Hi,
well this looks okay. If you would want to clean this up a little bit more and add some comments, I would accept it as a patch.
Here, it is not an option to call killproc without the PID file since it would kill all running instances of snort at once. We usually always do this anyway though.
-Michael
On Mon, 2017-04-24 at 13:57 +0200, Matthias Fischer wrote:
Hi,
On 24.04.2017 12:24, Michael Tremer wrote:
Hi,
yes indeed.
But is not 100% necessary to pass the -p parameter with the PID file. I just removed that when ever it got difficult to use and did not even add that for new scripts.
I noticed that. 'killproc' is used in two different ways.
'killproc -p' is only used in four init-scripts (dhcp, dhcrelay, rngd and snort). All other scripts use 'killproc [PROGRAMNAME]', sometimes 'killproc [PATH][PROGRAMNAME].
As I'm not really sure about this: which solution should we prefer?
But using $DEVICE is definitely wrong in the snort script.
Ok - but as far as I can see, this is working?
Improving this would lead to changing the complete 'start'- and 'stop'-section:
Example: ... stop) DEVICES="" if [ -r /var/run/snort_$BLUE_DEV.pid ]; then DEVICES+="$BLUE_DEV " fi if [ -r /var/run/snort_$GREEN_DEV.pid ]; then DEVICES+="$GREEN_DEV " fi
if [ -r /var/run/snort_$ORANGE_DEV.pid ]; then DEVICES+="$ORANGE_DEV " fi
RED=`cat /var/ipfire/red/iface 2>/dev/null` if [ -r /var/run/snort_$RED.pid ]; then DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null` fi
for DEVICE in $DEVICES; do boot_mesg "Stopping Intrusion Detection System on $DEVICE..." killproc -p /var/run/snort_$DEVICE.pid /var/run done ...
The whole thing began because I wanted a 'reload' section for 'snort' for use after automatic rule updates, which seems to work:
... reload) DEVICES="" if [ -r /var/run/snort_$BLUE_DEV.pid ]; then DEVICES+="$BLUE_DEV " fi
if [ -r /var/run/snort_$GREEN_DEV.pid ]; then DEVICES+="$GREEN_DEV " fi
if [ -r /var/run/snort_$ORANGE_DEV.pid ]; then DEVICES+="$ORANGE_DEV " fi
RED=`cat /var/ipfire/red/iface 2>/dev/null` if [ -r /var/run/snort_$RED.pid ]; then DEVICES+=`cat /var/ipfire/red/iface 2>/dev/null` fi
for DEVICE in $DEVICES; do boot_mesg "Reloading Intrusion Detection System on $DEVICE..." /bin/kill -SIGHUP `cat /var/run/snort_$DEVICE.pid` evaluate_retval done ;; ...
Any better solution is welcome... ;-))
Best,
Matthias
-Michael
On Sun, 2017-04-23 at 19:20 +0200, Matthias Fischer wrote:
Hi,
while searching for something else I found this:
Usage for the 'killproc'-function in '/etc/init.d/'-files should be (cited):
"# Function - killproc [-p pidfile] pathname [signal] # # Purpose: # # Inputs: -p pidfile, uses the specified pidfile # pathname, pathname to the specified program ..."
But in the 'init'-files for 'dhcp', 'dhcrelay' and 'rndg' there is the PROGRAMname and in 'snort'-file '/var/run' is given. The latter leads to an error (FAIL) if both 'green0' and 'red0' are enabled and should be both stopped:
... killproc -p /var/run/dhcpd.pid /usr/sbin/dhcpd ^^^^^^ ... killproc -p /var/run/dhcrelay.pid /usr/sbin/dhcrelay ^^^^^^^^^ ... killproc -p /var/run/rngd.pid /usr/sbin/rngd ^^^^^ ... killproc -p /var/run/snort_$DEVICE.pid /var/run ^^^^^^^^
IMHO, all these should be changed to "pathname to the specified program" as cited above ('/usr/sbin').
Can anyone please confirm?
Best, Matthias