mirror of
https://github.com/jokob-sk/NetAlertX.git
synced 2025-12-07 09:36:05 -08:00
Move all check- scripts to /entrypoint.d/ for better organization
This commit is contained in:
Adam Outler
@@ -1,137 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
# check-0-permissions.sh: Verify file system permissions for critical paths.
|
||||
#
|
||||
# This script ensures that the application has the necessary read and write
|
||||
# permissions for its operational directories. It distinguishes between running
|
||||
# as root (user 0) and a non-privileged user.
|
||||
#
|
||||
# As root, it will proactively fix ownership and permissions.
|
||||
# As a non-root user, it will only warn about issues.
|
||||
|
||||
# --- Color Codes ---
|
||||
RED='\033[1;31m'
|
||||
YELLOW='\033[1;33m'
|
||||
MAGENTA='\033[1;35m'
|
||||
RESET='\033[0m'
|
||||
|
||||
# --- Main Logic ---
|
||||
|
||||
# Define paths that need read-only access
|
||||
READ_ONLY_PATHS="
|
||||
${NETALERTX_APP}
|
||||
${NETALERTX_SERVER}
|
||||
${NETALERTX_FRONT}
|
||||
${SYSTEM_SERVICES_CONFIG}
|
||||
${VIRTUAL_ENV}
|
||||
"
|
||||
|
||||
# Define paths that need read-write access
|
||||
READ_WRITE_PATHS="
|
||||
${NETALERTX_API}
|
||||
${NETALERTX_LOG}
|
||||
${SYSTEM_SERVICES_RUN}
|
||||
${NETALERTX_CONFIG}
|
||||
${NETALERTX_CONFIG_FILE}
|
||||
${NETALERTX_DB}
|
||||
${NETALERTX_DB_FILE}
|
||||
"
|
||||
|
||||
# If running as root, fix permissions first
|
||||
if [ "$(id -u)" -eq 0 ]; then
|
||||
>&2 printf "%s" "${MAGENTA}"
|
||||
>&2 cat <<'EOF'
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
🚨 CRITICAL SECURITY ALERT: NetAlertX is running as ROOT (UID 0)! 🚨
|
||||
|
||||
This configuration bypasses all built-in security hardening measures.
|
||||
You've granted a network monitoring application unrestricted access to
|
||||
your host system. A successful compromise here could jeopardize your
|
||||
entire infrastructure.
|
||||
|
||||
IMMEDIATE ACTION REQUIRED: Switch to the dedicated 'netalertx' user:
|
||||
* Remove any 'user:' directive specifying UID 0 from docker-compose.yml or
|
||||
* switch to the default USER in the image (20211:20211)
|
||||
|
||||
IMPORTANT: This corrective mode automatically adjusts ownership of
|
||||
/app/db and /app/config directories to the netalertx user, ensuring
|
||||
proper operation in subsequent runs.
|
||||
|
||||
Remember: Never operate security-critical tools as root unless you're
|
||||
actively trying to get pwned.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
|
||||
# Set ownership to netalertx user for all read-write paths
|
||||
chown -R netalertx ${READ_WRITE_PATHS}
|
||||
|
||||
# Set directory and file permissions for all read-write paths
|
||||
find ${READ_WRITE_PATHS} -type d -exec chmod u+rwx {} + 2>/dev/null
|
||||
find ${READ_WRITE_PATHS} -type f -exec chmod u+rw {} + 2>/dev/null
|
||||
echo Permissions fixed for read-write paths. Please restart the container as user 20211.
|
||||
sleep infinity & wait $!; exit 211
|
||||
fi
|
||||
|
||||
# --- Permission Validation ---
|
||||
|
||||
failures=0
|
||||
|
||||
# Check all paths
|
||||
ALL_PATHS="${READ_ONLY_PATHS} ${READ_WRITE_PATHS}"
|
||||
echo "${READ_ONLY_PATHS}" | while IFS= read -r path; do
|
||||
[ -z "$path" ] && continue
|
||||
if [ ! -e "$path" ]; then
|
||||
failures=1
|
||||
>&2 printf "%s" "${RED}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
❌ CRITICAL: Path does not exist.
|
||||
|
||||
The required path "${path}" could not be found. The application
|
||||
cannot start without its complete directory structure.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
elif [ ! -r "$path" ]; then
|
||||
failures=1
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: Read permission denied.
|
||||
|
||||
The application cannot read from "${path}". This will cause
|
||||
unpredictable errors. Please correct the file system permissions.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
fi
|
||||
done
|
||||
|
||||
# Check read-write paths specifically for write access
|
||||
for path in $READ_WRITE_PATHS; do
|
||||
if [ -e "$path" ] && [ ! -w "$path" ]; then
|
||||
failures=1
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: Write permission denied.
|
||||
|
||||
The application cannot write to "${path}". This will prevent it from
|
||||
saving data, logs, or configuration.
|
||||
|
||||
To fix this automatically, restart the container with root privileges
|
||||
(e.g., remove the "user:" directive in your Docker Compose file).
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
fi
|
||||
done
|
||||
|
||||
# If there were any failures, exit
|
||||
if [ "$failures" -ne 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
|
||||
@@ -1,31 +0,0 @@
|
||||
#!/bin/sh
|
||||
# check-cap.sh - Uses a real nmap command to detect missing container
|
||||
# privileges and warns the user. It is silent on success.
|
||||
|
||||
# Run a fast nmap command that requires raw sockets, capturing only stderr.
|
||||
ERROR_OUTPUT=$(nmap --privileged -sS -p 20211 127.0.0.1 2>&1)
|
||||
EXIT_CODE=$?
|
||||
|
||||
# Flag common capability errors regardless of exact exit code.
|
||||
if [ "$EXIT_CODE" -ne 0 ] && \
|
||||
echo "$ERROR_OUTPUT" | grep -q -e "Operation not permitted" -e "requires root privileges"
|
||||
then
|
||||
YELLOW=$(printf '\033[1;33m')
|
||||
RESET=$(printf '\033[0m')
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<'EOF'
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: Raw network capabilities are missing.
|
||||
|
||||
Tools that rely on NET_RAW/NET_ADMIN/NET_BIND_SERVICE (e.g. nmap -sS,
|
||||
arp-scan, nbtscan) will not function. Restart the container with:
|
||||
|
||||
--cap-add=NET_RAW --cap-add=NET_ADMIN --cap-add=NET_BIND_SERVICE
|
||||
|
||||
Without those caps, NetAlertX cannot inspect your network. Fix it before
|
||||
trusting any results.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
fi
|
||||
exit 0 # Always exit success even after warnings
|
||||
@@ -1,26 +0,0 @@
|
||||
#!/bin/sh
|
||||
# first-run-check.sh - Checks and initializes configuration files on first run
|
||||
|
||||
# Check for app.conf and deploy if required
|
||||
if [ ! -f ${NETALERTX_CONFIG}/app.conf ]; then
|
||||
mkdir -p "${NETALERTX_CONFIG}" || {
|
||||
>&2 echo "ERROR: Failed to create config directory ${NETALERTX_CONFIG}"
|
||||
exit 1
|
||||
}
|
||||
cp /app/back/app.conf "${NETALERTX_CONFIG}/app.conf" || {
|
||||
>&2 echo "ERROR: Failed to copy default config to ${NETALERTX_CONFIG}/app.conf"
|
||||
exit 2
|
||||
}
|
||||
RESET='\033[0m'
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
🆕 First run detected. Default configuration written to ${NETALERTX_CONFIG}/app.conf.
|
||||
|
||||
Review your settings in the UI or edit the file directly before trusting
|
||||
this instance in production.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
|
||||
>&2 printf "%s" "${RESET}"
|
||||
fi
|
||||
|
||||
@@ -1,464 +0,0 @@
|
||||
#!/bin/sh
|
||||
# This script checks if the database file exists, and if not, creates it with the initial schema.
|
||||
# It is intended to be run at the first start of the application.
|
||||
|
||||
# If ALWAYS_FRESH_INSTALL is true, remove the database to force a rebuild.
|
||||
if [ "${ALWAYS_FRESH_INSTALL}" = "true" ]; then
|
||||
if [ -f "${NETALERTX_DB_FILE}" ]; then
|
||||
# Provide feedback to the user.
|
||||
>&2 echo "INFO: ALWAYS_FRESH_INSTALL is true. Removing existing database to force a fresh installation."
|
||||
rm -f "${NETALERTX_DB_FILE}" "${NETALERTX_DB_FILE}-shm" "${NETALERTX_DB_FILE}-wal"
|
||||
fi
|
||||
# Otherwise, if the db exists, exit.
|
||||
elif [ -f "${NETALERTX_DB_FILE}" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
CYAN='\033[1;36m'
|
||||
RESET='\033[0m'
|
||||
>&2 printf "%s" "${CYAN}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
🆕 First run detected. Building initial database schema in ${NETALERTX_DB_FILE}.
|
||||
|
||||
Do not interrupt this step. Once complete, consider backing up the fresh
|
||||
database before onboarding sensitive networks.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
|
||||
# Write all text to db file until we see "end-of-database-schema"
|
||||
sqlite3 "${NETALERTX_DB_FILE}" <<'end-of-database-schema'
|
||||
CREATE TABLE Events (eve_MAC STRING (50) NOT NULL COLLATE NOCASE, eve_IP STRING (50) NOT NULL COLLATE NOCASE, eve_DateTime DATETIME NOT NULL, eve_EventType STRING (30) NOT NULL COLLATE NOCASE, eve_AdditionalInfo STRING (250) DEFAULT (''), eve_PendingAlertEmail BOOLEAN NOT NULL CHECK (eve_PendingAlertEmail IN (0, 1)) DEFAULT (1), eve_PairEventRowid INTEGER);
|
||||
CREATE TABLE Sessions (ses_MAC STRING (50) COLLATE NOCASE, ses_IP STRING (50) COLLATE NOCASE, ses_EventTypeConnection STRING (30) COLLATE NOCASE, ses_DateTimeConnection DATETIME, ses_EventTypeDisconnection STRING (30) COLLATE NOCASE, ses_DateTimeDisconnection DATETIME, ses_StillConnected BOOLEAN, ses_AdditionalInfo STRING (250));
|
||||
CREATE TABLE IF NOT EXISTS "Online_History" (
|
||||
"Index" INTEGER,
|
||||
"Scan_Date" TEXT,
|
||||
"Online_Devices" INTEGER,
|
||||
"Down_Devices" INTEGER,
|
||||
"All_Devices" INTEGER,
|
||||
"Archived_Devices" INTEGER,
|
||||
"Offline_Devices" INTEGER,
|
||||
PRIMARY KEY("Index" AUTOINCREMENT)
|
||||
);
|
||||
CREATE TABLE Devices (
|
||||
devMac STRING (50) PRIMARY KEY NOT NULL COLLATE NOCASE,
|
||||
devName STRING (50) NOT NULL DEFAULT "(unknown)",
|
||||
devOwner STRING (30) DEFAULT "(unknown)" NOT NULL,
|
||||
devType STRING (30),
|
||||
devVendor STRING (250),
|
||||
devFavorite BOOLEAN CHECK (devFavorite IN (0, 1)) DEFAULT (0) NOT NULL,
|
||||
devGroup STRING (10),
|
||||
devComments TEXT,
|
||||
devFirstConnection DATETIME NOT NULL,
|
||||
devLastConnection DATETIME NOT NULL,
|
||||
devLastIP STRING (50) NOT NULL COLLATE NOCASE,
|
||||
devStaticIP BOOLEAN DEFAULT (0) NOT NULL CHECK (devStaticIP IN (0, 1)),
|
||||
devScan INTEGER DEFAULT (1) NOT NULL,
|
||||
devLogEvents BOOLEAN NOT NULL DEFAULT (1) CHECK (devLogEvents IN (0, 1)),
|
||||
devAlertEvents BOOLEAN NOT NULL DEFAULT (1) CHECK (devAlertEvents IN (0, 1)),
|
||||
devAlertDown BOOLEAN NOT NULL DEFAULT (0) CHECK (devAlertDown IN (0, 1)),
|
||||
devSkipRepeated INTEGER DEFAULT 0 NOT NULL,
|
||||
devLastNotification DATETIME,
|
||||
devPresentLastScan BOOLEAN NOT NULL DEFAULT (0) CHECK (devPresentLastScan IN (0, 1)),
|
||||
devIsNew BOOLEAN NOT NULL DEFAULT (1) CHECK (devIsNew IN (0, 1)),
|
||||
devLocation STRING (250) COLLATE NOCASE,
|
||||
devIsArchived BOOLEAN NOT NULL DEFAULT (0) CHECK (devIsArchived IN (0, 1)),
|
||||
devParentMAC TEXT,
|
||||
devParentPort INTEGER,
|
||||
devIcon TEXT,
|
||||
devGUID TEXT,
|
||||
devSite TEXT,
|
||||
devSSID TEXT,
|
||||
devSyncHubNode TEXT,
|
||||
devSourcePlugin TEXT
|
||||
, "devCustomProps" TEXT);
|
||||
CREATE TABLE IF NOT EXISTS "Settings" (
|
||||
"setKey" TEXT,
|
||||
"setName" TEXT,
|
||||
"setDescription" TEXT,
|
||||
"setType" TEXT,
|
||||
"setOptions" TEXT,
|
||||
"setGroup" TEXT,
|
||||
"setValue" TEXT,
|
||||
"setEvents" TEXT,
|
||||
"setOverriddenByEnv" INTEGER
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS "Parameters" (
|
||||
"par_ID" TEXT PRIMARY KEY,
|
||||
"par_Value" TEXT
|
||||
);
|
||||
CREATE TABLE Plugins_Objects(
|
||||
"Index" INTEGER,
|
||||
Plugin TEXT NOT NULL,
|
||||
Object_PrimaryID TEXT NOT NULL,
|
||||
Object_SecondaryID TEXT NOT NULL,
|
||||
DateTimeCreated TEXT NOT NULL,
|
||||
DateTimeChanged TEXT NOT NULL,
|
||||
Watched_Value1 TEXT NOT NULL,
|
||||
Watched_Value2 TEXT NOT NULL,
|
||||
Watched_Value3 TEXT NOT NULL,
|
||||
Watched_Value4 TEXT NOT NULL,
|
||||
Status TEXT NOT NULL,
|
||||
Extra TEXT NOT NULL,
|
||||
UserData TEXT NOT NULL,
|
||||
ForeignKey TEXT NOT NULL,
|
||||
SyncHubNodeName TEXT,
|
||||
"HelpVal1" TEXT,
|
||||
"HelpVal2" TEXT,
|
||||
"HelpVal3" TEXT,
|
||||
"HelpVal4" TEXT,
|
||||
ObjectGUID TEXT,
|
||||
PRIMARY KEY("Index" AUTOINCREMENT)
|
||||
);
|
||||
CREATE TABLE Plugins_Events(
|
||||
"Index" INTEGER,
|
||||
Plugin TEXT NOT NULL,
|
||||
Object_PrimaryID TEXT NOT NULL,
|
||||
Object_SecondaryID TEXT NOT NULL,
|
||||
DateTimeCreated TEXT NOT NULL,
|
||||
DateTimeChanged TEXT NOT NULL,
|
||||
Watched_Value1 TEXT NOT NULL,
|
||||
Watched_Value2 TEXT NOT NULL,
|
||||
Watched_Value3 TEXT NOT NULL,
|
||||
Watched_Value4 TEXT NOT NULL,
|
||||
Status TEXT NOT NULL,
|
||||
Extra TEXT NOT NULL,
|
||||
UserData TEXT NOT NULL,
|
||||
ForeignKey TEXT NOT NULL,
|
||||
SyncHubNodeName TEXT,
|
||||
"HelpVal1" TEXT,
|
||||
"HelpVal2" TEXT,
|
||||
"HelpVal3" TEXT,
|
||||
"HelpVal4" TEXT, "ObjectGUID" TEXT,
|
||||
PRIMARY KEY("Index" AUTOINCREMENT)
|
||||
);
|
||||
CREATE TABLE Plugins_History(
|
||||
"Index" INTEGER,
|
||||
Plugin TEXT NOT NULL,
|
||||
Object_PrimaryID TEXT NOT NULL,
|
||||
Object_SecondaryID TEXT NOT NULL,
|
||||
DateTimeCreated TEXT NOT NULL,
|
||||
DateTimeChanged TEXT NOT NULL,
|
||||
Watched_Value1 TEXT NOT NULL,
|
||||
Watched_Value2 TEXT NOT NULL,
|
||||
Watched_Value3 TEXT NOT NULL,
|
||||
Watched_Value4 TEXT NOT NULL,
|
||||
Status TEXT NOT NULL,
|
||||
Extra TEXT NOT NULL,
|
||||
UserData TEXT NOT NULL,
|
||||
ForeignKey TEXT NOT NULL,
|
||||
SyncHubNodeName TEXT,
|
||||
"HelpVal1" TEXT,
|
||||
"HelpVal2" TEXT,
|
||||
"HelpVal3" TEXT,
|
||||
"HelpVal4" TEXT, "ObjectGUID" TEXT,
|
||||
PRIMARY KEY("Index" AUTOINCREMENT)
|
||||
);
|
||||
CREATE TABLE Plugins_Language_Strings(
|
||||
"Index" INTEGER,
|
||||
Language_Code TEXT NOT NULL,
|
||||
String_Key TEXT NOT NULL,
|
||||
String_Value TEXT NOT NULL,
|
||||
Extra TEXT NOT NULL,
|
||||
PRIMARY KEY("Index" AUTOINCREMENT)
|
||||
);
|
||||
CREATE TABLE CurrentScan (
|
||||
cur_MAC STRING(50) NOT NULL COLLATE NOCASE,
|
||||
cur_IP STRING(50) NOT NULL COLLATE NOCASE,
|
||||
cur_Vendor STRING(250),
|
||||
cur_ScanMethod STRING(10),
|
||||
cur_Name STRING(250),
|
||||
cur_LastQuery STRING(250),
|
||||
cur_DateTime STRING(250),
|
||||
cur_SyncHubNodeName STRING(50),
|
||||
cur_NetworkSite STRING(250),
|
||||
cur_SSID STRING(250),
|
||||
cur_NetworkNodeMAC STRING(250),
|
||||
cur_PORT STRING(250),
|
||||
cur_Type STRING(250),
|
||||
UNIQUE(cur_MAC)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS "AppEvents" (
|
||||
"Index" INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
"GUID" TEXT UNIQUE,
|
||||
"AppEventProcessed" BOOLEAN,
|
||||
"DateTimeCreated" TEXT,
|
||||
"ObjectType" TEXT,
|
||||
"ObjectGUID" TEXT,
|
||||
"ObjectPlugin" TEXT,
|
||||
"ObjectPrimaryID" TEXT,
|
||||
"ObjectSecondaryID" TEXT,
|
||||
"ObjectForeignKey" TEXT,
|
||||
"ObjectIndex" TEXT,
|
||||
"ObjectIsNew" BOOLEAN,
|
||||
"ObjectIsArchived" BOOLEAN,
|
||||
"ObjectStatusColumn" TEXT,
|
||||
"ObjectStatus" TEXT,
|
||||
"AppEventType" TEXT,
|
||||
"Helper1" TEXT,
|
||||
"Helper2" TEXT,
|
||||
"Helper3" TEXT,
|
||||
"Extra" TEXT
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS "Notifications" (
|
||||
"Index" INTEGER,
|
||||
"GUID" TEXT UNIQUE,
|
||||
"DateTimeCreated" TEXT,
|
||||
"DateTimePushed" TEXT,
|
||||
"Status" TEXT,
|
||||
"JSON" TEXT,
|
||||
"Text" TEXT,
|
||||
"HTML" TEXT,
|
||||
"PublishedVia" TEXT,
|
||||
"Extra" TEXT,
|
||||
PRIMARY KEY("Index" AUTOINCREMENT)
|
||||
);
|
||||
CREATE INDEX IDX_eve_DateTime ON Events (eve_DateTime);
|
||||
CREATE INDEX IDX_eve_EventType ON Events (eve_EventType COLLATE NOCASE);
|
||||
CREATE INDEX IDX_eve_MAC ON Events (eve_MAC COLLATE NOCASE);
|
||||
CREATE INDEX IDX_eve_PairEventRowid ON Events (eve_PairEventRowid);
|
||||
CREATE INDEX IDX_ses_EventTypeDisconnection ON Sessions (ses_EventTypeDisconnection COLLATE NOCASE);
|
||||
CREATE INDEX IDX_ses_EventTypeConnection ON Sessions (ses_EventTypeConnection COLLATE NOCASE);
|
||||
CREATE INDEX IDX_ses_DateTimeDisconnection ON Sessions (ses_DateTimeDisconnection);
|
||||
CREATE INDEX IDX_ses_MAC ON Sessions (ses_MAC COLLATE NOCASE);
|
||||
CREATE INDEX IDX_ses_DateTimeConnection ON Sessions (ses_DateTimeConnection);
|
||||
CREATE INDEX IDX_dev_PresentLastScan ON Devices (devPresentLastScan);
|
||||
CREATE INDEX IDX_dev_FirstConnection ON Devices (devFirstConnection);
|
||||
CREATE INDEX IDX_dev_AlertDeviceDown ON Devices (devAlertDown);
|
||||
CREATE INDEX IDX_dev_StaticIP ON Devices (devStaticIP);
|
||||
CREATE INDEX IDX_dev_ScanCycle ON Devices (devScan);
|
||||
CREATE INDEX IDX_dev_Favorite ON Devices (devFavorite);
|
||||
CREATE INDEX IDX_dev_LastIP ON Devices (devLastIP);
|
||||
CREATE INDEX IDX_dev_NewDevice ON Devices (devIsNew);
|
||||
CREATE INDEX IDX_dev_Archived ON Devices (devIsArchived);
|
||||
CREATE VIEW Events_Devices AS
|
||||
SELECT *
|
||||
FROM Events
|
||||
LEFT JOIN Devices ON eve_MAC = devMac
|
||||
/* Events_Devices(eve_MAC,eve_IP,eve_DateTime,eve_EventType,eve_AdditionalInfo,eve_PendingAlertEmail,eve_PairEventRowid,devMac,devName,devOwner,devType,devVendor,devFavorite,devGroup,devComments,devFirstConnection,devLastConnection,devLastIP,devStaticIP,devScan,devLogEvents,devAlertEvents,devAlertDown,devSkipRepeated,devLastNotification,devPresentLastScan,devIsNew,devLocation,devIsArchived,devParentMAC,devParentPort,devIcon,devGUID,devSite,devSSID,devSyncHubNode,devSourcePlugin,devCustomProps) */;
|
||||
CREATE VIEW LatestEventsPerMAC AS
|
||||
WITH RankedEvents AS (
|
||||
SELECT
|
||||
e.*,
|
||||
ROW_NUMBER() OVER (PARTITION BY e.eve_MAC ORDER BY e.eve_DateTime DESC) AS row_num
|
||||
FROM Events AS e
|
||||
)
|
||||
SELECT
|
||||
e.*,
|
||||
d.*,
|
||||
c.*
|
||||
FROM RankedEvents AS e
|
||||
LEFT JOIN Devices AS d ON e.eve_MAC = d.devMac
|
||||
INNER JOIN CurrentScan AS c ON e.eve_MAC = c.cur_MAC
|
||||
WHERE e.row_num = 1
|
||||
/* LatestEventsPerMAC(eve_MAC,eve_IP,eve_DateTime,eve_EventType,eve_AdditionalInfo,eve_PendingAlertEmail,eve_PairEventRowid,row_num,devMac,devName,devOwner,devType,devVendor,devFavorite,devGroup,devComments,devFirstConnection,devLastConnection,devLastIP,devStaticIP,devScan,devLogEvents,devAlertEvents,devAlertDown,devSkipRepeated,devLastNotification,devPresentLastScan,devIsNew,devLocation,devIsArchived,devParentMAC,devParentPort,devIcon,devGUID,devSite,devSSID,devSyncHubNode,devSourcePlugin,devCustomProps,cur_MAC,cur_IP,cur_Vendor,cur_ScanMethod,cur_Name,cur_LastQuery,cur_DateTime,cur_SyncHubNodeName,cur_NetworkSite,cur_SSID,cur_NetworkNodeMAC,cur_PORT,cur_Type) */;
|
||||
CREATE VIEW Sessions_Devices AS SELECT * FROM Sessions LEFT JOIN "Devices" ON ses_MAC = devMac
|
||||
/* Sessions_Devices(ses_MAC,ses_IP,ses_EventTypeConnection,ses_DateTimeConnection,ses_EventTypeDisconnection,ses_DateTimeDisconnection,ses_StillConnected,ses_AdditionalInfo,devMac,devName,devOwner,devType,devVendor,devFavorite,devGroup,devComments,devFirstConnection,devLastConnection,devLastIP,devStaticIP,devScan,devLogEvents,devAlertEvents,devAlertDown,devSkipRepeated,devLastNotification,devPresentLastScan,devIsNew,devLocation,devIsArchived,devParentMAC,devParentPort,devIcon,devGUID,devSite,devSSID,devSyncHubNode,devSourcePlugin,devCustomProps) */;
|
||||
CREATE VIEW Convert_Events_to_Sessions AS SELECT EVE1.eve_MAC,
|
||||
EVE1.eve_IP,
|
||||
EVE1.eve_EventType AS eve_EventTypeConnection,
|
||||
EVE1.eve_DateTime AS eve_DateTimeConnection,
|
||||
CASE WHEN EVE2.eve_EventType IN ('Disconnected', 'Device Down') OR
|
||||
EVE2.eve_EventType IS NULL THEN EVE2.eve_EventType ELSE '<missing event>' END AS eve_EventTypeDisconnection,
|
||||
CASE WHEN EVE2.eve_EventType IN ('Disconnected', 'Device Down') THEN EVE2.eve_DateTime ELSE NULL END AS eve_DateTimeDisconnection,
|
||||
CASE WHEN EVE2.eve_EventType IS NULL THEN 1 ELSE 0 END AS eve_StillConnected,
|
||||
EVE1.eve_AdditionalInfo
|
||||
FROM Events AS EVE1
|
||||
LEFT JOIN
|
||||
Events AS EVE2 ON EVE1.eve_PairEventRowID = EVE2.RowID
|
||||
WHERE EVE1.eve_EventType IN ('New Device', 'Connected','Down Reconnected')
|
||||
UNION
|
||||
SELECT eve_MAC,
|
||||
eve_IP,
|
||||
'<missing event>' AS eve_EventTypeConnection,
|
||||
NULL AS eve_DateTimeConnection,
|
||||
eve_EventType AS eve_EventTypeDisconnection,
|
||||
eve_DateTime AS eve_DateTimeDisconnection,
|
||||
0 AS eve_StillConnected,
|
||||
eve_AdditionalInfo
|
||||
FROM Events AS EVE1
|
||||
WHERE (eve_EventType = 'Device Down' OR
|
||||
eve_EventType = 'Disconnected') AND
|
||||
EVE1.eve_PairEventRowID IS NULL
|
||||
/* Convert_Events_to_Sessions(eve_MAC,eve_IP,eve_EventTypeConnection,eve_DateTimeConnection,eve_EventTypeDisconnection,eve_DateTimeDisconnection,eve_StillConnected,eve_AdditionalInfo) */;
|
||||
CREATE TRIGGER "trg_insert_devices"
|
||||
AFTER INSERT ON "Devices"
|
||||
WHEN NOT EXISTS (
|
||||
SELECT 1 FROM AppEvents
|
||||
WHERE AppEventProcessed = 0
|
||||
AND ObjectType = 'Devices'
|
||||
AND ObjectGUID = NEW.devGUID
|
||||
AND ObjectStatus = CASE WHEN NEW.devPresentLastScan = 1 THEN 'online' ELSE 'offline' END
|
||||
AND AppEventType = 'insert'
|
||||
)
|
||||
BEGIN
|
||||
INSERT INTO "AppEvents" (
|
||||
"GUID",
|
||||
"DateTimeCreated",
|
||||
"AppEventProcessed",
|
||||
"ObjectType",
|
||||
"ObjectGUID",
|
||||
"ObjectPrimaryID",
|
||||
"ObjectSecondaryID",
|
||||
"ObjectStatus",
|
||||
"ObjectStatusColumn",
|
||||
"ObjectIsNew",
|
||||
"ObjectIsArchived",
|
||||
"ObjectForeignKey",
|
||||
"ObjectPlugin",
|
||||
"AppEventType"
|
||||
)
|
||||
VALUES (
|
||||
|
||||
lower(
|
||||
hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-' || '4' ||
|
||||
substr(hex( randomblob(2)), 2) || '-' ||
|
||||
substr('AB89', 1 + (abs(random()) % 4) , 1) ||
|
||||
substr(hex(randomblob(2)), 2) || '-' ||
|
||||
hex(randomblob(6))
|
||||
)
|
||||
,
|
||||
DATETIME('now'),
|
||||
FALSE,
|
||||
'Devices',
|
||||
NEW.devGUID, -- ObjectGUID
|
||||
NEW.devMac, -- ObjectPrimaryID
|
||||
NEW.devLastIP, -- ObjectSecondaryID
|
||||
CASE WHEN NEW.devPresentLastScan = 1 THEN 'online' ELSE 'offline' END, -- ObjectStatus
|
||||
'devPresentLastScan', -- ObjectStatusColumn
|
||||
NEW.devIsNew, -- ObjectIsNew
|
||||
NEW.devIsArchived, -- ObjectIsArchived
|
||||
NEW.devGUID, -- ObjectForeignKey
|
||||
'DEVICES', -- ObjectForeignKey
|
||||
'insert'
|
||||
);
|
||||
END;
|
||||
CREATE TRIGGER "trg_update_devices"
|
||||
AFTER UPDATE ON "Devices"
|
||||
WHEN NOT EXISTS (
|
||||
SELECT 1 FROM AppEvents
|
||||
WHERE AppEventProcessed = 0
|
||||
AND ObjectType = 'Devices'
|
||||
AND ObjectGUID = NEW.devGUID
|
||||
AND ObjectStatus = CASE WHEN NEW.devPresentLastScan = 1 THEN 'online' ELSE 'offline' END
|
||||
AND AppEventType = 'update'
|
||||
)
|
||||
BEGIN
|
||||
INSERT INTO "AppEvents" (
|
||||
"GUID",
|
||||
"DateTimeCreated",
|
||||
"AppEventProcessed",
|
||||
"ObjectType",
|
||||
"ObjectGUID",
|
||||
"ObjectPrimaryID",
|
||||
"ObjectSecondaryID",
|
||||
"ObjectStatus",
|
||||
"ObjectStatusColumn",
|
||||
"ObjectIsNew",
|
||||
"ObjectIsArchived",
|
||||
"ObjectForeignKey",
|
||||
"ObjectPlugin",
|
||||
"AppEventType"
|
||||
)
|
||||
VALUES (
|
||||
|
||||
lower(
|
||||
hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-' || '4' ||
|
||||
substr(hex( randomblob(2)), 2) || '-' ||
|
||||
substr('AB89', 1 + (abs(random()) % 4) , 1) ||
|
||||
substr(hex(randomblob(2)), 2) || '-' ||
|
||||
hex(randomblob(6))
|
||||
)
|
||||
,
|
||||
DATETIME('now'),
|
||||
FALSE,
|
||||
'Devices',
|
||||
NEW.devGUID, -- ObjectGUID
|
||||
NEW.devMac, -- ObjectPrimaryID
|
||||
NEW.devLastIP, -- ObjectSecondaryID
|
||||
CASE WHEN NEW.devPresentLastScan = 1 THEN 'online' ELSE 'offline' END, -- ObjectStatus
|
||||
'devPresentLastScan', -- ObjectStatusColumn
|
||||
NEW.devIsNew, -- ObjectIsNew
|
||||
NEW.devIsArchived, -- ObjectIsArchived
|
||||
NEW.devGUID, -- ObjectForeignKey
|
||||
'DEVICES', -- ObjectForeignKey
|
||||
'update'
|
||||
);
|
||||
END;
|
||||
CREATE TRIGGER "trg_delete_devices"
|
||||
AFTER DELETE ON "Devices"
|
||||
WHEN NOT EXISTS (
|
||||
SELECT 1 FROM AppEvents
|
||||
WHERE AppEventProcessed = 0
|
||||
AND ObjectType = 'Devices'
|
||||
AND ObjectGUID = OLD.devGUID
|
||||
AND ObjectStatus = CASE WHEN OLD.devPresentLastScan = 1 THEN 'online' ELSE 'offline' END
|
||||
AND AppEventType = 'delete'
|
||||
)
|
||||
BEGIN
|
||||
INSERT INTO "AppEvents" (
|
||||
"GUID",
|
||||
"DateTimeCreated",
|
||||
"AppEventProcessed",
|
||||
"ObjectType",
|
||||
"ObjectGUID",
|
||||
"ObjectPrimaryID",
|
||||
"ObjectSecondaryID",
|
||||
"ObjectStatus",
|
||||
"ObjectStatusColumn",
|
||||
"ObjectIsNew",
|
||||
"ObjectIsArchived",
|
||||
"ObjectForeignKey",
|
||||
"ObjectPlugin",
|
||||
"AppEventType"
|
||||
)
|
||||
VALUES (
|
||||
|
||||
lower(
|
||||
hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-' || '4' ||
|
||||
substr(hex( randomblob(2)), 2) || '-' ||
|
||||
substr('AB89', 1 + (abs(random()) % 4) , 1) ||
|
||||
substr(hex(randomblob(2)), 2) || '-' ||
|
||||
hex(randomblob(6))
|
||||
)
|
||||
,
|
||||
DATETIME('now'),
|
||||
FALSE,
|
||||
'Devices',
|
||||
OLD.devGUID, -- ObjectGUID
|
||||
OLD.devMac, -- ObjectPrimaryID
|
||||
OLD.devLastIP, -- ObjectSecondaryID
|
||||
CASE WHEN OLD.devPresentLastScan = 1 THEN 'online' ELSE 'offline' END, -- ObjectStatus
|
||||
'devPresentLastScan', -- ObjectStatusColumn
|
||||
OLD.devIsNew, -- ObjectIsNew
|
||||
OLD.devIsArchived, -- ObjectIsArchived
|
||||
OLD.devGUID, -- ObjectForeignKey
|
||||
'DEVICES', -- ObjectForeignKey
|
||||
'delete'
|
||||
);
|
||||
END;
|
||||
end-of-database-schema
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
RED='\033[1;31m'
|
||||
RESET='\033[0m'
|
||||
>&2 printf "%s" "${RED}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
❌ CRITICAL: Database schema creation failed for ${NETALERTX_DB_FILE}.
|
||||
|
||||
NetAlertX cannot start without a properly initialized database. This
|
||||
failure typically indicates:
|
||||
|
||||
* Insufficient disk space or write permissions in the database directory
|
||||
* Corrupted or inaccessible SQLite installation
|
||||
* File system issues preventing database file creation
|
||||
|
||||
Check the logs for detailed SQLite error messages. Ensure the container
|
||||
has write access to the database path and adequate storage space.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,53 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Initialize required directories and log files
|
||||
# These must exist before services start to avoid permission/write errors
|
||||
|
||||
check_mandatory_folders() {
|
||||
# Check and create plugins log directory
|
||||
if [ ! -d "${NETALERTX_PLUGINS_LOG}" ]; then
|
||||
echo " * Creating Plugins log."
|
||||
if ! mkdir -p "${NETALERTX_PLUGINS_LOG}"; then
|
||||
echo "Error: Failed to create plugins log directory: ${NETALERTX_PLUGINS_LOG}"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check and create system services run log directory
|
||||
if [ ! -d "${SYSTEM_SERVICES_RUN_LOG}" ]; then
|
||||
echo " * Creating System services run log."
|
||||
if ! mkdir -p "${SYSTEM_SERVICES_RUN_LOG}"; then
|
||||
echo "Error: Failed to create system services run log directory: ${SYSTEM_SERVICES_RUN_LOG}"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check and create system services run tmp directory
|
||||
if [ ! -d "${SYSTEM_SERVICES_RUN_TMP}" ]; then
|
||||
echo " * Creating System services run tmp."
|
||||
if ! mkdir -p "${SYSTEM_SERVICES_RUN_TMP}"; then
|
||||
echo "Error: Failed to create system services run tmp directory: ${SYSTEM_SERVICES_RUN_TMP}"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check and create DB locked log file
|
||||
if [ ! -f "${LOG_DB_IS_LOCKED}" ]; then
|
||||
echo " * Creating DB locked log."
|
||||
if ! touch "${LOG_DB_IS_LOCKED}"; then
|
||||
echo "Error: Failed to create DB locked log file: ${LOG_DB_IS_LOCKED}"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check and create execution queue log file
|
||||
if [ ! -f "${LOG_EXECUTION_QUEUE}" ]; then
|
||||
echo " * Creating Execution queue log."
|
||||
if ! touch "${LOG_EXECUTION_QUEUE}"; then
|
||||
echo "Error: Failed to create execution queue log file: ${LOG_EXECUTION_QUEUE}"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Run the function
|
||||
check_mandatory_folders
|
||||
@@ -1,64 +0,0 @@
|
||||
#!/bin/sh
|
||||
# check-network-mode.sh - detect when the container is not using host networking.
|
||||
|
||||
# Exit if NETALERTX_DEBUG=1
|
||||
if [ "${NETALERTX_DEBUG}" = "1" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Get the default network interface
|
||||
DEFAULT_IF="$(ip route show default 0.0.0.0/0 2>/dev/null | awk 'NR==1 {print $5}')"
|
||||
if [ -z "${DEFAULT_IF}" ]; then
|
||||
# No default route; nothing to validate.
|
||||
exit 0
|
||||
fi
|
||||
|
||||
|
||||
IF_LINK_INFO="$(ip link show "${DEFAULT_IF}" 2>/dev/null)"
|
||||
IF_IP="$(ip -4 addr show "${DEFAULT_IF}" 2>/dev/null | awk '/inet / {print $2}' | head -n1)"
|
||||
IF_MAC=""
|
||||
if [ -r "/sys/class/net/${DEFAULT_IF}/address" ]; then
|
||||
IF_MAC="$(cat "/sys/class/net/${DEFAULT_IF}/address")"
|
||||
fi
|
||||
|
||||
looks_like_bridge="0"
|
||||
|
||||
# Check for common bridge MAC and IP patterns
|
||||
case "${IF_MAC}" in
|
||||
02:42:*) looks_like_bridge="1" ;;
|
||||
00:00:00:00:00:00) looks_like_bridge="1" ;;
|
||||
"") ;; # leave as is
|
||||
esac
|
||||
|
||||
# Check for common bridge IP ranges
|
||||
case "${IF_IP}" in
|
||||
172.1[6-9].*|172.2[0-9].*|172.3[0-1].*) looks_like_bridge="1" ;;
|
||||
192.168.65.*) looks_like_bridge="1" ;;
|
||||
esac
|
||||
|
||||
if echo "${IF_LINK_INFO}" | grep -q "@if"; then
|
||||
looks_like_bridge="1"
|
||||
fi
|
||||
|
||||
if [ "${looks_like_bridge}" -ne 1 ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
YELLOW=$(printf '\033[1;33m')
|
||||
RESET=$(printf '\033[0m')
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: NetAlertX is not running with --network=host.
|
||||
|
||||
Bridge networking blocks passive discovery (ARP, NBNS, mDNS) and active
|
||||
scanning accuracy. Most plugins expect raw access to the LAN through host
|
||||
networking and CAP_NET_RAW capabilities.
|
||||
|
||||
Restart the container with:
|
||||
docker run --network=host --cap-add=NET_RAW --cap-add=NET_ADMIN --cap-add=NET_BIND_SERVICE
|
||||
or set "network_mode: host" in docker-compose.yml.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
exit 0
|
||||
@@ -1,50 +0,0 @@
|
||||
#!/bin/sh
|
||||
# check-nginx-config.sh - verify nginx conf.active mount is writable when startup needs to render config.
|
||||
|
||||
CONF_ACTIVE_DIR="${SYSTEM_NGINX_CONFIG}/conf.active"
|
||||
TARGET_FILE="${CONF_ACTIVE_DIR}/netalertx.conf"
|
||||
|
||||
# If the directory is missing entirely we warn and exit failure so the caller can see the message.
|
||||
if [ ! -d "${CONF_ACTIVE_DIR}" ]; then
|
||||
YELLOW=$(printf '\033[1;33m')
|
||||
RESET=$(printf '\033[0m')
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: Nginx configuration mount ${CONF_ACTIVE_DIR} is missing.
|
||||
|
||||
Custom listen address or port changes require a writable nginx conf.active
|
||||
directory. Without it, the container falls back to defaults and ignores
|
||||
your overrides.
|
||||
|
||||
Create a bind mount:
|
||||
--mount type=bind,src=/path/on/host,dst=${CONF_ACTIVE_DIR}
|
||||
and ensure it is owned by the netalertx user (20211:20211) with 700 perms.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TMP_FILE="${CONF_ACTIVE_DIR}/.netalertx-write-test"
|
||||
if ! ( : >"${TMP_FILE}" ) 2>/dev/null; then
|
||||
YELLOW=$(printf '\033[1;33m')
|
||||
RESET=$(printf '\033[0m')
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: Unable to write to ${TARGET_FILE}.
|
||||
|
||||
Ensure the conf.active mount is writable by the netalertx user before
|
||||
changing LISTEN_ADDR or PORT. Fix permissions:
|
||||
chown -R 20211:20211 ${CONF_ACTIVE_DIR}
|
||||
find ${CONF_ACTIVE_DIR} -type d -exec chmod 700 {} +
|
||||
find ${CONF_ACTIVE_DIR} -type f -exec chmod 600 {} +
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
exit 1
|
||||
fi
|
||||
rm -f "${TMP_FILE}"
|
||||
|
||||
exit 0
|
||||
@@ -1,45 +0,0 @@
|
||||
#!/bin/sh
|
||||
# check-storage-extra.sh - ensure additional NetAlertX directories are persistent mounts.
|
||||
|
||||
|
||||
if [ "${NETALERTX_DEBUG}" == "1" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
warn_if_not_persistent_mount() {
|
||||
path="$1"
|
||||
label="$2"
|
||||
if awk -v target="${path}" '$5 == target {found=1} END {exit found ? 0 : 1}' /proc/self/mountinfo; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
failures=1
|
||||
YELLOW=$(printf '\033[1;33m')
|
||||
RESET=$(printf '\033[0m')
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: ${path} is not a persistent mount.
|
||||
|
||||
${label} relies on host storage to persist data across container restarts.
|
||||
Mount this directory from the host or a named volume before trusting the
|
||||
container's output.
|
||||
|
||||
Example:
|
||||
--mount type=bind,src=/path/on/host,dst=${path}
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
return 1
|
||||
}
|
||||
|
||||
failures=0
|
||||
warn_if_not_persistent_mount "${NETALERTX_LOG}" "Logs" || failures=$((failures + 1))
|
||||
warn_if_not_persistent_mount "${NETALERTX_API}" "API JSON cache" || failures=$((failures + 1))
|
||||
warn_if_not_persistent_mount "${SYSTEM_SERVICES_RUN}" "Runtime work directory" || failures=$((failures + 1))
|
||||
|
||||
if [ "${failures}" -ne 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
exit 0
|
||||
@@ -1,84 +0,0 @@
|
||||
#!/bin/sh
|
||||
# check-storage.sh - Verify critical paths are persistent mounts.
|
||||
|
||||
# Define non-persistent filesystem types to check against
|
||||
# NOTE: 'overlay' and 'aufs' are the primary non-persistent types for container roots.
|
||||
# 'tmpfs' and 'ramfs' are for specific non-persistent mounts.
|
||||
NON_PERSISTENT_FSTYPES="tmpfs|ramfs|overlay|aufs"
|
||||
MANDATORY_PERSISTENT_PATHS="/app/db /app/config"
|
||||
|
||||
# This function is now the robust persistence checker.
|
||||
is_persistent_mount() {
|
||||
target_path="$1"
|
||||
|
||||
mount_entry=$(awk -v path="${target_path}" '$2 == path { print $0 }' /proc/mounts)
|
||||
|
||||
if [ -z "${mount_entry}" ]; then
|
||||
# CRITICAL FIX: If the mount entry is empty, check if it's one of the mandatory paths.
|
||||
if echo "${MANDATORY_PERSISTENT_PATHS}" | grep -w -q "${target_path}"; then
|
||||
# The path is mandatory but not mounted: FAIL (Not persistent)
|
||||
return 1
|
||||
else
|
||||
# Not mandatory and not a mount point: Assume persistence is inherited from parent (pass)
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# ... (rest of the original logic remains the same for explicit mounts)
|
||||
fs_type=$(echo "${mount_entry}" | awk '{print $3}')
|
||||
|
||||
# Check if the filesystem type matches any non-persistent types
|
||||
if echo "${fs_type}" | grep -E -q "^(${NON_PERSISTENT_FSTYPES})$"; then
|
||||
return 1 # Not persistent (matched a non-persistent type)
|
||||
else
|
||||
return 0 # Persistent
|
||||
fi
|
||||
}
|
||||
|
||||
warn_if_not_persistent_mount() {
|
||||
path="$1"
|
||||
|
||||
if is_persistent_mount "${path}"; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
failures=1
|
||||
YELLOW=$(printf '\033[1;33m')
|
||||
RESET=$(printf '\033[0m')
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: ${path} is not a persistent mount.
|
||||
|
||||
Your data in this directory may not persist across container restarts or
|
||||
upgrades. The filesystem type for this path is identified as non-persistent.
|
||||
|
||||
Fix: mount ${path} explicitly as a bind mount or a named volume:
|
||||
# Bind mount
|
||||
--mount type=bind,src=/path/on/host,dst=${path}
|
||||
|
||||
# Named volume
|
||||
--mount type=volume,src=netalertx-data,dst=${path}
|
||||
|
||||
Apply one of these mount options and restart the container.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
}
|
||||
|
||||
# If NETALERTX_DEBUG=1 then we will exit
|
||||
if [ "${NETALERTX_DEBUG}" = "1" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
failures=0
|
||||
# NETALERTX_DB is a file, so we check its directory
|
||||
warn_if_not_persistent_mount "$(dirname "${NETALERTX_DB_FILE}")"
|
||||
warn_if_not_persistent_mount "${NETALERTX_CONFIG}"
|
||||
|
||||
|
||||
if [ "${failures}" -ne 0 ]; then
|
||||
# We only warn, not exit, as this is not a critical failure
|
||||
# but the user should be aware of the potential data loss.
|
||||
sleep 1 # Give user time to read the message
|
||||
fi
|
||||
@@ -1,48 +0,0 @@
|
||||
#!/bin/sh
|
||||
# storage-check.sh - Verify critical paths use dedicated mounts.
|
||||
|
||||
warn_if_not_dedicated_mount() {
|
||||
path="$1"
|
||||
if awk -v target="${path}" '$5 == target {found=1} END {exit found ? 0 : 1}' /proc/self/mountinfo; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
failures=1
|
||||
YELLOW=$(printf '\033[1;33m')
|
||||
RESET=$(printf '\033[0m')
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: ${path} is not mounted separately inside this container.
|
||||
|
||||
NetAlertX runs as a single unprivileged process and pounds this directory
|
||||
with writes. Leaving it on the container overlay will thrash storage and
|
||||
slow the stack.
|
||||
|
||||
Fix: mount ${path} explicitly — tmpfs for ephemeral data, or bind/volume if
|
||||
you want to preserve history:
|
||||
--mount type=tmpfs,destination=${path}
|
||||
# or
|
||||
--mount type=bind,src=/path/on/host,dst=${path}
|
||||
|
||||
Apply the mount and restart the container.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
}
|
||||
|
||||
|
||||
# If NETALERTX_DEBUG=1 then we will exit
|
||||
if [ "${NETALERTX_DEBUG}" = "1" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
failures=0
|
||||
warn_if_not_dedicated_mount "${NETALERTX_API}"
|
||||
warn_if_not_dedicated_mount "${NETALERTX_LOG}"
|
||||
|
||||
|
||||
if [ ! -w "${SYSTEM_NGINX_CONFIG}/conf.active" ]; then
|
||||
echo "Note: Using default listen address 0.0.0.0:20211 instead of ${LISTEN_ADDR}:${PORT} (no ${SYSTEM_NGINX_CONFIG}/conf.active override)."
|
||||
fi
|
||||
exit 0
|
||||
@@ -1,35 +0,0 @@
|
||||
#!/bin/sh
|
||||
# check-root.sh - ensure the container is not running as root.
|
||||
|
||||
CURRENT_UID="$(id -u)"
|
||||
|
||||
if [ "${CURRENT_UID}" -eq 0 ]; then
|
||||
YELLOW=$(printf '\033[1;33m')
|
||||
RESET=$(printf '\033[0m')
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<'EOF'
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: NetAlertX is running as root (UID 0).
|
||||
|
||||
This defeats every hardening safeguard built into the image. You just
|
||||
handed a high-value network monitoring appliance full control over your
|
||||
host. If an attacker compromises NetAlertX now, the entire machine goes
|
||||
with it.
|
||||
|
||||
Run the container as the dedicated 'netalertx' user instead:
|
||||
* Keep the default USER in the image (20211:20211), or
|
||||
* In docker-compose.yml, remove any 'user:' override that sets UID 0.
|
||||
|
||||
Note: As a courtesy, this special mode is only used to set the permissions
|
||||
of /app/db and /app/config to be owned by the netalertx user so future
|
||||
runs work correctly.
|
||||
|
||||
Bottom line: never run security tooling as root unless you are actively
|
||||
trying to get pwned.
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
exit 0
|
||||
@@ -1,41 +0,0 @@
|
||||
#!/bin/sh
|
||||
# check-user-netalertx.sh - ensure the container is running as the hardened service user.
|
||||
|
||||
EXPECTED_USER="${NETALERTX_USER:-netalertx}"
|
||||
EXPECTED_UID="$(getent passwd "${EXPECTED_USER}" 2>/dev/null | cut -d: -f3)"
|
||||
EXPECTED_GID="$(getent passwd "${EXPECTED_USER}" 2>/dev/null | cut -d: -f4)"
|
||||
CURRENT_UID="$(id -u)"
|
||||
CURRENT_GID="$(id -g)"
|
||||
|
||||
# Fallback to known defaults when lookups fail
|
||||
if [ -z "${EXPECTED_UID}" ]; then
|
||||
EXPECTED_UID="20211"
|
||||
fi
|
||||
if [ -z "${EXPECTED_GID}" ]; then
|
||||
EXPECTED_GID="20211"
|
||||
fi
|
||||
|
||||
if [ "${CURRENT_UID}" -eq "${EXPECTED_UID}" ] && [ "${CURRENT_GID}" -eq "${EXPECTED_GID}" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
YELLOW=$(printf '\033[1;33m')
|
||||
RESET=$(printf '\033[0m')
|
||||
>&2 printf "%s" "${YELLOW}"
|
||||
>&2 cat <<EOF
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
⚠️ ATTENTION: NetAlertX is running as UID ${CURRENT_UID}:${CURRENT_GID}.
|
||||
|
||||
Hardened permissions, file ownership, and runtime isolation expect the
|
||||
dedicated service account (${EXPECTED_USER} -> ${EXPECTED_UID}:${EXPECTED_GID}).
|
||||
When you override the container user (for example, docker run --user 1000:1000
|
||||
or a Compose "user:" directive), NetAlertX loses crucial safeguards and
|
||||
future upgrades may silently fail.
|
||||
|
||||
Restore the container to the default user:
|
||||
* Remove any custom --user flag
|
||||
* Delete "user:" overrides in compose files
|
||||
* Recreate the container so volume ownership is reset
|
||||
══════════════════════════════════════════════════════════════════════════════
|
||||
EOF
|
||||
>&2 printf "%s" "${RESET}"
|
||||
Reference in New Issue
Block a user