#!/bin/sh
# tripwire-backend -- remctl backend for tripwire check and update.
#
# Written by Russ Allbery <rra@stanford.edu>
# Copyright 2008, 2010 Board of Trustees, Leland Stanford Jr. University

# Set a sane default PATH.
PATH=/bin:/usr/bin; export PATH

# Pull configuration from the system configuration file if it exists.
tripwire=/afs/ir/site/leland/tripwire/bin/tripwire
address=tripwire@devnull.stanford.edu
mail=mail
if [ -r /etc/tripwire/config ] ; then
    . /etc/tripwire/config
fi

command="$1"
shift
case "$command" in
    check)
        exec "$tripwire"
        ;;
    help)
        cat <<EOF
Tripwire remctl help:
  tripwire check                Run tripwire and return the results
  tripwire init                 Reinitialize tripwire and return new database
  tripwire mail                 Run the nightly tripwire cron job
  tripwire update <file> ...    Update files and return new database
EOF
        exit 0
        ;;
    init)
        cd /root/tmp
        "$tripwire" -init >/dev/null
        if [ $? != 0 ] ; then
            echo 'tripwire failed' >&2
            exit 1
        fi
        cat /root/tmp/databases/tw.db
        rm -rf /root/tmp/databases
        exit 0
        ;;
    mail)
        date=`date +%Y-%m-%d`
        shorthost=`hostname -s`
        subject="$shorthost tripwire report - $date"
        $tripwire 2>&1 | $mail -s "$subject" $address
        exit 0
        ;;
    update)
        cd /root/tmp
        if [ -z "$1" ] ; then
            echo 'No files given for tripwire update' >&2
            exit 1
        fi
        "$tripwire" -update "$@" >/dev/null
        if [ $? != 0 ] ; then
            echo 'tripwire failed' >&2
            exit 1
        fi
        cat /root/tmp/databases/tw.db
        rm -rf /root/tmp/databases
        exit 0
        ;;
    *)
        echo "Unknown command $command" 2>&1
        exit 1
        ;;
    esac
exit 0

# Documentation.  Use a hack to hide this from the shell.  Because of the
# above exit line, this should never be executed.
DOCS=<<__END_OF_DOCS__

=for stopwords
Allbery backend tripwire-backend -init init remctl

=head1 NAME

tripwire-backend - remctl backend for tripwire check and update

=head1 SYNOPSIS

B<tripwire-backend> ( check | help | init | mail )

B<tripwire-backend> update I<file> [I<file> ...]

=head1 DESCRIPTION

B<tripwire-backend> provides a remctl interface to run B<tripwire> on the
system and possibly update and return an updated tripwire database.  It
supports several commands:

=over 4

=item check

Runs C<tripwire> and returns whatever B<tripwire> returns.  This will show
you the absolutely current tripwire report.  It will exit with a non-zero
exit status if the report isn't clean.

=item help

Prints out a summary of supported commands.

=item init

Runs C<tripwire -init> and returns the new database on standard output.
If there are any errors, returns them on standard error and exits with a
non-zero exit status.

=item mail

Sends the current tripwire report to the configured e-mail address for
processing.

=item update I<file> [I<file> ...]

Generates a new tripwire database, updating the database entries for all
of the provided I<file> paths, and returns the new database on standard
output.  If there are any errors, returns them on standard error and exits
with a non-zero exit status.

=back

=head1 AUTHOR

Russ Allbery <rra@stanford.edu>

=cut

__END_OF_DOCS__
