Skip to content

Commit 6562b97

Browse files
committed
Winter is Coming
Changes all around. Full Automation for EVERYONE. Thanks to my supports, bug submitters and feature requesters! Enjoy.
1 parent bda04d9 commit 6562b97

File tree

67 files changed

+8805
-561
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+8805
-561
lines changed

Autosnort - CentOS/PolicyModules/PolicyModuleNotes.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ The first volley of commands is to allow apache access to read/write what's in t
44
chcon -R -t httpd_sys_rw_content_t /var/www/html/snorby/
55
setsebool -P httpd_can_network_connect_db 1
66
setsebool -P httpd_can_network_connect 1
7-
I've found that the following files/dirs need to be set to the context of httpd_sys_script_exec_t in order to get fuckall to work:
7+
I've found that the following files/dirs need to be set to the context of httpd_sys_script_exec_t in order to get anything to work:
88
/usr/local/rvm/rubies/ruby-1.9.3-p429/bin/ruby
99
/usr/local/rvm/wrappers/ruby-1.9.3-p429/ruby
1010
/usr/local/rvm/rubies/ruby-1.9.3-p429/lib/libruby.so*

Autosnort - CentOS/aanvalbpu

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#!/bin/bash
2+
#
3+
#Snortbarn Startup script for Aanval Background Processors
4+
# chkconfig: - 86 14
5+
# description: This script provided by Autosnort. It is \
6+
# Responsible for Starting/Stopping Both \
7+
# Aanval's Background Processor Daemons
8+
# processnames: BPU
9+
### BEGIN INIT INFO
10+
# Provides: background processors
11+
# Required-Start: $local_fs $remote_fs $network $named $syslog $time $httpd
12+
# Required-Stop: $local_fs $remote_fs $network $named $syslog $time $httpd
13+
# Default-Start: 2 3 4 5
14+
# Default-Stop: 0 1 6
15+
# Short-Description: start and stop aanval BPUs (background processors)
16+
# Description: Aanval is a web front-end for snort.
17+
### END INIT INFO
18+
19+
# Source function library.
20+
. /etc/rc.d/init.d/functions
21+
22+
do_start()
23+
{
24+
echo "Starting Aanval BPUs"
25+
cd /var/www/html/aanval/apps
26+
perl idsBackground.pl -start
27+
if [ $? -eq 0 ]; then
28+
echo "Aanval BPUs successfully started."
29+
logger "Aanval BPUs Started!"
30+
else
31+
echo "Aanval BPUs failed to start!"
32+
fi
33+
return 0
34+
}
35+
36+
do_stop()
37+
{
38+
echo "Stopping Aanval BPUs"
39+
cd /var/www/html/aanval/apps
40+
perl idsBackground.pl -stop
41+
if [ $? -eq 0 ]; then
42+
echo "Aanval BPUs successfully stopped."
43+
logger "Aanval BPUs Stopped!"
44+
else
45+
echo "Aanval BPUs failed to stop! (Permissions? Already stopped?)"
46+
fi
47+
return 0
48+
}
49+
50+
case "$1" in
51+
start)
52+
do_start
53+
;;
54+
stop)
55+
do_stop
56+
;;
57+
restart)
58+
do_stop
59+
do_start
60+
;;
61+
*)
62+
echo "Usage: snortbarn {start|stop|restart}" >&2
63+
exit 3
64+
;;
65+
esac
66+
exit 0

Autosnort - CentOS/aanvalbpu.service

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
[Unit]
2+
Description=Aanval Background Processors
3+
After=http.service
4+
5+
[Service]
6+
Type=forking
7+
ExecStart=/bin/bash -c "cd /var/www/html/aanval/apps;perl idsBackground.pl -start"
8+
9+
[Install]
10+
WantedBy=multi-user.target
+216
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
########################################
2+
#logging setup: Stack Exchange made this.
3+
4+
aanval_logfile=/var/log/aanval_install.log
5+
mkfifo ${aanval_logfile}.pipe
6+
tee < ${aanval_logfile}.pipe $aanval_logfile &
7+
exec &> ${aanval_logfile}.pipe
8+
rm ${aanval_logfile}.pipe
9+
10+
########################################
11+
#Metasploit-like print statements: status, good, bad and notification. Gratouitiously copied from Darkoperator's metasploit install script.
12+
13+
function print_status ()
14+
{
15+
echo -e "\x1B[01;34m[*]\x1B[0m $1"
16+
}
17+
18+
function print_good ()
19+
{
20+
echo -e "\x1B[01;32m[*]\x1B[0m $1"
21+
}
22+
23+
function print_error ()
24+
{
25+
echo -e "\x1B[01;31m[*]\x1B[0m $1"
26+
}
27+
28+
function print_notification ()
29+
{
30+
echo -e "\x1B[01;33m[*]\x1B[0m $1"
31+
}
32+
33+
########################################
34+
#Error Checking function. Checks for exist status of last command ran. If non-zero assumes something went wrong and bails script.
35+
36+
function error_check
37+
{
38+
39+
if [ $? -eq 0 ]; then
40+
print_good "$1 successfully completed."
41+
else
42+
print_error "$1 failed. Please check $logfile for more details, or contact deusexmachina667 at gmail dot com for more assistance."
43+
exit 1
44+
fi
45+
46+
}
47+
48+
########################################
49+
#Pre-setup. First, if the aanval directory exists, delete it. It causes more problems than it resolves, and usually only exists if the install failed in some way. Wipe it away, start with a clean slate.
50+
51+
if [ -d /var/www/html/aanval ]; then
52+
print_notification "aanval directory exists. Deleting to prevent issues.."
53+
rm -rf /var/www/html/aanval
54+
fi
55+
execdir=`pwd`
56+
if [ ! -f $execdir/full_autosnort.conf ]; then
57+
print_error "full_autosnort.conf was NOT found in $execdir. This script relies HEAVILY on this config file. The main autosnort script, full_autosnort.conf and this file should be located in the SAME directory to ensure success."
58+
exit 1
59+
else
60+
source $execdir/full_autosnort.conf
61+
print_good "Found config file."
62+
fi
63+
64+
########################################
65+
66+
print_status "Grabbing packages for aanval.."
67+
yum -y install php php-common php-gd php-cli php-mysql byacc libxslt-devel php-pear.noarch perl-Crypt-SSLeay perl-libwww-perl perl-Archive-Tar perl-IO-Socket-SSL openssl-devel mod_ssl &>> $aanval_logfile
68+
#second time in a row where adodb is required, but I can't get it in centOS 7
69+
#error_check 'Package installation'
70+
########################################
71+
72+
#Make the aanval directory under /var/www, and cd into it
73+
mkdir /var/www/html/aanval
74+
cd /var/www/html/aanval
75+
76+
77+
78+
# We need to grab aanval from the aanval.com site.
79+
print_status "Grabbing aanval."
80+
wget https://www.aanval.com/download/pickup -O aanval.tar.gz --no-check-certificate &>> $aanval_logfile
81+
error_check 'Aanval download'
82+
83+
print_status "Installing Aanval.."
84+
85+
tar -xzvf aanval.tar.gz &>> $aanval_logfile
86+
error_check 'Aanval file install'
87+
rm -rf aanval.tar.gz
88+
89+
########################################
90+
91+
#Creating the database infrastructure for Aanval -- We make the database aanvaldb and give the snort user the ability to do work on it.
92+
#This database is totally separate from the snort database, BOTH must be present.
93+
94+
print_status "Configuring mysql to work with Aanval.."
95+
96+
mysql -u root -p$root_mysql_pass -e "create database aanvaldb;" &>> $aanval_logfile
97+
error_check 'Aanval database creation'
98+
99+
100+
#granting the snort user the ability to maintain the snort database so Aanval doesn't need root dba creds.
101+
102+
print_status "Granting snort database user permissions to operate on aanval's database.."
103+
mysql -u root -p$root_mysql_pass -e "grant create, insert, select, delete, update on aanvaldb.* to snort@localhost identified by '$snort_mysql_pass';" &>> $aanval_logfile
104+
error_check 'Grant permissions to aanval database'
105+
106+
########################################
107+
108+
#Here we're making some virtual hosts in /etc/httpd/conf/httpd.conf to support SSL, and ensuring proper file perms for aanval
109+
110+
111+
print_status "Adding Virtual Host settings and reconfiguring httpd to use SSL.."
112+
113+
echo "" >> /etc/httpd/conf/httpd.conf
114+
echo "<IfModule mod_ssl.c>" >> /etc/httpd/conf/httpd.conf
115+
echo " <VirtualHost *:443>" >> /etc/httpd/conf/httpd.conf
116+
echo " #SSL Settings, including support for PFS." >> /etc/httpd/conf/httpd.conf
117+
echo " SSLEngine on" >> /etc/httpd/conf/httpd.conf
118+
echo " SSLCertificateFile /etc/httpd/ssl/ids.cert" >> /etc/httpd/conf/httpd.conf
119+
echo " SSLCertificateKeyFile /etc/httpd/ssl/ids.key" >> /etc/httpd/conf/httpd.conf
120+
echo " SSLProtocol all -SSLv2 -SSLv3" >> /etc/httpd/conf/httpd.conf
121+
echo " SSLHonorCipherOrder on" >> /etc/httpd/conf/httpd.conf
122+
echo " SSLCipherSuite \"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS\"" >> /etc/httpd/conf/httpd.conf
123+
echo "" >> /etc/httpd/conf/httpd.conf
124+
echo " #Mod_Rewrite Settings. Force everything to go over SSL." >> /etc/httpd/conf/httpd.conf
125+
echo " RewriteEngine On" >> /etc/httpd/conf/httpd.conf
126+
echo " RewriteCond %{HTTPS} off" >> /etc/httpd/conf/httpd.conf
127+
echo " RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}" >> /etc/httpd/conf/httpd.conf
128+
echo "" >> /etc/httpd/conf/httpd.conf
129+
echo " #Now, we finally get to configuring our VHOST." >> /etc/httpd/conf/httpd.conf
130+
echo " ServerName aanval.localhost" >> /etc/httpd/conf/httpd.conf
131+
echo " DocumentRoot /var/www/html/aanval" >> /etc/httpd/conf/httpd.conf
132+
echo " </VirtualHost>" >> /etc/httpd/conf/httpd.conf
133+
echo "</IfModule>" >> /etc/httpd/conf/httpd.conf
134+
135+
print_good "httpd reconfigured."
136+
print_status "Granting ownership of /var/www/html/aanval to apache.."
137+
138+
chown -R apache:apache /var/www/html/aanval
139+
error_check 'aanval file ownership reset'
140+
141+
########################################
142+
#These are SELinux perms that Aanval requires.
143+
144+
print_status "Configuring SELinux permissions for Aanval.."
145+
print_notification "Setsebool takes a moment or two to do its thing. Please be patient, I promise the script isn't hanging."
146+
147+
setsebool -P httpd_can_network_connect_db 1
148+
error_check 'setsebool'
149+
150+
cd /var/www/html
151+
chcon -R -t httpd_sys_rw_content_t aanval/
152+
error_check 'SELinux permission reset'
153+
154+
########################################
155+
# The background processors are vital to Aanval working properly. They're responsible for importing data to the aanval interface.
156+
#We start the Background processors now and add either a systemd or init script depending CentOS/RHEL release.
157+
158+
print_status "Starting background processors for Aanval web interface.."
159+
cd /var/www/html/aanval/apps
160+
perl idsBackground.pl -start &>> $aanval_logfile
161+
error_check 'aanval background processor initialization'
162+
163+
print_status "Adding init/systemd script for aanval background processors.."
164+
165+
#This is code to check what centOS release it is we're running on and copy either the sys V init script and include it, or the systemd script for aanval's BPUs. We do some checks to make sure the systemd/init script are in the same directory the aanval installer script is in.
166+
167+
cd $execdir
168+
release=`grep -oP '(?<!\.)[67]\.[0-9]+(\.[0-9]+)?' /etc/redhat-release | cut -d"." -f1`
169+
170+
if [[ "$release" -ge "7" ]]; then
171+
if [ -f /usr/lib/systemd/system/aanvalbpu.service ]; then
172+
print_notification "aanvalbpu.service systemd script is already installed."
173+
else
174+
print_notification "Installing aanvalbpu.service.."
175+
if [ ! -f $execdir/aanvalbpu.service ]; then
176+
print_error "The aanvalbpu.service file was not found in $execdir. Please make sure the file is there and try again."
177+
exit 1
178+
else
179+
print_good "Found aanvalbpu.service systemd script."
180+
fi
181+
cp aanvalbpu.service /usr/lib/systemd/system/aanvalbpu.service &>> $aanval_logfile
182+
chown root:root /usr/lib/systemd/system/aanvalbpu.service &>> $aanval_logfile
183+
chmod 644 /usr/lib/systemd/system/aanvalbpu.service &>> $aanval_logfile
184+
systemctl enable aanvalbpu.service &>> $aanval_logfile
185+
error_check 'Systemd service install'
186+
print_notification "aanvalbpu.service located in /lib/systemd/system/aanvalbpu.service"
187+
fi
188+
else
189+
if [ -f /etc/init.d/aanvalbpu ]; then
190+
print_notification "aanvalbpu init script already installed."
191+
else
192+
if [ ! -f $execdir/aanvalbpu ]; then
193+
print_error "The aanvalbpu file was not found in $execdir. Please make sure the file is there and try again."
194+
exit 1
195+
else
196+
print_good "Found aanvalbpu init script."
197+
fi
198+
cp aanvalbpu /etc/init.d/aanvalbpu &>> $aanval_logfile
199+
chown root:root /etc/init.d/aanvalbpu &>> $aanval_logfile
200+
chmod 700 /etc/init.d/aanvalbpu &>> $aanval_logfile
201+
chkconfig aanvalbpu --add &>> $aanval_logfile
202+
chkconfig aanvalbpu --level 345 on &>> $aanval_logfile
203+
error_check 'Init Script creation'
204+
print_notification "aanvalbpu init script located in /etc/init.d/aanvalbpu"
205+
fi
206+
fi
207+
208+
########################################
209+
#This restart is to make sure the configuration changes to httpd were performed succesfully and do not cause any problems starting/stopping the service.
210+
print_status "Restarting httpd.."
211+
service httpd restart &>> $aanval_logfile
212+
error_check 'httpd restart'
213+
214+
print_notification "The log file for this interface installation is located at: $aanval_logfile"
215+
216+
exit 0

0 commit comments

Comments
 (0)