Monday, September 29, 2008

Snort startup script for Ubuntu

Some folks just cannot write shell scripts, especially startup scripts, no matter what. They aren't just a collection of cli commands echoed into a file with a .sh extension and made executable. Ubuntu has a nice skeleton startup script that provides a good template for writing your own custom scripts. Here is one I made earlier for Snort:


#! /bin/sh
### BEGIN INIT INFO
# Provides: Snort
# Required-Start: $local_fs $remote_fs $syslog $network mysql
# Required-Stop: $local_fs $remote_fs $syslog $network mysql
# Default-Start: 2 3 4 5
# Default-Stop: S 0 1 6
# Short-Description: Init script to start the Snort daemon
# Description: Provides Snort service on startup and terminates
# on shutdown. Snort is an IDS or IPS. This script
# assumes that snort is installed in /usr/sbin and
# that it's main snort.conf file is in /etc/snort.
# The service will be started as a daemon, listening
# on eth0 and will also start quietly. If you require
# something other than this, you will have to edit
# the script accordingly.
# USE AT YOUR OWN RISK, YMMV. THIS SCRIPT COMES WITH
# ABSOLUTELY NO WARRANTY WHATSOEVER.
# License: GPLv2 see http://www.gnu.org/licenses/gpl-2.0.txt
### END INIT INFO

# Author: Nigel Houghton <nigel.houghton@sourcefire.com>

PATH=/usr/sbin:/usr/bin:/sbin:/bin
DESC="Snort service for IDS or IPS"
NAME=snort
CONFIG="/etc/snort/snort.conf"
INTERFACE="eth0"
DAEMON=/usr/sbin/$NAME
DAEMON_ARGS="-c $CONFIG -i $INTERFACE -qD"
PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/$NAME

# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 1

# Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME

# Load the VERBOSE setting and other rcS variables
[ -f /etc/default/rcS ] && . /etc/default/rcS

# Define LSB log_* functions.
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
. /lib/lsb/init-functions

#
# Function that starts the daemon/service
#
do_start()
{
# Return
# 0 if daemon has been started
# 1 if daemon was already running
# 2 if daemon could not be started
start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
|| return 1
start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
$DAEMON_ARGS \
|| return 2
}

#
# Function that stops the daemon/service
#
do_stop()
{
# Return
# 0 if daemon has been stopped
# 1 if daemon was already stopped
# 2 if daemon could not be stopped
# other if a failure occurred
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
RETVAL="$?"
[ "$RETVAL" = 2 ] && return 2
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
[ "$?" = 2 ] && return 2
# Many daemons don't delete their pidfiles when they exit.
if [ -f "$PIDFILE" ]; then
rm -f $PIDFILE
fi
return "$RETVAL"
}

#
# Function that sends a SIGHUP to the daemon/service
#
do_reload() {
start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
return 0
}

case "$1" in
start)
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
do_start
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
stop)
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
do_stop
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
restart|force-reload)
log_daemon_msg "Restarting $DESC" "$NAME"
do_stop
case "$?" in
0|1)
do_start
case "$?" in
0) log_end_msg 0 ;;
1) log_end_msg 1 ;; # Old process is still running
*) log_end_msg 1 ;; # Failed to start
esac
;;
*)
# Failed to stop
log_end_msg 1
;;
esac
;;
*)
echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2
exit 3
;;
esac

:


You may use it at your own risk :D Some things may need to be changed before it will work for your system and you should use the update-rc.d command to put the links in the right places for you after installation into /etc/init.d/.

p.s. Don't forget to chmod 0700 /etc/init.d/snortstart after you install it.

1 comment:

  1. Good one thanks a lot for the script, I have added how to use update.rc.d on my blog here :-)

    http://bullet-bala.blogspot.com/2012/01/starting-snort-on-reboot.html

    ReplyDelete

Post a Comment