12f50a5fb4
Removed not neeeded fies and service files as sshguard can now parse journal files /etc/sysconfig/sshgaurd is not used any more as sshguard uses it's own config file OBS-URL: https://build.opensuse.org/request/show/672113 OBS-URL: https://build.opensuse.org/package/show/security/sshguard?expand=0&rev=34
116 lines
2.7 KiB
Bash
116 lines
2.7 KiB
Bash
#!/bin/sh
|
|
#
|
|
### BEGIN INIT INFO
|
|
# Provides: sshguard
|
|
# Required-Start: $syslog $remote_fs
|
|
# Should-Start:
|
|
# Required-Stop: $syslog $remote_fs
|
|
# Should-Stop:
|
|
# Default-Start: 3 5
|
|
# Default-Stop: 0 1 2 6
|
|
# Short-Description: SSHGUARD provides automatic attack blocking
|
|
# Description: Start SSHGUARD to protect certain services
|
|
# from brute force attacks noticed in system logging
|
|
### END INIT INFO
|
|
|
|
SSHGUARD_BIN=/usr/sbin/sshguard
|
|
test -x $SSHGUARD_BIN || { echo "$SSHGUARD_BIN not installed";
|
|
if [ "$1" = "stop" ]; then exit 0;
|
|
else exit 5; fi; }
|
|
test -x /usr/sbin/iptables || { echo "iptables not installed";
|
|
if [ "$1" = "stop" ]; then exit 0;
|
|
else exit 5; fi; }
|
|
|
|
# Check for existence of needed config file and read it
|
|
SSHGUARD_CONFIG=/etc/sshguard.conf
|
|
test -r $SSHGUARD_CONFIG || { echo "$SSHGUARD_CONFIG not existing";
|
|
if [ "$1" = "stop" ]; then exit 0;
|
|
else exit 6; fi; }
|
|
|
|
# Read config
|
|
. $SSHGUARD_CONFIG
|
|
|
|
# setup commandline as required
|
|
setup_cmdline() {
|
|
cmdline=""
|
|
if [ "$1" != "stop" ]; then
|
|
|
|
test -n $THRESHOLD && cmdline="$cmdline -a $THRESHOLD"
|
|
test -n $BLOCK_TIME && cmdline="$cmdline -p $BLOCK_TIME"
|
|
test -n $DETECTION_TIME && cmdline="$cmdline -s $DETECTION_TIME"
|
|
test -n "$WHITELIST_FILE" && cmdline="$cmdline -w $WHITELIST_FILE"
|
|
test -n "$BLACKLIST_FILE" && cmdline="$cmdline -b $BLACKLIST_FILE"
|
|
}
|
|
|
|
iptables_start() {
|
|
/usr/sbin/iptables -N sshguard
|
|
/usr/sbin/ip6tables -N sshguard
|
|
}
|
|
|
|
iptables_stop() {
|
|
/usr/sbin/iptables -F sshguard
|
|
/usr/sbin/ip6tables -F sshguard
|
|
/usr/sbin/iptables -X sshguard
|
|
/usr/sbin/ip6tables -X sshguard
|
|
}
|
|
|
|
. /etc/rc.status
|
|
|
|
# Reset status of this service
|
|
rc_reset
|
|
case "$1" in
|
|
start)
|
|
echo -n "Starting SSHGUARD "
|
|
iptables_start
|
|
setup_cmdline
|
|
/sbin/startproc -q $SSHGUARD_BIN $cmdline
|
|
rc_status -v
|
|
;;
|
|
stop)
|
|
echo -n "Shutting down SSHGUARD "
|
|
/sbin/killproc -q -TERM $SSHGUARD_BIN
|
|
iptables_stop
|
|
rc_status -v
|
|
;;
|
|
try-restart|condrestart)
|
|
if test "$1" = "condrestart"; then
|
|
echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
|
|
fi
|
|
$0 status
|
|
if test $? = 0; then
|
|
$0 restart
|
|
else
|
|
rc_reset # Not running is not a failure.
|
|
fi
|
|
rc_status
|
|
;;
|
|
restart)
|
|
$0 stop
|
|
$0 start
|
|
rc_status
|
|
;;
|
|
force-reload)
|
|
echo -n "Reload service SSHGUARD "
|
|
$0 try-restart
|
|
rc_status
|
|
;;
|
|
reload)
|
|
echo -n "Reload service SSHGUARD "
|
|
rc_failed 3
|
|
rc_status -v
|
|
;;
|
|
status)
|
|
echo -n "Checking for service SSHGUARD "
|
|
/sbin/checkproc $SSHGUARD_BIN
|
|
rc_status -v
|
|
;;
|
|
probe)
|
|
test $SSHGUARD_CONFIG -nt /var/run/sshguard.pid && echo reload
|
|
;;
|
|
*)
|
|
echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
|
|
exit 1
|
|
;;
|
|
esac
|
|
rc_exit
|