net-analyzer/sguil-sensor: Version 1.0.0

Package-Manager: Portage-2.3.68, Repoman-2.3.16
Signed-off-by: Jeroen Roovers <jer@gentoo.org>

diff --git a/net-analyzer/sguil-sensor/Manifest b/net-analyzer/sguil-sensor/Manifest
index 4aab28bb7835e88ba0ee564bc4b3d206b8b4a14a..c9b086c62dca0cbd87e6ae5c733a5fb2136f41b5 100644 (file)
--- a/net-analyzer/sguil-sensor/Manifest
+++ b/net-analyzer/sguil-sensor/Manifest
@@ -1,2 +1,3 @@
 DIST sguil-0.9.0.tar.gz 464204 BLAKE2B 147b743fd8f70969ee560a3f6995775c40cfbaf543d8292f16aa6f02289edde54207a3cddb4969229e0a123dad2fb589eaef3bddb016e6ff408a3d9be4c7820d SHA512 3f300901d0f0260fbc950b4c7604e3dc3eeb2d088ff45171db84e2d58e281242bf3582eac51162968f1f3766961aec4d0a7af54e85773102ee643a52e879cfa6
+DIST sguil-1.0.0.tar.gz 892934 BLAKE2B 69459eed682d91a1b57ba08c141dd655dbbfaa0d9d2956e6a26065f1b6820307b0e0e4dcbcad89537eba7499aea38f81739c351246e3dd6c46cab46bdf0d054f SHA512 fc3007383f90c99a0ace3eeebac75864f9aa549676e784c7bf1d81222282e3a5a3d5290b121097ae3c027dee3dd35bbe8ac9dfede04dbd561edfd3948a0465ab
 DIST sguil-sensor-0.8.0.tar.gz 142829 BLAKE2B f753c1bf6a95ba7b12d3a91d2d6ddf506b9dfb09208d08ad5ffcea95210525f014c3807d3e79df10739b00466e5e10e88d2e2494cfbbbb7c7145f2800df62600 SHA512 9b90598f2a3fdcf8652ccb92123944ffbda61c00f131bc951b12a95002f84f555f8c63cc1235fd7bb90875d00edbecbda02750bcca3bba7d16e1b1a150eb74ae

diff --git a/net-analyzer/sguil-sensor/sguil-sensor-1.0.0.ebuild b/net-analyzer/sguil-sensor/sguil-sensor-1.0.0.ebuild
new file mode 100644 (file)
index 0000000..cb9d1ed
--- /dev/null
+++ b/net-analyzer/sguil-sensor/sguil-sensor-1.0.0.ebuild
@@ -0,0 +1,80 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit user
+
+MY_PV="${PV/_p/p}"
+DESCRIPTION="Sensor part of sguil Network Security Monitoring"
+HOMEPAGE="https://github.com/bammv/sguil"
+SRC_URI="${HOMEPAGE}/archive/v${PV}.tar.gz -> ${P/-sensor}.tar.gz"
+
+LICENSE="GPL-2 QPL"
+SLOT="0"
+KEYWORDS="~x86"
+IUSE=""
+
+RDEPEND="
+       >=dev-lang/tcl-8.3:0=[-threads]
+       >=dev-tcltk/tclx-8.3
+       >=net-analyzer/barnyard-0.2.0-r1
+       >=net-analyzer/snort-2.4.1-r1
+       dev-ml/pcre-ocaml
+       net-analyzer/sancp
+"
+
+S="${WORKDIR}/sguil-${MY_PV}"
+
+pkg_setup() {
+       enewgroup sguil
+       enewuser sguil -1 -1 /var/lib/sguil sguil
+}
+
+src_prepare() {
+       default
+       sed -i \
+               -e "s:gateway:${HOSTNAME}:" \
+               -e 's:/snort_data:/var/lib/sguil:' \
+               -e 's:DAEMON 0:DAEMON 1:' \
+               -e 's:DEBUG 1:DEBUG 0:g' \
+               sensor/sensor_agent.conf || die
+       sed -i \
+               -e 's:/var/run/sensor_agent.pid:/run/sguil-sensor.pid:' \
+               sensor/sensor_agent.tcl || die
+}
+
+src_install() {
+       dodoc doc/*
+
+       dobin sensor/sensor_agent.tcl
+
+       newinitd "${FILESDIR}/log_packets.initd" log_packets
+       newinitd "${FILESDIR}/sensor_agent.initd" sensor_agent
+       newconfd "${FILESDIR}/log_packets.confd" log_packets
+       insinto /etc/sguil
+       doins sensor/sensor_agent.conf
+
+       # Create the directory structure
+       diropts -g sguil -o sguil
+       keepdir /var/lib/sguil /var/lib/sguil/archive \
+               "/var/lib/sguil/${HOSTNAME}" \
+               "/var/lib/sguil/${HOSTNAME}/portscans" \
+               "/var/lib/sguil/${HOSTNAME}/ssn_logs" \
+               "/var/lib/sguil/${HOSTNAME}/dailylogs" \
+               "/var/lib/sguil/${HOSTNAME}/sancp"
+
+}
+
+pkg_postinst() {
+       elog
+       elog "You should check /etc/sguil/sensor_agent.conf and"
+       elog "/etc/init.d/logpackets and ensure that they are accurate"
+       elog "for your environment. They should work providing that you"
+       elog "are running the sensor on the same machine as the server."
+       elog "This ebuild assumes that you are running a single sensor"
+       elog "environment, if this is not the case then you must make sure"
+       elog "to modify /etc/sguil/sensor_agent.conf and change the HOSTNAME variable."
+       elog "You should crontab the /etc/init.d/log_packets script to restart"
+       elog "each hour."
+       elog
+}