Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 585768 - net-analyzer/sguil-sensor-0.9.0: add systemd units
Summary: net-analyzer/sguil-sensor-0.9.0: add systemd units
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Netmon Herd
URL:
Whiteboard:
Keywords: PATCH
Depends on: 585766
Blocks: install-systemd-unit
  Show dependency tree
 
Reported: 2016-06-13 03:08 UTC by Patrick Michaelis
Modified: 2016-06-14 23:11 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
patch for sguil-sensor-0.9.0.ebuild (sguil-sensor-0.9.0.systemd.diff,1.75 KB, patch)
2016-06-13 03:08 UTC, Patrick Michaelis
Details | Diff
pads_agent.service (pads_agent.service,218 bytes, text/plain)
2016-06-13 03:09 UTC, Patrick Michaelis
Details
pcap_agent.service (pcap_agent.service,234 bytes, text/plain)
2016-06-13 03:09 UTC, Patrick Michaelis
Details
pcap_agent-sancp.service (pcap_agent-sancp.service,236 bytes, text/plain)
2016-06-13 03:09 UTC, Patrick Michaelis
Details
sancp_agent.service (sancp_agent.service,221 bytes, text/plain)
2016-06-13 03:10 UTC, Patrick Michaelis
Details
snort_agent.service (snort_agent.initd,750 bytes, text/plain)
2016-06-13 03:10 UTC, Patrick Michaelis
Details
log_packets_at.service (log_packets_at.service,653 bytes, text/plain)
2016-06-13 03:10 UTC, Patrick Michaelis
Details
log_packets_rotate.timer (log_packets_rotate.timer,103 bytes, text/plain)
2016-06-13 03:11 UTC, Patrick Michaelis
Details
log_packets_rotate.service (log_packets_rotate.service,152 bytes, text/plain)
2016-06-13 03:11 UTC, Patrick Michaelis
Details
systemd-log_packets_rotate.sh (systemd-log_packets_rotate.sh,2.18 KB, application/x-shellscript)
2016-06-13 03:11 UTC, Patrick Michaelis
Details
updated patch for sguil-sensor-0.9.0.ebuild v2 (sguil-sensor-0.9.0.systemd.diff,2.66 KB, patch)
2016-06-14 22:57 UTC, Patrick Michaelis
Details | Diff
log_packets.service (log_packets.service,258 bytes, text/plain)
2016-06-14 22:58 UTC, Patrick Michaelis
Details
log_packets_rotate.timer v2 (log_packets_rotate.timer,102 bytes, text/plain)
2016-06-14 22:58 UTC, Patrick Michaelis
Details
log_packets_rotate.service v2 (log_packets_rotate.service,219 bytes, text/plain)
2016-06-14 22:59 UTC, Patrick Michaelis
Details
0.9.0_log_packets.patch (0.9.0_log_packets.patch,3.79 KB, patch)
2016-06-14 23:00 UTC, Patrick Michaelis
Details | Diff
pads_agent.service v2 (pads_agent.service,267 bytes, text/plain)
2016-06-14 23:00 UTC, Patrick Michaelis
Details
pcap_agent.service v2 (pcap_agent.service,268 bytes, text/plain)
2016-06-14 23:00 UTC, Patrick Michaelis
Details
sancp_agent.service v2 (sancp_agent.service,271 bytes, text/plain)
2016-06-14 23:00 UTC, Patrick Michaelis
Details
snort_agent.service v2 (snort_agent.service,271 bytes, text/plain)
2016-06-14 23:01 UTC, Patrick Michaelis
Details
systemd-tmpfiles.conf (systemd-tmpfiles.conf,32 bytes, text/plain)
2016-06-14 23:02 UTC, Patrick Michaelis
Details
sguil-sensor-0.9.0-r1.ebuild (patched) (sguil-sensor-0.9.0-r1.ebuild,4.60 KB, text/plain)
2016-06-14 23:11 UTC, Patrick Michaelis
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Patrick Michaelis 2016-06-13 03:08:48 UTC
Created attachment 437318 [details, diff]
patch for sguil-sensor-0.9.0.ebuild

Attached are systemd units to start the various agents as systemd services as well as a patch for the current ebuild. 

The agent service units are quite simple and mirror what the init scripts from bug #585766 do.

The MAX_DISK_USE functionality implemented in the log_rotate init.d script has been split into three units and a helper shell script:

log_packets@.service - starts snort in logging mode. The device to be logged can be given as instance name (previously IFACE variable in /etc/conf.d/log_packets). The Hostname is queried from systemd, hence the HOSTNAME in the conf.d file variable ignored. As options sane defaults are hardcoded into the unit. (to get a similar customizability, one just has to create a file /etc/systemd/system/log_packet@IFACE.service.d/my_vars.conf and override the ExecStart= value.

log_packets_rotate.timer - is started whenever a log_packet@.service is started. Once a day this timer starts the log_packets_rotate.service.

log_packet_rotate.service - takes care of deleting old logs when disk gets full. This unit starts the log_packet_rotate shell script, that is basically a copy of the real_cleandisk() function from the init.d script. Aditionally it restarts all running log_packets@ services, to ensure that snort is logging in a new directory each day.

I have tested all service units on a mashine, all agents run well.

The snort started by log_rotate@.service in logging appears to be doing its job, however it spams the journal with complaints about missing preprocessors.  It may be neccessary to add a -c flag to a seperate config file containing preprocessor config (see Step #5 in the default snort.conf). However, just using the default /etc/snort/snort.conf one would not work, as it starts snort in IDS mode. It seems that with the init.d script the same would be happening, as it starts with the same parameters. A further fix should therefore be applied to both, the systemd unit and the init.d script.
Comment 1 Patrick Michaelis 2016-06-13 03:09:12 UTC
Created attachment 437320 [details]
pads_agent.service
Comment 2 Patrick Michaelis 2016-06-13 03:09:31 UTC
Created attachment 437322 [details]
pcap_agent.service
Comment 3 Patrick Michaelis 2016-06-13 03:09:48 UTC
Created attachment 437324 [details]
pcap_agent-sancp.service
Comment 4 Patrick Michaelis 2016-06-13 03:10:03 UTC
Created attachment 437326 [details]
sancp_agent.service
Comment 5 Patrick Michaelis 2016-06-13 03:10:20 UTC
Created attachment 437328 [details]
snort_agent.service
Comment 6 Patrick Michaelis 2016-06-13 03:10:46 UTC
Created attachment 437330 [details]
log_packets_at.service
Comment 7 Patrick Michaelis 2016-06-13 03:11:07 UTC
Created attachment 437332 [details]
log_packets_rotate.timer
Comment 8 Patrick Michaelis 2016-06-13 03:11:27 UTC
Created attachment 437334 [details]
log_packets_rotate.service
Comment 9 Patrick Michaelis 2016-06-13 03:11:57 UTC
Created attachment 437336 [details]
systemd-log_packets_rotate.sh
Comment 10 Patrick Michaelis 2016-06-14 11:36:49 UTC
I just noticed that upstream has its own shell script for the log_packets service. I will rewrite the log_packet*.service / .timer unit to use the upsteam script instead of a custom one and post updated unit files soon.
Comment 11 Patrick Michaelis 2016-06-14 22:57:52 UTC
Created attachment 437590 [details, diff]
updated patch for sguil-sensor-0.9.0.ebuild v2

Updated patch for the ebuild. This will only apply on top of the patch from bug #585766. I will attach the resulting ebuild below to make this more convinient.

Changes since the first patch:

* removed the pcap_agent-sancp.service again, in favor of using the pcap_agent.service for both cases. If the sancp USE flag is set, the sancp version of the agent will be installed as /usr/bin/pcap_agent.tcl now.

* added PIDFile to each agent unit

* added Restart=always to each agent, to keep them running in case of a crash. That appears to be what upstream is doing in the current git tree as well, where the first couple of systemd units have been commited.

* re-implemented the log_packets* units to use the upstream log_packets.sh and log_packets-sancp.sh script to start snort in logging mode. 

This is now also backwards compatible with how the init scripts worked: configuration happens in /etc/conf.d/log_packets, unit names are the same. (note: the conf.d file is not used in the systemd units, but sourced in the patched log_packets.sh script).

The log_packets_rotate.service/.timer units do manage the resarting of the packet logger and removing of old files, as a cron job would for the init script version.

For this to work a small patch needs to be applied to the log_packets(-sancp).sh scripts. This patch removes the hard coded config values and replaces them with the included ones from the conf.d file. It also removes the piping of snort log output to a log file. Instead it will be logged in the journal now.
Comment 12 Patrick Michaelis 2016-06-14 22:58:28 UTC
Created attachment 437592 [details]
log_packets.service
Comment 13 Patrick Michaelis 2016-06-14 22:58:55 UTC
Created attachment 437594 [details]
log_packets_rotate.timer v2
Comment 14 Patrick Michaelis 2016-06-14 22:59:12 UTC
Created attachment 437596 [details]
log_packets_rotate.service v2
Comment 15 Patrick Michaelis 2016-06-14 23:00:06 UTC
Created attachment 437598 [details, diff]
0.9.0_log_packets.patch

for the files/ dir, not to be applied to the ebuild!
Comment 16 Patrick Michaelis 2016-06-14 23:00:25 UTC
Created attachment 437600 [details]
pads_agent.service v2
Comment 17 Patrick Michaelis 2016-06-14 23:00:41 UTC
Created attachment 437602 [details]
pcap_agent.service v2
Comment 18 Patrick Michaelis 2016-06-14 23:00:57 UTC
Created attachment 437604 [details]
sancp_agent.service v2
Comment 19 Patrick Michaelis 2016-06-14 23:01:18 UTC
Created attachment 437606 [details]
snort_agent.service v2
Comment 20 Patrick Michaelis 2016-06-14 23:02:45 UTC
Created attachment 437608 [details]
systemd-tmpfiles.conf

will be installed as /usr/lib/tmpfiles.d/sguil-sensor.conf

it auto creates the /run/sguil directory with write permissions for user sguil, so that the agents can run without root privileges.
Comment 21 Patrick Michaelis 2016-06-14 23:11:55 UTC
Created attachment 437610 [details]
sguil-sensor-0.9.0-r1.ebuild (patched)

finally, the ebuild with the v2 patch applied, on top of the patch from bug #585766. I included the proposed changes from #585770 (~amdd64 keyword) and #585772 (dev-tcltk/tls dependency) as well.