FM / siteguardlite

/opt/jp-secure/siteguardlite

Name	Size	Mode	Actions
bak/	-	0755	rm
conf/	-	0755	rm
databases_waf/	-	0755	rm
doc/	-	0755	rm
java/	-	0755	rm
logs/	-	0755	rm
misc/	-	0755	rm
modules/	-	0755	rm
notify/	-	0777	rm
statistics/	-	0777	rm
tmp/	-	0777	rm
tomcat/	-	0755	rm
update_waf/	-	0755	rm
check_pcre	173158	0755	edit dl rm
configured.module	6	0644	edit dl rm
cromtab_tmp	0	0644	edit dl rm
dbupdate_waf	5888	0755	edit dl rm
dbupdate_waf.bak	5888	0755	edit dl rm
license_check	178688	0755	edit dl rm
Makefile	27216	0644	edit dl rm
Makefile.bak	27133	0644	edit dl rm
Makefile.vars	2359	0644	edit dl rm
Makefile.vars.bak	2353	0644	edit dl rm
Makefile.verup-config	9035	0755	edit dl rm
make_conf_log.sh	1140	0755	edit dl rm
pid.siteguardlite_notify	5	0644	edit dl rm
pid.tomcat	5	0644	edit dl rm
rc.siteguardlite_admin	6194	0755	edit dl rm
rc.siteguardlite_admin.bak	6185	0755	edit dl rm
rc.siteguardlite_notify	3495	0755	edit dl rm
rc.siteguardlite_notify.bak	3495	0755	edit dl rm
setup.sh	13318	0755	edit dl rm
set_secontext.sh	4755	0755	edit dl rm
siteguardlite_notify	344519	0755	edit dl rm
siteguardlite_statistics.sh	949	0755	edit dl rm
siteguardlite_statistics.sh.bak	949	0755	edit dl rm
statistics_collect.awk	1714	0644	edit dl rm
waf_sig_merge.pl	1111	0755	edit dl rm

Edit: /opt/jp-secure/siteguardlite/setup.sh (13318B)

#! /bin/sh
#-------------------------------------------------------
# setup.sh for SiteGuard Lite
#
# by JP-Secure
#-------------------------------------------------------

CONF1=/usr/local/apache2/conf/httpd.conf
CONF2=/etc/httpd/conf/httpd.conf
CONF3=/etc/apache2/apache2.conf
CONF4=/usr/local/etc/apache22/httpd.conf
BIN1=/usr/local/apache2/bin/httpd
BIN2=/usr/bin/httpd
BIN3=/usr/sbin/httpd
BIN4=/usr/local/bin/httpd
BIN5=/usr/sbin/apache2
BIN6=/usr/local/sbin/httpd
JRE1=/usr/java/latest/jre
JRE2=/usr/java/latest
JRE3=/usr/local/openjdk8/jre
CHECK_MODULE1=proxy_module
CHECK_MODULE2=proxy_http_module
CHECK_MODULE3=ssl_module

HTTPD1=/etc/rc.d/init.d/httpd
HTTPD2=/etc/init.d/apache2
APACHECTL=apachectl
APACHEBIN=httpd
OSNAME=""

conf_file=""
bin_file=""
bin_path=""
apache_type=""
console_port=""
java_dir=""
web_console=1
flag_remove=0

return_str=""

set_apachectl_from_makefile() {
	APACHECTL=`grep APACHECTL= ./Makefile | sed 's%APACHECTL=$.*$$%\1%'`
	APACHEBIN=`grep APACHEBIN= ./Makefile | sed 's%APACHEBIN=$.*$$%\1%'`
	OSNAME=`uname`
}

find_file() {
	for f in  $CONF1 $CONF2 $CONF3 $CONF4
	do
		if [ -f "$f" ]; then
			conf_file=$f
			break
		fi
	done
	for f in $BIN1 $BIN2 $BIN3 $BIN4 $BIN5 $BIN6
	do
		if [ -f "$f" ]; then
			bin_file=$f
			break;
		fi
	done
	for f in $JRE1 $JRE2 $JRE3
	do
		if [ -x "$f/bin/java" ]; then
			java_dir=$f
			break;
		fi
	done
}

is_configured() {
	conf_file=`grep APACHE_CONFFILE ./Makefile | awk -F = '{print $2}'`
	apache_type=`grep APACHE_TYPE ./Makefile | awk -F = '{print $2}'`
	if [ -z $conf_file ]; then
		return 0
	fi
	if [ -z $apache_type ]; then
		return 0
	fi
	cnt=`grep -c "include .*siteguardlite.conf" $conf_file`
	if [ $cnt -eq 0 ]; then
		return 0
	fi
	return 1
}

input_text() {
	answer=""
	while true; do
		echo -n "please enter $1. [$2] -->"
		answer=""
		read answer
		if [ -z $answer ]; then
			answer=$2
		fi

ANS=""
		echo "$1=[$answer]"
		echo -n "is correct? [yes]|no -->"
		read ANS
		if [ "X$ANS" = "Xn" -o "X$ANS" = "Xno" ]; then
			continue
		else
			break
		fi
	done
	return_str=$answer
}

input_numeric() {
	answer=""
	while true; do
		echo -n "please enter $1. [$2] -->"
		answer=""
		read answer
		if [ -z $answer ]; then
			answer=$2
		fi

if [ -z `echo $answer | egrep "^[0-9]+$"` ] ; then
			echo "[$answer] is not numeric."
			answer=""
			continue
		fi

ANS=""
		echo "$1=[$answer]"
		echo -n "is correct? [yes]|no -->"
		read ANS
		if [ "X$ANS" = "Xn" -o "X$ANS" = "Xno" ]; then
			continue
		else
			break
		fi
	done
	return_str=$answer
}

input_file_dir() {
	answer=""
	while true; do
		echo -n "please enter $1. [$2] -->"
		answer=""
		read answer
		if [ -z $answer ]; then
			answer=$2
		fi

input_check=0
		if [ $3 = "file" ];then
			if [ -f $answer ]; then
				input_check=1
			fi
		else
			if [ -d $answer ]; then
				input_check=1
			fi
		fi
				
		if [ $input_check -eq 1 ]; then
			ANS=""
			echo "$1=[$answer]"
			echo -n "is correct? [yes]|no -->"
			read ANS
			if [ "X$ANS" = "Xn" -o "X$ANS" = "Xno" ]; then
				continue
			else
				break
			fi
		fi
		echo "[$answer] is not exist."
		answer=""
	done
	return_str=$answer
}

input_file() {
	input_file_dir "$1" "$2" "file"
}

input_dir() {
	input_file_dir "$1" "$2" "dir"
}

get_apache_type() {
	if [ ! -x $1 ]; then
		return 1
	fi
	apache_ver=`($1 -V) 2> /dev/null | grep "Server version:" | sed -e 's/^.*Apache\/$[0-9\.]*$.*$/\1/' | awk '{print substr($0,1,3);}'`
	apache_arc=`($1 -V) 2> /dev/null | grep "Architecture:" | sed -e 's/^Architecture:[ \t]*$[0-9][0-9]$.*$/\1/'`
	if [ "X$apache_arc" != "X32" -a "X$apache_arc" != "X64" ]; then
		return 1
	fi

case $apache_ver in
		2.2 ) ver_type=1;;
		2.4 ) ver_type=2;;
		* )   ver_type=3;;
	esac

if [ $ver_type -eq 3 ]; then
		echo "Apache $apache_ver is not supported."
		echo
		exit
	fi

return_str=$apache_arc"_"$apache_ver

return 0
}

create_module_link()
{
	if [ $OSNAME = "FreeBSD" ]; then
		case $apache_type in
			32_2.2 )	ln -fs ./mod_siteguard_32_2.2_bsd.so ./modules/mod_siteguard.so >/dev/null;;
			32_2.4 )	ln -fs ./mod_siteguard_32_2.4_bsd.so ./modules/mod_siteguard.so >/dev/null;;
			64_2.2 )	ln -fs ./mod_siteguard_64_2.2_bsd.so ./modules/mod_siteguard.so >/dev/null;;
			64_2.4 )	ln -fs ./mod_siteguard_64_2.4_bsd.so ./modules/mod_siteguard.so >/dev/null;;
		esac
	else
		case $apache_type in
			32_2.0 )	ln -fs ./mod_siteguard_32_2.0.so ./modules/mod_siteguard.so >/dev/null;;
			32_2.2 )	ln -fs ./mod_siteguard_32_2.2.so ./modules/mod_siteguard.so >/dev/null;;
			32_2.4 )	ln -fs ./mod_siteguard_32_2.4.so ./modules/mod_siteguard.so >/dev/null;;
			64_2.0 )	ln -fs ./mod_siteguard_64_2.0.so ./modules/mod_siteguard.so >/dev/null;;
			64_2.2 )	ln -fs ./mod_siteguard_64_2.2.so ./modules/mod_siteguard.so >/dev/null;;
			64_2.4 )	ln -fs ./mod_siteguard_64_2.4.so ./modules/mod_siteguard.so >/dev/null;;
		esac
	fi
	if [ $? -ne 0 ]; then
		return 1
	fi
	return 0
}

del_include()
{
	cp -f $conf_file $conf_file".bak"
	if [ $? -ne 0 ]; then return 1; fi
	grep -v "include .*siteguard" $conf_file.bak > $conf_file
	sleep 1
	return 0
}

add_include()
{
	cp -f $conf_file $conf_file".bak"
	if [ $? -ne 0 ]; then return 1; fi
	echo "include `pwd`/conf/siteguardlite.conf" >> $conf_file
	if [ $web_console -eq 1 ]; then echo "include `pwd`/conf/httpd.conf.siteguardlite_admin_ssl" >> $conf_file; fi
	sleep 1
	return 0
}

set_console_proxy()
{
	tomcat_port=`cat ./conf/siteguardlite.ini | grep "svcport" | sed -e 's/^svcport=$[0-9\.]*$$/\1/'`
	allow_address=$@

cmd="s%\@CONSOLE_PORT\@%"$console_port"%;s%\@TOMCAT_PORT\@%"$tomcat_port"%;s%\@ALLOW\@"%$allow_address"%;s%\@PREFIX\@%`pwd`%;" 
	sed -e "$cmd" ./conf/httpd.conf.siteguardlite_admin_ssl-template > ./conf/httpd.conf.siteguardlite_admin_ssl
	if [ $? -ne 0 ]; then return 1; fi
	return 0
}

update_java()
{
	## enter JRE path
	jre_done=0
	while [ $jre_done -eq 0 ]; do
		## input JDK or JRE directory
		echo
		input_dir "JDK or JRE directory" $java_dir
		java_dir=$return_str

if [ ! -x "$java_dir/bin/java" ]; then
			echo "[$java_dir] is not JDK or JRE directory."
			java_dir=""
		else
			jre_version=`$java_dir/bin/java -version 2>&1 | grep " version " | awk '{print $3;}' | sed -e 's/^\"$[0-9]*$\.$[0-9]*$\..*\"$/\1 \2/' | xargs printf "1%02d%02d"`
			if [ $jre_version -lt 10108 ]; then
				echo "###ERROR: [$java_dir]/bin/java version $jre_version. 1.8 or higher is required."
				java_dir=""
			else
				jre_done=1
			fi
		fi
	done
	if [ -f "./pid.tomcat" ]; then
		./rc.siteguardlite_admin stop
		sleep 2
	fi
	rm -f ./java
	ln -sf $java_dir ./java
}

check_modules()
{
	case $apache_type in
	*_2.0) return 1 ;;
	*) ;;
	esac

for m in  $CHECK_MODULE1 $CHECK_MODULE2 $CHECK_MODULE3
	do
		$APACHECTL -M 2>&1 | grep "$m" >/dev/null 2>&1
		if [ $? -ne 0 ]; then
			echo "###ERROR: In order to use the web console, $m is required.";
			return 0;
		fi
	done

return 1;
}

set_apachectl_from_bin_file()
{
	APACHEBIN=$bin_file
	bin_path=`echo "$bin_file" | awk 'BEGIN{FS="/"}{for(i=1;i<NF;i++){printf("%s/",$i);}}'`
	APACHECTL="$bin_path"apachectl
	if ! [ -x $APACHECTL ]; then
		APACHECTL="$bin_path"apache2ctl
	fi
}

set_makefile()
{
	cp -f ./Makefile ./Makefile.bak
	if [ $? -ne 0 ]; then return 1; fi
	cmd="s%APACHE_CONFFILE=.*%APACHE_CONFFILE="$conf_file"%;s%APACHE_TYPE=.*%APACHE_TYPE="$apache_type"%;s%APACHECTL=.*%APACHECTL=$APACHECTL%;s%APACHEBIN=.*%APACHEBIN=$APACHEBIN%" 
	sed -e $cmd ./Makefile.bak > ./Makefile
	if [ $? -ne 0 ]; then return 1; fi
	return 0
}

del_makefile()
{
	cp -f ./Makefile ./Makefile.bak
	if [ $? -ne 0 ]; then return 1; fi
	cmd="s/APACHE_CONFFILE=.*/APACHE_CONFFILE=/;s/APACHE_TYPE=.*/APACHE_TYPE=/" 
	sed -e $cmd ./Makefile.bak > ./Makefile
	if [ $? -ne 0 ]; then return 1; fi
	return 0
}

set_admin_service()
{
	cp -f ./conf/siteguardlite.ini ./conf/siteguardlite.ini.bak
	if [ $? -ne 0 ]; then return 1; fi
	cmd="s%admin_service=.*%admin_service=$1%" 
	sed -e $cmd ./conf/siteguardlite.ini.bak > ./conf/siteguardlite.ini
	if [ $? -ne 0 ]; then return 1; fi
	return 0
}

set_statistics()
{
	cp -f ./conf/siteguardlite.ini ./conf/siteguardlite.ini.bak
	if [ $? -ne 0 ]; then return 1; fi
	cmd="s%statistics=.*%statistics=$1%" 
	sed -e $cmd ./conf/siteguardlite.ini.bak > ./conf/siteguardlite.ini
	if [ $? -ne 0 ]; then return 1; fi
	return 0
}

show_error()
{
	echo "-----------------------------------------------------"
	echo "+ Setup failure. please try again.                  +"
	echo "-----------------------------------------------------"
	echo
	exit
}

restart_apache()
{
	if [ $flag_remove -eq 0 ]; then
		echo
		echo -n "Apache restart. Are you sure? [yes]|no -->"
		read ANS
		if [ "X$ANS" = "Xn" -o "X$ANS" = "Xno" ]; then
			return 1
		fi
	fi
	make httpstop
	sleep 1
	if [ $flag_remove -eq 0 ]; then
		make httpstart
	else
		echo "starting apache ..."
		$APACHECTL start
	fi

return $?
}

del_sem_shm()
{
	if ls tmp/*.sem >/dev/null 2>&1; then
		for semfile in tmp/*.sem
		do
			semkey=`cat $semfile`
			ipcrm -S $semkey
			rm $semfile
		done
	fi
	if ls tmp/*.shm >/dev/null 2>&1; then
		for shmfile in tmp/*.shm
		do
			shmkey=`cat $shmfile`
			ipcrm -M $shmkey
			rm $shmfile
		done
	fi
}

remove_siteguard()
{
	flag_remove=1
	del_include
	if [ $? -ne 0 ]; then show_error; fi
	del_makefile
	if [ $? -ne 0 ]; then show_error; fi
	restart_apache
	if [ $? -ne 0 ]; then show_error; fi
	del_sem_shm
	make uninstall-statistics-cron
	echo "SiteGuard Lite setup removed."
	echo
}

#### start

if [ $# -ne 0 ]; then
	if [ "X$1" = "X--remove" ]; then
		is_configured
		if [ $? -eq 0 ]; then
			echo SiteGuard Lite is not configured.
			exit
		fi
		set_apachectl_from_makefile
		remove_siteguard
		exit
	fi
fi

echo "-----------------------------------------------------"
echo "+ SiteGuard Lite setup start...                     +"
echo "-----------------------------------------------------"
echo

if [ $(id -u) -ne 0 ]; then
	echo "You should be root for setup."
	show_error
fi

set_apachectl_from_makefile

is_configured
if [ $? -ne 0 ]; then
	echo "SiteGuard Lite is already setup."
	echo "Apache Config File: $conf_file"
	echo "Apache Type: $apache_type"
	echo -n "please select. q:quit [s:setup] r:remove -->"
	ANS=""
	read ANS
	if [ "X$ANS" = "Xq" ]; then
		exit
	fi
	if [ "X$ANS" = "Xr" ]; then
		ANS=""
		echo -n "remove SiteGuard Lite setup. Are you sure? yes|[no] -->"
		read ANS
		if [ "X$ANS" = "Xy" -o "X$ANS" = "Xyes" ]; then
			remove_siteguard
		fi
		exit
	fi
fi

## pre search file
find_file

## enter apache config file path
echo
input_file "Apache Config File" $conf_file
conf_file=$return_str

type_done=0
while [ $type_done -eq 0 ]; do
	## input apache binary file path
	echo
	input_file "Apache Binary File (httpd)" $bin_file
	bin_file=$return_str

## gete apache type
	get_apache_type $bin_file
	ret=$?
	if [ $ret -eq 1 ]; then
		echo "[$bin_file] is not Apache Binary File."
		bin_file=""
	else
		type_done=1
		apache_type=$return_str
	fi
done

set_apachectl_from_bin_file

## create module sym link
create_module_link
if [ $? -ne 0 ]; then show_error; fi

## switch web console setup
while true; do
	echo
	echo "do you want to use the web administrative console?"
	echo "* to use the console, you will need JDK or JRE is installed."
	echo -n "please select. [yes]|no -->"
	read ANS
	if [ "X$ANS" = "Xn" -o "X$ANS" = "Xno" ]; then
		if [ -f "./pid.tomcat" ]; then
			./rc.siteguardlite_admin stop
		fi
		set_admin_service "no"
		web_console=0
		break
	else
		check_modules
		if [ $? -eq 0 ]; then
			continue;
		fi
		update_java
		if [ $? -ne 0 ]; then 
			continue; 
		else
			set_admin_service "yes"
			web_console=1
			break;
		fi
		if [ $OSNAME = "Linux" ]; then
			glibc_ver=`misc/get_glibcver | sed 's/glibc $[0-9]*$\.$[0-9]*$[. ].*$/\1 \2/' | xargs printf "1%02d%02d"`
			if [ "$glibc_ver" -lt 10204 ]; then
				echo
				echo "###ERROR: In order to use the web console, glibc 2.4 or higher is required.";
			else
				set_admin_service "yes"
				web_console=1
				break
			fi
		fi
	fi
done

## access control
if [ $web_console -eq 1 ]; then
	set_statistics "yes"
	make install-statistics-cron
	echo
	echo "please enter the port number of the web console for https."
	input_numeric "port number" "9443"
	console_port=$return_str

echo
	echo "please enter the addresses allowed to access the web console for https."
	echo "ex:192.168.1. 10.0.0.0/24"
	input_text "allowed addresses" "ALL"
	allow_address=$return_str
	set_console_proxy $allow_address
else
	set_statistics "no"
	make uninstall-statistics-cron
fi

## add include at httpd.conf
del_include
if [ $? -ne 0 ]; then show_error; fi
add_include
if [ $? -ne 0 ]; then show_error; fi
echo update httpd.conf done.

## update Makefile 
set_makefile
if [ $? -ne 0 ]; then show_error; fi
echo update Makefile done.
 
## start web console and notify service
make start
		
restart_apache
if [ $? -ne 0 ]; then
	echo apache restart failure. please restart apache.
else
	echo apache restart done.
fi

echo "-----------------------------------------------------"
echo "+ finished SiteGuard Lite setup                     +"
echo "-----------------------------------------------------"
if [ $web_console -eq 1 ]; then
	echo "  Please access following URL for starting service."
	echo "  https://`hostname`:"$console_port"/"
	echo "  (default user:admin, default password:admin) "
fi
echo

cmd: