tripwire安装、检测、恢复、更新脚本（参数版本）

#!/bin/bash#初始化安装#./xs_tripwire.sh install#解除报警，初始化#./xs_tripwire.sh init#正常执行定时任务，或正常检测：#./xs_tripwire.sh check#人为修改需要检测的配置文件后：#./xs_tripwire.sh update#定义变量:#两个密钥sitekey="ssssssssss"localkey="ccccccccc"#日志目录logdir=/etc/tripwire/tripwirelog/
#邮件接人receiver=luanxiaojian@starmerx.com
#receiver=xxx@163.com# 主机名hn=`hostname`# 安装expect工具和安装tripwireyum_tools (){
yum install -y expect
yum -y install tripwire
}
# 获取ipget_ip() {
cmd_get_ip=$(/sbin/ifconfig |grep "192.168.1\." |awk -F ' ''{print $2}'|tr -d "地址:"|tr -d "addr:")echo"IDC-"$cmd_get_ip}
# 定义函数--使用twadmin命令重新生成并重新签署tripwire配置--需要输入site密码！twadmin_m_P() {
expect -c"spawn twadmin -m P /etc/tripwire/twpol.txtexpect \"site passphrase:\"send \"${sitekey}\r\"expect eof"}
# 定义函数--重新初始化数据库--需要输入local密码！trpwire_init() {
expect -c"spawn tripwire --initexpect \"local passphrase:\"send \"${localkey}\r\"set timeout 60expect eofset timeout 60"}
# 设置生成两个密钥setup_keyfiles(){
expect -c"spawn tripwire-setup-keyfilesexpect \"site keyfile passphrase:\"send \"${sitekey}\r\"expect \"site keyfile passphrase:\"send \"${sitekey}\r\"expect \"local keyfile passphrase:\"send \"${localkey}\r\"expect \"local keyfile passphrase:\"send \"${localkey}\r\"expect \"site passphrase:\"send \"${sitekey}\r\"expect \"site passphrase:\"send \"${sitekey}\r\"expect eof"echo"密钥生成结束！"echo""sleep2}
# 第一次安装时批量修改没有的文件及目录update_twpol() {
sh-c"tripwire --check  |  grep Filename > /etc/tripwire/no-directory.txt"# 运行脚本-将配置文件里的无效文件（twpol.txt是tripwire的配置文件）注释 (脚本已准备好)for f in$(grep "Filename:" /etc/tripwire/no-directory.txt | cut -f2 -d:); dosed-i"s|\($f\) |#\\1|g" /etc/tripwire/twpol.txt
doneecho"处理配置文件结束！"echo""}
# 文档目录有变动邮件bad_email() {
# mail -s $ip'目录文件有变动' $receiver< $logecho'详情看附件' |  mail -s$ip'-'$hn'目录文件有变动'-a$log$receiver# echo -e `cat $log` | mail -s $ip'目录文件有变动' $receiver}
# 文档目录没有变动邮件good_email() {
# echo -e $ip'目录文件无变动\n '`date` |mail -s $ip'-'$hn'目录文件无变动' $receiverecho`date +%Y%m%d%H%M%S`"-文件目录检测无改动" >> /tools/tripwire/tripwire.log
}
#检查tripwire_check() {
#删除60天之前的日志记录find$logdir-name \*tw.txt -mtime+20-delete#生成当天的日志记录tripwire --check > $log#判断文件目录是否有变动result=`grep 'No violations.'$log`if [ "$result"=="No violations." ];then
  good_email
else  bad_email
fi}
ip=$(get_ip)#本次日志log=$logdir$ip$hn`date +%Y%m%d%H%M%S`tw.txt
if [ "$1"="install" ];then
  yum -y remove tripwire
rm-fr /etc/tripwire/
  yum_tools
mkdir-p$logdir  setup_keyfiles
    trpwire_init
  update_twpol
  twadmin_m_P
  trpwire_init
  tripwire_check
elif [ "$1"="check" ];then
if [ -d$logdir ];then
    tripwire_check    
elseecho'目录丢失，请关注！' |  mail -s$ip'-'$hn'目录丢失'$receiverfielif [ "$1"="update" ];then
        update_twpol
elif [ "$1"="init" ];then
  twadmin_m_P
  trpwire_init
  tripwire_check
elseecho"您输入的参数有误，若是新部署请加参数install来部署或者check来启动检查。"exit0fi