#!/bin/bash
#
# Starts / Stops snort
#
# Source function library.
. /etc/init.d/functions
[ -f /usr/local/bin/snort ] || exit 0
[ -f /usr/local/etc/snort/snort.conf ] || exit 0
# Option
SNORT_OPTIONS="-Dd -A full -u snort -g snort -c /usr/local/etc/snort/snort.conf -i eth0 -l /var/log/snort"
RETVAL=0
umask 077
start() {
echo -n $"Starting snort: "
daemon /usr/local/bin/snort $SNORT_OPTIONS
RETVAL=$?
echo
return $RETVAL
}
stop() {
echo -n $"Shutting down snort: "
killproc snort
RETVAL=$?
echo
return $RETVAL
}
logrotate() {
export LANG=C;
DATESTR=`/bin/date +%b%d%Y-%H:%M`
# send an alert email using snort_stat.pl
/usr/local/etc/snort/snort_stat.pl -r /var/log/snort/alert | /usr/lib/sendmail "e-mail address"
/usr/local/etc/snort/snort_stat.pl -r /var/log/snort/alert | /usr/lib/sendmail "e-mail address"
# rotate alert log
/bin/mv /var/log/snort/alert /var/log/snort/backup/alert-${DATESTR}
/bin/chown snort.snort /var/log/snort/backup/alert-${DATESTR}.gz
/bin/chmod 0440 /var/log/snort/backup/alert-${DATESTR}.gz
/bin/gzip /var/log/snort/backup/alert-${DATESTR}
# rotate scan.log
/bin/mv /var/log/snort/scan.log /var/log/snort/backup/scanlog-${DATESTR}
/bin/chown snort.snort /var/log/snort/backup/scanlog-${DATESTR}.gz
/bin/chmod 0440 /var/log/snort/backup/scanlog-${DATESTR}.gz
/bin/gzip /var/log/snort/backup/scanlog-${DATESTR}
}
# この一連の処理で通知ならびにログのローテーションを行う
# 欠点はログサイズが大きくなるとsnortが起動していない時間が長くなる。
restart() {
stop
logrotate
start
}
case "$1" in
start)
start
;;
stop)
stop
;;
restart|reload)
restart
;;
*)
echo $"Usage: $0 {start|stop|restart}"
exit 1
esac
exit $?
|