 989                 echo "${unabletoupdate}"
 990                 sleep 5;
 991                 update_only=""
 992             else
 993                 # Get update
 994                 USER_INSTALL_TYPE=`getPreinstalled`
 995                 USER_DIR=`getPreinstalledDir`
 996                 USER_DELETE_DIR="$nomatch"
 997             fi
 998
 999             ct="1"
1000
1001             # We dont need to update the rules on agent installs
1002             if [ "X${USER_INSTALL_TYPE}" = "Xagent" ]; then
1003                 ct="0"
1004             fi
1005
1006             while [ $ct = "1" ]; do
1007                 ct="0"
1008                 $ECHO " - ${updaterules} ($yes/$no): "
1009                 if [ "X${USER_UPDATE_RULES}" = "X" ]; then
1010                     read ANY
1011                 else
1012                     ANY=$yes
1013                 fi
1014
1015                 case $ANY in
1016                     $yes)
1017                         update_rules="yes"
1018                         break;
1019                         ;;
1020                     $no)
1021                         break;
1022                         ;;
1023                     *)
1024                         ct="1"
1025                         ;;
1026                 esac
1027             done
1028         fi
1029         echo ""
1030     fi
1031
1032     serverm=`echo ${server} | cut -b 1`
1033     localm=`echo ${local} | cut -b 1`
1034     agentm=`echo ${agent} | cut -b 1`
1035     helpm=`echo ${help} | cut -b 1`
1036
1037     # If user install type is not set, ask for it.
1038     if [ "X${USER_INSTALL_TYPE}" = "X" ]; then
1039
1040         # Loop for the installation options
1041         while [ 1 ]
1042         do
1043             echo ""
1044             $ECHO "1- ${whattoinstall} "
1045
1046             read ANSWER
1047             case $ANSWER in
1048
1049                 ${helpm}|${help})
1050                 catMsg "0x102-installhelp"
1051                     ;;
1052
1053                 ${server}|${serverm})
1054                 echo ""
1055                     echo "  - ${serverchose}."
1056                     INSTYPE="server"
1057                     break;
1058                     ;;
1059
1060                 ${agent}|${agentm})
1061                 echo ""
1062                     echo "  - ${clientchose}."
1063                     INSTYPE="agent"
1064                     break;
1065                     ;;
1066
1067                 ${local}|${localm})
1068                 echo ""
1069                 echo "  - ${localchose}."
1070                 INSTYPE="local"
1071                 break;
1072                 ;;
1073             esac
1074         done
1075
1076     else
1077         INSTYPE=${USER_INSTALL_TYPE}
1078     fi
1079
1080
1081     # Setting up the environment
1082     setEnv
1083
1084
1085     # Configuring the system (based on the installation type)
1086     if [ "X${update_only}" = "X" ]; then
1087         if [ "X$INSTYPE" = "Xserver" ]; then
1088             ConfigureServer
1089         elif [ "X$INSTYPE" = "Xagent" ]; then
1090             ConfigureClient
1091         elif [ "X$INSTYPE" = "Xlocal" ]; then
1092             ConfigureServer
1093         else
1094             catError "0x4-installtype"
1095         fi
1096     fi
1097
1098     # Installing (calls the respective script
1099     # -- InstallAgent.sh or InstallServer.sh
1100     Install
1101
1102     # User messages
1103     echo ""
1104     echo " - ${configurationdone}."
1105     echo ""
1106     echo " - ${tostart}:"
1107     echo "              $INSTALLDIR/bin/ossec-control start"
1108     echo ""
1109     echo " - ${tostop}:"
1110     echo "              $INSTALLDIR/bin/ossec-control stop"
1111     echo ""
1112     echo " - ${configat} $INSTALLDIR/etc/ossec.conf"
1113     echo ""
1114
1115
1116     catMsg "0x103-thanksforusing"
1117
1118
1119     if [ "X${update_only}" = "Xyes" ]; then
1120         # Message for the update
1121         if [ "X`sh ./src/init/fw-check.sh`" = "XPF" -a "X${ACTIVERESPONSE}" = "Xyes" ]; then
1122             if [ "X$USER_NO_STOP" = "X" ]; then
1123                 read ANY
1124             fi
1125             AddPFTable
1126         fi
1127         echo ""
1128         echo " - ${updatecompleted}"
1129         echo ""
1130         exit 0;
1131     fi
1132
1133
1134     if [ "X$USER_NO_STOP" = "X" ]; then
1135         read ANY
1136     fi
1137
1138
1139     # PF firewall message
1140     if [ "X`sh ./src/init/fw-check.sh`" = "XPF" -a "X${ACTIVERESPONSE}" = "Xyes" ]; then
1141         AddPFTable
1142     fi
1143
1144
1145     if [ "X$INSTYPE" = "Xserver" ]; then
1146         echo ""
1147         echo " - ${addserveragent}"
1148         echo "   ${runma}:"
1149         echo ""
1150         echo "   $INSTALLDIR/bin/manage_agents"
1151         echo ""
1152         echo "   ${moreinfo}"
1153         echo "   http://www.ossec.net/en/manual.html#ma"
1154         echo ""
1155
1156     elif [ "X$INSTYPE" = "Xagent" ]; then
1157         catMsg "0x104-client"
1158         echo "   $INSTALLDIR/bin/manage_agents"
1159         echo ""
1160         echo "   ${moreinfo}"
1161         echo "   http://www.ossec.net/en/manual.html#ma"
1162         echo ""
1163     fi
1164
1165     if [ "X$notmodified" = "Xyes" ]; then
1166         catMsg "0x105-noboot"
1167         echo "          $INSTALLDIR/bin/ossec-control start"
1168         echo ""
1169     fi
1170 }
1171
1172
1173
1174
1175 ### Calling main function where everything happens
1176 main
1177
1178
1179 exit 0
1180
1181
1182
1183 ## EOF ##
1184