hawk.init

#!/bin/bash
#                                                                     
# hawk
#	Bruteforce attacks intrusion detection protection and logging system.
#                                                                     
# chkconfig: 2345 99 17                                               
# description: [Hawk] daemon monitors various files for unsuccessfull login attempts, block the offenders and store the attack info in a database
# probe: true     
# version: 3.0.2

VERSION='3.0.2'
pidfile='/var/run/hawk.pid'
program='/var/lib/hawk/hawk.pl'
cron_program='/var/lib/hawk/bin/hawk-unblock.sh'
conf='/etc/hawk.conf'

check_status() {
	check=0;
	okcount=0;
	for i in 1 2 3 4 5; do
		if [ -f $pidfile ]; then
			if [ "$1" == 0 ]; then
				if [ -d /proc/$(cat $pidfile) ]; then
					if [ "$okcount" -gt '1' ]; then
						check=1;
						continue 6;
					fi
					let okcount++;
				fi
			else
				if [ ! -d /proc/$(cat $pidfile) ]; then
					check=1;
					continue 6;
				fi
			fi
		else
			if [ "$1" != 0 ]; then
				check=1
				continue 6
			fi
		fi
		sleep 1
	done
	if [ $check == "1" ]; then
		echo -e "OK"
	else
		echo -e "FAILED"
	fi
}

# Starting Hawk
start_program() {
	# TODO
	#	Make sure that the in_hawk exists and create it if needed
	echo -n "Checking if in_hawk exists ... "
	if ( ! iptables -t filter -L in_hawk -n >> /dev/null 2>&1 ); then
		echo -n "[ NO ] ... "
		if ( ! iptables -t filter -N in_hawk ); then
			echo "iptables -t filter -N in_hawk FAILED"
			exit 1
		fi
		if ( ! iptables -I INPUT -j in_hawk ); then
			echo "iptables -I INPUT -j in_hawk FAILED"
			exit 1
		fi
		echo "[ CREATED ]"
	else
		if ( ! iptables -t filter -F in_hawk ); then
			echo "Failed to flush the old rules from in_hawk"
		fi
		echo "[ YES ]"
	fi
	block_list=$(awk -F = '/block_list/{print $2}' $conf)
	if [ -x "$block_list" ]; then
		echo -n "Restoring the rules from $block_list ... "
		if ( ! $block_list ); then
			echo "[ FAILED ]"
		else
			echo "[ OK ]"
		fi
	fi

	if [ -x $program ]; then
		if [ "$1" == 'debug' ]; then
			$program debug
		else
			$program
	    fi
	    echo -n 'Starting Hawk: '
	  fi
	check_status 0
}

# Stop the Hawk
stop_program() {
	echo -n 'Stopping Hawk: '
	if [ -f $pidfile ]; then
		pid=`cat $pidfile`
		if [ -d /proc/$pid ]; then
	  		kill -15 $pid
		fi
	  	rm -f $pidfile
	fi
	pkill -f Hawk >> /dev/null 2>&1
	check_status 1
}

check_run() {
	if [ ! -f $pidfile ]; then
		start_program
	else
		pid=`cat $pidfile`;
	    if [ ! -d /proc/$pid ]; then
			start_program
		fi
	fi
}

# change the DB password for all hawk tools
change_hawk_pass() {
	echo "Changing Hawk password"
	newpass=$(head -n 5 /dev/urandom | md5sum |cut -c 1-12)
	#echo "New password: $newpass"
	psql -Upostgres -c "ALTER USER hawk PASSWORD '$newpass'" template1
	sed -i '/hawk/D' /root/.pgpass
	echo "*:*:hawk:hawk:$newpass" >> /root/.pgpass
	chmod 600 /root/.pgpass
	sed -i "/dbpass/s/=.*/=$newpass/" $conf

    stop_program
    sleep 1
    start_program
}

# Control structure
case "$1" in
	'start')
		start_program
	;;
	'stop')
		stop_program
	;;
	'restart')
		stop_program
		sleep 1
		start_program
	;;
	'debug')
		start_program debug
	;;
	'reload')
		kill -HUP `cat $pidfile`
	;;
	'changepass')
		change_hawk_pass
	;;
	'checkdb')
		check_db
	;;
	'status')
		echo -n 'Hawk status: '
		check_status 0
	;;
	'check_run')
		check_run
	;;
	*)
	  echo -e "usage $0 OPTION\nBasic options:\t\tstart|stop|restart|status\nAdvanced options:\tdebug|reload|changepass"
esac