Untangle UTM IPS Update Script
2/17/2010 09:30:00 AM
Posted by johnhomer
This script will generate an .sql file from emergingthreats.net ready for dumping to Untangle Postgres database. Although this script may not be needed as Untangle will auto-update itself, but for those who want to be cutting-edge, this script is for you. You will have to manually update the table by:
psql -e -f newrules.sql uvm postgres
Now for the script:
#! /bin/bash # John Homer H Alvero # Feb 13, 2010 # Change to working directory cd /root/emergingthreats RULEFILE='emerging-all.rules' LIVE="t" LOGGING="t" /usr/bin/wget http://www.emergingthreats.net/version.txt if [ "$?" -ne "0" ]; then # failed download - abort run exit fi exec < version.txt read CURRENTVERSION echo $CURRENTVERSION exec < oldversion.txt read OLDVERSION echo $OLDVERSION if [ ${CURRENTVERSION} -eq ${OLDVERSION} ]; then echo "same release available - checking next for updates to exceptions" rm -f version.txt* else echo "new version available" rm -f $RULEFILE /usr/bin/wget http://www.emergingthreats.net/rules/$RULEFILE if [ "$?" -ne "0" ]; then echo "failed retrieve of new files - exiting" exit 3 fi mv version.txt oldversion.txt rm -f version.txt* # Process file now echo "delete from n_ips_rule where Category = 'EmergingThreat';">newrules.sql RACK=( ) DATA=`psql -c "SELECT settings_id from n_ips_settings;" uvm postgres` for d in $DATA do if [ -z "$(echo "$d" |\ sed 's/[0-9]//g;s/[0-9]//g;s/\.//' \ )" ] ; then RACK=`echo " $RACK $d" ` fi done CUSTOMSID=50000 exec <$RULEFILE while read RULES do CHAR1=`echo $RULES|awk '{print substr($0,1,1)}'` WORD1=`echo $RULES|awk '{print $1}'` if [ "$CHAR1" = "#" ]; then DESCRIPTION=`echo $RULES|awk '{gsub(/\047/,"");print substr($0,1,60)}'` elif [ "$WORD1" = "alert" ]; then RULE=`echo -e $RULES|awk '{sub(/alert /,"");gsub(/\047/,"");print}'` SID=`echo $RULES|awk '{FS=";";;print $(NF-1)}'|awk '{sub(/sid:/,"");sub(/;/,"");print $0}'` NAME="Name" CATEGORY="EmergingThreat" ALERT="f" SETTINGSID=$CURRENTVERSION for r in $RACK do echo -e "INSERT INTO n_ips_rule (rule_id, rule, sid, name, category, description, live, alert, log, settings_id)" \ " VALUES ( $CUSTOMSID, \047$RULE\047, $SID , \047$NAME\047, \047$CATEGORY\047," \ " \047$DESCRIPTION\047, \047$LIVE\047, \047$ALERT\047, \047$LOGGING\047, \047" \ "$r\047);" >>newrules.sql CUSTOMSID=$(($CUSTOMSID+1)) done fi done fi echo "Done generating SQL" echo "Load SQL with psql -e -f newrules.sql uvm postgres"
This entry was posted on October 4, 2009 at 12:14 pm, and is filed under
linux,
security
. Follow any responses to this post through RSS. You can leave a response, or trackback from your own site.
Subscribe to:
Post Comments (Atom)
January 8, 2011 at 1:28 PM
The url of the emergeringthreat.net has been updated in your script. The script seems working fine for the first run. However, the number of rules are keeping at something like 11644 and it cannot be updated at Untangle even there are new rules.
I have tried /etc/init.d/untangle-vm force-reload with no hope.
Any idea?
Samiux