javara999
313 lines
8.9 KiB
Bash
Executable File
313 lines
8.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
ENV_FILE="${ENV_FILE:-$SCRIPT_DIR/.env}"
|
|
SRC_DIR="$SCRIPT_DIR/src"
|
|
|
|
log(){ printf '[malware-watch] %s\n' "$*"; }
|
|
die(){ printf '[malware-watch] ERROR: %s\n' "$*" >&2; exit 1; }
|
|
|
|
if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
|
|
exec sudo -E bash "$0" "$@"
|
|
fi
|
|
|
|
[[ -r "$ENV_FILE" ]] || die "Missing $ENV_FILE"
|
|
set -a
|
|
. "$ENV_FILE"
|
|
set +a
|
|
|
|
: "${DISCORD_WEBHOOK:?DISCORD_WEBHOOK is required in .env}"
|
|
: "${ABUSECH_AUTH_KEY:?ABUSECH_AUTH_KEY is required in .env}"
|
|
[[ "$DISCORD_WEBHOOK" != "디스코드웹훅URL" ]] || die "Replace DISCORD_WEBHOOK placeholder in .env"
|
|
[[ "$ABUSECH_AUTH_KEY" != "abuse.ch api 키" ]] || die "Replace ABUSECH_AUTH_KEY placeholder in .env"
|
|
|
|
CPU_THRESHOLD="${CPU_THRESHOLD:-150}"
|
|
ALERT_SCORE="${ALERT_SCORE:-60}"
|
|
CRITICAL_SCORE="${CRITICAL_SCORE:-100}"
|
|
COOLDOWN_SECONDS="${COOLDOWN_SECONDS:-1800}"
|
|
CLAMAV_VERSION="${CLAMAV_VERSION:-1.4.6}"
|
|
CLAMAV_URL="${CLAMAV_URL:-}"
|
|
INSTALL_CLAMAV="${INSTALL_CLAMAV:-1}"
|
|
RUN_FRESHCLAM_NOW="${RUN_FRESHCLAM_NOW:-0}"
|
|
SEND_INSTALL_TEST="${SEND_INSTALL_TEST:-0}"
|
|
|
|
case "$DISCORD_WEBHOOK$ABUSECH_AUTH_KEY" in
|
|
*"'"*) die "Secrets containing a single quote are not supported by this installer" ;;
|
|
esac
|
|
|
|
command -v systemctl >/dev/null || die "systemd is required"
|
|
command -v apt-get >/dev/null || die "This installer currently supports Debian/Ubuntu (apt)"
|
|
|
|
for f in malware-watch.py malware-quarantine.py malware-feed-update.py clamav-watch-scan.sh block-malware-iocs; do
|
|
[[ -f "$SRC_DIR/$f" ]] || die "Missing $SRC_DIR/$f"
|
|
done
|
|
|
|
log "Installing base dependencies"
|
|
apt-get update -y
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y \
|
|
ca-certificates curl python3 iproute2 procps util-linux iptables coreutils passwd
|
|
|
|
install -d -m 700 /etc/malware-watch /var/lib/malware-watch /var/lib/malware-watch/feeds
|
|
install -d -m 700 /root/security-evidence/malware-watch /root/security-evidence/quarantine
|
|
|
|
BACKUP="/root/security-evidence/malware-watch/install-backup-$(date +%Y%m%d-%H%M%S)"
|
|
install -d -m 700 "$BACKUP"
|
|
for f in \
|
|
/etc/malware-watch/config \
|
|
/usr/local/sbin/malware-watch.py \
|
|
/usr/local/sbin/malware-quarantine.py \
|
|
/usr/local/sbin/malware-feed-update.py \
|
|
/usr/local/sbin/clamav-watch-scan.sh \
|
|
/usr/local/sbin/block-malware-iocs; do
|
|
[[ -e "$f" ]] && cp -a "$f" "$BACKUP/" || true
|
|
done
|
|
|
|
umask 077
|
|
{
|
|
printf "CPU_THRESHOLD='%s'\n" "$CPU_THRESHOLD"
|
|
printf "ALERT_SCORE='%s'\n" "$ALERT_SCORE"
|
|
printf "CRITICAL_SCORE='%s'\n" "$CRITICAL_SCORE"
|
|
printf "COOLDOWN_SECONDS='%s'\n" "$COOLDOWN_SECONDS"
|
|
printf "ABUSECH_AUTH_KEY='%s'\n" "$ABUSECH_AUTH_KEY"
|
|
printf "DISCORD_WEBHOOK='%s'\n" "$DISCORD_WEBHOOK"
|
|
} > /etc/malware-watch/config
|
|
chmod 600 /etc/malware-watch/config
|
|
|
|
for f in malware-watch.py malware-quarantine.py malware-feed-update.py clamav-watch-scan.sh block-malware-iocs; do
|
|
install -o root -g root -m 700 "$SRC_DIR/$f" "/usr/local/sbin/$f"
|
|
done
|
|
|
|
if [[ "$INSTALL_CLAMAV" == "1" ]]; then
|
|
arch="$(uname -m)"
|
|
case "$arch" in
|
|
aarch64|arm64) clam_arch="aarch64" ;;
|
|
x86_64|amd64) clam_arch="x86_64" ;;
|
|
*) die "Unsupported ClamAV architecture: $arch" ;;
|
|
esac
|
|
|
|
if ! /usr/local/bin/clamscan --version 2>/dev/null | grep -q "ClamAV $CLAMAV_VERSION"; then
|
|
log "Installing official ClamAV $CLAMAV_VERSION for $clam_arch"
|
|
deb="$(mktemp /tmp/clamav.XXXXXX.deb)"
|
|
url="${CLAMAV_URL:-https://www.clamav.net/downloads/production/clamav-${CLAMAV_VERSION}.linux.${clam_arch}.deb}"
|
|
curl -fL --retry 3 --retry-delay 2 -o "$deb" "$url"
|
|
systemctl disable --now clamav-freshclam 2>/dev/null || true
|
|
DEBIAN_FRONTEND=noninteractive apt-get remove -y \
|
|
clamav clamav-freshclam clamav-base libclamav9 libclamav11 2>/dev/null || true
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y "$deb"
|
|
rm -f "$deb"
|
|
fi
|
|
|
|
[[ -x /usr/local/bin/clamscan ]] || die "Official ClamAV clamscan not found after installation"
|
|
[[ -f /usr/local/etc/freshclam.conf.sample ]] || die "freshclam.conf.sample not found"
|
|
|
|
if ! getent group clamav >/dev/null 2>&1; then
|
|
groupadd --system clamav
|
|
fi
|
|
if ! id -u clamav >/dev/null 2>&1; then
|
|
useradd --system --gid clamav --home-dir /var/lib/clamav --shell /usr/sbin/nologin clamav
|
|
fi
|
|
install -d -o clamav -g clamav -m 755 /var/lib/clamav
|
|
|
|
cp /usr/local/etc/freshclam.conf.sample /usr/local/etc/freshclam.conf
|
|
sed -i 's/^Example/#Example/' /usr/local/etc/freshclam.conf
|
|
cat >> /usr/local/etc/freshclam.conf <<'EOF_FRESH'
|
|
DatabaseDirectory /var/lib/clamav
|
|
DatabaseOwner clamav
|
|
Checks 12
|
|
EOF_FRESH
|
|
chmod 644 /usr/local/etc/freshclam.conf
|
|
fi
|
|
|
|
cat > /etc/systemd/system/malware-watch.service <<'EOF_UNIT'
|
|
[Unit]
|
|
Description=Malware Watch realtime detector
|
|
After=network-online.target docker.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/malware-watch.py
|
|
User=root
|
|
Nice=10
|
|
IOSchedulingClass=best-effort
|
|
IOSchedulingPriority=7
|
|
EOF_UNIT
|
|
|
|
cat > /etc/systemd/system/malware-watch.timer <<'EOF_UNIT'
|
|
[Unit]
|
|
Description=Run Malware Watch every minute
|
|
|
|
[Timer]
|
|
OnBootSec=2min
|
|
OnUnitActiveSec=1min
|
|
AccuracySec=5s
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF_UNIT
|
|
|
|
cat > /etc/systemd/system/malware-feed-update.service <<'EOF_UNIT'
|
|
[Unit]
|
|
Description=Malware Watch abuse.ch feed updater
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
EnvironmentFile=/etc/malware-watch/config
|
|
ExecStart=/usr/local/sbin/malware-feed-update.py
|
|
User=root
|
|
EOF_UNIT
|
|
|
|
cat > /etc/systemd/system/malware-feed-update.timer <<'EOF_UNIT'
|
|
[Unit]
|
|
Description=Update malware threat feeds every 6 hours
|
|
|
|
[Timer]
|
|
OnBootSec=5min
|
|
OnUnitActiveSec=6h
|
|
RandomizedDelaySec=5min
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF_UNIT
|
|
|
|
cat > /etc/systemd/system/block-malware-iocs.service <<'EOF_UNIT'
|
|
[Unit]
|
|
Description=Restore malware IOC firewall blocks
|
|
After=network-online.target docker.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/block-malware-iocs
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF_UNIT
|
|
|
|
if [[ "$INSTALL_CLAMAV" == "1" ]]; then
|
|
cat > /etc/systemd/system/clamav-freshclam-local.service <<EOF_UNIT
|
|
[Unit]
|
|
Description=ClamAV ${CLAMAV_VERSION} signature database update
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/bin/freshclam --config-file=/usr/local/etc/freshclam.conf
|
|
ExecStartPost=-/bin/systemctl start clamav-risk-scan.service
|
|
User=root
|
|
Nice=10
|
|
IOSchedulingClass=best-effort
|
|
IOSchedulingPriority=7
|
|
EOF_UNIT
|
|
|
|
cat > /etc/systemd/system/clamav-freshclam-local.timer <<'EOF_UNIT'
|
|
[Unit]
|
|
Description=Update ClamAV signatures every 2 hours
|
|
|
|
[Timer]
|
|
OnBootSec=15min
|
|
OnUnitActiveSec=2h
|
|
RandomizedDelaySec=5min
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF_UNIT
|
|
|
|
cat > /etc/systemd/system/clamav-risk-scan.service <<'EOF_UNIT'
|
|
[Unit]
|
|
Description=ClamAV high-risk path scan
|
|
After=local-fs.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/clamav-watch-scan.sh quick
|
|
User=root
|
|
Nice=15
|
|
IOSchedulingClass=idle
|
|
SuccessExitStatus=1
|
|
EOF_UNIT
|
|
|
|
cat > /etc/systemd/system/clamav-risk-scan.timer <<'EOF_UNIT'
|
|
[Unit]
|
|
Description=Hourly ClamAV scan of high-risk temporary paths
|
|
|
|
[Timer]
|
|
OnBootSec=20min
|
|
OnUnitActiveSec=1h
|
|
RandomizedDelaySec=5min
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF_UNIT
|
|
|
|
cat > /etc/systemd/system/clamav-deep-scan.service <<'EOF_UNIT'
|
|
[Unit]
|
|
Description=ClamAV daily low-priority server scan
|
|
After=local-fs.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/clamav-watch-scan.sh deep
|
|
User=root
|
|
Nice=19
|
|
IOSchedulingClass=idle
|
|
SuccessExitStatus=1
|
|
EOF_UNIT
|
|
|
|
cat > /etc/systemd/system/clamav-deep-scan.timer <<'EOF_UNIT'
|
|
[Unit]
|
|
Description=Daily ClamAV low-priority server scan
|
|
|
|
[Timer]
|
|
OnCalendar=*-*-* 04:30:00
|
|
RandomizedDelaySec=15min
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF_UNIT
|
|
fi
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now malware-watch.timer malware-feed-update.timer block-malware-iocs.service
|
|
if [[ "$INSTALL_CLAMAV" == "1" ]]; then
|
|
systemctl enable --now clamav-freshclam-local.timer clamav-risk-scan.timer clamav-deep-scan.timer
|
|
fi
|
|
|
|
log "Updating abuse.ch feeds"
|
|
if ! systemctl start malware-feed-update.service; then
|
|
log "WARNING: abuse.ch feed update failed; timer will retry"
|
|
fi
|
|
|
|
if [[ "$INSTALL_CLAMAV" == "1" && "$RUN_FRESHCLAM_NOW" == "1" ]]; then
|
|
log "Trying initial ClamAV signature update"
|
|
systemctl start clamav-freshclam-local.service || log "WARNING: freshclam failed; timer will retry"
|
|
fi
|
|
|
|
systemctl start malware-watch.service || true
|
|
|
|
if [[ "$SEND_INSTALL_TEST" == "1" ]]; then
|
|
payload="$(python3 - <<'PYMSG'
|
|
import json,socket
|
|
print(json.dumps({'content':f'malware-watch install OK | server: {socket.gethostname()}'},ensure_ascii=False))
|
|
PYMSG
|
|
)"
|
|
curl -sS -o /dev/null -A 'Mozilla/5.0 (compatible; malware-watch/2.0)' \
|
|
-H 'Content-Type: application/json' --data "$payload" "$DISCORD_WEBHOOK" || true
|
|
fi
|
|
|
|
log "Installation complete"
|
|
/usr/local/sbin/malware-watch.py || true
|
|
if [[ -x "$SCRIPT_DIR/verify.sh" ]]; then
|
|
"$SCRIPT_DIR/verify.sh" || true
|
|
fi
|