Skip to content

Commit 79c166e

Browse files
Zalgo2462Logan L
Zalgo2462
and
Logan L
authored
Add Zeek-Transport Installer and install_data_import.sh (#15)
* Add install_data_import.sh * Move Zeek-Transport installer generation to this repo * Reorganize files to mirror other projects * cleanup modules * don't commit tar files * Replace data_source_name / Zeek with the system hostname --------- Co-authored-by: Logan L <[email protected]>
1 parent 3af1d45 commit 79c166e

12 files changed

+295
-0
lines changed

Diff for: ‎.gitmodules

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[submodule "Zeek-Transport/shell-lib"]
2+
path = Zeek-Transport/shell-lib
3+
url = [email protected]:activecm/shell-lib.git

Diff for: ‎Zeek-Transport/install_data_import.sh

+148
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
#!/usr/bin/env bash
2+
#Copyright 2019 Active Countermeasures
3+
#Installs the data import user account and zeek_log_transport.sh cron job.
4+
#version = 2.0.1
5+
6+
#### Environment Set Up
7+
8+
# Set the working directory to the script directory
9+
pushd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null
10+
11+
# Set exit on error
12+
set -o errexit
13+
set -o errtrace
14+
set -o pipefail
15+
16+
# ERROR HANDLING
17+
__err() {
18+
echo2 ""
19+
echo2 "Installation failed on line ${0##*/}:$1."
20+
echo2 ""
21+
exit 1
22+
}
23+
24+
__int() {
25+
echo2 ""
26+
echo2 "Installation cancelled."
27+
echo2 ""
28+
exit 1
29+
}
30+
31+
trap '__err $LINENO' ERR
32+
trap '__int' INT
33+
34+
# Load the function library
35+
. ./shell-lib/acmlib.sh
36+
normalize_environment
37+
38+
#### Script Constants
39+
data_import_private_key="$HOME/.ssh/id_rsa_dataimport"
40+
data_import_public_key="$HOME/.ssh/id_rsa_dataimport.pub"
41+
42+
#### Init State
43+
ach_ip=""
44+
45+
#### Main Logic
46+
print_usage_text () {
47+
cat >&2 <<EOHELP
48+
This script will set up routine data transfers to AC-Hunter. This script
49+
should not be called directly.
50+
51+
The first parameter is an optional IP address for AC-Hunter. If it is not set,
52+
the script will prompt the user for the address.
53+
If the address is set to 127.0.0.1, nothing will be installed.
54+
55+
On the command line, enter:
56+
$0 [ip.address.for.achunter]
57+
EOHELP
58+
}
59+
60+
parse_parameters () {
61+
# Reads input parameters into the the Init State variables
62+
if [ "$1" = 'help' -o "$1" = '--help' ]; then
63+
print_usage_text
64+
exit 0
65+
fi
66+
67+
ach_ip="$1"
68+
}
69+
70+
check_data_import_ip () {
71+
# Checks if the data import ip address is local or not. Returns true if it is.
72+
# If it isn't, it attempts to ssh under the dataimport account to the given ip
73+
# using the data import private key
74+
check_ssh_target_is_local "$ach_ip" || can_ssh "dataimport@$ach_ip" -i "$data_import_private_key" -o "StrictHostKeyChecking=no"
75+
}
76+
77+
main() {
78+
parse_parameters "$@"
79+
require_sudo
80+
export acm_no_interactive
81+
82+
#Only run this function if the data import private key has been
83+
#transferred in via install_acm.sh
84+
if [ ! -e "$data_import_private_key" ]; then
85+
status "Skipping data transfer set-up. SSH key does not exist."
86+
return 0
87+
fi
88+
89+
if [ "$acm_no_interactive" = 'yes' ] && [ -z "$ach_ip" ]; then
90+
echo2 "No AC-Hunter IP address supplied, and we are in non-interactive mode. Exiting."
91+
exit 1
92+
fi
93+
status "Configuring data transfer to AC-Hunter"
94+
while [ -z "$ach_ip" ] || ! check_data_import_ip ; do
95+
if [ -n "$ach_ip" -a -e "$data_import_public_key" ]; then
96+
echo2 "Please ensure $data_import_public_key has been added to /home/dataimport/.ssh/authorized_keys on $ach_ip."
97+
fi
98+
echo2 "In order to transfer data from `hostname` to AC-Hunter, we need to know the hostname or IP address of the AC-Hunter system."
99+
echo2 "Enter 127.0.0.1 if AC-Hunter is installed locally."
100+
prompt2 "Please enter the hostname or IP address of your AC-Hunter system: "
101+
read -e ach_ip <&2
102+
done
103+
104+
if check_ssh_target_is_local "$ach_ip"; then
105+
echo2 "Skipping data transfer set-up. AC-Hunter is installed locally."
106+
return 0
107+
fi
108+
109+
echo2 "`hostname` is able to send data to AC-Hunter, good."
110+
111+
status "Installing data transfer routine"
112+
113+
$SUDO cp "zeek_log_transport.sh" /usr/local/bin/zeek_log_transport.sh
114+
115+
# Remove bro_log_transport used in previous versions of this script if it exists
116+
if [ -f /usr/local/bin/bro_log_transport.sh ]; then
117+
$SUDO rm -f /usr/local/bin/bro_log_transport.sh
118+
fi
119+
# Migrate old cron job used in previous version of this script
120+
if [ -f /etc/cron.d/bro_log_transport ]; then
121+
$SUDO mv /etc/cron.d/bro_log_transport /etc/cron.d/zeek_log_transport
122+
$SUDO sed -i "s|/usr/local/bin/bro_log_transport.sh|/usr/local/bin/zeek_log_transport.sh|g" /etc/cron.d/zeek_log_transport
123+
fi
124+
125+
if ! grep -qs '/usr/local/bin/zeek_log_transport.sh --dest '"${ach_ip}"'' /etc/cron.d/zeek_log_transport ; then
126+
#We don't already have this line in that file, so add it.
127+
#This runs the log transport at 5 minutes past every hour.
128+
echo "5 * * * * ${SUDO_USER:-$USER} /usr/local/bin/zeek_log_transport.sh --dest $ach_ip" | $SUDO tee -a /etc/cron.d/zeek_log_transport >/dev/null
129+
fi
130+
131+
$SUDO service cron reload >/dev/null 2>&1 || : #Correct for Ubuntu 16.x
132+
$SUDO service crond reload >/dev/null 2>&1 || : #Correct for CentOS 7
133+
134+
if [ -n "$SUDO_USER" ]; then
135+
#Because the ssh tests (and host key harvesting) may have been performed as root, we need to copy any discovered host keys to the original user's known_hosts.
136+
cat /root/.ssh/known_hosts | tee -a "$HOME/.ssh/known_hosts" >/dev/null
137+
chown "$SUDO_USER" "$HOME/.ssh/known_hosts"
138+
chmod go-rwx "$HOME/.ssh/known_hosts"
139+
fi
140+
echo2 "Cron is set to transfer data to AC-Hunter every hour, good."
141+
echo2
142+
}
143+
144+
main "$@"
145+
146+
#### Clean Up
147+
# Change back to the initial working directory
148+
popd > /dev/null

Diff for: ‎Zeek-Transport/install_zeek_transport.sh

+92
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#!/usr/bin/env bash
2+
#Copyright 2020 Active Countermeasures
3+
#Performs installation of Zeek
4+
5+
#### Environment Set Up
6+
7+
# Set the working directory to the script directory
8+
pushd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null
9+
10+
# Set exit on error
11+
set -o errexit
12+
set -o errtrace
13+
set -o pipefail
14+
15+
# ERROR HANDLING
16+
__err() {
17+
echo2 ""
18+
echo2 "Installation failed on line $1:$2."
19+
echo2 ""
20+
exit 1
21+
}
22+
23+
__int() {
24+
echo2 ""
25+
echo2 "Installation cancelled."
26+
echo2 ""
27+
exit 1
28+
}
29+
30+
trap '__err ${BASH_SOURCE##*/} $LINENO' ERR
31+
trap '__int' INT
32+
33+
# Load the function library
34+
. ./scripts/shell-lib/acmlib.sh
35+
normalize_environment
36+
37+
#### Script Constants
38+
39+
#### Init State
40+
# These variables could be sourced from a configuration script
41+
# in order to support unattended installation.
42+
43+
ach_ip="$ach_ip"
44+
45+
#### Working State
46+
47+
#### Main Logic
48+
49+
print_usage_text () {
50+
cat >&2 <<EOHELP
51+
This script will set up routine data transfers of Zeek data to AC-Hunter.
52+
If the environment variable "ach_ip" is set, the value will be used for
53+
AC-Hunter's IP address or hostname. Otherwise, the installer will present
54+
a prompt asking for the information.
55+
EOHELP
56+
}
57+
58+
parse_parameters () {
59+
# Reads input parameters into the the Init State variables
60+
if [ "$1" = 'help' -o "$1" = '--help' ]; then
61+
print_usage_text
62+
exit 0
63+
fi
64+
}
65+
66+
test_system () {
67+
status "Checking minimum requirements"
68+
require_supported_os
69+
require_selinux_permissive
70+
require_free_space_MB "/" "/usr" 5120
71+
}
72+
73+
main () {
74+
parse_parameters "$@"
75+
76+
status "Checking for administrator privileges"
77+
require_sudo
78+
export acm_no_interactive
79+
80+
test_system
81+
82+
status "Installing supporting software"
83+
ensure_common_tools_installed
84+
85+
scripts/install_data_import.sh $ach_ip
86+
}
87+
88+
main "$@"
89+
90+
#### Clean Up
91+
# Change back to the initial working directory
92+
popd > /dev/null

Diff for: ‎Zeek-Transport/installer/.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
*.tar

Diff for: ‎Zeek-Transport/installer/generate_installer.sh

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/usr/bin/env bash
2+
3+
set -e
4+
5+
# Store the absolute path of the script's dir and switch to the top dir
6+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
7+
pushd "$SCRIPT_DIR" > /dev/null
8+
9+
__help() {
10+
cat <<HEREDOC
11+
This script generates an installer for setting up Zeek data transfers to AC-Hunter.
12+
The resulting file is not intended to be installed directly by customers.
13+
Usage:
14+
${_NAME} [<arguments>]
15+
Options:
16+
-h|--help Show this help message.
17+
HEREDOC
18+
}
19+
20+
# Parse through command args
21+
while [[ $# -gt 0 ]]; do
22+
case $1 in
23+
-h|--help)
24+
# Display help and exit
25+
__help
26+
exit 0
27+
;;
28+
*)
29+
;;
30+
esac
31+
shift
32+
done
33+
34+
# File/ Directory Names
35+
TRANSPORT_ARCHIVE=Zeek-Transport
36+
STAGE_DIR="$SCRIPT_DIR/stage/$TRANSPORT_ARCHIVE"
37+
38+
echo "Creating Zeek installer archive..."
39+
# This has the result of only including the files we want
40+
# but putting them in a single directory so they extract nicely
41+
tar -C "$STAGE_DIR/.." --exclude '.*' -chf "$SCRIPT_DIR/${TRANSPORT_ARCHIVE}.tar" $TRANSPORT_ARCHIVE
42+
43+
popd > /dev/null

Diff for: ‎Zeek-Transport/installer/stage/Zeek-Transport/.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Don't commit any generated resources
2+
*.tar.gz
3+
*.tar

Diff for: ‎Zeek-Transport/installer/stage/Zeek-Transport/install_zeek_transport.sh

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../install_zeek_transport.sh

Diff for: ‎Zeek-Transport/installer/stage/Zeek-Transport/scripts/install_data_import.sh

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../install_data_import.sh

Diff for: ‎Zeek-Transport/installer/stage/Zeek-Transport/scripts/shell-lib

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../shell-lib/

Diff for: ‎Zeek-Transport/installer/stage/Zeek-Transport/scripts/zeek_log_transport.sh

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../../zeek_log_transport.sh

Diff for: ‎Zeek-Transport/shell-lib

Submodule shell-lib added at cdeedf3

Diff for: ‎connect_sensor.sh

100644100755
File mode changed.

0 commit comments

Comments
 (0)