Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:centos:6:sec:l108 [2023/06/12 14:28] – admin | elearning:workbooks:centos:6:sec:l108 [2024/04/26 09:28] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | Version : **2021.01** | + | Version : **2024.01** |
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| Ligne 69: | Ligne 69: | ||
| < | < | ||
| - | [root@centos7 ~]# wget http://ftp.tu-chemnitz.de/ | + | [root@centos7 ~]# wget https://www.dropbox.com/scl/fi/e55p8pmn5sbo4uflddpue/ |
| </ | </ | ||
| Ligne 461: | Ligne 461: | ||
| </ | </ | ||
| - | Téléchargez le script **openvas-nvt-sync** : | + | Téléchargez le script **greenbone-nvt-sync** : |
| < | < | ||
| - | [root@centos7 ~]# wget https:// | + | [root@centos7 ~]# wget https:// |
| + | |||
| + | [root@centos7 ~]# mv greenbone-nvt-sync? | ||
| </ | </ | ||
| - | <file> | + | Si vous ne pouvez pas téléchargez le script **greenbone-nvt-sync**, |
| + | |||
| + | <code> | ||
| + | [root@centos7 ~]# vi greenbone-nvt-sync | ||
| + | [root@centos7 ~]# cat greenbone-nvt-sync | ||
| #!/bin/sh | #!/bin/sh | ||
| # Copyright (C) 2009-2021 Greenbone Networks GmbH | # Copyright (C) 2009-2021 Greenbone Networks GmbH | ||
| Ligne 1061: | Ligne 1067: | ||
| exit 0 | exit 0 | ||
| - | </file> | + | </code> |
| Rendez le script exécutable : | Rendez le script exécutable : | ||
| Ligne 1337: | Ligne 1342: | ||
| < | < | ||
| - | [root@centos7 ~]# wget https:// | + | [root@centos7 ~]# wget https:// |
| + | [root@centos7 ~]# mv greenbone-nvt-sync? | ||
| + | </ | ||
| + | |||
| + | Si vous ne pouvez pas téléchargez le script **greenbone-feed-sync**, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# vi greenbone-feed-sync | ||
| + | [root@centos7 ~]# cat greenbone-feed-sync | ||
| + | #!/bin/sh | ||
| + | # Copyright (C) 2011-2020 Greenbone Networks GmbH | ||
| + | # | ||
| + | # SPDX-License-Identifier: | ||
| + | # | ||
| + | # This program is free software: you can redistribute it and/or modify | ||
| + | # it under the terms of the GNU Affero General Public License as | ||
| + | # published by the Free Software Foundation, either version 3 of the | ||
| + | # License, or (at your option) any later version. | ||
| + | # | ||
| + | # This program is distributed in the hope that it will be useful, | ||
| + | # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| + | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. | ||
| + | # GNU Affero General Public License for more details. | ||
| + | # | ||
| + | # You should have received a copy of the GNU Affero General Public License | ||
| + | # along with this program. | ||
| + | |||
| + | # This script synchronizes a GVM installation with the | ||
| + | # feed data from either the Greenbone Security Feed (in | ||
| + | # case a GSF access key is present) or else from the Greenbone | ||
| + | # Community Feed. | ||
| + | |||
| + | log_notice () { | ||
| + | $LOG_CMD -p daemon.notice " | ||
| + | } | ||
| + | |||
| + | |||
| + | ########## SETTINGS | ||
| + | ########## ======== | ||
| + | |||
| + | # PRIVATE_SUBDIR defines a subdirectory of the feed data directory | ||
| + | # where files not part of the feed or database will not be deleted by rsync. | ||
| + | if [ -z " | ||
| + | then | ||
| + | PRIVATE_SUBDIR=" | ||
| + | fi | ||
| + | |||
| + | # RSYNC_DELETE controls whether files which are not part of the repository will | ||
| + | # be removed from the local directory after synchronization. The default value | ||
| + | # for this setting is | ||
| + | # " | ||
| + | # which means that files which are not part of the feed, feed info or private | ||
| + | # directory will be deleted. | ||
| + | RSYNC_DELETE=" | ||
| + | |||
| + | # RSYNC_SSH_OPTS contains options which should be passed to ssh for the rsync | ||
| + | # connection to the repository. | ||
| + | RSYNC_SSH_OPTS=" | ||
| + | |||
| + | # RSYNC_COMPRESS specifies the compression level to use for the rsync connection. | ||
| + | RSYNC_COMPRESS=" | ||
| + | |||
| + | # PORT controls the outgoing TCP port for updates. If PAT/ | ||
| + | # not used, this should be " | ||
| + | # the value 22 (Standard SSH) is useful. Only change if you know what you are | ||
| + | # doing. | ||
| + | PORT=24 | ||
| + | |||
| + | # SCRIPT_NAME is the name the scripts will use to identify itself and to mark | ||
| + | # log messages. | ||
| + | SCRIPT_NAME=" | ||
| + | |||
| + | # LOG_CMD defines the command to use for logging. To have logger log to stderr | ||
| + | # as well as syslog, add " | ||
| + | LOG_CMD=" | ||
| + | |||
| + | # LOCK_FILE is the name of the file used to lock the feed during sync or update. | ||
| + | if [ -z " | ||
| + | then | ||
| + | LOCK_FILE=" | ||
| + | fi | ||
| + | |||
| + | |||
| + | ########## GLOBAL VARIABLES | ||
| + | ########## ================ | ||
| + | |||
| + | VERSION=@GVMD_VERSION@ | ||
| + | |||
| + | [ -r " | ||
| + | |||
| + | if [ -z " | ||
| + | DROP_USER=" | ||
| + | fi | ||
| + | |||
| + | ACCESSKEY=" | ||
| + | |||
| + | # Note when running as root or restart as $DROP_USER if defined | ||
| + | if [ $(id -u) -eq 0 ] | ||
| + | then | ||
| + | if [ -z " | ||
| + | then | ||
| + | log_notice " | ||
| + | else | ||
| + | log_notice " | ||
| + | su --shell /bin/sh --command "$0 $*" " | ||
| + | exit $? | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | # Determine whether a GSF access key is present. If yes, | ||
| + | # then use the Greenbone Security Feed. Else use the | ||
| + | # Greenbone Community Feed. | ||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | RESTRICTED=1 | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_VENDOR=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_HOME=" | ||
| + | fi | ||
| + | |||
| + | else | ||
| + | RESTRICTED=0 | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_VENDOR=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_HOME=" | ||
| + | fi | ||
| + | |||
| + | fi | ||
| + | |||
| + | RSYNC=`command -v rsync` | ||
| + | |||
| + | # Current supported feed types (for --type parameter) | ||
| + | FEED_TYPES_SUPPORTED=" | ||
| + | |||
| + | ########## FUNCTIONS | ||
| + | ########## ========= | ||
| + | |||
| + | log_debug () { | ||
| + | $LOG_CMD -p daemon.debug " | ||
| + | } | ||
| + | |||
| + | log_info () { | ||
| + | $LOG_CMD -p daemon.info " | ||
| + | } | ||
| + | |||
| + | log_warning () { | ||
| + | $LOG_CMD -p daemon.warning " | ||
| + | } | ||
| + | |||
| + | log_err () { | ||
| + | $LOG_CMD -p daemon.err " | ||
| + | } | ||
| + | |||
| + | init_feed_type () { | ||
| + | if [ -z " | ||
| + | then | ||
| + | echo "No feed type given to --type parameter" | ||
| + | log_err "No feed type given to --type parameter" | ||
| + | exit 1 | ||
| + | elif [ " | ||
| + | then | ||
| + | [ -r " | ||
| + | |||
| + | FEED_TYPE_LONG=" | ||
| + | FEED_DIR=" | ||
| + | TIMESTAMP=" | ||
| + | SCRIPT_ID=" | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_RSYNC_FEED=" | ||
| + | else | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | fi | ||
| + | |||
| + | GSF_RSYNC_PATH="/ | ||
| + | |||
| + | if [ -e $ACCESSKEY ]; then | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | else | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | fi | ||
| + | elif [ " | ||
| + | then | ||
| + | [ -r " | ||
| + | |||
| + | FEED_TYPE_LONG=" | ||
| + | FEED_DIR=" | ||
| + | TIMESTAMP=" | ||
| + | SCRIPT_ID=" | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_RSYNC_FEED=" | ||
| + | else | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | fi | ||
| + | |||
| + | GSF_RSYNC_PATH="/ | ||
| + | |||
| + | if [ -e $ACCESSKEY ]; then | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | else | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | fi | ||
| + | elif [ " | ||
| + | then | ||
| + | [ -r " | ||
| + | |||
| + | FEED_TYPE_LONG=" | ||
| + | FEED_DIR=" | ||
| + | TIMESTAMP=" | ||
| + | SCRIPT_ID=" | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_RSYNC_FEED=" | ||
| + | else | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | fi | ||
| + | |||
| + | GSF_RSYNC_PATH="/ | ||
| + | |||
| + | if [ -e $ACCESSKEY ]; then | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | else | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | fi | ||
| + | else | ||
| + | echo " | ||
| + | log_err " | ||
| + | exit 1 | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | write_feed_xml () { | ||
| + | if [ -r $TIMESTAMP ] | ||
| + | then | ||
| + | FEED_VERSION=`cat $TIMESTAMP` | ||
| + | else | ||
| + | FEED_VERSION=0 | ||
| + | fi | ||
| + | |||
| + | mkdir -p $FEED_DIR | ||
| + | echo '< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "This script synchronizes a $FEED_TYPE collection with the ' | ||
| + | echo "The ' | ||
| + | echo " | ||
| + | echo "</ | ||
| + | echo "</ | ||
| + | } | ||
| + | |||
| + | create_tmp_key () { | ||
| + | KEYTEMPDIR=`mktemp -d` | ||
| + | cp " | ||
| + | TMPACCESSKEY=" | ||
| + | chmod 400 " | ||
| + | } | ||
| + | |||
| + | remove_tmp_key () { | ||
| + | rm -rf " | ||
| + | } | ||
| + | |||
| + | set_interrupt_trap () { | ||
| + | trap " | ||
| + | } | ||
| + | |||
| + | handle_interrupt () { | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | do_describe () { | ||
| + | echo "This script synchronizes a $FEED_TYPE collection with the ' | ||
| + | echo "The ' | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | do_feedversion () { | ||
| + | if [ -r $TIMESTAMP ]; then | ||
| + | cat $TIMESTAMP | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | # This function uses gos-state-manager to get information about the settings. | ||
| + | # gos-state-manager is only available on a Greenbone OS. | ||
| + | # If gos-state-manager is missing the settings values can not be retrieved. | ||
| + | # | ||
| + | # Input: option | ||
| + | # Output: value as string or empty String if gos-state-manager is not installed | ||
| + | # or option not set | ||
| + | get_value () | ||
| + | { | ||
| + | value="" | ||
| + | key=$1 | ||
| + | if which gos-state-manager 1>/ | ||
| + | then | ||
| + | if gos-state-manager get " | ||
| + | then | ||
| + | value=" | ||
| + | fi | ||
| + | fi | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | is_feed_current () { | ||
| + | if [ -r $TIMESTAMP ] | ||
| + | then | ||
| + | FEED_VERSION=`cat $TIMESTAMP` | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_warning "Could not determine feed version." | ||
| + | FEED_CURRENT=0 | ||
| + | return $FEED_CURRENT | ||
| + | fi | ||
| + | |||
| + | FEED_INFO_TEMP_DIR=`mktemp -d` | ||
| + | |||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | read feeduser < $ACCESSKEY | ||
| + | custid_at_host=`head -1 $ACCESSKEY | cut -d : -f 1` | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine credentials, | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | gsmproxy=$(get_value proxy_feed | sed -r -e ' | ||
| + | syncport=$(get_value syncport) | ||
| + | if [ " | ||
| + | then | ||
| + | PORT=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD="" | ||
| + | else | ||
| + | if [ -e $GVM_SYSCONF_DIR/ | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | else | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | fi | ||
| + | fi | ||
| + | create_tmp_key | ||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TMPACCESSKEY" | ||
| + | if [ $? -ne 0 ] | ||
| + | then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | rm -rf " | ||
| + | remove_tmp_key | ||
| + | exit 1 | ||
| + | fi | ||
| + | remove_tmp_key | ||
| + | else | ||
| + | # Sleep for five seconds (a previous feed might have been synced a few seconds before) to prevent | ||
| + | # IP blocking due to network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
| + | eval " | ||
| + | if [ $? -ne 0 ] | ||
| + | then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | FEED_VERSION_SERVER=`cat " | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine server feed version." | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | # Check against FEED_VERSION | ||
| + | if [ $FEED_VERSION -lt $FEED_VERSION_SERVER ]; then | ||
| + | FEED_CURRENT=0 | ||
| + | else | ||
| + | FEED_CURRENT=1 | ||
| + | fi | ||
| + | |||
| + | # Cleanup | ||
| + | rm -rf " | ||
| + | |||
| + | return $FEED_CURRENT | ||
| + | } | ||
| + | |||
| + | do_help () { | ||
| + | echo "$0: Sync feed data" | ||
| + | |||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | echo "GSF access key found: Using Greenbone Security Feed" | ||
| + | else | ||
| + | echo "No GSF access key found: Using Community Feed" | ||
| + | fi | ||
| + | |||
| + | echo " --describe | ||
| + | echo " --feedversion | ||
| + | echo " --help | ||
| + | echo " --identify | ||
| + | echo " --selftest | ||
| + | echo " --type < | ||
| + | echo " --version | ||
| + | echo "" | ||
| + | exit 0 | ||
| + | } | ||
| + | |||
| + | do_rsync_community_feed () { | ||
| + | if [ -z " | ||
| + | log_err "rsync not found!" | ||
| + | else | ||
| + | # Sleep for five seconds (after is_feed_current) to prevent IP blocking due to | ||
| + | # network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | log_notice "Using rsync: $RSYNC" | ||
| + | log_notice " | ||
| + | mkdir -p " | ||
| + | eval " | ||
| + | if [ $? -ne 0 ]; then | ||
| + | log_err "rsync failed. Your $FEED_TYPE_LONG might be broken now." | ||
| + | exit 1 | ||
| + | fi | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | do_sync_community_feed () { | ||
| + | if [ -z " | ||
| + | log_err "rsync not found!" | ||
| + | log_err "No utility available in PATH environment variable to download Feed data" | ||
| + | exit 1 | ||
| + | else | ||
| + | log_notice "Will use rsync" | ||
| + | do_rsync_community_feed | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | sync_feed_data(){ | ||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | log_notice "Found Greenbone Security Feed subscription file, trying to synchronize with Greenbone $FEED_TYPE_LONG Repository ..." | ||
| + | notsynced=1 | ||
| + | |||
| + | mkdir -p " | ||
| + | read feeduser < $ACCESSKEY | ||
| + | custid_at_host=`head -1 $ACCESSKEY | cut -d : -f 1` | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine credentials, | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | while [ 0 -ne " | ||
| + | do | ||
| + | |||
| + | gsmproxy=$(get_value proxy_feed | sed -r -e ' | ||
| + | syncport=$(get_value syncport) | ||
| + | if [ " | ||
| + | then | ||
| + | PORT=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD="" | ||
| + | else | ||
| + | if [ -e $GVM_SYSCONF_DIR/ | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | else | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | fi | ||
| + | fi | ||
| + | create_tmp_key | ||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $ACCESSKEY" | ||
| + | if [ 0 -ne " | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | remove_tmp_key | ||
| + | exit 1 | ||
| + | fi | ||
| + | remove_tmp_key | ||
| + | notsynced=0 | ||
| + | done | ||
| + | log_notice " | ||
| + | else | ||
| + | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
| + | do_sync_community_feed | ||
| + | fi | ||
| + | |||
| + | write_feed_xml | ||
| + | } | ||
| + | |||
| + | do_self_test () { | ||
| + | if [ -z " | ||
| + | then | ||
| + | SELFTEST_STDERR=0 | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | if [ 0 -ne $SELFTEST_STDERR ] | ||
| + | then | ||
| + | echo "rsync not found (required)." | ||
| + | fi | ||
| + | log_err "rsync not found (required)." | ||
| + | SELFTEST_FAIL=1 | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | |||
| + | ########## START | ||
| + | ########## ===== | ||
| + | |||
| + | while test $# -gt 0; do | ||
| + | case " | ||
| + | " | ||
| + | if [ -z " | ||
| + | ACTION=" | ||
| + | fi | ||
| + | ;; | ||
| + | " | ||
| + | do_help | ||
| + | exit 0 | ||
| + | ;; | ||
| + | " | ||
| + | FEED_TYPE=$(echo " | ||
| + | shift | ||
| + | ;; | ||
| + | esac | ||
| + | shift | ||
| + | done | ||
| + | |||
| + | init_feed_type | ||
| + | |||
| + | write_feed_xml | ||
| + | |||
| + | case " | ||
| + | --version) | ||
| + | echo $VERSION | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --identify) | ||
| + | echo " | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --describe) | ||
| + | do_describe | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --feedversion) | ||
| + | do_feedversion | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --selftest) | ||
| + | SELFTEST_FAIL=0 | ||
| + | SELFTEST_STDERR=1 | ||
| + | do_self_test | ||
| + | exit $SELFTEST_FAIL | ||
| + | ;; | ||
| + | --feedcurrent) | ||
| + | is_feed_current | ||
| + | exit $? | ||
| + | ;; | ||
| + | esac | ||
| + | |||
| + | SELFTEST_FAIL=0 | ||
| + | do_self_test | ||
| + | if [ $SELFTEST_FAIL -ne 0 ] | ||
| + | then | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | is_feed_current | ||
| + | if [ $FEED_CURRENT -eq 1 ] | ||
| + | then | ||
| + | log_notice "Feed is already current, skipping synchronization." | ||
| + | exit 0 | ||
| + | fi | ||
| + | ( | ||
| + | chmod +660 $LOCK_FILE | ||
| + | flock -n 9 | ||
| + | if [ $? -eq 1 ]; then | ||
| + | log_notice "Sync in progress, exiting." | ||
| + | exit 1 | ||
| + | fi | ||
| + | date > $LOCK_FILE | ||
| + | sync_feed_data | ||
| + | echo -n > $LOCK_FILE | ||
| + | ) 9>> | ||
| + | |||
| + | exit 0 | ||
| </ | </ | ||
| Ligne 3715: | Ligne 4346: | ||
| ----- | ----- | ||
| - | < | + | Copyright © 2024 Hugh Norris. |
| - | <div align=" | + | |
| - | Copyright © 2021 Hugh Norris.< | + | |
| - | </ | + | |
| - | </ | + | |