2 # Shell script update functions for the OSSEC HIDS
3 # Author: Daniel B. Cid <daniel.cid@gmail.com>
10 ls -la ${OSSEC_INIT} > /dev/null 2>&1
13 if [ "X$DIRECTORY" = "X" ]; then
14 echo "# ($FUNCNAME) ERROR: The variable DIRECTORY wasn't set" 1>&2
18 ls -la $DIRECTORY > /dev/null 2>&1
32 if [ "X$DIRECTORY" = "X" ]; then
33 echo "# ($FUNCNAME) ERROR: The variable DIRECTORY wasn't set." 1>&2
38 # Checking if the directory is valid.
39 _dir_pattern_update="^/[-a-zA-Z0-9/\.-]{3,128}$"
40 echo $DIRECTORY | grep -E "$_dir_pattern_update" > /dev/null 2>&1
42 echo "# ($FUNCNAME) ERROR: directory name ($DIRECTORY) doesn't match the pattern $_dir_pattern_update" 1>&2
53 cat $DIRECTORY/etc/ossec.conf | grep "<client>" > /dev/null 2>&1
59 cat $DIRECTORY/etc/ossec.conf | grep "<remote>" > /dev/null 2>&1
80 $DIRECTORY/bin/ossec-control start
87 $DIRECTORY/bin/ossec-control stop
89 # We also need to remove all syscheck queue file (format changed)
90 if [ "X$VERSION" = "X0.9-3" ]; then
91 rm -f $DIRECTORY/queue/syscheck/* > /dev/null 2>&1
92 rm -f $DIRECTORY/queue/agent-info/* > /dev/null 2>&1
94 rm -f $DIRECTORY/queue/syscheck/.* > /dev/null 2>&1
101 OSSEC_CONF_FILE="$DIRECTORY/etc/ossec.conf"
103 # Backing up the old config
104 cp -pr ${OSSEC_CONF_FILE} "${OSSEC_CONF_FILE}.$$.bak"
106 # Getting rid of old rules entries
107 grep -Ev "</*rules>|<include>|<list>|<decoder>|<decoder_dir|<rule_dir>|rules global entry" ${OSSEC_CONF_FILE} > "${OSSEC_CONF_FILE}.$$.tmp"
109 # Customer decoder, decoder_dir, rule_dir are carried over during upgrade
110 grep -E '<decoder>|<decoder_dir|<rule_dir>' ${OSSEC_CONF_FILE} | grep -v '<!--' >> "${OSSEC_CONF_FILE}.$$.tmp2"
112 # Check for custom files that may have been added in <rules> element
113 for i in `grep -E '<include>|<list>' ${OSSEC_CONF_FILE} | grep -v '<!--'`
115 grep "$i" ${RULES_TEMPLATE}>/dev/null || echo " $i" >> "${OSSEC_CONF_FILE}.$$.tmp2"
118 # Putting everything back together
119 cat "${OSSEC_CONF_FILE}.$$.tmp" > ${OSSEC_CONF_FILE}
120 rm "${OSSEC_CONF_FILE}.$$.tmp"
121 echo "" >> ${OSSEC_CONF_FILE}
122 echo "<ossec_config> <!-- rules global entry -->" >> ${OSSEC_CONF_FILE}
123 grep -v '</rules>' ${RULES_TEMPLATE} >> ${OSSEC_CONF_FILE}
124 cat "${OSSEC_CONF_FILE}.$$.tmp2" >> ${OSSEC_CONF_FILE}
125 echo "</rules>" >> ${OSSEC_CONF_FILE}
126 echo "</ossec_config> <!-- rules global entry -->" >> ${OSSEC_CONF_FILE}
127 rm "${OSSEC_CONF_FILE}.$$.tmp2"