Différences
Ci-dessous, les différences entre deux révisions de la page.
Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
elearning:workbooks:centos:6:sec:l108 [2023/06/12 14:28] – admin | elearning:workbooks:centos:6:sec:l108 [2024/04/26 09:28] (Version actuelle) – admin | ||
---|---|---|---|
Ligne 1: | Ligne 1: | ||
~~PDF: | ~~PDF: | ||
- | Version : **2021.01** | + | Version : **2024.01** |
Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
Ligne 69: | Ligne 69: | ||
< | < | ||
- | [root@centos7 ~]# wget http://ftp.tu-chemnitz.de/ | + | [root@centos7 ~]# wget https://www.dropbox.com/scl/fi/e55p8pmn5sbo4uflddpue/ |
</ | </ | ||
Ligne 461: | Ligne 461: | ||
</ | </ | ||
- | Téléchargez le script **openvas-nvt-sync** : | + | Téléchargez le script **greenbone-nvt-sync** : |
< | < | ||
- | [root@centos7 ~]# wget https:// | + | [root@centos7 ~]# wget https:// |
+ | |||
+ | [root@centos7 ~]# mv greenbone-nvt-sync? | ||
</ | </ | ||
- | <file> | + | Si vous ne pouvez pas téléchargez le script **greenbone-nvt-sync**, |
+ | |||
+ | <code> | ||
+ | [root@centos7 ~]# vi greenbone-nvt-sync | ||
+ | [root@centos7 ~]# cat greenbone-nvt-sync | ||
#!/bin/sh | #!/bin/sh | ||
# Copyright (C) 2009-2021 Greenbone Networks GmbH | # Copyright (C) 2009-2021 Greenbone Networks GmbH | ||
Ligne 1061: | Ligne 1067: | ||
exit 0 | exit 0 | ||
- | </file> | + | </code> |
Rendez le script exécutable : | Rendez le script exécutable : | ||
Ligne 1337: | Ligne 1342: | ||
< | < | ||
- | [root@centos7 ~]# wget https:// | + | [root@centos7 ~]# wget https:// |
+ | [root@centos7 ~]# mv greenbone-nvt-sync? | ||
+ | </ | ||
+ | |||
+ | Si vous ne pouvez pas téléchargez le script **greenbone-feed-sync**, | ||
+ | |||
+ | < | ||
+ | [root@centos7 ~]# vi greenbone-feed-sync | ||
+ | [root@centos7 ~]# cat greenbone-feed-sync | ||
+ | #!/bin/sh | ||
+ | # Copyright (C) 2011-2020 Greenbone Networks GmbH | ||
+ | # | ||
+ | # SPDX-License-Identifier: | ||
+ | # | ||
+ | # This program is free software: you can redistribute it and/or modify | ||
+ | # it under the terms of the GNU Affero General Public License as | ||
+ | # published by the Free Software Foundation, either version 3 of the | ||
+ | # License, or (at your option) any later version. | ||
+ | # | ||
+ | # This program is distributed in the hope that it will be useful, | ||
+ | # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
+ | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. | ||
+ | # GNU Affero General Public License for more details. | ||
+ | # | ||
+ | # You should have received a copy of the GNU Affero General Public License | ||
+ | # along with this program. | ||
+ | |||
+ | # This script synchronizes a GVM installation with the | ||
+ | # feed data from either the Greenbone Security Feed (in | ||
+ | # case a GSF access key is present) or else from the Greenbone | ||
+ | # Community Feed. | ||
+ | |||
+ | log_notice () { | ||
+ | $LOG_CMD -p daemon.notice " | ||
+ | } | ||
+ | |||
+ | |||
+ | ########## SETTINGS | ||
+ | ########## ======== | ||
+ | |||
+ | # PRIVATE_SUBDIR defines a subdirectory of the feed data directory | ||
+ | # where files not part of the feed or database will not be deleted by rsync. | ||
+ | if [ -z " | ||
+ | then | ||
+ | PRIVATE_SUBDIR=" | ||
+ | fi | ||
+ | |||
+ | # RSYNC_DELETE controls whether files which are not part of the repository will | ||
+ | # be removed from the local directory after synchronization. The default value | ||
+ | # for this setting is | ||
+ | # " | ||
+ | # which means that files which are not part of the feed, feed info or private | ||
+ | # directory will be deleted. | ||
+ | RSYNC_DELETE=" | ||
+ | |||
+ | # RSYNC_SSH_OPTS contains options which should be passed to ssh for the rsync | ||
+ | # connection to the repository. | ||
+ | RSYNC_SSH_OPTS=" | ||
+ | |||
+ | # RSYNC_COMPRESS specifies the compression level to use for the rsync connection. | ||
+ | RSYNC_COMPRESS=" | ||
+ | |||
+ | # PORT controls the outgoing TCP port for updates. If PAT/ | ||
+ | # not used, this should be " | ||
+ | # the value 22 (Standard SSH) is useful. Only change if you know what you are | ||
+ | # doing. | ||
+ | PORT=24 | ||
+ | |||
+ | # SCRIPT_NAME is the name the scripts will use to identify itself and to mark | ||
+ | # log messages. | ||
+ | SCRIPT_NAME=" | ||
+ | |||
+ | # LOG_CMD defines the command to use for logging. To have logger log to stderr | ||
+ | # as well as syslog, add " | ||
+ | LOG_CMD=" | ||
+ | |||
+ | # LOCK_FILE is the name of the file used to lock the feed during sync or update. | ||
+ | if [ -z " | ||
+ | then | ||
+ | LOCK_FILE=" | ||
+ | fi | ||
+ | |||
+ | |||
+ | ########## GLOBAL VARIABLES | ||
+ | ########## ================ | ||
+ | |||
+ | VERSION=@GVMD_VERSION@ | ||
+ | |||
+ | [ -r " | ||
+ | |||
+ | if [ -z " | ||
+ | DROP_USER=" | ||
+ | fi | ||
+ | |||
+ | ACCESSKEY=" | ||
+ | |||
+ | # Note when running as root or restart as $DROP_USER if defined | ||
+ | if [ $(id -u) -eq 0 ] | ||
+ | then | ||
+ | if [ -z " | ||
+ | then | ||
+ | log_notice " | ||
+ | else | ||
+ | log_notice " | ||
+ | su --shell /bin/sh --command "$0 $*" " | ||
+ | exit $? | ||
+ | fi | ||
+ | fi | ||
+ | |||
+ | # Determine whether a GSF access key is present. If yes, | ||
+ | # then use the Greenbone Security Feed. Else use the | ||
+ | # Greenbone Community Feed. | ||
+ | if [ -e $ACCESSKEY ] | ||
+ | then | ||
+ | RESTRICTED=1 | ||
+ | |||
+ | if [ -z " | ||
+ | FEED_VENDOR=" | ||
+ | fi | ||
+ | |||
+ | if [ -z " | ||
+ | FEED_HOME=" | ||
+ | fi | ||
+ | |||
+ | else | ||
+ | RESTRICTED=0 | ||
+ | |||
+ | if [ -z " | ||
+ | FEED_VENDOR=" | ||
+ | fi | ||
+ | |||
+ | if [ -z " | ||
+ | FEED_HOME=" | ||
+ | fi | ||
+ | |||
+ | fi | ||
+ | |||
+ | RSYNC=`command -v rsync` | ||
+ | |||
+ | # Current supported feed types (for --type parameter) | ||
+ | FEED_TYPES_SUPPORTED=" | ||
+ | |||
+ | ########## FUNCTIONS | ||
+ | ########## ========= | ||
+ | |||
+ | log_debug () { | ||
+ | $LOG_CMD -p daemon.debug " | ||
+ | } | ||
+ | |||
+ | log_info () { | ||
+ | $LOG_CMD -p daemon.info " | ||
+ | } | ||
+ | |||
+ | log_warning () { | ||
+ | $LOG_CMD -p daemon.warning " | ||
+ | } | ||
+ | |||
+ | log_err () { | ||
+ | $LOG_CMD -p daemon.err " | ||
+ | } | ||
+ | |||
+ | init_feed_type () { | ||
+ | if [ -z " | ||
+ | then | ||
+ | echo "No feed type given to --type parameter" | ||
+ | log_err "No feed type given to --type parameter" | ||
+ | exit 1 | ||
+ | elif [ " | ||
+ | then | ||
+ | [ -r " | ||
+ | |||
+ | FEED_TYPE_LONG=" | ||
+ | FEED_DIR=" | ||
+ | TIMESTAMP=" | ||
+ | SCRIPT_ID=" | ||
+ | |||
+ | if [ -z " | ||
+ | COMMUNITY_RSYNC_FEED=" | ||
+ | # An alternative syntax which might work if the above doesn' | ||
+ | # COMMUNITY_RSYNC_FEED=" | ||
+ | else | ||
+ | COMMUNITY_RSYNC_FEED=" | ||
+ | fi | ||
+ | |||
+ | GSF_RSYNC_PATH="/ | ||
+ | |||
+ | if [ -e $ACCESSKEY ]; then | ||
+ | if [ -z " | ||
+ | FEED_NAME=" | ||
+ | fi | ||
+ | else | ||
+ | if [ -z " | ||
+ | FEED_NAME=" | ||
+ | fi | ||
+ | fi | ||
+ | elif [ " | ||
+ | then | ||
+ | [ -r " | ||
+ | |||
+ | FEED_TYPE_LONG=" | ||
+ | FEED_DIR=" | ||
+ | TIMESTAMP=" | ||
+ | SCRIPT_ID=" | ||
+ | |||
+ | if [ -z " | ||
+ | COMMUNITY_RSYNC_FEED=" | ||
+ | # An alternative syntax which might work if the above doesn' | ||
+ | # COMMUNITY_RSYNC_FEED=" | ||
+ | else | ||
+ | COMMUNITY_RSYNC_FEED=" | ||
+ | fi | ||
+ | |||
+ | GSF_RSYNC_PATH="/ | ||
+ | |||
+ | if [ -e $ACCESSKEY ]; then | ||
+ | if [ -z " | ||
+ | FEED_NAME=" | ||
+ | fi | ||
+ | else | ||
+ | if [ -z " | ||
+ | FEED_NAME=" | ||
+ | fi | ||
+ | fi | ||
+ | elif [ " | ||
+ | then | ||
+ | [ -r " | ||
+ | |||
+ | FEED_TYPE_LONG=" | ||
+ | FEED_DIR=" | ||
+ | TIMESTAMP=" | ||
+ | SCRIPT_ID=" | ||
+ | |||
+ | if [ -z " | ||
+ | COMMUNITY_RSYNC_FEED=" | ||
+ | # An alternative syntax which might work if the above doesn' | ||
+ | # COMMUNITY_RSYNC_FEED=" | ||
+ | else | ||
+ | COMMUNITY_RSYNC_FEED=" | ||
+ | fi | ||
+ | |||
+ | GSF_RSYNC_PATH="/ | ||
+ | |||
+ | if [ -e $ACCESSKEY ]; then | ||
+ | if [ -z " | ||
+ | FEED_NAME=" | ||
+ | fi | ||
+ | else | ||
+ | if [ -z " | ||
+ | FEED_NAME=" | ||
+ | fi | ||
+ | fi | ||
+ | else | ||
+ | echo " | ||
+ | log_err " | ||
+ | exit 1 | ||
+ | fi | ||
+ | } | ||
+ | |||
+ | write_feed_xml () { | ||
+ | if [ -r $TIMESTAMP ] | ||
+ | then | ||
+ | FEED_VERSION=`cat $TIMESTAMP` | ||
+ | else | ||
+ | FEED_VERSION=0 | ||
+ | fi | ||
+ | |||
+ | mkdir -p $FEED_DIR | ||
+ | echo '< | ||
+ | echo "< | ||
+ | echo "< | ||
+ | echo "< | ||
+ | echo "< | ||
+ | echo "< | ||
+ | echo "< | ||
+ | echo "This script synchronizes a $FEED_TYPE collection with the ' | ||
+ | echo "The ' | ||
+ | echo " | ||
+ | echo "</ | ||
+ | echo "</ | ||
+ | } | ||
+ | |||
+ | create_tmp_key () { | ||
+ | KEYTEMPDIR=`mktemp -d` | ||
+ | cp " | ||
+ | TMPACCESSKEY=" | ||
+ | chmod 400 " | ||
+ | } | ||
+ | |||
+ | remove_tmp_key () { | ||
+ | rm -rf " | ||
+ | } | ||
+ | |||
+ | set_interrupt_trap () { | ||
+ | trap " | ||
+ | } | ||
+ | |||
+ | handle_interrupt () { | ||
+ | echo " | ||
+ | } | ||
+ | |||
+ | do_describe () { | ||
+ | echo "This script synchronizes a $FEED_TYPE collection with the ' | ||
+ | echo "The ' | ||
+ | echo " | ||
+ | } | ||
+ | |||
+ | do_feedversion () { | ||
+ | if [ -r $TIMESTAMP ]; then | ||
+ | cat $TIMESTAMP | ||
+ | fi | ||
+ | } | ||
+ | |||
+ | # This function uses gos-state-manager to get information about the settings. | ||
+ | # gos-state-manager is only available on a Greenbone OS. | ||
+ | # If gos-state-manager is missing the settings values can not be retrieved. | ||
+ | # | ||
+ | # Input: option | ||
+ | # Output: value as string or empty String if gos-state-manager is not installed | ||
+ | # or option not set | ||
+ | get_value () | ||
+ | { | ||
+ | value="" | ||
+ | key=$1 | ||
+ | if which gos-state-manager 1>/ | ||
+ | then | ||
+ | if gos-state-manager get " | ||
+ | then | ||
+ | value=" | ||
+ | fi | ||
+ | fi | ||
+ | echo " | ||
+ | } | ||
+ | |||
+ | is_feed_current () { | ||
+ | if [ -r $TIMESTAMP ] | ||
+ | then | ||
+ | FEED_VERSION=`cat $TIMESTAMP` | ||
+ | fi | ||
+ | |||
+ | if [ -z " | ||
+ | then | ||
+ | log_warning "Could not determine feed version." | ||
+ | FEED_CURRENT=0 | ||
+ | return $FEED_CURRENT | ||
+ | fi | ||
+ | |||
+ | FEED_INFO_TEMP_DIR=`mktemp -d` | ||
+ | |||
+ | if [ -e $ACCESSKEY ] | ||
+ | then | ||
+ | read feeduser < $ACCESSKEY | ||
+ | custid_at_host=`head -1 $ACCESSKEY | cut -d : -f 1` | ||
+ | |||
+ | if [ -z " | ||
+ | then | ||
+ | log_err "Could not determine credentials, | ||
+ | rm -rf " | ||
+ | exit 1 | ||
+ | fi | ||
+ | |||
+ | gsmproxy=$(get_value proxy_feed | sed -r -e ' | ||
+ | syncport=$(get_value syncport) | ||
+ | if [ " | ||
+ | then | ||
+ | PORT=" | ||
+ | fi | ||
+ | |||
+ | if [ -z " | ||
+ | then | ||
+ | RSYNC_SSH_PROXY_CMD="" | ||
+ | else | ||
+ | if [ -e $GVM_SYSCONF_DIR/ | ||
+ | RSYNC_SSH_PROXY_CMD=" | ||
+ | else | ||
+ | RSYNC_SSH_PROXY_CMD=" | ||
+ | fi | ||
+ | fi | ||
+ | create_tmp_key | ||
+ | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TMPACCESSKEY" | ||
+ | if [ $? -ne 0 ] | ||
+ | then | ||
+ | log_err "rsync failed, aborting synchronization." | ||
+ | rm -rf " | ||
+ | remove_tmp_key | ||
+ | exit 1 | ||
+ | fi | ||
+ | remove_tmp_key | ||
+ | else | ||
+ | # Sleep for five seconds (a previous feed might have been synced a few seconds before) to prevent | ||
+ | # IP blocking due to network equipment in between keeping the previous connection too long open. | ||
+ | sleep 5 | ||
+ | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
+ | eval " | ||
+ | if [ $? -ne 0 ] | ||
+ | then | ||
+ | log_err "rsync failed, aborting synchronization." | ||
+ | rm -rf " | ||
+ | exit 1 | ||
+ | fi | ||
+ | fi | ||
+ | |||
+ | FEED_VERSION_SERVER=`cat " | ||
+ | |||
+ | if [ -z " | ||
+ | then | ||
+ | log_err "Could not determine server feed version." | ||
+ | rm -rf " | ||
+ | exit 1 | ||
+ | fi | ||
+ | |||
+ | # Check against FEED_VERSION | ||
+ | if [ $FEED_VERSION -lt $FEED_VERSION_SERVER ]; then | ||
+ | FEED_CURRENT=0 | ||
+ | else | ||
+ | FEED_CURRENT=1 | ||
+ | fi | ||
+ | |||
+ | # Cleanup | ||
+ | rm -rf " | ||
+ | |||
+ | return $FEED_CURRENT | ||
+ | } | ||
+ | |||
+ | do_help () { | ||
+ | echo "$0: Sync feed data" | ||
+ | |||
+ | if [ -e $ACCESSKEY ] | ||
+ | then | ||
+ | echo "GSF access key found: Using Greenbone Security Feed" | ||
+ | else | ||
+ | echo "No GSF access key found: Using Community Feed" | ||
+ | fi | ||
+ | |||
+ | echo " --describe | ||
+ | echo " --feedversion | ||
+ | echo " --help | ||
+ | echo " --identify | ||
+ | echo " --selftest | ||
+ | echo " --type < | ||
+ | echo " --version | ||
+ | echo "" | ||
+ | exit 0 | ||
+ | } | ||
+ | |||
+ | do_rsync_community_feed () { | ||
+ | if [ -z " | ||
+ | log_err "rsync not found!" | ||
+ | else | ||
+ | # Sleep for five seconds (after is_feed_current) to prevent IP blocking due to | ||
+ | # network equipment in between keeping the previous connection too long open. | ||
+ | sleep 5 | ||
+ | log_notice "Using rsync: $RSYNC" | ||
+ | log_notice " | ||
+ | mkdir -p " | ||
+ | eval " | ||
+ | if [ $? -ne 0 ]; then | ||
+ | log_err "rsync failed. Your $FEED_TYPE_LONG might be broken now." | ||
+ | exit 1 | ||
+ | fi | ||
+ | fi | ||
+ | } | ||
+ | |||
+ | do_sync_community_feed () { | ||
+ | if [ -z " | ||
+ | log_err "rsync not found!" | ||
+ | log_err "No utility available in PATH environment variable to download Feed data" | ||
+ | exit 1 | ||
+ | else | ||
+ | log_notice "Will use rsync" | ||
+ | do_rsync_community_feed | ||
+ | fi | ||
+ | } | ||
+ | |||
+ | sync_feed_data(){ | ||
+ | if [ -e $ACCESSKEY ] | ||
+ | then | ||
+ | log_notice "Found Greenbone Security Feed subscription file, trying to synchronize with Greenbone $FEED_TYPE_LONG Repository ..." | ||
+ | notsynced=1 | ||
+ | |||
+ | mkdir -p " | ||
+ | read feeduser < $ACCESSKEY | ||
+ | custid_at_host=`head -1 $ACCESSKEY | cut -d : -f 1` | ||
+ | |||
+ | if [ -z " | ||
+ | then | ||
+ | log_err "Could not determine credentials, | ||
+ | exit 1 | ||
+ | fi | ||
+ | |||
+ | while [ 0 -ne " | ||
+ | do | ||
+ | |||
+ | gsmproxy=$(get_value proxy_feed | sed -r -e ' | ||
+ | syncport=$(get_value syncport) | ||
+ | if [ " | ||
+ | then | ||
+ | PORT=" | ||
+ | fi | ||
+ | |||
+ | if [ -z " | ||
+ | then | ||
+ | RSYNC_SSH_PROXY_CMD="" | ||
+ | else | ||
+ | if [ -e $GVM_SYSCONF_DIR/ | ||
+ | RSYNC_SSH_PROXY_CMD=" | ||
+ | else | ||
+ | RSYNC_SSH_PROXY_CMD=" | ||
+ | fi | ||
+ | fi | ||
+ | create_tmp_key | ||
+ | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $ACCESSKEY" | ||
+ | if [ 0 -ne " | ||
+ | log_err "rsync failed, aborting synchronization." | ||
+ | remove_tmp_key | ||
+ | exit 1 | ||
+ | fi | ||
+ | remove_tmp_key | ||
+ | notsynced=0 | ||
+ | done | ||
+ | log_notice " | ||
+ | else | ||
+ | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
+ | do_sync_community_feed | ||
+ | fi | ||
+ | |||
+ | write_feed_xml | ||
+ | } | ||
+ | |||
+ | do_self_test () { | ||
+ | if [ -z " | ||
+ | then | ||
+ | SELFTEST_STDERR=0 | ||
+ | fi | ||
+ | |||
+ | if [ -z " | ||
+ | then | ||
+ | if [ 0 -ne $SELFTEST_STDERR ] | ||
+ | then | ||
+ | echo "rsync not found (required)." | ||
+ | fi | ||
+ | log_err "rsync not found (required)." | ||
+ | SELFTEST_FAIL=1 | ||
+ | fi | ||
+ | } | ||
+ | |||
+ | |||
+ | ########## START | ||
+ | ########## ===== | ||
+ | |||
+ | while test $# -gt 0; do | ||
+ | case " | ||
+ | " | ||
+ | if [ -z " | ||
+ | ACTION=" | ||
+ | fi | ||
+ | ;; | ||
+ | " | ||
+ | do_help | ||
+ | exit 0 | ||
+ | ;; | ||
+ | " | ||
+ | FEED_TYPE=$(echo " | ||
+ | shift | ||
+ | ;; | ||
+ | esac | ||
+ | shift | ||
+ | done | ||
+ | |||
+ | init_feed_type | ||
+ | |||
+ | write_feed_xml | ||
+ | |||
+ | case " | ||
+ | --version) | ||
+ | echo $VERSION | ||
+ | exit 0 | ||
+ | ;; | ||
+ | --identify) | ||
+ | echo " | ||
+ | exit 0 | ||
+ | ;; | ||
+ | --describe) | ||
+ | do_describe | ||
+ | exit 0 | ||
+ | ;; | ||
+ | --feedversion) | ||
+ | do_feedversion | ||
+ | exit 0 | ||
+ | ;; | ||
+ | --selftest) | ||
+ | SELFTEST_FAIL=0 | ||
+ | SELFTEST_STDERR=1 | ||
+ | do_self_test | ||
+ | exit $SELFTEST_FAIL | ||
+ | ;; | ||
+ | --feedcurrent) | ||
+ | is_feed_current | ||
+ | exit $? | ||
+ | ;; | ||
+ | esac | ||
+ | |||
+ | SELFTEST_FAIL=0 | ||
+ | do_self_test | ||
+ | if [ $SELFTEST_FAIL -ne 0 ] | ||
+ | then | ||
+ | exit 1 | ||
+ | fi | ||
+ | |||
+ | is_feed_current | ||
+ | if [ $FEED_CURRENT -eq 1 ] | ||
+ | then | ||
+ | log_notice "Feed is already current, skipping synchronization." | ||
+ | exit 0 | ||
+ | fi | ||
+ | ( | ||
+ | chmod +660 $LOCK_FILE | ||
+ | flock -n 9 | ||
+ | if [ $? -eq 1 ]; then | ||
+ | log_notice "Sync in progress, exiting." | ||
+ | exit 1 | ||
+ | fi | ||
+ | date > $LOCK_FILE | ||
+ | sync_feed_data | ||
+ | echo -n > $LOCK_FILE | ||
+ | ) 9>> | ||
+ | |||
+ | exit 0 | ||
</ | </ | ||
Ligne 3715: | Ligne 4346: | ||
----- | ----- | ||
- | < | + | Copyright © 2024 Hugh Norris. |
- | <div align=" | + | |
- | Copyright © 2021 Hugh Norris.< | + | |
- | </ | + | |
- | </ | + |