install.sh

   1 #!/bin/sh
   2 # Installation script for the OSSEC
   3 # Author: Daniel B. Cid <daniel.cid@gmail.com>
   4 # Last modification: Mar 02, 2006
   5
   6 # Changelog 19/03/2006 - Rafael M. Capovilla <under@underlinux.com.br>
   7 # New function AddWhite to allow users to add more Ips in the white_list
   8 # Minor *echos* modifications to better look
   9 # Bug fix - When email address is blank
  10 # Bug fix - delete INSTALLDIR - Default is yes but if the user just press enter the script wasn't deleting it as it should
  11 # Changelog 15/07/2006 - Rafael M. Capovilla <under@underlinux.com.br>
  12 # New function AddTable to add support for OpenBSD pf rules in firewall-drop active response
  13
  14
  15
  16 ### Looking up for the execution directory
  17 cd `dirname $0`
  18
  19
  20 ### Looking for echo -n
  21 ECHO="echo -n"
  22 hs=`echo -n "a"`
  23 if [ ! "X$hs" = "Xa" ]; then
  24     ls "/usr/ucb/echo" > /dev/null 2>&1
  25     if [ $? = 0 ]; then
  26         ECHO="/usr/ucb/echo -n"
  27     else
  28         ECHO=echo
  29     fi
  30 fi
  31
  32 # For solaris
  33 echo "xxxx" | grep -E "xxx" > /dev/null 2>&1
  34 if [ ! $? = 0 ]; then
  35     ls "/usr/xpg4/bin/grep" > /dev/null 2>&1
  36     if [ $? = 0 ]; then
  37         PATH=/usr/xpg4/bin:$PATH
  38     fi
  39 fi
  40
  41 # Initializing vars
  42 SET_DEBUG=""
  43
  44 # Checking for command line arguments
  45 for i in $*; do
  46     if [ "X$i" = "Xdebug" ]; then
  47         SET_DEBUG="debug"
  48     elif [ "X$i" = "Xbinary-install" ]; then
  49         USER_BINARYINSTALL="yes"
  50     elif [ "X$i" = "Xhelp" ]; then
  51         echo "$0 debug"
  52         echo "$0 binary-install"
  53         exit 1;
  54     fi
  55 done
  56
  57
  58
  59 ##########
  60 # install()
  61 ##########
  62 Install()
  63 {
  64         echo ""
  65         echo "5- ${installing}"
  66
  67         echo "DIR=\"${INSTALLDIR}\"" > ${LOCATION}
  68     echo "CC=${CC}" >> ${LOCATION}
  69     echo "GCC=${CC}" >> ${LOCATION}
  70     echo "CLANG=clang" >> ${LOCATION}
  71
  72     # Changing Config.OS with the new C flags
  73     # Checking if debug is enabled
  74     if [ "X${SET_DEBUG}" = "Xdebug" ]; then
  75         CEXTRA="${CEXTRA} -DDEBUGAD"
  76     fi
  77
  78     echo "CEXTRA=${CEXTRA}" >> ./src/Config.OS
  79
  80     # Makefile
  81         echo " - ${runningmake}"
  82     cd ./src
  83
  84     # Binary install will use the previous generated code.
  85     if [ "X${USER_BINARYINSTALL}" = "X" ]; then
  86         make all
  87         if [ $? != 0 ]; then
  88             cd ../
  89             catError "0x5-build"
  90         fi
  91
  92         # Building everything
  93         make build
  94         if [ $? != 0 ]; then
  95             cd ../
  96             catError "0x5-build"
  97         fi
  98     fi
  99
 100     # If update, stop ossec
 101     if [ "X${update_only}" = "Xyes" ]; then
 102         UpdateStopOSSEC
 103     fi
 104
 105     # Making the right installation type
 106         if [ "X$INSTYPE" = "Xserver" ]; then
 107         ./InstallServer.sh
 108
 109     elif [ "X$INSTYPE" = "Xagent" ]; then
 110         ./InstallAgent.sh
 111
 112     elif [ "X$INSTYPE" = "Xlocal" ]; then
 113         ./InstallServer.sh local
 114         fi
 115
 116     cd ../
 117
 118
 119     # Generate the /etc/ossec-init.conf
 120     VERSION_FILE="./src/VERSION"
 121     VERSION=`cat ${VERSION_FILE}`
 122     chmod 700 ${OSSEC_INIT} > /dev/null 2>&1
 123     echo "DIRECTORY=\"${INSTALLDIR}\"" > ${OSSEC_INIT}
 124     echo "VERSION=\"${VERSION}\"" >> ${OSSEC_INIT}
 125     echo "DATE=\"`date`\"" >> ${OSSEC_INIT}
 126     echo "TYPE=\"${INSTYPE}\"" >> ${OSSEC_INIT}
 127     chmod 600 ${OSSEC_INIT}
 128     cp -pr ${OSSEC_INIT} ${INSTALLDIR}${OSSEC_INIT}
 129     chmod 644 ${INSTALLDIR}${OSSEC_INIT}
 130
 131
 132     # If update_rules is set, we need to tweak
 133     # ossec.conf to read the new signatures.
 134     if [ "X${update_rules}" = "Xyes" ]; then
 135         UpdateOSSECRules
 136     fi
 137
 138     # If update, start OSSEC
 139     if [ "X${update_only}" = "Xyes" ]; then
 140         UpdateStartOSSEC
 141     fi
 142
 143     # Calling the init script  to start ossec hids during boot
 144     if [ "X${update_only}" = "X" ]; then
 145         runInit
 146         if [ $? = 1 ]; then
 147             notmodified="yes"
 148         fi
 149     fi
 150
 151 }
 152
 153
 154
 155
 156 ##########
 157 # UseSyscheck()
 158 ##########
 159 UseSyscheck()
 160 {
 161
 162     # Integrity check config
 163     echo ""
 164     $ECHO "  3.2- ${runsyscheck} ($yes/$no) [$yes]: "
 165     if [ "X${USER_ENABLE_SYSCHECK}" = "X" ]; then
 166         read AS
 167     else
 168         AS=${USER_ENABLE_SYSCHECK}
 169     fi
 170     echo ""
 171     case $AS in
 172         $nomatch)
 173             echo "   - ${nosyscheck}."
 174             ;;
 175         *)
 176             SYSCHECK="yes"
 177             echo "   - ${yessyscheck}."
 178             ;;
 179     esac
 180
 181     # Adding to the config file
 182     if [ "X$SYSCHECK" = "Xyes" ]; then
 183         cat ${SYSCHECK_TEMPLATE} >> $NEWCONFIG
 184     fi
 185 }
 186
 187
 188
 189
 190 ##########
 191 # UseRootcheck()
 192 ##########
 193 UseRootcheck()
 194 {
 195
 196     # Rootkit detection configuration
 197     echo ""
 198     $ECHO "  3.3- ${runrootcheck} ($yes/$no) [$yes]: "
 199
 200     if [ "X${USER_ENABLE_ROOTCHECK}" = "X" ]; then
 201         read ES
 202     else
 203         ES=${USER_ENABLE_ROOTCHECK}
 204     fi
 205
 206     echo ""
 207     case $ES in
 208         $nomatch)
 209             echo "   - ${norootcheck}."
 210             ;;
 211         *)
 212             ROOTCHECK="yes"
 213             echo "   - ${yesrootcheck}."
 214             ;;
 215     esac
 216
 217
 218     # Adding to the config file
 219     if [ "X$ROOTCHECK" = "Xyes" ]; then
 220         echo "" >> $NEWCONFIG
 221         echo "  <rootcheck>" >> $NEWCONFIG
 222         echo "    <rootkit_files>$INSTALLDIR/etc/shared/rootkit_files.txt</rootkit_files>" >> $NEWCONFIG
 223         echo "    <rootkit_trojans>$INSTALLDIR/etc/shared/rootkit_trojans.txt</rootkit_trojans>" >> $NEWCONFIG
 224         echo "    <system_audit>$INSTALLDIR/etc/shared/system_audit_rcl.txt</system_audit>" >> $NEWCONFIG
 225         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_debian_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 226         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_rhel_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 227         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_rhel5_linux_rcl.txt</system_audit>" >> $NEWCONFIG
 228         echo "  </rootcheck>" >> $NEWCONFIG
 229     else
 230       echo "" >> $NEWCONFIG
 231       echo "  <rootcheck>" >> $NEWCONFIG
 232         echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 233       echo "  </rootcheck>" >> $NEWCONFIG
 234     fi
 235 }
 236
 237
 238
 239
 240 ##########
 241 # SetupLogs()
 242 ##########
 243 SetupLogs()
 244 {
 245
 246     NB=$1
 247     echo ""
 248     echo "  $NB- ${readlogs}"
 249
 250     echo "  <!-- Files to monitor (localfiles) -->" >> $NEWCONFIG
 251     LOG_FILES=`cat ${SYSLOG_TEMPLATE}`
 252     for i in ${LOG_FILES}; do
 253         # If log file present, add it
 254         ls $i > /dev/null 2>&1
 255         if [ $? = 0 ]; then
 256             echo "    -- $i"
 257                 echo "" >> $NEWCONFIG
 258                 echo "  <localfile>" >> $NEWCONFIG
 259             echo "    <log_format>syslog</log_format>" >> $NEWCONFIG
 260                 echo "    <location>$i</location>" >>$NEWCONFIG
 261                 echo "  </localfile>" >> $NEWCONFIG
 262         fi
 263     done
 264
 265     # Getting snort files
 266     SNORT_FILES=`cat ${SNORT_TEMPLATE}`
 267     for i in ${SNORT_FILES}; do
 268         ls $i > /dev/null 2>&1
 269         if [ $? = 0 ]; then
 270             echo "" >> $NEWCONFIG
 271             echo "  <localfile>" >> $NEWCONFIG
 272
 273             head -n 1 $i|grep "\[**\] "|grep -v "Classification:" > /dev/null
 274             if [ $? = 0 ]; then
 275                 echo "    <log_format>snort-full</log_format>" >> $NEWCONFIG
 276                 echo "    -- $i (snort-full file)"
 277             else
 278                 echo "    <log_format>snort-fast</log_format>" >> $NEWCONFIG
 279                 echo "    -- $i (snort-fast file)"
 280             fi
 281             echo "    <location>$i</location>" >>$NEWCONFIG
 282             echo "  </localfile>" >> $NEWCONFIG
 283         fi
 284     done
 285
 286     # Getting apache logs
 287     APACHE_FILES=`cat ${APACHE_TEMPLATE}`
 288     for i in ${APACHE_FILES}; do
 289         ls $i > /dev/null 2>&1
 290         if [ $? = 0 ]; then
 291           echo "" >> $NEWCONFIG
 292           echo "  <localfile>" >> $NEWCONFIG
 293           echo "    <log_format>apache</log_format>" >> $NEWCONFIG
 294           echo "    <location>$i</location>" >>$NEWCONFIG
 295           echo "  </localfile>" >> $NEWCONFIG
 296
 297           echo "    -- $i (apache log)"
 298         fi
 299     done
 300
 301     # Getting postgresql logs
 302     PGSQL_FILES=`cat ${PGSQL_TEMPLATE}`
 303     for i in ${PGSQL_FILES}; do
 304         ls $i > /dev/null 2>&1
 305         if [ $? = 0 ]; then
 306           echo "" >> $NEWCONFIG
 307           echo "  <localfile>" >> $NEWCONFIG
 308           echo "    <log_format>postgresql_log</log_format>" >> $NEWCONFIG
 309           echo "    <location>$i</location>" >>$NEWCONFIG
 310           echo "  </localfile>" >> $NEWCONFIG
 311
 312           echo "    -- $i (postgresql log)"
 313         fi
 314     done
 315
 316
 317     echo ""
 318     catMsg "0x106-logs"
 319
 320
 321     if [ "X$USER_NO_STOP" = "X" ]; then
 322         read ANY
 323     fi
 324 }
 325
 326
 327
 328
 329 ##########
 330 # ConfigureClient()
 331 ##########
 332 ConfigureClient()
 333 {
 334         echo ""
 335         echo "3- ${configuring} $NAME."
 336         echo ""
 337
 338     if [ "X${USER_AGENT_SERVER_IP}" = "X" ]; then
 339         # Looping and asking for server ip
 340         while [ 1 ]; do
 341             $ECHO "  3.1- ${serverip}: "
 342                 read IPANSWER
 343             echo $IPANSWER | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" > /dev/null 2>&1
 344             if [ $? = 0 ]; then
 345                     echo ""
 346                 IP=$IPANSWER
 347                     echo "   - ${addingip} $IP"
 348                 break;
 349             fi
 350         done
 351     else
 352         IP=${USER_AGENT_SERVER_IP}
 353     fi
 354
 355     echo "<ossec_config>" > $NEWCONFIG
 356     echo "  <client>" >> $NEWCONFIG
 357         echo "    <server-ip>$IP</server-ip>" >> $NEWCONFIG
 358         echo "  </client>" >> $NEWCONFIG
 359     echo "" >> $NEWCONFIG
 360
 361     # Syscheck?
 362     UseSyscheck
 363
 364     # Rootcheck?
 365     UseRootcheck
 366
 367     echo ""
 368     $ECHO "  3.4 - ${enable_ar} ($yes/$no) [$yes]: "
 369
 370     if [ "X${USER_ENABLE_ACTIVE_RESPONSE}" = "X" ]; then
 371         read ANY
 372     else
 373         ANY=${USER_ENABLE_ACTIVE_RESPONSE}
 374     fi
 375
 376     case $ANY in
 377         $nomatch)
 378             echo ""
 379             echo "   - ${noactive}."
 380             echo "" >> $NEWCONFIG
 381             echo "  <active-response>" >> $NEWCONFIG
 382             echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 383             echo "  </active-response>" >> $NEWCONFIG
 384             echo "" >> $NEWCONFIG
 385             ;;
 386         *)
 387             ACTIVERESPONSE="yes"
 388             echo ""
 389             ;;
 390     esac
 391
 392     # Set up the log files
 393     SetupLogs "3.5"
 394
 395     echo "</ossec_config>" >> $NEWCONFIG
 396 }
 397
 398
 399
 400
 401 ##########
 402 # ConfigureServer()
 403 ##########
 404 ConfigureServer()
 405 {
 406         echo ""
 407         echo "3- ${configuring} $NAME."
 408
 409
 410     # Configuring e-mail notification
 411         echo ""
 412         $ECHO "  3.1- ${mailnotify} ($yes/$no) [$yes]: "
 413
 414     if [ "X${USER_ENABLE_EMAIL}" = "X" ]; then
 415         read ANSWER
 416     else
 417         ANSWER=${USER_ENABLE_EMAIL}
 418     fi
 419
 420         case $ANSWER in
 421                 $nomatch)
 422             echo ""
 423                         echo "   --- ${nomail}."
 424                         EMAILNOTIFY="no"
 425                         ;;
 426                 *)
 427                         EMAILNOTIFY="yes"
 428                         $ECHO "   - ${whatsemail} "
 429             if [ "X${USER_EMAIL_ADDRESS}" = "X" ]; then
 430
 431                 read EMAIL
 432                 echo "${EMAIL}" | grep -E "^[a-zA-Z0-9_.-]{1,36}@[a-zA-Z0-9_.-]{1,54}$" > /dev/null 2>&1 ;RVAL=$?;
 433                 # Ugly e-mail validation
 434                             while [ "$EMAIL" = "" -o ! ${RVAL} = 0 ] ; do
 435                                     $ECHO "   - ${whatsemail} "
 436                                     read EMAIL
 437                     echo "${EMAIL}" | grep -E "^[a-zA-Z0-9_.-]{1,36}@[a-zA-Z0-9_.-]{1,54}$" > /dev/null 2>&1 ;RVAL=$?;
 438                             done
 439             else
 440                 EMAIL=${USER_EMAIL_ADDRESS}
 441             fi
 442
 443             ls ${HOST_CMD} > /dev/null 2>&1
 444             if [ $? = 0 ]; then
 445               HOSTTMP=`${HOST_CMD} -W 5 -t mx devmail.ossec.net 2>/dev/null`
 446               if [ $? = 1 ]; then
 447                  # Trying without the -W
 448                  HOSTTMP=`${HOST_CMD} -t mx devmail.ossec.net 2>/dev/null`
 449               fi
 450               if [ "X$HOSTTMP" = "X${OSSECMX}" -o "X$HOSTTMP" = "X${OSSECMX2}" -o "X$HOSTTMP" = "X${OSSECMX3}" ];then
 451                  # Breaking down the user e-mail
 452                  EMAILHOST=`echo ${EMAIL} | cut -d "@" -f 2`
 453                  if [ "X${EMAILHOST}" = "Xlocalhost" ]; then
 454                     SMTPHOST="127.0.0.1"
 455                  else
 456                     HOSTTMP=`${HOST_CMD} -W 5 -t mx ${EMAILHOST}`
 457                     SMTPHOST=`echo ${HOSTTMP} | cut -d " " -f 7`
 458                  fi
 459               fi
 460             fi
 461
 462             if [ "X${USER_EMAIL_SMTP}" = "X" ]; then
 463                 if [ "X${SMTPHOST}" != "X" ]; then
 464                     echo ""
 465                     echo "   - ${yoursmtp}: ${SMTPHOST}"
 466                     $ECHO "   - ${usesmtp} ($yes/$no) [$yes]: "
 467                     read EMAIL2
 468                     case ${EMAIL2} in
 469                         $nomatch)
 470                         echo ""
 471                         SMTP=""
 472                         ;;
 473                     *)
 474                         SMTP=${SMTPHOST}
 475                         echo ""
 476                         echo "   --- ${usingsmtp} ${SMTP}"
 477                         ;;
 478                     esac
 479                 fi
 480
 481                 if [ "X${SMTP}" = "X" ]; then
 482                                 $ECHO "   - ${whatsmtp} "
 483                     read SMTP
 484                 fi
 485             else
 486                 SMTP=${USER_EMAIL_SMTP}
 487             fi
 488         ;;
 489         esac
 490
 491
 492         # Writting global parameters
 493     echo "<ossec_config>" > $NEWCONFIG
 494         echo "  <global>" >> $NEWCONFIG
 495         if [ "$EMAILNOTIFY" = "yes" ]; then
 496                 echo "    <email_notification>yes</email_notification>" >> $NEWCONFIG
 497                 echo "    <email_to>$EMAIL</email_to>" >> $NEWCONFIG
 498                 echo "    <smtp_server>$SMTP</smtp_server>" >> $NEWCONFIG
 499                 echo "    <email_from>ossecm@${HOST}</email_from>" >> $NEWCONFIG
 500         else
 501                 echo "    <email_notification>no</email_notification>" >> $NEWCONFIG
 502         fi
 503
 504     echo "  </global>" >> $NEWCONFIG
 505         echo "" >> $NEWCONFIG
 506
 507         # Writting rules configuration
 508     cat ${RULES_TEMPLATE} >> $NEWCONFIG
 509         echo "" >> $NEWCONFIG
 510
 511
 512     # Checking if syscheck should run
 513     UseSyscheck
 514
 515     # Checking if rootcheck should run
 516     UseRootcheck
 517
 518
 519     # Active response
 520     catMsg "0x107-ar"
 521     $ECHO "   - ${enable_ar} ($yes/$no) [$yes]: "
 522
 523     if [ "X${USER_ENABLE_ACTIVE_RESPONSE}" = "X" ]; then
 524         read AR
 525     else
 526         AR=${USER_ENABLE_ACTIVE_RESPONSE}
 527     fi
 528
 529     case $AR in
 530         $nomatch)
 531             echo ""
 532             echo "     - ${noactive}."
 533             echo "" >> $NEWCONFIG
 534             echo "  <active-response>" >> $NEWCONFIG
 535             echo "    <disabled>yes</disabled>" >> $NEWCONFIG
 536             echo "  </active-response>" >> $NEWCONFIG
 537             echo "" >> $NEWCONFIG
 538             ;;
 539         *)
 540             ACTIVERESPONSE="yes"
 541             echo ""
 542             catMsg "0x108-ar-enabled"
 543
 544             echo ""
 545             $ECHO "   - ${firewallar} ($yes/$no) [$yes]: "
 546
 547             if [ "X${USER_ENABLE_FIREWALL_RESPONSE}" = "X" ]; then
 548                 read HD2
 549             else
 550                 HD2=${USER_ENABLE_FIREWALL_RESPONSE}
 551             fi
 552
 553             echo ""
 554             case $HD2 in
 555                 $nomatch)
 556                     echo "     - ${nofirewall}"
 557                     ;;
 558                 *)
 559                     echo "     - ${yesfirewall}"
 560                     FIREWALLDROP="yes"
 561                     ;;
 562             esac
 563             echo "" >> $NEWCONFIG
 564             echo "  <global>" >> $NEWCONFIG
 565             echo "    <white_list>127.0.0.1</white_list>" >> $NEWCONFIG
 566             echo "    <white_list>^localhost.localdomain$</white_list>">>$NEWCONFIG
 567             echo ""
 568             echo "   - ${defaultwhitelist}"
 569             for ip in ${NAMESERVERS} ${NAMESERVERS2};
 570             do
 571             if [ ! "X${ip}" = "X" ]; then
 572                 echo "      - ${ip}"
 573                 echo "    <white_list>${ip}</white_list>" >>$NEWCONFIG
 574             fi
 575             done
 576             AddWhite
 577
 578             # If Openbsd or Freebsd with pf enable, ask about
 579             # automatically setting it up.
 580             # Commenting it out in case I change my mind about it
 581             # later.
 582             #if [ "X`sh ./src/init/fw-check.sh`" = "XPF" ]; then
 583             #    echo ""
 584             #    $ECHO "   - ${pfenable} ($yes/$no) [$yes]: "
 585             #    if [ "X${USER_ENABLE_PF}" = "X" ]; then
 586             #        read PFENABLE
 587             #    else
 588             #        PFENABLE=${USER_ENABLE_PF}
 589             #    fi
 590             #
 591             #    echo ""
 592             #    case $PFENABLE in
 593             #        $nomatch)
 594             #            echo "     - ${nopf}"
 595             #            ;;
 596             #        *)
 597             #            AddPFTable
 598             #            ;;
 599             #    esac
 600             #fi
 601
 602             echo "  </global>" >> $NEWCONFIG
 603             ;;
 604     esac
 605
 606
 607     if [ "X$INSTYPE" = "Xserver" ]; then
 608       # Configuring remote syslog
 609           echo ""
 610           $ECHO "  3.5- ${syslog} ($yes/$no) [$yes]: "
 611
 612       if [ "X${USER_ENABLE_SYSLOG}" = "X" ]; then
 613             read ANSWER
 614       else
 615         ANSWER=${USER_ENABLE_SYSLOG}
 616       fi
 617
 618       echo ""
 619       case $ANSWER in
 620                 $nomatch)
 621                         echo "   --- ${nosyslog}."
 622                         ;;
 623                 *)
 624                         echo "   - ${yessyslog}."
 625                         RLOG="yes"
 626                         ;;
 627           esac
 628
 629           # Configuring remote connections
 630       SLOG="yes"
 631         fi
 632
 633
 634
 635         if [ "X$RLOG" = "Xyes" ]; then
 636         echo "" >> $NEWCONFIG
 637         echo "  <remote>" >> $NEWCONFIG
 638         echo "    <connection>syslog</connection>" >> $NEWCONFIG
 639         echo "  </remote>" >> $NEWCONFIG
 640         fi
 641
 642         if [ "X$SLOG" = "Xyes" ]; then
 643         echo "" >> $NEWCONFIG
 644         echo "  <remote>" >> $NEWCONFIG
 645         echo "    <connection>secure</connection>" >> $NEWCONFIG
 646         echo "  </remote>" >> $NEWCONFIG
 647         fi
 648
 649
 650         # Email/log alerts
 651         echo "" >> $NEWCONFIG
 652         echo "  <alerts>" >> $NEWCONFIG
 653     echo "    <log_alert_level>1</log_alert_level>" >> $NEWCONFIG
 654     if [ "$EMAILNOTIFY" = "yes" ]; then
 655         echo "    <email_alert_level>7</email_alert_level>">> $NEWCONFIG
 656         fi
 657         echo "  </alerts>" >> $NEWCONFIG
 658
 659
 660     if [ "X$ACTIVERESPONSE" = "Xyes" ]; then
 661         # Add commands in here
 662         echo "" >> $NEWCONFIG
 663         cat ${HOST_DENY_TEMPLATE} >> $NEWCONFIG
 664         echo "" >> $NEWCONFIG
 665         cat ${FIREWALL_DROP_TEMPLATE} >> $NEWCONFIG
 666         echo "" >> $NEWCONFIG
 667         cat ${DISABLE_ACCOUNT_TEMPLATE} >> $NEWCONFIG
 668         echo "" >> $NEWCONFIG
 669         cat ${ROUTENULL_TEMPLATE} >> $NEWCONFIG
 670         echo "" >> $NEWCONFIG
 671
 672         if [ "X$FIREWALLDROP" = "Xyes" ]; then
 673             echo "" >> $NEWCONFIG
 674             cat ${ACTIVE_RESPONSE_TEMPLATE} >> $NEWCONFIG
 675             echo "" >> $NEWCONFIG
 676         fi
 677     fi
 678
 679     # Setting up the logs
 680     SetupLogs "3.6"
 681     echo "</ossec_config>" >> $NEWCONFIG
 682 }
 683
 684
 685
 686
 687 ##########
 688 # setEnv()
 689 ##########
 690 setEnv()
 691 {
 692     echo ""
 693     echo "2- ${settingupenv}."
 694
 695     echo ""
 696     if [ "X${USER_DIR}" = "X" ]; then
 697         while [ 1 ]; do
 698             $ECHO " - ${wheretoinstall} [$INSTALLDIR]: "
 699             read ANSWER
 700             if [ ! "X$ANSWER" = "X" ]; then
 701                 echo $ANSWER |grep -E "^/[a-zA-Z0-9./_-]{3,128}$">/dev/null 2>&1
 702                 if [ $? = 0 ]; then
 703                     INSTALLDIR=$ANSWER;
 704                     break;
 705                 fi
 706             else
 707                 break;
 708             fi
 709         done
 710     else
 711         INSTALLDIR=${USER_DIR}
 712     fi
 713
 714
 715     CEXTRA="$CEXTRA -DDEFAULTDIR=\\\"${INSTALLDIR}\\\""
 716
 717     echo ""
 718     echo "    - ${installat} ${INSTALLDIR} ."
 719
 720
 721     if [ "X$INSTYPE" = "Xagent" ]; then
 722         CEXTRA="$CEXTRA -DCLIENT"
 723     elif [ "X$INSTYPE" = "Xlocal" ]; then
 724         CEXTRA="$CEXTRA -DLOCAL"
 725     fi
 726
 727     ls $INSTALLDIR >/dev/null 2>&1
 728     if [ $? = 0 ]; then
 729         if [ "X${USER_DELETE_DIR}" = "X" ]; then
 730             echo ""
 731             $ECHO "    - ${deletedir} ($yes/$no) [$yes]: "
 732             read ANSWER
 733         else
 734             ANSWER=${USER_DELETE_DIR}
 735         fi
 736
 737         case $ANSWER in
 738             $yesmatch)
 739                 rm -rf $INSTALLDIR
 740                 if [ ! $? = 0 ]; then
 741                     exit 2;
 742                 fi
 743                 ;;
 744         esac
 745     fi
 746 }
 747
 748
 749
 750
 751 ##########
 752 # checkDependencies()
 753 # Thanks to gabriel@macacos.org
 754 ##########
 755 checkDependencies()
 756 {
 757     echo ""
 758     OLDOPATH=$PATH
 759     if [ "X$NUNAME" = "XSunOS" ]; then
 760         PATH=$PATH:/usr/ccs/bin:/usr/xpg4/bin:/opt/csw/gcc3/bin:/opt/csw/bin:/usr/sfw/bin
 761         export  PATH
 762     elif [ "X$NUNAME" = "XAIX" ]; then
 763         PATH=$PATH:/usr/vac/bin
 764         export  PATH
 765     fi
 766
 767     ls "`which gcc`" > /dev/null 2>&1
 768     if [ ! $? = 0 ]; then
 769         ls "`which cc`" > /dev/null 2>&1
 770         if [ ! $? = 0 ]; then
 771             if [ "X${USER_BINARYINSTALL}" = "X" ]; then
 772                 catError "0x3-dependencies"
 773             fi
 774         fi
 775         CC="cc"
 776     else
 777         CC="gcc"
 778     fi
 779
 780     PATH=$OLDOPATH
 781     export PATH
 782 }
 783
 784 ##########
 785 # AddWhite()
 786 ##########
 787 AddWhite()
 788 {
 789         while [ 1 ]
 790         do
 791         echo ""
 792                 $ECHO "   - ${addwhite} ($yes/$no)? [$no]: "
 793
 794         # If white list is set, we don't need to ask it here.
 795         if [ "X${USER_WHITE_LIST}" = "X" ]; then
 796                     read ANSWER
 797         else
 798             ANSWER=$yes
 799         fi
 800
 801                 if [ "X${ANSWER}" = "X" ] ; then
 802                         ANSWER=$no
 803                 fi
 804
 805                 case $ANSWER in
 806                         $no)
 807                                 break;
 808                                 ;;
 809                         *)
 810                                 $ECHO "   - ${ipswhite}"
 811                 if [ "X${USER_WHITE_LIST}" = "X" ]; then
 812                                     read IPS
 813                                 else
 814                     IPS=${USER_WHITE_LIST}
 815                 fi
 816
 817                                 for ip in ${IPS};
 818                                 do
 819                                         if [ ! "X${ip}" = "X" ]; then
 820                         echo $ip | grep -E "^[0-9./]{5,20}$" > /dev/null 2>&1
 821                         if [ $? = 0 ]; then
 822                                                 echo "    <white_list>${ip}</white_list>" >>$NEWCONFIG
 823                         fi
 824                                         fi
 825                                 done
 826
 827                                 break;
 828                                 ;;
 829                 esac
 830         done
 831 }
 832
 833
 834 ##########
 835 # AddPFTable()
 836 ##########
 837 AddPFTable()
 838 {
 839     #default pf rules
 840     TABLE="ossec_fwtable"
 841
 842     # Add table to the first line
 843     echo ""
 844     echo "   - ${pfmessage}:"
 845     echo "     ${moreinfo}"
 846     echo "     http://www.ossec.net/en/manual.html#active-response-tools"
 847
 848     echo ""
 849     echo ""
 850     echo "      table <${TABLE}> persist #$TABLE "
 851     echo "      block in quick from <${TABLE}> to any"
 852     echo "      block out quick from any to <${TABLE}>"
 853     echo ""
 854     echo ""
 855
 856 }
 857
 858 ##########
 859 # main()
 860 ##########
 861 main()
 862 {
 863     LG="en"
 864     LANGUAGE="en"
 865     . ./src/init/shared.sh
 866     . ./src/init/functions.sh
 867
 868     # Reading pre-defined file
 869     if [ ! `isFile ${PREDEF_FILE}` = "${FALSE}" ]; then
 870         . ${PREDEF_FILE}
 871     fi
 872
 873     # If user language is not set
 874
 875     if [ "X${USER_LANGUAGE}" = "X" ]; then
 876
 877         # Choosing the language.
 878         while [ 1 ]; do
 879         echo ""
 880         for i in `ls ${TEMPLATE}`; do
 881             # ignore CVS (should not be there anyways and config)
 882             if [ "$i" = "CVS" -o "$i" = "config" ]; then continue; fi
 883             cat "${TEMPLATE}/$i/language.txt"
 884             if [ ! "$i" = "en" ]; then
 885                 LG="${LG}/$i"
 886             fi
 887         done
 888         $ECHO "  (${LG}) [en]: "
 889         read USER_LG;
 890
 891         if [ "X${USER_LG}" = "X" ]; then
 892             USER_LG="en"
 893         fi
 894
 895         ls "${TEMPLATE}/${USER_LG}" > /dev/null 2>&1
 896         if [ $? = 0 ]; then
 897             break;
 898         fi
 899         done;
 900
 901         LANGUAGE=${USER_LG}
 902
 903     else
 904
 905         # If provided language is not valid, default to english
 906         ls "${TEMPLATE}/${USER_LANGUAGE}" > /dev/null 2>&1
 907         if [ $? = 0 ]; then
 908             LANGUAGE=${USER_LANGUAGE}
 909         else
 910             LANGUAGE="en"
 911         fi
 912
 913     fi # for USER_LANGUAGE
 914
 915
 916     . ./src/init/shared.sh
 917     . ./src/init/language.sh
 918     . ./src/init/functions.sh
 919     . ./src/init/init.sh
 920     . ${TEMPLATE}/${LANGUAGE}/messages.txt
 921
 922
 923     # Must be executed as ./install.sh
 924     if [ `isFile ${VERSION_FILE}` = "${FALSE}" ]; then
 925         catError "0x1-location";
 926     fi
 927
 928     # Must be root
 929     if [ ! "X$ME" = "Xroot" ]; then
 930         catError "0x2-beroot";
 931     fi
 932
 933     # Checking dependencies
 934     checkDependencies
 935
 936     clear
 937
 938
 939     # Initial message
 940     echo " $NAME $VERSION ${installscript} - http://www.ossec.net"
 941
 942     catMsg "0x101-initial"
 943
 944     echo "  - $system: $UNAME"
 945     echo "  - $user: $ME"
 946     echo "  - $host: $HOST"
 947     echo ""
 948     echo ""
 949     echo "  -- $hitanyorabort --"
 950
 951     if [ "X$USER_NO_STOP" = "X" ]; then
 952         read ANY
 953     fi
 954
 955     . ./src/init/update.sh
 956     # Is this an update?
 957     if [ "`isUpdate`" = "${TRUE}" ]; then
 958         echo ""
 959         ct="1"
 960         while [ $ct = "1" ]; do
 961             ct="0"
 962             $ECHO " - ${wanttoupdate} ($yes/$no): "
 963             if [ "X${USER_UPDATE}" = "X" ]; then
 964                 read ANY
 965             else
 966                 ANY=$yes
 967             fi
 968
 969             case $ANY in
 970                 $yes)
 971                     update_only="yes"
 972                     break;
 973                     ;;
 974                 $no)
 975                     break;
 976                     ;;
 977                   *)
 978                     ct="1"
 979                     ;;
 980             esac
 981         done
 982
 983
 984         # Do some of the update steps.
 985         if [ "X${update_only}" = "Xyes" ]; then
 986             . ./src/init/update.sh
 987
 988             if [ "`doUpdatecleanup`" = "${FALSE}" ]; then
 989                 # Disabling update
 990                 echo ""
 991                 echo "${unabletoupdate}"
 992                 sleep 5;
 993                 update_only=""
 994             else
 995                 # Get update
 996                 USER_INSTALL_TYPE=`getPreinstalled`
 997                 USER_DIR=`getPreinstalledDir`
 998                 USER_DELETE_DIR="$nomatch"
 999             fi
1000
1001             ct="1"
1002
1003             # We dont need to update the rules on agent installs
1004             if [ "X${USER_INSTALL_TYPE}" = "Xagent" ]; then
1005                 ct="0"
1006             fi
1007
1008             while [ $ct = "1" ]; do
1009                 ct="0"
1010                 $ECHO " - ${updaterules} ($yes/$no): "
1011                 if [ "X${USER_UPDATE_RULES}" = "X" ]; then
1012                     read ANY
1013                 else
1014                     ANY=$yes
1015                 fi
1016
1017                 case $ANY in
1018                     $yes)
1019                         update_rules="yes"
1020                         break;
1021                         ;;
1022                     $no)
1023                         break;
1024                         ;;
1025                     *)
1026                         ct="1"
1027                         ;;
1028                 esac
1029             done
1030         fi
1031         echo ""
1032     fi
1033
1034     serverm=`echo ${server} | cut -b 1`
1035     localm=`echo ${local} | cut -b 1`
1036     agentm=`echo ${agent} | cut -b 1`
1037     helpm=`echo ${help} | cut -b 1`
1038
1039     # If user install type is not set, ask for it.
1040     if [ "X${USER_INSTALL_TYPE}" = "X" ]; then
1041
1042         # Loop for the installation options
1043         while [ 1 ]
1044         do
1045             echo ""
1046             $ECHO "1- ${whattoinstall} "
1047
1048             read ANSWER
1049             case $ANSWER in
1050
1051                 ${helpm}|${help})
1052                 catMsg "0x102-installhelp"
1053                     ;;
1054
1055                 ${server}|${serverm})
1056                 echo ""
1057                     echo "  - ${serverchose}."
1058                     INSTYPE="server"
1059                     break;
1060                     ;;
1061
1062                 ${agent}|${agentm})
1063                 echo ""
1064                     echo "  - ${clientchose}."
1065                     INSTYPE="agent"
1066                     break;
1067                     ;;
1068
1069                 ${local}|${localm})
1070                 echo ""
1071                 echo "  - ${localchose}."
1072                 INSTYPE="local"
1073                 break;
1074                 ;;
1075             esac
1076         done
1077
1078     else
1079         INSTYPE=${USER_INSTALL_TYPE}
1080     fi
1081
1082
1083     # Setting up the environment
1084     setEnv
1085
1086
1087     # Configuring the system (based on the installation type)
1088     if [ "X${update_only}" = "X" ]; then
1089         if [ "X$INSTYPE" = "Xserver" ]; then
1090             ConfigureServer
1091         elif [ "X$INSTYPE" = "Xagent" ]; then
1092             ConfigureClient
1093         elif [ "X$INSTYPE" = "Xlocal" ]; then
1094             ConfigureServer
1095         else
1096             catError "0x4-installtype"
1097         fi
1098     fi
1099
1100     # Installing (calls the respective script
1101     # -- InstallAgent.sh or InstallServer.sh
1102     Install
1103
1104     # User messages
1105     echo ""
1106     echo " - ${configurationdone}."
1107     echo ""
1108     echo " - ${tostart}:"
1109     echo "              $INSTALLDIR/bin/ossec-control start"
1110     echo ""
1111     echo " - ${tostop}:"
1112     echo "              $INSTALLDIR/bin/ossec-control stop"
1113     echo ""
1114     echo " - ${configat} $INSTALLDIR/etc/ossec.conf"
1115     echo ""
1116
1117
1118     catMsg "0x103-thanksforusing"
1119
1120
1121     if [ "X${update_only}" = "Xyes" ]; then
1122         # Message for the update
1123         if [ "X`sh ./src/init/fw-check.sh`" = "XPF" -a "X${ACTIVERESPONSE}" = "Xyes" ]; then
1124             if [ "X$USER_NO_STOP" = "X" ]; then
1125                 read ANY
1126             fi
1127             AddPFTable
1128         fi
1129         echo ""
1130         echo " - ${updatecompleted}"
1131         echo ""
1132         exit 0;
1133     fi
1134
1135
1136     if [ "X$USER_NO_STOP" = "X" ]; then
1137         read ANY
1138     fi
1139
1140
1141     # PF firewall message
1142     if [ "X`sh ./src/init/fw-check.sh`" = "XPF" -a "X${ACTIVERESPONSE}" = "Xyes" ]; then
1143         AddPFTable
1144     fi
1145
1146
1147     if [ "X$INSTYPE" = "Xserver" ]; then
1148         echo ""
1149         echo " - ${addserveragent}"
1150         echo "   ${runma}:"
1151         echo ""
1152         echo "   $INSTALLDIR/bin/manage_agents"
1153         echo ""
1154         echo "   ${moreinfo}"
1155         echo "   http://www.ossec.net/en/manual.html#ma"
1156         echo ""
1157
1158     elif [ "X$INSTYPE" = "Xagent" ]; then
1159         catMsg "0x104-client"
1160         echo "   $INSTALLDIR/bin/manage_agents"
1161         echo ""
1162         echo "   ${moreinfo}"
1163         echo "   http://www.ossec.net/en/manual.html#ma"
1164         echo ""
1165     fi
1166
1167     if [ "X$notmodified" = "Xyes" ]; then
1168         catMsg "0x105-noboot"
1169         echo "          $INSTALLDIR/bin/ossec-control start"
1170         echo ""
1171     fi
1172 }
1173
1174
1175
1176
1177 ### Calling main function where everything happens
1178 main
1179
1180
1181 exit 0
1182
1183
1184
1185 ## EOF ##
1186