-MD5 3aa338a75d24347cc5e8ab52018c3198 ChangeLog 1563
-MD5 c4841c33091271d0b9fa535771020629 nbaudit-1.0.ebuild 983
+MD5 17a45199cd0510fa5b0bc0b29a3df935 ChangeLog 1684
MD5 3d43677d80da81ea017059e47706b615 metadata.xml 240
+MD5 c4841c33091271d0b9fa535771020629 nbaudit-1.0.ebuild 983
+MD5 bb7e3ea5aff2cbb349c967dc0dd00842 nbaudit-1.0-r1.ebuild 993
MD5 ad726c93a81f56b634d898446e1a803b files/digest-nbaudit-1.0 54
MD5 3db83317eead74eb910f332814c82988 files/nbaudit-1.0-gentoo.diff 2517
+MD5 ad726c93a81f56b634d898446e1a803b files/digest-nbaudit-1.0-r1 54
# ChangeLog for net-analyzer/sguil-sensor
# Copyright 1999-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/ChangeLog,v 1.1 2005/10/08 14:04:11 strerror Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/ChangeLog,v 1.2 2005/10/09 13:54:39 strerror Exp $
+
+*sguil-sensor-0.5.3-r1 (09 Oct 2005)
+
+ 09 Oct 2005; Benjamin Smee <strerror@gentoo.org> +files/log_packets.confd,
+ files/log_packets.initd, +sguil-sensor-0.5.3-r1.ebuild:
+ New log_packets initd and confd. Changed einfo
*sguil-sensor-0.5.3 (08 Oct 2005)
-MD5 5f29597e62a3bdc8b3ae18d2a04b1cee ChangeLog 427
+MD5 b3896e4b977e661e1431e2c844bcb84e sguil-sensor-0.5.3.ebuild 2454
+MD5 e5c1400ae04bad1465adfd604a9f6336 ChangeLog 650
+MD5 5355b4f79a0130d075711f0a54840239 metadata.xml 223
+MD5 4779568b92fb5781000081886273291d sguil-sensor-0.5.3-r1.ebuild 2568
MD5 7dea1d8d6ed9dadaa3768e6ba138fe76 files/digest-sguil-sensor-0.5.3 69
-MD5 803ece3f96486fc2665c7dacda1b9bb0 files/log_packets.initd 2215
+MD5 b00be8c2354effc6b8d51da0ca0a02da files/log_packets.confd 553
+MD5 f65542111d77226b3dfa9f16501a09f6 files/log_packets.initd 2214
MD5 eafeeec66dc5b155a58067d03baccc8b files/sensor_agent.initd 794
-MD5 5355b4f79a0130d075711f0a54840239 metadata.xml 223
-MD5 b3896e4b977e661e1431e2c844bcb84e sguil-sensor-0.5.3.ebuild 2454
+MD5 7dea1d8d6ed9dadaa3768e6ba138fe76 files/digest-sguil-sensor-0.5.3-r1 69
--- /dev/null
+MD5 681fa7e99aa674c0e2be4788ef503d69 sguil-sensor-0.5.3.tar.gz 89816
--- /dev/null
+# Config file for /etc/init.d/log_packets
+
+# This tell snort which interface to listen on (any for every interface)
+IFACE=eth1
+
+# Make sure this matches your IFACE
+PIDFILE=/var/run/log_packets_$IFACE.pid
+
+# You probably don't want to change this, but in case you do
+LOGDIR="/var/lib/sguil"
+
+# Probably not this either
+CONF=/etc/snort/snort.conf
+
+# Percentage of disk to try and maintain
+MAX_DISK_USE=95
+
+# This pulls in the options above
+#SNORT_OPTS="-D -m 122 -u sguil -g sguil -A none -i $IFACE -l $LOGDIR -c $CONF"
+OPTIONS="-m 122 -u sguil -g sguil"
#!/sbin/runscript
# Copyright 1999-2005 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/files/log_packets.initd,v 1.1 2005/10/08 14:04:11 strerror Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/files/log_packets.initd,v 1.2 2005/10/09 13:54:39 strerror Exp $
opts="start stop cleandisk"
-[ -d "${LOG_DIR}" ] && LOGDIR="/var/log/sguild"
-
start() {
- ebegin "Starting Sensor Agent"
+ ebegin "Starting Log_packest"
if [ ! -x /usr/bin/snort ]
then
eerror "No snort - cannot start"
eend 1
return 1
fi
+
+ LOG_DIR="${LOGDIR}/${HOSTNAME}/dailylogs"
+
if [ ! -d ${LOG_DIR} ]
then
mkdir -p ${LOG_DIR}
mkdir "${LOG_DIR}/${today}"
chmod 770 "${LOG_DIR}/${today}"
fi
- start-stop-daemon --start -c sguil --pidfile /var/run/sguil/logpackets.pid \
+ start-stop-daemon --start --quiet -b -m --pidfile /var/run/sguil/logpackets.pid \
--exec /usr/bin/snort \
- -- ${OPTIONS} -l "${LOG_DIR}/${today}" -b -i "${INTERFACE}" "${FILTER}"
+ -- ${OPTIONS} -l "${LOG_DIR}/${today}" -b -i "${IFACE}" "${FILTER}"
real_cleandisk
eend $?
}
real_cleandisk() {
einfo "Checking disk space (limited to ${MAX_DISK_USE}%)..."
# grep, awk, tr...woohoo!
- CUR_USE=$(df ${LOG_DIR} | grep -v -i filesystem | awk '{print $5}' | tr -d %)
+ CUR_USE=$(df -P ${LOG_DIR} | grep -v -i filesystem | awk '{print $5}' | tr -d %)
einfo " Current Disk Use: ${CUR_USE}%"
- if [ ${CUR_USE} -gt ${MAX_DISK_USE }]
+ if [ ${CUR_USE} -gt ${MAX_DISK_USE} ]
then
# If we are here then we passed our disk limit
# First find the oldest DIR
--- /dev/null
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/sguil-sensor-0.5.3-r1.ebuild,v 1.1 2005/10/09 13:54:39 strerror Exp $
+
+inherit eutils
+
+DESCRIPTION="Sensor part of sguil Network Security Monitoring"
+HOMEPAGE="http://sguil.sourceforge.net"
+SRC_URI="mirror://sourceforge/sguil/sguil-sensor-${PV}.tar.gz"
+
+LICENSE="QPL"
+SLOT="0"
+KEYWORDS="~x86"
+IUSE=""
+
+DEPEND=">=dev-lang/tcl-8.3"
+RDEPEND="${DEPEND}
+ >=net-analyzer/snort-2.4.1-r1
+ >=net-analyzer/barnyard-0.2.0-r1
+ net-analyzer/sancp
+ dev-ml/pcre-ocaml"
+
+S=${WORKDIR}/sguil-${PV}
+
+pkg_setup() {
+ if built_with_use tcl threads ; then
+ eerror
+ eerror "Sguil does not run when tcl was built with threading enabled."
+ eerror "Please rebuild tcl without threads and reemerge this ebuild."
+ eerror
+ die
+ fi
+
+ if ! built_with_use snort sguil ; then
+ eerror
+ eerror "You need to emerge snort with 'sguil' USE flag to get"
+ eerror "the full sguil functionality"
+ eerror
+ die
+ fi
+ enewgroup sguil
+ enewuser sguil -1 -1 /var/lib/sguil sguil
+}
+
+src_unpack() {
+ unpack ${A}
+ cd ${S}/sensor
+ sed -i -e 's:192.168.8.1:127.0.0.1:' -e "s:gateway:${HOSTNAME}:" \
+ -e 's:/snort_data:/var/lib/sguil:' -e 's:DAEMON 0:DAEMON 1:' \
+ -e 's:DEBUG 1:DEBUG 0:g' sensor_agent.conf || die "sed failed"
+}
+
+src_install() {
+
+ dodoc doc/*
+
+ dobin sensor/sensor_agent.tcl
+
+ newinitd "${FILESDIR}/log_packets.initd" log_packets
+ newinitd "${FILESDIR}/sensor_agent.initd" sensor_agent
+ newconfd "${FILESDIR}/log_packets.confd" log_packets
+ insinto /etc/sguil
+ doins sensor/sensor_agent.conf
+
+ # Create the directory structure
+ diropts -g sguil -o sguil
+ keepdir /var/lib/sguil /var/run/sguil /var/run/sguil/archive \
+ "/var/lib/sguil/${HOSTNAME}" \
+ "/var/lib/sguil/${HOSTNAME}/portscans" \
+ "/var/lib/sguil/${HOSTNAME}/ssn_logs" \
+ "/var/lib/sguil/${HOSTNAME}/dailylogs" \
+ "/var/lib/sguil/${HOSTNAME}/sancp"
+
+}
+
+pkg_postinst() {
+ einfo
+ einfo "You should check /etc/sguil/sensor_agent.conf and"
+ einfo "/etc/init.d/logpackets and ensure that they are accurate"
+ einfo "for your environment. They should work providing that you"
+ einfo "are running the sensor on the same machine as the server."
+ einfo "This ebuild assumes that you are running a single sensor"
+ einfo "environment, if this is not the case then you must make sure"
+ einfo "to modify /etc/sguil/sensor_agent.conf and change the HOSTNAME variable."
+ einfo "You should crontab the /etc/init.d/log_packets script to restart"
+ einfo "each hour."
+ einfo
+}
+
projects / gentoo.git / commitdiff