diff --git a/src/warden-server/etc/WardenWatchdog.conf b/src/warden-server/etc/WardenWatchdog.conf deleted file mode 100644 index 00ee8bc9ad9e7555f5663144639826c812e4ca89..0000000000000000000000000000000000000000 --- a/src/warden-server/etc/WardenWatchdog.conf +++ /dev/null @@ -1,72 +0,0 @@ -# -# wardenWatchdog.conf - configuration file for Wachdog script -# - -#------------------------------------------------------------------------------- -# server_conf - warden server configuration file path -#------------------------------------------------------------------------------- -$server_conf = '/opt/warden-server/etc/warden-server.conf'; - -#------------------------------------------------------------------------------- -# domain_name - server full domain name -#------------------------------------------------------------------------------- -$domain_name = "warden-dev.cesnet.cz"; - -#------------------------------------------------------------------------------- -# email_subject - ... -#------------------------------------------------------------------------------- -$email_subject = "Kontrola stavu udalosti warden serveru na stroji $domain_name"; - -#------------------------------------------------------------------------------- -# email_server_conf - path and params of an email server for reports sending -#------------------------------------------------------------------------------- -$email_server_conf = '|/usr/sbin/sendmail -oi -t'; - -#------------------------------------------------------------------------------- -# sql_precondition - array of procedures which are executed "before" main action -#------------------------------------------------------------------------------- -@sql_precondition = ('DROP FUNCTION IF EXISTS iptest;', 'CREATE FUNCTION iptest(ip VARCHAR(15)) RETURNS TINYINT(1) DETERMINISTIC -BEGIN - SET @nip = INET_ATON(ip); - IF( - ISNULL( @nip) OR - @nip BETWEEN 0 AND 16777216 OR - @nip BETWEEN 167772160 AND 171966464 OR - @nip BETWEEN 2130706432 AND 2130706433 OR - @nip BETWEEN 2851995648 AND 2851995649 OR - @nip BETWEEN 2886729728 AND 2886729729 OR - @nip BETWEEN 3221225472 AND 3221225473 OR - @nip BETWEEN 3221225984 AND 3221225985 OR - @nip BETWEEN 3227017984 AND 3227017985 OR - @nip BETWEEN 3232235520 AND 3232235521 OR - @nip BETWEEN 3323068416 AND 3323068417 OR - @nip BETWEEN 3325256704 AND 3325256705 OR - @nip BETWEEN 3405803776 AND 3405803777 OR - @nip BETWEEN 3758096384 AND 3758096385 OR - @nip BETWEEN 4026531840 AND 4026531841 OR - @nip > 4294967295) THEN - RETURN TRUE; - ELSE - RETURN FALSE; - END IF; -END;'); - -#------------------------------------------------------------------------------- -# sql_queries - array of hashes of actions for the WardenWatchdog script. -# Each action has three followin parts: -# query => sql query of an action (check) on Warden database -# text => body of an email which is send to a admin of an client -# in case of nonempty check result -# contact => contact for message, which overrides contact collumn -# in a database table. -#------------------------------------------------------------------------------- -@sql_queries = ( - {query => "SELECT hostname, service, MAX(received) FROM events WHERE valid = 't' GROUP BY hostname, service ORDER BY MAX(received) ASC;", text => "Uvedeny klient, nebo klienti jiz delsi dobu nereportovali zadne udalosti do Wardenu. Je mozne, ze nefunguji spravne.", contact => 'jakubcegan@cesnet.cz, ph@cesnet.cz'}, - {query => "SELECT clients.* FROM clients JOIN events ON clients.service=events.service WHERE events.detected > '\$date' AND NOT FIND_IN_SET(events.type, 'portscan,bruteforce,probe,spam,phishing,botnet_c_c,dos,malware,copyright,webattack,test,other') AND events.valid = 't' GROUP BY requestor;", text => "Uvedeny klient, nebo klienti zasilaji nepodporovany nebo zastaraly typ udalosti na server Warden", contact => 'jakubcegan@cesnet.cz, ph@cesnet.cz'}, - {query => "SELECT hostname, service, type, COUNT(*) FROM events WHERE detected - received > 0 AND received > '$date' GROUP BY hostname, service, type;", text => "Uvedeny klient, nebo klienti odesilaji odesilaji udalosti s casem z budoucnosti. Cas prirazeny serverem pri prichodu udalosti (received) musi byt vzdy roven nebo vetsi casu detekce (detected).", contact => 'jakubcegan@cesnet.cz, ph@cesnet.cz'}, - {query => "SELECT hostname, service, received, source, count(source) AS c, min(received), max(received) FROM events WHERE valid = 't' AND source_type = 'IP' AND iptest(source) GROUP BY hostname, service, source ORDER BY c DESC;", text => "Uvedeni klient, nebo klienti odesilaji udalosti se zdrojovou adresou, ktera by se nemela objevit v internetu (privatni rozsah), nebo je neplatna (prazdny oktet, oktet je vetsi nez 255, apod.). kvuli omezeni verzi MySQL serveru funguje zatim pouze pro IPv6.", contact => 'jakubcegan@cesnet.cz, ph@cesnet.cz'}); - -#------------------------------------------------------------------------------- -# sql_postcondition - array of procedures which are executed "after" main action -#------------------------------------------------------------------------------- -@sql_postcondition = ('DROP FUNCTION IF EXISTS iptest;');