=< B z d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
m Z ddl m
Z
ddlmZmZ ddlmZ ddlmZ d d
lmZmZ ej e Z ej d Z e d z Z d
Z dZ ej de dej! diZ"ej ej# e ej# ej! ej# iZ$g dZ%dZ&dZ' ej( Z) G d de* Z+ ed d Z,d Z-de.de/d e/fd Z0d/d e1d dfd Z2d e e. fd!Z3d" Z4d e/fd#Z5d0d$Z6d0d%Z7d&ed dfd'Z8d1d)e/d e
e fd*Z9d0d+Z:d0d,Z;d-e/d dfd.Z directory. Then symlinks are created
from /var/ossec/etc/dirname.d -> VERSIONS//dirname.
N) lru_cache)ListOptional)svcctl)
CheckRunError check_run) LooseVersion)files )
PamServicePamServiceStatusValuez/var/ossec/etcVERSIONSz
ossec.confdovecotz rules_pam.d/320_pam_switch.xmlz&rules_pam.d/320_pam_switch_dovecot.xmlzrules_pam.d/320_pam_ftp.xml)decodersrules rules_pamVERSION c e Zd ZdS )OssecRulesErrorN)__name__
__module__ __qualname__ G/opt/imunify360/venv/lib/python3.11/site-packages/im360/subsys/ossec.pyr r > s Dr r )maxsizec * t j d S )Nz
ossec-hids)r adaptorr r r _ossec_servicer B s >, ' ''r c t } t D ]\ }}t |z r`t
j | |< t j t 5 t |dz z
d d d n # 1 swxY w Y t |dz z rt
j | |< t d
| | S )N .disabledzAbsent rule {})dictPAM_RULES_NAMESitemsETC_DIRexistsr
enabled
contextlibsuppressFileNotFoundErrorunlinkdisabledr format)resultservicerules r _get_pam_config_stater2 G s$
VVF(..00 A A
dN " " $ $ A 3 ;F7O$%677
:
:D; ./77999
:
:
:
:
:
:
:
:
:
:
:
:
:
:
: +,
4
4
6
6 A 3 >## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ L L LEsKKKKKKKKL 4s< B &B B BB BB
C &CC c 6 t } | r| d S d S )Nr )_sorted_versions)versionss r get_rules_installed_versionrW s) !!H { r c K t ddg d {V n3# t $ r&} t d| Y d } ~ dS d } ~ ww xY wdS )Nz /var/ossec/bin/ossec-logtestz-tz$Ossec configuration is not valid: %sFT)r r rP error)rB s r _is_conf_validrZ s| 7>?????????? ;SAAAuuuuu 4s
A AA c 0 t j t j t j } | t z }t j
t 5 t j
t t |z ddd n # 1 swxY w Y t |dz z }t j
t 5 t j
t | ddd n # 1 swxY w Y | t" D ]:}t j t | |z t ||dz z ;| t |z dS )z@Copy new files to appropriate subdirectory in OSSEC config tree.N.tmp.d)pathlibPathr
rH rI rJ rK read_textrN r) r* r+ shutilrmtreestr
_VERSIONS_DIRmkdir _RULES_DIRScopytreer6 ) files_prefixversiontmp_dirdir_names r _do_prepare_new_versionrl s < 6 6u{ C CDDLm+6688>>@@G . / / 4 4
c-'1223334 4 4 4 4 4 4 4 4 4 4 4 4 4 4w /0G . / / $ $
c'll###$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ MMOOO
x' ( (#gD .I*J*J
NN=7*+++++s$ *B99B= B=*"DD D c r K t j } | d t d {V d S )N)asyncioget_event_looprun_in_executorrl )loops r _prepare_new_versionrr sC ! # #D
t%<
=
==========r ri c t d| t D ]}t |dz z }| rJ| r| n!t j t | |
t t | z |j z
t dS )z%Activate configuration for `version`.z+Selecting %s version of OSSEC configurationr] N)rP inforf r& r'
is_symlinkr, ra rb rc
symlink_tord name relative_to)ri rw ossec_dirs r _switch_version_torz s
KK=wGGG
td{+ .##%%
. """"
c)nn---
S\\
)IN
: G G
r T skip_invalidc n t fdt d D d S )zReturn a list of prepared OSSEC configuration versions.
If `skip_invalid` is True (default) then only versions (directories) not
ending in ".tmp" are returned.
Versions are sorted in descending order (latest first).c 3 Z K | ]%}r |j d k t |j V &dS )r\ N)suffixr rw ).0dr{ s r z#_sorted_versions.. sP
$%8v#5#5
#5#5#5#5
r *T)reverse)sortedrd globr{ s `r rU rU sU
"'',,
r c D K t } n# t $ r
t } Y nw xY wt }t |d t | dk r)t
d{V st |d t | d d{V dS )zDSelect latest version if it is valid, or second to latest otherwise.r r Nr T)r> )r2 r _PAM_CONFIG_DISABLEDrU rz lenrZ rC )pam_config_staterV s r _select_versionr s 0022 0 0 0/0 !!Hx{###
8}}(8(8"8"8"8"8"8"88A;'''
,D
A
A
AAAAAAAAAAs ''c d} t d D ]h}t j t t | z }|j dk s | t k r"t j t | c| dz
} id S )Nr Fr r\ r ) rU r^ r_ rd rc r~ _VERSIONS_TO_KEEPra rb )keptri rF s r _cleanup_old_versionsr s D#777 |MCLL 899 ;& D,=$=$= M#d)) $ $ $ $ AIDD r
is_updatedc K |sd S t 4 d {V t dd t d {V t d {V n9# t
t f$ r%}t d| Y d }~nd }~ww xY wt n# t w xY w d d d d {V d S # 1 d {V swxY w Y d S )Ni T)exist_okz(Failed to update OSSEC configuration: %s)
rules_update_lockrd re rr r rO r rP rY r )_r rB s r on_files_updater s $ $ $ $ $ $ $ $ED111 $&(( ( ( ( ( ( ( (!## # # # # # # # # ) J J J LLCS I I I I I I I I J
" # # # # ! # # # # #$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $sL C
(AB#B,B B# BB#C
#B33C
CC)F)r4 N)T)=__doc__rn r) loggingrE r^ ra functoolsr typingr r defence360agent.subsysr defence360agent.utilsr r defence360agent.utils.commonr im360r
pamr r
getLoggerr rP r_ r& rd CONF_NAMEDOVECOTSSHDFTPr$ r- r rf rK r Lockr Exceptionr r r2 rc boolr: r# rC rS rW rZ rl rr rz rU r r r r r r r sN ,
! ! ! ! ! ! ! ! ) ) ) ) ) ) : : : : : : : : 5 5 5 5 5 5 2 2 2 2 2 2 2 2 8 $ $
','
(
(*$
O5
5N1 O*3
"
+N)2 100
GLNN i 1( ( ( 3 $ P P Pd P P P P*8C= d , , , ,&> > > >
& 4 4 3E "
B
B
B
B $ $$ $ $ $ $ $ $r