2020-11-30 09:37:17 +00:00
|
|
|
#!/bin/sh
|
|
|
|
|
2021-10-14 15:02:38 +00:00
|
|
|
# Set the crowdsec config file
|
|
|
|
CS_CONFIG_FILE="/etc/crowdsec/config.yaml"
|
|
|
|
if [ "$CONFIG_FILE" != "" ]; then
|
|
|
|
CS_CONFIG_FILE="$CONFIG_FILE"
|
|
|
|
fi
|
|
|
|
|
2022-02-02 12:20:12 +00:00
|
|
|
# TLS defaults
|
|
|
|
CERT_FILE="${CERT_FILE:-/etc/ssl/cert.pem}"
|
|
|
|
KEY_FILE="${KEY_FILE:-/etc/ssl/key.pem}"
|
|
|
|
|
2022-02-01 11:35:57 +00:00
|
|
|
#Check & prestage databases
|
|
|
|
if [ ! -e "/var/lib/data/GeoLite2-ASN.mmdb" ] && [ ! -e "/var/lib/data/GeoLite2-City.mmdb" ]; then
|
|
|
|
mkdir -p /var/lib/crowdsec/data
|
|
|
|
cp /staging/var/lib/crowdsec/data/*.mmdb /var/lib/crowdsec/data/
|
|
|
|
fi
|
|
|
|
|
|
|
|
#Check & prestage /etc/crowdsec
|
|
|
|
if [ ! -e "/etc/crowdsec/local_api_credentials.yaml" ] && [ ! -e "/etc/crowdsec/config.yaml" ]; then
|
|
|
|
mkdir -p /etc/crowdsec
|
|
|
|
cp -r /staging/etc/* /etc/
|
|
|
|
fi
|
|
|
|
|
2021-11-02 08:19:22 +00:00
|
|
|
# regenerate local agent credentials (ignore if agent is disabled)
|
2021-09-10 12:59:22 +00:00
|
|
|
if [ "$DISABLE_AGENT" == "" ] ; then
|
2021-10-14 15:02:38 +00:00
|
|
|
echo "Regenerate local agent credentials"
|
2022-02-02 09:12:54 +00:00
|
|
|
cscli -c "$CS_CONFIG_FILE" machines delete ${CUSTOM_HOSTNAME:-localhost}
|
2022-02-01 16:45:04 +00:00
|
|
|
if [ "$LOCAL_API_URL" != "" ] ; then
|
2022-02-02 09:12:54 +00:00
|
|
|
cscli -c "$CS_CONFIG_FILE" machines add ${CUSTOM_HOSTNAME:-localhost} --auto --url $LOCAL_API_URL
|
2022-02-01 16:45:04 +00:00
|
|
|
else
|
2022-02-02 09:12:54 +00:00
|
|
|
cscli -c "$CS_CONFIG_FILE" machines add ${CUSTOM_HOSTNAME:-localhost} --auto
|
2022-02-01 16:45:04 +00:00
|
|
|
fi
|
2021-09-10 12:59:22 +00:00
|
|
|
if [ "$AGENT_USERNAME" != "" ] && [ "$AGENT_PASSWORD" != "" ] && [ "$LOCAL_API_URL" != "" ] ; then
|
|
|
|
echo "set up lapi credentials for agent"
|
2021-10-14 15:02:38 +00:00
|
|
|
CONFIG_PATH=$(yq eval '.api.client.credentials_path' "$CS_CONFIG_FILE" )
|
2021-09-10 12:59:22 +00:00
|
|
|
echo "url: $LOCAL_API_URL" > $CONFIG_PATH
|
|
|
|
echo "login: $AGENT_USERNAME" >> $CONFIG_PATH
|
|
|
|
echo "password: $AGENT_PASSWORD" >> $CONFIG_PATH
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
|
2021-11-02 08:19:22 +00:00
|
|
|
# Check if lapi needs to automatically register an agent
|
2021-09-10 12:59:22 +00:00
|
|
|
echo Check if lapi need to register automatically an agent
|
|
|
|
if [ "$DISABLE_LOCAL_API" == "" ] && [ "$AGENT_USERNAME" != "" ] && [ "$AGENT_PASSWORD" != "" ] ; then
|
2021-10-14 15:02:38 +00:00
|
|
|
cscli -c "$CS_CONFIG_FILE" machines add $AGENT_USERNAME --password $AGENT_PASSWORD
|
2021-09-21 08:54:05 +00:00
|
|
|
echo "Agent registered to lapi"
|
2020-11-30 09:37:17 +00:00
|
|
|
fi
|
|
|
|
|
2021-02-10 08:29:29 +00:00
|
|
|
# registration to online API for signal push
|
|
|
|
if [ "$DISABLE_ONLINE_API" == "" ] && [ "$CONFIG_FILE" == "" ] ; then
|
2021-10-14 15:02:38 +00:00
|
|
|
CONFIG_EXIST=$(yq eval '.api.server.online_client | has("credentials_path")' "$CS_CONFIG_FILE")
|
2021-02-10 08:29:29 +00:00
|
|
|
if [ "$CONFIG_EXIST" != "true" ]; then
|
2021-10-14 15:02:38 +00:00
|
|
|
yq eval '.api.server.online_client = {"credentials_path": "/etc/crowdsec/online_api_credentials.yaml"}' "$CS_CONFIG_FILE" > /etc/crowdsec/config2.yaml
|
|
|
|
mv /etc/crowdsec/config2.yaml "$CS_CONFIG_FILE"
|
|
|
|
cscli -c "$CS_CONFIG_FILE" capi register > /etc/crowdsec/online_api_credentials.yaml
|
2021-09-21 08:54:05 +00:00
|
|
|
echo "registration to online API done"
|
2020-11-30 09:37:17 +00:00
|
|
|
fi
|
|
|
|
fi
|
|
|
|
|
2021-02-25 10:29:39 +00:00
|
|
|
# crowdsec sqlite database permissions
|
|
|
|
if [ "$GID" != "" ]; then
|
2021-10-14 15:02:38 +00:00
|
|
|
IS_SQLITE=$(yq eval '.db_config.type == "sqlite"' "$CS_CONFIG_FILE")
|
|
|
|
DB_PATH=$(yq eval '.db_config.db_path' "$CS_CONFIG_FILE")
|
2021-02-25 10:29:39 +00:00
|
|
|
if [ "$IS_SQLITE" == "true" ]; then
|
|
|
|
chown :$GID $DB_PATH
|
2021-09-21 08:54:05 +00:00
|
|
|
echo "sqlite database permissions updated"
|
2021-02-25 10:29:39 +00:00
|
|
|
fi
|
|
|
|
fi
|
|
|
|
|
2022-02-02 12:20:12 +00:00
|
|
|
if [ "$USE_TLS" != "" ]; then
|
|
|
|
yq -i eval ".api.server.tls.cert_file = \"$CERT_FILE\"" "$CS_CONFIG_FILE"
|
|
|
|
yq -i eval ".api.server.tls.key_file = \"$KEY_FILE\"" "$CS_CONFIG_FILE"
|
|
|
|
yq -i eval '... comments=""' "$CS_CONFIG_FILE"
|
|
|
|
fi
|
|
|
|
|
2020-11-30 09:37:17 +00:00
|
|
|
## Install collections, parsers & scenarios
|
2021-10-14 15:02:38 +00:00
|
|
|
cscli -c "$CS_CONFIG_FILE" hub update
|
|
|
|
cscli -c "$CS_CONFIG_FILE" collections upgrade crowdsecurity/linux || true
|
|
|
|
cscli -c "$CS_CONFIG_FILE" parsers upgrade crowdsecurity/whitelists || true
|
|
|
|
cscli -c "$CS_CONFIG_FILE" parsers install crowdsecurity/docker-logs || true
|
2020-11-30 09:37:17 +00:00
|
|
|
if [ "$COLLECTIONS" != "" ]; then
|
2021-10-14 15:02:38 +00:00
|
|
|
cscli -c "$CS_CONFIG_FILE" collections install $COLLECTIONS
|
2020-11-30 09:37:17 +00:00
|
|
|
fi
|
|
|
|
if [ "$PARSERS" != "" ]; then
|
2021-10-14 15:02:38 +00:00
|
|
|
cscli -c "$CS_CONFIG_FILE" parsers install $PARSERS
|
2020-11-30 09:37:17 +00:00
|
|
|
fi
|
|
|
|
if [ "$SCENARIOS" != "" ]; then
|
2021-10-14 15:02:38 +00:00
|
|
|
cscli -c "$CS_CONFIG_FILE" scenarios install $SCENARIOS
|
2020-11-30 09:37:17 +00:00
|
|
|
fi
|
|
|
|
if [ "$POSTOVERFLOWS" != "" ]; then
|
2021-10-14 15:02:38 +00:00
|
|
|
cscli -c "$CS_CONFIG_FILE" postoverflows install $POSTOVERFLOWS
|
2020-11-30 09:37:17 +00:00
|
|
|
fi
|
|
|
|
|
|
|
|
ARGS=""
|
|
|
|
if [ "$CONFIG_FILE" != "" ]; then
|
|
|
|
ARGS="-c $CONFIG_FILE"
|
|
|
|
fi
|
2021-06-29 16:03:45 +00:00
|
|
|
if [ "$DSN" != "" ]; then
|
|
|
|
ARGS="$ARGS -dsn ${DSN}"
|
2020-11-30 09:37:17 +00:00
|
|
|
fi
|
2021-06-29 16:03:45 +00:00
|
|
|
|
2020-11-30 09:37:17 +00:00
|
|
|
if [ "$TYPE" != "" ]; then
|
|
|
|
ARGS="$ARGS -type $TYPE"
|
|
|
|
fi
|
|
|
|
if [ "$TEST_MODE" == "true" ] || [ "$TEST_MODE" == "TRUE" ]; then
|
|
|
|
ARGS="$ARGS -t"
|
|
|
|
fi
|
|
|
|
if [ "$DISABLE_AGENT" == "true" ] || [ "$DISABLE_AGENT" == "TRUE" ]; then
|
|
|
|
ARGS="$ARGS -no-cs"
|
|
|
|
fi
|
2021-09-10 12:59:22 +00:00
|
|
|
if [ "$DISABLE_LOCAL_API" == "true" ] || [ "$DISABLE_LOCAL_API" == "TRUE" ]; then
|
2020-11-30 09:37:17 +00:00
|
|
|
ARGS="$ARGS -no-api"
|
|
|
|
fi
|
|
|
|
if [ "$LEVEL_TRACE" == "true" ] || [ "$LEVEL_TRACE" == "TRUE" ]; then
|
|
|
|
ARGS="$ARGS -trace"
|
|
|
|
fi
|
|
|
|
if [ "$LEVEL_DEBUG" == "true" ] || [ "$LEVEL_DEBUG" == "TRUE" ]; then
|
|
|
|
ARGS="$ARGS -debug"
|
|
|
|
fi
|
|
|
|
if [ "$LEVEL_INFO" == "true" ] || [ "$LEVEL_INFO" == "TRUE" ]; then
|
|
|
|
ARGS="$ARGS -info"
|
|
|
|
fi
|
|
|
|
|
2021-11-02 08:19:22 +00:00
|
|
|
exec crowdsec $ARGS
|