root/fwknop/tags/fwknop-0.9.7-pre3/install.pl

#!/usr/bin/perl -w
#
#############################################################################
#
# File: install.pl
#
# Purpose: Installer for fwknop
#
# Credits:  (see the CREDITS file)
#
# Copyright (C) 1999-2002 Michael Rash (mbr@cipherdyne.org)
#
# License (GNU Public License):
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
#    USA
#
#############################################################################
#
# $Id$
#

use Cwd;
use File::Copy;
use File::Path;
use Getopt::Long;
use Sys::Hostname;
use strict;

#========================== config ===========================
my $libdir     = '/usr/lib/fwknop';
my $confdir    = '/etc/fwknop';
my $vardir     = '/var/log/fwknop';
my $varlibdir  = '/var/lib/fwknop';
my $piddir     = '/var/run/fwknop';
my $archivedir = "$confdir/archive";
my $bindir     = '/usr/bin';
my $sbindir    = '/usr/sbin';
my $initdir    = '/etc/init.d';

### only used it $ENV{'HOME'} is not set for some reason
my $config_homedir = '';

my $fwknop_fifo = "$varlibdir/fwknopfifo";

### system binaries
my $chkconfigCmd = '/sbin/chkconfig';
my $rcupdateCmd  = '/sbin/rc-update';  ### Gentoo
my $makeCmd      = '/usr/bin/make';
my $perlCmd      = '/usr/bin/perl';
my $gzipCmd      = '/bin/gzip';
my $killallCmd   = '/usr/bin/killall';
my $mknodCmd     = '/bin/mknod';
my $ifconfigCmd  = '/sbin/ifconfig';
#======================== end config =========================

my $client_install = 0;
my $homedir = '';
my $syslog_conf = '';
my $distro = '';
my $print_help = 0;
my $uninstall  = 0;
my $data_method = '';
my $runlevel;
my $cmdline_force_install = 0;

### perl module directories
my %required_perl_modules = (
    'Class::MethodMaker' => {
        'force-install' => 0,
        'mod-dir' => 'Class-MethodMaker'
    },
    'GnuPG::Interface' => {
        'force-install' => 0,
        'mod-dir' => 'GnuPG-Interface'
    },
    'Unix::Syslog' => {
        'force-install' => 0,
        'mod-dir' => 'Unix-Syslog'
    },
    'Net::IPv4Addr' => {
        'force-install' => 0,
        'mod-dir' => 'Net-IPv4Addr'
    },
    'Net::RawIP' => {
        'force-install' => 0,
        'mod-dir' => 'Net-RawIP'
    },
    'Net::Ping::External' => {
        'force-install' => 0,
        'mod-dir' => 'Net-Ping-External'
    },
    'Net::Pcap' => {
        'force-install' => 0,
        'mod-dir' => 'Net-Pcap'
    },
    'Crypt::Rijndael' => {
        'force-install' => 0,
        'mod-dir' => 'Crypt-Rijndael'
    },
    'Crypt::CBC' => {
        'force-install' => 0,
        'mod-dir' => 'Crypt-CBC'
    },
    'Term::ReadKey' => {
        'force-install' => 0,
        'mod-dir' => 'TermReadKey'
    },
    'IPTables::Parse' => {
        'force-install' => 1,
        'mod-dir' => 'IPTables-Parse'
    },
    'IPTables::ChainMgr' => {
        'force-install' => 1,
        'mod-dir' => 'IPTables-ChainMgr'
    }
);

my %cmds = (
    'make'     => $makeCmd,
    'perl'     => $perlCmd,
    'gzip'     => $gzipCmd,
    'killall'  => $killallCmd,
    'mknod'    => $mknodCmd,
    'ifconfig' => $ifconfigCmd,
);

&usage(1) unless (GetOptions(
    'force-mod-install' => \$cmdline_force_install,  ### force install of all modules
    'client-only'   => \$client_install, # Force client-only installation
    'uninstall'     => \$uninstall,      # Uninstall fwknop.
    'syslog-conf=s' => \$syslog_conf,    # Specify path to syslog config file.
    'help'          => \$print_help      # Display help.
));
&usage(0) if $print_help;

unless ($< == 0 && $> == 0) {
    ### we are installing as a normal user instead of root, so see
    ### if it is ok to install within the user's home directory
    $homedir = '';
    if ($config_homedir) {
        $homedir = $config_homedir;
    } else {
        $homedir = $ENV{'HOME'} or die '[*] Could not get home ',
            "directory, set the $config_homedir var.";
    }
    print
"[+] It looks like you are installing fwknop as a non-root user.  This will\n",
"    result in fwknop being installed in your local home directory.\n",
"    Specifically, fwknop will be installed at $homedir/bin/fwknop, and a few\n",
"    perl modules needed by fwknop may be installed in $homedir/lib/fwknop/.\n",
"    If you want fwknop to act as a server (i.e. monitor knock sequences or\n",
"    authentication packets and modify firewall access or execute commands\n",
"    accordingly), you will need to install as root.\n\n";
    $client_install = 1;
    $libdir = "$homedir/lib/fwknop";
    $bindir = "$homedir/bin";
}

unless ($client_install) {
    $distro = &get_distro();

    if ($distro eq 'redhat' or $distro eq 'fedora') {
        ### add chkconfig only if we are runing on a redhat distro
        $cmds{'chkconfig'} = $chkconfigCmd;
    } elsif ($distro eq 'gentoo') {
        ### add rc-update if we are running on a gentoo distro
        $cmds{'rc-update'} = $rcupdateCmd;
    }
}

### make sure the system binaries are where we expect
### them to be.
&check_commands();

my $hostname = hostname();

my $src_dir = getcwd() or die "[*] Could not get current working directory.";

unless ($client_install) {
    unless (-d $initdir) {
        if (-d '/etc/rc.d/init.d') {
            $initdir = '/etc/rc.d/init.d';
        } elsif (-d '/etc/rc.d') {  ### for Slackware
            $initdir = '/etc/rc.d';
        } else {
            die "[*] Cannot find the init script directory, edit ",
                "the \$initdir variable.\n";
        }
    }
}

if (not $uninstall) {
    &install();
} else {
    &uninstall();
}
exit 0;
#======================= end main ==========================

sub install() {
    print "[+] Installing fwknop on $hostname\n";

    my $init_file = '';
    my $preserve_rv = 0;
    unless ($client_install) {
        if (&ask_to_stop_fwknop()) {
            &stop_fwknop();
        }

        unless (-d '/usr/lib') {
            mkdir '/usr/lib' or die "[*] Could not mkdir /usr/lib: $!";
        }
        unless (-d '/var/run') {
            mkdir '/var/run' or die "[*] Could not mkdir /var/run: $!";
        }
        unless (-d '/var/log') {
            mkdir '/var/log' or die "[*] Could not mkdir /var/log: $!";
        }
        unless (-d $piddir) {
            mkdir $piddir or die "[*] Could not mkdir $piddir: $!";
        }
        unless (-d $varlibdir) {
            mkdir $varlibdir or die "[*] Could not mkdir $varlibdir: $!";
        }
        unless (-d $sbindir) {
            mkdir $sbindir or die "[*] Could not mkdir $sbindir: $!";
        }
    }
    unless (-d $bindir) {
        print "[+] Creating: $bindir\n";
        mkdir $bindir or die "[*] Could not mkdir $bindir: $!";
    }

    ### config directory
    unless ($client_install) {
        if (-d $confdir) {
            print "[-] Config directory $confdir already exists.\n";
        } else {
            ### Note that root will only be able to view files in
            ### /etc/fwknop since fwknop only needs to view fwknop.conf
            ### when being run as a daemon.
            print "[+] Creating config directory: $confdir\n";
            mkdir $confdir, 0500 or die "[*] Could not mkdir $confdir: $!";
        }

        if (-d $vardir) {
            print "[-] Cache directory $vardir already exists.\n";
        } else {
            print "[+] Creating cache directory: $vardir\n";
            mkdir $vardir, 0500 or die "[*] Could not mkdir $vardir: $!";
        }

        ### archive directory for previously install config files
        if (-d $archivedir) {
            print "[-] Archive directory $archivedir already exists.\n";
        } else {
            print "[+] Creating archive directory: $archivedir\n";
            mkdir $archivedir, 0500 or die "[*] Could not mkdir $archivedir: $!";
        }
    }

    print "[+] Several perl modules needed by fwknop will be installed in\n",
        "    $libdir.  Installing them here will keep the system perl\n",
        "    library tree clean.\n";

    ### make our library directory (for perl modules)
    if ($client_install) {
        if (-d "$homedir/lib") {
            print "[-] Directory $homedir/lib already exists.\n";
        } else {
            print "[+] Creating directory $homedir/lib\n";
            mkdir "$homedir/lib", 0755
                or die "[*] Could not mkdir $homedir/lib: $!";
        }
    }
    if (-d $libdir) {
        print "[-] Lib directory $libdir already exists.\n";
    } else {
        print "[+] Creating directory $libdir\n";
        mkdir $libdir, 0755 or die "[*] Could not mkdir $libdir: $!";
    }

    ### install perl modules
    for my $module (keys %required_perl_modules) {
        &install_perl_module($module);
    }

    ### special case the NetPacket::<proto> modules since the NetPacket
    ### directory is just for the base class, and we need to make sure
    ### we have each of the NetPacket::IP, NetPacket::ICMP, NetPacket::UDP,
    ### and NetPacket::TCP modules.
    chdir 'NetPacket' or die "[*] Could not chdir NetPacket directory: $!";
    unless (-e 'Makefile.PL') {
        die "[*] Your NetPacket source directory appears to be incomplete!\n",
            "    Download the latest sources from ",
            "http://www.cipherdyne.org\n";
    }
    system "$cmds{'make'} clean" if -e 'Makefile';
    system "$cmds{'perl'} Makefile.PL PREFIX=$libdir LIB=$libdir";
    system $cmds{'make'};
#        system "$cmds{'make'} test";
    system "$cmds{'make'} install";
    chdir $src_dir or die "[*] Could not chdir $src_dir: $!";

    unless ($client_install) {

        ### install man pages
        &install_manpage('knopmd.8');
        &install_manpage('knopwatchd.8');
        &install_manpage('fwknop.8');
        &install_manpage('fwknopd.8');

        if ($distro eq 'redhat') {
            $init_file = 'fwknop-init.redhat';
        } elsif ($distro eq 'fedora') {
            $init_file = 'fwknop-init.fedora';
        } elsif ($distro eq 'gentoo') {
            $init_file = 'fwknop-init.gentoo';
        } else {
            $init_file = 'fwknop-init.generic';
        }

        if (-e "${confdir}/fwknop.conf") {
            $preserve_rv = &query_preserve_config();
        }

        ### install all config and access files
        for my $file qw(fwknop.conf
                knopmd.conf
                knopwatchd.conf
                access.conf
                alert.conf
                pf.os) {
            if (-e "$confdir/$file") {
                &archive("$confdir/$file");
                if ($preserve_rv) {
                    if ($file eq 'access.conf') {
                        ### access.conf can have missing fields (i.e.
                        ### REQUIRE_OS_REGEX and REQUIRE_USERNAME),
                        ### and also it can have multiple sequences
                        ### defined.  Hence we just use the old one.
                        print "[+] Using original access.conf\n";
                    } elsif ($file ne 'pf.os') {
                        &preserve_config($file);
                    }
                } else {
                    print "[+] Copying $file -> $confdir\n";
                    copy $file, $confdir or
                        die "[*] Could not cp $file to $confdir";
                }
            } else {
                print "[+] Copying $file -> $confdir\n";
                copy $file, $confdir or
                    die "[*] Could not cp $file to $confdir";
            }
            if ($file eq 'knopwatchd.conf') {
                &set_hostname("$confdir/$file");
            }
            chmod 0600, "$confdir/$file" or
                die "[*] Could not chmod(600, $confdir/$file: $!";
            chown 0, 0, "$confdir/$file" or
                die "[*] Could not chown 0, 0, $confdir/$file: $!";
        }

        ### get data acquisition method (e.g. syslogd, sysylog-ng, ulogd
        ### or pcap)
        $data_method = &query_data_method();

        if ($data_method =~ /syslog/) {

            ### create the named pipe
            unless (-e $fwknop_fifo and -p $fwknop_fifo) {
                unlink $fwknop_fifo if -e $fwknop_fifo;
                print "[+] Creating named pipe $fwknop_fifo\n";
                my $created_pipe = 1;
                unless (((system "$cmds{'mknod'} -m 600 $fwknop_fifo p")>>8)
                        == 0) {
                    $created_pipe = 0;
                }
                unless (-e $fwknop_fifo and -p $fwknop_fifo) {
                    $created_pipe = 0;
                }
                unless ($created_pipe) {
                    die
"[*] Could not create the named pipe \"$fwknop_fifo\"!\n",
"[*] fwknop requires this file to exist!  Aborting install.\n";
                }
            }

            unless (-e "${vardir}/fwdata") {
                print "[+] Creating ${vardir}/fwdata file\n";
                open F, "> ${vardir}/fwdata" or die "[*] Could not open ",
                    "${vardir}/fwdata: $!";
                close F;
                chmod 0600, "${vardir}/fwdata";
                &perms_ownership("${vardir}/fwdata", 0600);
            }

            ### we are acquiring data via syslog
            &put_string('AUTH_MODE', 'KNOCK', "${confdir}/fwknop.conf");

            &put_string('SYSLOG_DAEMON', $data_method,
                "${confdir}/fwknop.conf");

            my $restarted_syslog = 0;
            if ($data_method eq 'syslogd') {
                if (-e $syslog_conf) {
                    &append_fifo_syslog($syslog_conf);
                    if (((system "$cmds{'killall'} -HUP syslogd " .
                            "2> /dev/null")>>8) == 0) {
                        print "[+] HUP signal sent to syslogd.\n";
                        $restarted_syslog = 1;
                    }
                }
            } elsif ($data_method eq 'syslog-ng') {
                if (-e $syslog_conf) {
                    &append_fifo_syslog_ng($syslog_conf);
                    if (((system "$cmds{'killall'} -HUP syslog-ng " .
                            "2> /dev/null")>>8) == 0) {
                        print "[+] HUP signal sent to syslog-ng.\n";
                        $restarted_syslog = 1;
                    }
                }
            }

            unless ($restarted_syslog) {
                print "[-] Could not restart any syslog daemons.\n";
            }
        } elsif ($data_method =~ /pcap/i or $data_method =~ /ulog/i) {
            ### we are using a pcap method
            if ($data_method eq 'ulogd' or $data_method eq 'file_pcap') {
                print
"[+] By default, fwknop uses the file /var/log/sniff.pcap in order to\n",
"    acquire packet data logged via a sniffer (or ulogd) to a pcap file,\n",
"    but this path may be changed by altering the PCAP_PKT_FILE keyword\n",
"    in ${confdir}/fwknop.conf.\n\n";

                if ($data_method eq 'file_pcap') {
                    &put_string('AUTH_MODE', 'FILE_PCAP',
                        "${confdir}/fwknop.conf");
                } else {
                    &put_string('AUTH_MODE', 'ULOG_PCAP',
                        "${confdir}/fwknop.conf");
                }
            } else {
                my $intf = &get_pcap_intf();
                if ($intf) {
                    &put_string('PCAP_INTF', $intf, "${confdir}/fwknop.conf");
                } else {
print "[-] Could not get sniffing interface, need to set this manually in\n",
    "    {confdir}/fwknop.conf\n";
                }
            }
        } else {
            ### it is a client-only install, so don't reconfigure syslog
            ### or anything.
        }

        print "[+] Compiling knopmd and knopwatchd daemons:\n";

        ### remove any previously compiled knopmd
        unlink 'knopmd' if -e 'knopmd';

        ### remove any previously compiled knopwatchd
        unlink 'knopwatchd' if -e 'knopwatchd';

        ### compile the C fwknop daemons
        system $cmds{'make'};

        unless (-e 'knopmd' and -e 'knopwatchd') {
            die "[*] Compilation failed.";
        }

        ### install fwknop server-side daemons/programs
        for my $daemon qw(fwknopd knopmd knopwatchd knoptm fwknop_serv) {
            if ($daemon eq 'fwknopd' or $daemon eq 'knoptm') {
                unless (((system "$cmds{'perl'} -c $daemon")>>8) == 0) {
                    die "[*] $daemon does not compile with \"perl -c\".  ",
                        "Download the latest sources ",
                        "from:\n\nhttp://www.cipherdyne.org/\n";
                }
            }
            print "[+] Copying $daemon -> $sbindir\n";
            copy $daemon, $sbindir or
                die "[*] Could not cp $daemon to $sbindir: $!";
            chmod 0500, "$sbindir/$daemon" or
                die "[*] Could not chmod 500 $sbindir/$daemon: $!";
        }
    }

    print "[+] Copying fwknop -> $bindir\n";
    copy 'fwknop', $bindir or
        die "[*] Could not cp fwknop to $bindir: $!";

    if ($client_install) {
        open F, "< $bindir/fwknop" or die "[*] Could not open ",
            "$bindir/fwknop: $!";
        my @lines = <F>;
        close F;
        open P, "> $bindir/fwknop.tmp" or die "[*] Could not open ",
            "$bindir/fwknop.tmp: $!";
        for my $line (@lines) {
            ### change the lib dir to new homedir path
            if ($line =~ m|^\s*use\s+lib\s+\'/usr/lib/fwknop\';|) {
                print P "use lib '", $libdir, "';\n";
            } else {
                print P $line;
            }
        }
        close P;
        move "$bindir/fwknop.tmp", "$bindir/fwknop" or die "[*] Could ",
            "not move $bindir/fwknop.tmp -> $bindir/fwknop: $!";
        chmod 0700, "$bindir/fwknop" or
            die "[*] Could not chmod 755 $bindir/fwknop: $!";
    } else {
        chmod 0755, "$bindir/fwknop" or
            die "[*] Could not chmod 755 $bindir/fwknop: $!";
    }

    unless (((system "$cmds{'perl'} -c $bindir/fwknop")>>8) == 0) {
        die "[*] $bindir/fwknop does not compile with \"perl -c\".  ",
            "Download the latest sources ",
            "from:\n\nhttp://www.cipherdyne.org/\n";
    }

    unless ($client_install) {
        unless ($preserve_rv) {
            my $email_str = &query_email();
            if ($email_str) {
                for my $file qw(fwknop.conf knopwatchd.conf) {
                    &put_string('EMAIL_ADDRESSES', $email_str,
                        "$confdir/$file");
                }
            }
        }

        if (-d $initdir) {
            print "[+] Copying init-scripts/$init_file -> ${initdir}/fwknop\n";
            copy "init-scripts/$init_file", "${initdir}/fwknop"
                or die "[*] Could not cp fwknop init script to $initdir: $!";
            &perms_ownership("${initdir}/fwknop", 0744);
            &enable_fwknop_at_boot($distro) unless $data_method =~ /client/i;
        }
    }

    if ($client_install) {
        print
"\n[+] fwknop has been installed at $bindir/fwknop.  Since this is a\n",
"    client-only install, the man pages could not be installed.  For more\n",
"    information about how to use fwknop, execute \"$bindir/fwknop -h\" or\n",
"    refer to:\n\n",
"        http://www.cipherdyne.org/fwknop/manpage.html\n\n";
    } else {
        if ($data_method =~ /client/i) {
            print "\n[+] fwknop has been installed!\n\n";
        } else {
            print
"\n[+] fwknop has been installed!  To start in server mode, run\n\n",
"    \"/etc/init.d/fwknop start\"\n\n",
"    Note: You will need to edit $confdir/access.conf for fwknop to\n",
"    function properly in server mode.  More information can be found in\n",
"    the fwknop manpage.\n\n";
        }
    }
    return;
}

sub uninstall() {
    ### FIXME: need to pid check to see if fwknop is still running
    ### before we remove it.
    print "[+] Uninstalling fwknop\n";

    ### stop any running fwknop daemons.
    &stop_fwknop();

    unlink "$bindir/fwknop" if -e "$bindir/fwknop";
    unlink "$sbindir/knopmd" if -e "$sbindir/knopmd";
    unlink "$sbindir/knopwatchd" if -e "$sbindir/knopwatchd";
    unlink "$initdir/fwknop" if -e "$initdir/fwknop";
    rmtree $confdir, 1, 1 if -d $confdir;
    rmtree $libdir, 1, 1 if -d $libdir;

    return;
}

### check paths to commands and attempt to correct if any are wrong.
sub check_commands() {
    my @path = qw(
        /bin
        /sbin
        /usr/bin
        /usr/sbin
        /usr/local/bin
        /usr/local/sbin
    );
    CMD: for my $cmd (keys %cmds) {
        unless (-x $cmds{$cmd}) {
            my $found = 0;
            PATH: for my $dir (@path) {
                if (-x "${dir}/${cmd}") {
                    $cmds{$cmd} = "${dir}/${cmd}";
                    $found = 1;
                    last PATH;
                }
            }
            unless ($found) {
                die "[*] Could not find $cmd anywhere!!!  ",
                    "Please edit the config section to include the path to ",
                    "$cmd.\n";
            }
        }
        unless (-x $cmds{$cmd}) {
            die "[*] $cmd is located at ",
                "$cmds{$cmd} but is not executable by uid: $<\n";
        }
    }
    return;
}

sub archive() {
    my $file = shift;
    return unless -e $file;
    my $curr_pwd = cwd();
    chdir $archivedir or die $!;
    my ($filename) = ($file =~ m|.*/(.*)|);
    my $base = "${filename}.old";
    for (my $i = 5; $i > 1; $i--) {  ### keep five copies of old config files
        my $j = $i - 1;
        unlink "${base}${i}.gz" if -e "${base}${i}.gz";
        move "${base}${j}.gz", "${base}${i}.gz" if -e "${base}${j}.gz";
    }
    print "[+] Archiving $file -> ${base}1\n";
    unlink "${base}1.gz" if -e "${base}1.gz";
    copy $file, "${base}1";   ### move $file into the archive directory
    system "$cmds{'gzip'} ${base}1";
    chdir $curr_pwd or die $!;
    return;
}

sub preserve_config() {
    my $file = shift;
    open C, "< $file" or die "[*] Could not open $file: $!";
    my @new_lines = <C>;
    close C;

    open CO, "< ${confdir}/$file" or die "[*] Could not open ",
        "${confdir}/$file: $!";
    my @orig_lines = <CO>;
    close CO;

    print "[+] Preserving existing config: ${confdir}/$file\n";
    ### write to a tmp file and then move so any running fwknop daemon will
    ### re-import a full config file if a HUP signal is received during
    ### the install.
    open CONF, "> ${confdir}/${file}.new" or die "[*] Could not open ",
        "${confdir}/${file}.new: $!";
    for my $new_line (@new_lines) {
        if ($new_line =~ /^\s*#/) {
            print CONF $new_line;  ### take comments from new file.
        } elsif ($new_line =~ /^\s*(\S+)/) {
            my $var = $1;
            my $found = 0;
            for my $orig_line (@orig_lines) {
                if ($orig_line =~ /^\s*$var\s/) {
                    print CONF $orig_line;
                    $found = 1;
                    last;
                }
            }
            unless ($found) {
                print CONF $new_line;
            }
        } else {
            print CONF $new_line;
        }
    }
    close CONF;
    move "${confdir}/${file}.new", "${confdir}/$file" or die "[*] ",
        "Could not move ${confdir}/${file}.new -> ",
        "${confdir}/$file: $!";
    return;
}

sub append_fifo_syslog() {
    print "[+] Modifying /etc/syslog.conf to write kern.info messages to\n";
    print "    $fwknop_fifo\n";
    unless (-e '/etc/syslog.conf.orig') {
        copy '/etc/syslog.conf', '/etc/syslog.conf.orig';
    }
    &archive('/etc/syslog.conf');
    open RS, '< /etc/syslog.conf' or
        die "[*]  Unable to open /etc/syslog.conf: $!\n";
    my @slines = <RS>;
    close RS;
    open SYSLOG, '> /etc/syslog.conf' or
        die "[*]  Unable to open /etc/syslog.conf: $!\n";
    for my $line (@slines) {
        unless ($line =~ /fwknopfifo/) {
            print SYSLOG $line;
        }
    }
    ### reinstate kernel logging to our named pipe
    print SYSLOG '### Send kern.info messages to fwknopfifo for ',
        "analysis by knopmd\n",
        "kern.info\t\t|$fwknop_fifo\n";
    close SYSLOG;
    return;
}

sub append_fifo_syslog_ng() {
    print "[+] Modifying /etc/syslog-ng/syslog-ng.conf to write kern.info ",
        "messages to\n";
    print "    $fwknop_fifo\n";
    unless (-e '/etc/syslog-ng/syslog-ng.conf.orig') {
        copy '/etc/syslog-ng/syslog-ng.conf',
            '/etc/syslog-ng/syslog-ng.conf.orig';
    }
    &archive('/etc/syslog-ng/syslog-ng.conf');
    open RS, '< /etc/syslog-ng/syslog-ng.conf' or
        die "[*]  Unable to open /etc/syslog-ng/syslog-ng.conf: $!\n";
    my @slines = <RS>;
    close RS;

    my $found_fifo = 0;
    for my $line (@slines) {
        $found_fifo = 1 if ($line =~ /fwknopfifo/);
    }

    unless ($found_fifo) {
        open SYSLOGNG, '>> /etc/syslog-ng/syslog-ng.conf' or
            die "[*] Unable to open /etc/syslog-ng/syslog-ng.conf: $!\n";
        print SYSLOGNG "\n",
            "destination fwknoppipe { pipe(\"/var/lib/fwknop/fwknopfifo\"); };\n",
            "filter f_kerninfo { facility(kern) and level(info); };\n",
            "log { source(src); filter(f_kerninfo); destination(fwknoppipe); };\n";
        close SYSLOGNG;
    }