From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCHv2] convert-snort: Check and convert snort user and group.
Date: Fri, 03 Jan 2020 17:00:40 +0000
Message-ID: <DA7A7C3C-0262-46C7-A6E4-919DD1E4A04C@ipfire.org>
In-Reply-To: <20200103101653.2822-1-stefan.schantl@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============3143808813729337900=="
List-Id: <development.lists.ipfire.org>

--===============3143808813729337900==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

> On 3 Jan 2020, at 10:16, Stefan Schantl <stefan.schantl(a)ipfire.org> wrote:
>=20
> Fixes #12102.
>=20
> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
> ---
> config/suricata/convert-snort | 59 ++++++++++++++++++++++++++++-------
> 1 file changed, 47 insertions(+), 12 deletions(-)
>=20
> diff --git a/config/suricata/convert-snort b/config/suricata/convert-snort
> index 64b6e8b6a..ee52548e9 100644
> --- a/config/suricata/convert-snort
> +++ b/config/suricata/convert-snort
> @@ -34,7 +34,42 @@ my $snort_config_file =3D "/etc/snort/snort.conf";
> my $snort_rules_tarball =3D "/var/tmp/snortrules.tar.gz";
>=20
> #
> -## Step 1: Setup directory and file layout, if not present and set correct
> +## Step 1: Convert snort user and group to suricata if exist.
> +#
> +
> +# Check if the snort user exists.
> +if (getpwnam("snort")) {
> +	# Change username.
> +	my @command =3D (
> +		'/usr/sbin/usermod',
> +		'-l', 'suricata', 'snort'
> +	);
> +
> +	system(@command) =3D=3D 0 or die "Could not change username: @command fai=
led: $?\n";
> +
> +	# Adjust home directory.
> +	@command =3D (
> +		'/usr/sbin/usermod',
> +		'-d', "/var/log/suricata",
> +		'suricata'
> +	);
> +
> +	system(@command) =3D=3D 0 or die "Failed to adjust home directory: @comma=
nd failed: $?\n";
> +}
> +
> +# Check if the snort group exists.
> +if (getgrnam("snort")) {
> +	# Change groupname
> +	my @command =3D (
> +		'/usr/sbin/groupmod',
> +		'-n', 'suricata', 'snort'
> +	);
> +
> +	system(@command) =3D=3D 0 or die "Could not rename groupname: @command fa=
iled: $?\n";
> +}
> +
> +#
> +## Step 2: Setup directory and file layout, if not present and set correct
> ##         ownership. The converter runs as a privileged user, but the files
> ##         needs to be full access-able by the WUI user and group (nobody:n=
obody).
> #
> @@ -71,7 +106,7 @@ if (-z "$snort_settings_file") {
> }
>=20
> #
> -## Step 2: Import snort settings and convert to the required format for th=
e new IDS
> +## Step 3: Import snort settings and convert to the required format for th=
e new IDS
> ##         (suricata).
> #
>=20
> @@ -135,7 +170,7 @@ if($snortsettings{"OINKCODE"}) {
> }
>=20
> #
> -## Step 3: Import guardian settings and whitelist if the addon is installe=
d.
> +## Step 4: Import guardian settings and whitelist if the addon is installe=
d.
> #
>=20
> # Pakfire meta file for owncloud.
> @@ -183,7 +218,7 @@ if (-f $guardian_meta) {
> }
>=20
> #
> -## Step 4: Save IDS and rules settings.
> +## Step 5: Save IDS and rules settings.
> #
>=20
> # Write IDS settings.
> @@ -193,7 +228,7 @@ if (-f $guardian_meta) {
> &General::writehash("$IDS::rules_settings_file", \%rulessettings);
>=20
> #
> -## Step 5: Generate and write the file to modify the ruleset.
> +## Step 6: Generate and write the file to modify the ruleset.
> #
>=20
> # Call subfunction and pass the desired IDS action.
> @@ -203,7 +238,7 @@ if (-f $guardian_meta) {
> &IDS::set_ownership("$IDS::modify_sids_file");
>=20
> #
> -## Step 6: Move rulestarball to its new location.
> +## Step 7: Move rulestarball to its new location.
> #
>=20
> # Check if a rulestarball has been downloaded yet.
> @@ -230,7 +265,7 @@ if (-f $snort_rules_tarball) {
> }
>=20
> #
> -## Step 7: Call oinkmaster to extract and setup the rules structures.
> +## Step 8: Call oinkmaster to extract and setup the rules structures.
> #
>=20
> # Check if a rulestarball is present.
> @@ -243,7 +278,7 @@ if (-f $IDS::rulestarball) {
> }
>=20
> #
> -## Step 8: Generate file for the HOME Net.
> +## Step 9: Generate file for the HOME Net.
> #
>=20
> # Call subfunction to generate the file.
> @@ -253,7 +288,7 @@ if (-f $IDS::rulestarball) {
> &IDS::set_ownership("$IDS::homenet_file");
>=20
> #
> -## Step 9: Generate file for the DNS servers.
> +## Step 10: Generate file for the DNS servers.
> #
>=20
> # Call subfunction to generate the file.
> @@ -263,7 +298,7 @@ if (-f $IDS::rulestarball) {
> &IDS::set_ownership("$IDS::dns_servers_file");
>=20
> #
> -## Step 10: Setup automatic ruleset updates.
> +## Step 11: Setup automatic ruleset updates.
> #
>=20
> # Check if a ruleset is configured.
> @@ -273,7 +308,7 @@ if($rulessettings{"RULES"}) {
> }
>=20
> #
> -## Step 11: Grab used ruleset files from snort config file and convert
> +## Step 12: Grab used ruleset files from snort config file and convert
> ##         them into the new format.
> #
>=20
> @@ -319,7 +354,7 @@ close(SNORTCONF);
> &IDS::write_used_rulefiles_file(@enabled_rule_files);
>=20
> #
> -## Step 12: Start the IDS if enabled.
> +## Step 13: Start the IDS if enabled.
> #
>=20
> # Check if the IDS should be started.
> --=20
> 2.25.0.rc0
>=20


--===============3143808813729337900==--