Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit bb7d681

Browse files
coderdbacoderdba
authored
Create auditbeat_exadata.sh
1 parent 003b082 commit bb7d681

File tree

1 file changed

+266
-0
lines changed

1 file changed

+266
-0
lines changed

‎exadata/auditbeat/auditbeat_exadata.sh‎

Lines changed: 266 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,266 @@
1+
#
2+
#
3+
# auditbeat_exadata.sh
4+
#
5+
#
6+
7+
if [ $# -lt 2 ]
8+
then
9+
10+
echo
11+
echo Usage: $0 , appName , install or establish or install_and_establish or auditd_non_immutable
12+
echo
13+
14+
exit 1
15+
16+
fi
17+
18+
script=$0
19+
app=$1
20+
action=$2
21+
22+
if [ "$app" == "abc" ]
23+
then
24+
ymlfile=auditbeat.yml.exadata-abc
25+
else
26+
ymlfile=auditbeat.yml.exadata-non-abc
27+
fi
28+
29+
datetime=`date +%Y%m%d_%H%M%S`
30+
auditbeatyml=/etc/auditbeat/auditbeat.yml
31+
cksum_auditbeatyml=`cksum $auditbeatyml | awk '{print $1}'`
32+
cksum_ymlfile=`cksum $ymlfile | awk '{print $1}'`
33+
34+
check_error()
35+
{
36+
37+
if [ $retcode -ne 0 ]
38+
then
39+
40+
echo ERR - Error in the last operation
41+
exit
42+
43+
fi
44+
45+
}
46+
47+
install_auditbeat()
48+
{
49+
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
50+
# INSTALL AUDITBEAT AND COPY CORRECT YML
51+
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
52+
53+
if !(rpm -qa | grep auditbeat) > /dev/null
54+
then
55+
56+
echo
57+
echo INFO - Install auditbeat rpm
58+
rpm -Uvh auditbeat-6.2.4-x86_64.rpm
59+
retcode=$?
60+
check_error retcode
61+
62+
else
63+
64+
echo
65+
echo INFO - Auditbeat rpm already installed
66+
rpm -qa | grep auditbeat
67+
68+
fi
69+
70+
echo
71+
echo INFO - Verify
72+
rpm -qa|grep auditb
73+
which auditbeat
74+
75+
76+
if [ "$cksum_auditbeatyml" != "$cksum_ymlfile" ]
77+
then
78+
79+
echo
80+
echo INFO - Backup current auditbeat.yml
81+
/bin/cp -p ${auditbeatyml} ${auditbeatyml}.${datetime}
82+
83+
echo
84+
echo INFO - Copy the correct/new auditbeat.yml
85+
cp $ymlfile /etc/auditbeat/auditbeat.yml
86+
retcode=$?
87+
check_error retcode
88+
89+
else
90+
91+
echo
92+
echo INFO - Current $auditbeatyml is same as $ymlfile. No need to replace it.
93+
echo
94+
95+
fi
96+
97+
}
98+
99+
100+
configure_auditd_non_immutable()
101+
{
102+
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
103+
# Comment out "-e 2" immutable setting in /etc/auit/audit.rules
104+
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
105+
audit_rules_file=/etc/audit/audit.rules
106+
107+
if (grep "^\-e 2" $audit_rules_file) > /dev/null
108+
then
109+
110+
echo
111+
echo INFO - $audit_rules_file is immutable - need to make it non-immutable
112+
echo
113+
114+
echo INFO - Backing up current audit.rules file
115+
cp $audit_rules_file ${audit_rules_file}.${datetime}
116+
117+
echo INFO - making $audit_rules_file writeable by root using chattr
118+
echo
119+
chattr -i $audit_rules_file
120+
121+
echo
122+
echo INFO - Making audit.rules file non-immutable
123+
sed -e '/\-e 2$/ s/^#*/#/' -i ${audit_rules_file}
124+
125+
echo INFO - making $audit_rules_file non-writeable by root using chattr
126+
echo
127+
chattr +i $audit_rules_file
128+
129+
echo
130+
echo INFO - Verify - no results means good
131+
echo
132+
133+
if (grep "^\-e 2" $audit_rules_file)
134+
then
135+
echo INFO - Last operation not successful
136+
exit
137+
138+
else
139+
140+
echo
141+
echo INFO - Restarting auditd - NOTE - if it says anything about 'immutable' - note it down - it may then need machine restart
142+
echo
143+
service auditd restart
144+
echo
145+
146+
fi
147+
148+
else
149+
150+
echo INFO - $audit_rules_file already is non-immutable
151+
152+
fi
153+
154+
}
155+
156+
replace_auditd_start_auditbeat()
157+
{
158+
159+
echo
160+
echo INFO - Stopping auditd
161+
service auditd stop
162+
retcode=$?
163+
echo retcode = $retcode
164+
check_error retcode
165+
166+
echo
167+
echo INFO - Verify
168+
service auditd status
169+
170+
echo
171+
echo INFO - Disable auditd from starting
172+
chkconfig auditd off
173+
retcode=$?
174+
check_error retcode
175+
176+
echo
177+
echo INFO - Verify
178+
chkconfig --list auditd
179+
180+
echo
181+
echo INFO - Add auditbeat to auto-start
182+
chkconfig --add auditbeat
183+
retcode=$?
184+
check_error retcode
185+
186+
echo
187+
echo INFO - Verify
188+
chkconfig --list auditbeat
189+
190+
echo
191+
echo INFO - Start auditbeat service
192+
service auditbeat start
193+
retcode=$?
194+
check_error retcode
195+
196+
echo
197+
echo INFO - Verify
198+
service auditbeat status
199+
200+
echo
201+
echo ------------------------------
202+
echo INFO - Verify remote-server connection established using netstat -anp
203+
sleep 15
204+
netstat -anp |grep auditbeat
205+
retcode=$?
206+
check_error retcode
207+
208+
}
209+
210+
if [ "$action" == "install" ]
211+
then
212+
213+
echo
214+
echo INFO - THIS WILL ONLY INSTALL AUDITBEAT AND COPY THE CORRECT YML
215+
echo
216+
217+
install_auditbeat
218+
configure_auditd_non_immutable
219+
220+
elif [ "$action" == "establish" ]
221+
then
222+
223+
echo
224+
echo INFO - THIS WILL STOP AUDITD AND START AUDITBEAT
225+
echo
226+
echo Prerequiste 1 - AUDITBEAT ALREADY INSTALLED
227+
echo
228+
echo Prerequiste 2 - AUDITD RULES IN NON-IMMUTABLE STATE
229+
echo
230+
231+
echo INFO - Checking if auditbeat is installed
232+
if !(rpm -qa | grep auditbeat) > /dev/null
233+
then
234+
235+
echo
236+
echo ERR - Auditbeat rpm is not installed. Run this program with 'install' option first
237+
echo
238+
239+
exit 1
240+
241+
fi
242+
243+
replace_auditd_start_auditbeat
244+
245+
elif [ "$action" == "install_and_establish" ]
246+
then
247+
248+
install_auditbeat
249+
configure_auditd_non_immutable
250+
replace_auditd_start_auditbeat
251+
252+
elif [ "$action" == "auditd_non_immutable" ]
253+
then
254+
255+
echo
256+
echo INFO - THIS WILL MAKE AUDITD NON-IMMUTABLE
257+
echo
258+
259+
configure_auditd_non_immutable
260+
261+
262+
fi
263+
264+
echo
265+
echo INFO - Completing program and exiting
266+
echo

0 commit comments

Comments
 (0)