p0f.init

   1 #!/bin/sh
   2 # p0f           This shell script takes care of starting and stopping
   3 #               the p0f monitoring program
   4 #
   5 # chkconfig:    2345 52 48
   6 #
   7 # description:  p0f - the p0f monitoring program. \
   8 #               p0f performs passive OS fingerprinting technique bases on \
   9 #               information coming from remote host when it establishes \
  10 #               connection to our system. Captured packets contains enough \
  11 #               information to determine OS - and, unlike active scanners \
  12 #               (nmap, queSO) - without sending anything to this host.
  13 #
  14 # processname:  p0f
  15 # pidfile:      /var/run/p0f.pid
  16
  17 # Source function library.
  18 . /etc/rc.d/init.d/functions
  19
  20 # Get network config
  21 . /etc/sysconfig/network
  22
  23 # Get service config
  24 [ -f /etc/sysconfig/p0f ] && . /etc/sysconfig/p0f
  25
  26 # Check that networking is up.
  27 if is_yes "${NETWORKING}"; then
  28         if [ ! -f /var/lock/subsys/network ]; then
  29                 msg_network_down p0f
  30                 exit 1
  31         fi
  32 else
  33         exit 0
  34 fi
  35
  36 RETVAL=0
  37 # See how we were called.
  38 case "$1" in
  39   start)
  40         # Check if the service is already running?
  41         if [ ! -f /var/lock/subsys/p0f ]; then
  42                 msg_starting "p0f"
  43                 # The command in backticks returns all the local IP addresses on this machine.
  44                 for OneIP in `/sbin/ip -f inet addr show | awk '/inet/{print $2}' | awk -F/ '{print $1}' | LC_ALL=C sort -u`; do
  45                         if [ -z "$BpfFilter" ]; then
  46                                 BpfFilter="not src host $OneIP"
  47                         else
  48                                 BpfFilter="$BpfFilter and not src host $OneIP"
  49                         fi
  50                 done
  51                 RULE="$BpfFilter"
  52                 if [ -n "$P0F_RULE" ]; then
  53                         if [ -n "$RULE" ]; then
  54                                 RULE="$RULE and $P0F_RULE"
  55                         else
  56                                 RULE="$P0F_RULE"
  57                         fi
  58                 fi
  59                 OPTIONS=""
  60                 if [ -n "$P0F_INTERFACE" ]; then
  61                         OPTIONS="$OPTIONS -i $P0F_INTERFACE"
  62                 fi
  63                 if [ -n "$P0F_SOCKET" ]; then
  64                         # read the manual first and then ask why the umask
  65                         umask 007
  66                         OPTIONS="$OPTIONS -s $P0F_SOCKET"
  67                 fi
  68                 if [ -n "$P0F_USER" ]; then
  69                         OPTIONS="$OPTIONS -u $P0F_USER"
  70                 fi
  71                 # Start up p0f and filter out all packets originating from any of this machines IP's.
  72                 /usr/sbin/p0f $OPTIONS $P0F_OPTIONS "$RULE" -d -o /var/log/p0f 2>/dev/null
  73                 RETVAL=$?
  74                 if [ $RETVAL -eq 0 ]; then
  75                         # this is secure, as socket is always created with current umask and root
  76                         if [ "$P0F_USER" ] && [ "$P0F_SOCKET" ]; then
  77                                 chown ${P0F_USER}: $P0F_SOCKET
  78                         fi
  79                         touch /var/lock/subsys/p0f
  80                         ok;
  81                 else
  82                         fail;
  83                 fi
  84         else
  85                 msg_already_running "p0f"
  86         fi
  87         ;;
  88   stop)
  89         if [ -f /var/lock/subsys/p0f ]; then
  90                 msg_stopping "p0f"
  91                 killproc p0f
  92                 rm -f /var/lock/subsys/p0f >/dev/null 2>&1
  93         else
  94                 msg_not_running "p0f"
  95         fi
  96         ;;
  97   restart|force-reload)
  98         $0 stop
  99         $0 start
 100         exit $?
 101         ;;
 102   status)
 103         status p0f
 104         exit $?
 105         ;;
 106   *)
 107         msg_usage "$0 {start|stop|restart|force-reload|status}"
 108         exit 3
 109 esac
 110
 111 exit $RETVAL