|
@@ -1,223 +1,569 @@
|
|
-Summary: packet-sniffer/logger
|
|
+################################################################
|
|
-Name: snort
|
|
+# rpmbuild Package Options
|
|
-Version: 1.7
|
|
+# ========================
|
|
-Release: 0vl2
|
|
+#
|
|
|
|
+# See README.build_rpms for more details.
|
|
|
|
+#
|
|
|
|
+# --with flexresp
|
|
|
|
+# Add flexresp capability to whatever package(s) you are
|
|
|
|
+# building.
|
|
|
|
+#
|
|
|
|
+# --with inline
|
|
|
|
+# Add inline capability to whatever package(s) you are
|
|
|
|
+# building. This will create its own inline package.
|
|
|
|
+#
|
|
|
|
+# --with mysql
|
|
|
|
+# Builds a binary/package with support for MySQL.
|
|
|
|
+#
|
|
|
|
+# --with postgresql
|
|
|
|
+# Builds a binary/package with support for PostgreSQL.
|
|
|
|
+#
|
|
|
|
+# --with unixODBC
|
|
|
|
+# Build a binary/package with support for unixODBC
|
|
|
|
+#
|
|
|
|
+# --with oracle
|
|
|
|
+# Builds a binary/package with support for Oracle.
|
|
|
|
+#
|
|
|
|
+# See pg 399 of _Red_Hat_RPM_Guide_ for rpmbuild --with and --without options.
|
|
|
|
+################################################################
|
|
|
|
+
|
|
|
|
+# Other useful bits
|
|
|
|
+%define OracleHome /opt/oracle/OraHome1
|
|
|
|
+%define SnortRulesDir %{_sysconfdir}/snort/rules
|
|
|
|
+%define noShell /bin/false
|
|
|
|
+
|
|
|
|
+# Handle the options noted above.
|
|
|
|
+# Default of no flexresp, but --with flexresp will enable it
|
|
|
|
+%define flexresp 1
|
|
|
|
+%{?_with_flexresp:%define flexresp 1}
|
|
|
|
+%{?_without_flexresp:%define flexresp 0}
|
|
|
|
+
|
|
|
|
+# Default of no MySQL, but --with mysql will enable it
|
|
|
|
+%define mysql 0
|
|
|
|
+%{?_with_mysql:%define mysql 1}
|
|
|
|
+%{?_without_mysql:%define mysql 0}
|
|
|
|
+
|
|
|
|
+# Default of no PostgreSQL, but --with postgresql will enable it
|
|
|
|
+%define postgresql 0
|
|
|
|
+%{?_with_postgresql:%define postgresql 1}
|
|
|
|
+%{?_without_postgresql:%define postgresql 0}
|
|
|
|
+
|
|
|
|
+# Default of no unixODBC, but --with unixODBC will enable it
|
|
|
|
+%define unixODBC 0
|
|
|
|
+%{?_with_unixODBC:%define unixODBC 1}
|
|
|
|
+%{?_without_unixODBC:%define unixODBC 0}
|
|
|
|
+
|
|
|
|
+# Default of no Oracle, but --with oracle will enable it
|
|
|
|
+%define oracle 0
|
|
|
|
+%{?_with_oracle:%define oracle 1}
|
|
|
|
+
|
|
|
|
+# If not inline then we'll conflict with it
|
|
|
|
+%define conflicts snort-inline
|
|
|
|
+
|
|
|
|
+# Default of no Inline, but --with inline will enable it
|
|
|
|
+%define inline 0
|
|
|
|
+%define inlinetext %{nil}
|
|
|
|
+%{?_with_inline:%define inline 1}
|
|
|
|
+%{?_with_inline:%define inlinetext -inline }
|
|
|
|
+%{?_with_inline:%define conflicts snort }
|
|
|
|
+
|
|
|
|
+%define vendor Snort.org
|
|
|
|
+%define for_distro RPMs
|
|
|
|
+%define release 1
|
|
|
|
+%define realname snort
|
|
|
|
+
|
|
|
|
+# Look for a directory to see if we're building under cAos
|
|
|
|
+# Exit status is usually 0 if the dir exists, 1 if not, so
|
|
|
|
+# we reverse that with the '!'
|
|
|
|
+%define caos %([ ! -d /usr/lib/rpm/caos ]; echo $?)
|
|
|
|
+
|
|
|
|
+%if %{caos}
|
|
|
|
+ # We are building for cAos (www.caosity.org) and the autobuilder doesn't
|
|
|
|
+ # have command line options so we have to fake the options for whatever
|
|
|
|
+ # packages we actually want here, in addition to tweaking the package
|
|
|
|
+ # info.
|
|
|
|
+ %define vendor cAos Linux
|
|
|
|
+ %define for_distro RPMs for cAos Linux
|
|
|
|
+ %define mysql 1
|
|
|
|
+ %define postgresql 1
|
|
|
|
+ %define release 1.caos
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+Name: %{realname}%{inlinetext}
|
|
|
|
+%{?_with_inline:%define Name: %{realname}-inline }
|
|
|
|
+Version: 2.9.5.6
|
|
|
|
+Epoch: 1
|
|
|
|
+Release: 1%{?_dist_release}
|
|
|
|
+Summary: An open source Network Intrusion Detection System (NIDS)
|
|
|
|
+Group: Applications/Internet
|
|
License: GPL
|
|
License: GPL
|
|
|
|
+Url: http://www.snort.org/
|
|
|
|
+Source0: http://www.snort.org/snort-downloads/2.9.2/%{realname}-%{version}.tar.gz
|
|
|
|
+
|
|
|
|
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
|
|
|
+
|
|
|
|
+#Packager: Official Snort.org %{for_distro}
|
|
|
|
+#Vendor: %{vendor}
|
|
|
|
+Vendor: Project Vine
|
|
|
|
+Distribution: Vine Linux
|
|
|
|
+
|
|
|
|
+BuildRequires: autoconf, automake, flex, bison
|
|
|
|
+BuildRequires: pcre-devel
|
|
|
|
+BuildRequires: libpcap-devel
|
|
|
|
+BuildRequires: daq
|
|
|
|
+BuildRequires: libdnet-devel
|
|
|
|
+BuildRequires: zlib-devel
|
|
|
|
+BuildRequires: iptables-devel
|
|
|
|
+BuildRequires: libnfnetlink-devel
|
|
|
|
+BuildRequires: libnetfilter_queue-devel
|
|
|
|
+Conflicts: %{conflicts}
|
|
|
|
+
|
|
|
|
+%if %{flexresp}
|
|
|
|
+BuildRequires: libnet
|
|
|
|
+ %define EnableFlexresp --enable-flexresp
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+# Itables-devel removed from BuildReq as RH does not supply that package.
|
|
|
|
+# Will replace iptables-devel buildreq with a scripted solution. --jh
|
|
|
|
+%if %{inline}
|
|
|
|
+BuildRequires: libnet
|
|
|
|
+ %define EnableInline --enable-inline
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%package mysql
|
|
|
|
+Summary: Snort with MySQL support
|
|
Group: Applications/Internet
|
|
Group: Applications/Internet
|
|
-Url: http://www.snort.org
|
|
+Requires: %{name} = %{epoch}:%{version}-%{release}
|
|
-Source0: http://www.snort.org/Files/%{name}-%{version}.tar.gz
|
|
+%if %{mysql}
|
|
-Source1: snort-stat
|
|
+BuildRequires: mysql-devel
|
|
-Source2: snortlog
|
|
+%endif
|
|
-Source4: snortd
|
|
+
|
|
-Source5: snort.conf
|
|
+%description mysql
|
|
-Source6: snortrules.tar.gz
|
|
+Snort binary compiled with mysql support.
|
|
-Source7: README-snort.EUC
|
|
+
|
|
-Requires: libpcap >= 0.4
|
|
+%package postgresql
|
|
-BuildRequires: libpcap >= 0.4
|
|
+Summary: Snort with PostgreSQL support
|
|
-Buildroot: %{_tmppath}/%{name}-%{version}-root
|
|
+Group: Applications/Internet
|
|
|
|
+Requires: %{name} = %{epoch}:%{version}-%{release}
|
|
|
|
+%if %{postgresql}
|
|
|
|
+BuildRequires: postgresql-devel
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%description postgresql
|
|
|
|
+Snort binary compiled with postgresql support.
|
|
|
|
+
|
|
|
|
+%package unixODBC
|
|
|
|
+Summary: Snort with unixODBC support
|
|
|
|
+Group: Applications/Internet
|
|
|
|
+Requires: %{name} = %{epoch}:%{version}-%{release}
|
|
|
|
+%if %{unixODBC}
|
|
|
|
+BuildRequires: unixODBC-devel
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%description unixODBC
|
|
|
|
+Snort binary compiled with unixODBC support.
|
|
|
|
+
|
|
|
|
+%package oracle
|
|
|
|
+Summary: Snort with Oracle support
|
|
|
|
+Group: Applications/Internet
|
|
|
|
+Requires: %{name} = %{epoch}:%{version}-%{release}
|
|
|
|
+
|
|
|
|
+%description oracle
|
|
|
|
+Snort binary compiled with Oracle support.
|
|
|
|
+
|
|
|
|
+EXPERIMENTAL!! I don't have a way to test this, so let me know if it works!
|
|
|
|
+ORACLE_HOME=%{OracleHome}
|
|
|
|
+
|
|
|
|
|
|
%description
|
|
%description
|
|
-Snort is a libpcap-based packet sniffer/logger which
|
|
+Snort is an open source network intrusion detection system, capable of
|
|
-can be used as a lightweight network intrusion detection system.
|
|
+performing real-time traffic analysis and packet logging on IP networks.
|
|
-It features rules based logging and can perform protocol analysis,
|
|
+It can perform protocol analysis, content searching/matching and can be
|
|
-content searching/matching and can be used to detect a variety of
|
|
+used to detect a variety of attacks and probes, such as buffer overflows,
|
|
-attacks and probes, such as buffer overflows, stealth port scans,
|
|
+stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts,
|
|
-CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
|
|
+and much more.
|
|
-Snort has a real-time alerting capabilty, with alerts being sent to syslog,
|
|
+
|
|
-a seperate "alert" file, or as a WinPopup message via Samba's smbclient
|
|
+Snort has three primary uses. It can be used as a straight packet sniffer
|
|
-
|
|
+like tcpdump(1), a packet logger (useful for network traffic debugging,
|
|
-%description -l ja
|
|
+etc), or as a full blown network intrusion detection system.
|
|
-SnortとはIDSと呼ばれるソフトウェアで、侵入検知システムと言われます。
|
|
+
|
|
-ホストに何らかの悪さをしてくる行為を検出して知らせてくれるソフトです。
|
|
+You MUST edit /etc/snort/snort.conf to configure snort before it will work!
|
|
-いろいろな攻撃と調査(例えばバッファオーバフロー、
|
|
+
|
|
-ステルス・ポート・スキャン、CGI攻撃、SMB調査、OS指紋鑑定試み、
|
|
+There are 5 different packages available. All of them require the base
|
|
-その他たくさん)を見つけるために使うことができる。
|
|
+snort rpm (this one). Additionally, you may need to chose a different
|
|
|
|
+binary to install if you want database support.
|
|
|
|
+
|
|
|
|
+If you install a different binary package %{_sbindir}/snort should end up
|
|
|
|
+being a symlink to a binary in one of the following configurations:
|
|
|
|
+
|
|
|
|
+ plain Snort (this package, required)
|
|
|
|
+ mysql Snort with mysql (optional)
|
|
|
|
+ postgresql Snort with postgresql (optional)
|
|
|
|
+ unixODBC Snort with unixODBC (optional)
|
|
|
|
+ oracle Snort with oracle (optional, not official)
|
|
|
|
+ inline Snort with inline support (optional)
|
|
|
|
+
|
|
|
|
+Please see the documentation in %{_docdir}/%{realname}-%{version} for more
|
|
|
|
+information on snort features and configuration.
|
|
|
|
+
|
|
|
|
|
|
%prep
|
|
%prep
|
|
-%setup -q
|
|
+%setup -q -n %{realname}-%{version}
|
|
-cp -p %{SOURCE5} %{SOURCE7} .
|
|
+
|
|
|
|
+# When building from a Snort.org CVS snapshot tarball, you have to run
|
|
|
|
+# autojunk before you can build.
|
|
|
|
+if [ \( ! -s configure \) -a \( -x autojunk.sh \) ]; then
|
|
|
|
+ ./autojunk.sh
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
+# Make sure it worked, or die with a useful error message.
|
|
|
|
+if [ ! -s configure ]; then
|
|
|
|
+ echo "Can't find ./configure. ./autojunk.sh not present or not executable?"
|
|
|
|
+ exit 2
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
|
|
%build
|
|
%build
|
|
-CFLAGS="$RPM_OPT_FLAGS" \
|
|
+
|
|
-%configure --bindir=/usr/sbin --sysconfdir=/etc/snort --enable-smbalerts
|
|
+BuildSnort() {
|
|
-make
|
|
+ %__mkdir "$1"
|
|
|
|
+ cd "$1"
|
|
|
|
+ %__ln_s ../configure ./configure
|
|
|
|
+
|
|
|
|
+ if [ "$1" = "plain" ] ; then
|
|
|
|
+ ./configure $SNORT_BASE_CONFIG \
|
|
|
|
+ --without-mysql \
|
|
|
|
+ --without-postgresql \
|
|
|
|
+ --without-oracle \
|
|
|
|
+ --without-odbc \
|
|
|
|
+ %{?EnableFlexresp} %{?EnableFlexresp2} \
|
|
|
|
+ %{?EnableInline}
|
|
|
|
+ fi
|
|
|
|
+
|
|
|
|
+ if [ "$1" = "mysql" ]; then
|
|
|
|
+ ./configure $SNORT_BASE_CONFIG \
|
|
|
|
+ --with-mysql \
|
|
|
|
+ --with-mysql-libraries=%{_libdir} \
|
|
|
|
+ --without-postgresql \
|
|
|
|
+ --without-oracle \
|
|
|
|
+ --without-odbc \
|
|
|
|
+ %{?EnableFlexresp} %{?EnableFlexresp2} \
|
|
|
|
+ %{?EnableInline}
|
|
|
|
+ fi
|
|
|
|
+
|
|
|
|
+ if [ "$1" = "postgresql" ]; then
|
|
|
|
+ ./configure $SNORT_BASE_CONFIG \
|
|
|
|
+ --without-mysql \
|
|
|
|
+ --with-postgresql \
|
|
|
|
+ --without-odbc \
|
|
|
|
+ --without-oracle \
|
|
|
|
+ %{?EnableFlexresp} %{?EnableFlexresp2} \
|
|
|
|
+ %{?EnableInline}
|
|
|
|
+ fi
|
|
|
|
+
|
|
|
|
+ if [ "$1" = "unixODBC" ]; then
|
|
|
|
+ ./configure $SNORT_BASE_CONFIG \
|
|
|
|
+ --without-mysql \
|
|
|
|
+ --without-postgresql \
|
|
|
|
+ --with-odbc=%{_libdir} \
|
|
|
|
+ --without-oracle \
|
|
|
|
+ %{?EnableFlexresp} %{?EnableFlexresp2} \
|
|
|
|
+ %{?EnableInline}
|
|
|
|
+ fi
|
|
|
|
+
|
|
|
|
+ if [ "$1" = "oracle" ]; then
|
|
|
|
+ export ORACLE_HOME=%{OracleHome}
|
|
|
|
+ ./configure $SNORT_BASE_CONFIG \
|
|
|
|
+ --without-mysql \
|
|
|
|
+ --without-postgresql \
|
|
|
|
+ --without-odbc \
|
|
|
|
+ --with-oracle=$ORACLE_HOME \
|
|
|
|
+ %{?EnableFlexresp} %{?EnableFlexresp2} \
|
|
|
|
+ %{?EnableInline}
|
|
|
|
+ fi
|
|
|
|
+
|
|
|
|
+ %__make
|
|
|
|
+ %__mv src/snort ../%{name}-"$1"
|
|
|
|
+ cd ..
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+CFLAGS="$RPM_OPT_FLAGS"
|
|
|
|
+export AM_CFLAGS="-g -O2"
|
|
|
|
+SNORT_BASE_CONFIG="--prefix=%{_prefix} \
|
|
|
|
+ --bindir=%{_sbindir} \
|
|
|
|
+ --sysconfdir=%{_sysconfdir}/snort \
|
|
|
|
+ --with-libpcap-includes=%{_includedir} \
|
|
|
|
+ --enable-decoder-preprocessor-rules --enable-targetbased \
|
|
|
|
+ "
|
|
|
|
+
|
|
|
|
+# Always build snort-plain
|
|
|
|
+BuildSnort plain
|
|
|
|
+
|
|
|
|
+# Maybe build the others
|
|
|
|
+%if %{mysql}
|
|
|
|
+ BuildSnort mysql
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%if %{postgresql}
|
|
|
|
+ BuildSnort postgresql
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%if %{oracle}
|
|
|
|
+ BuildSnort oracle
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%if %{unixODBC}
|
|
|
|
+ BuildSnort unixODBC
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
|
|
%install
|
|
%install
|
|
-rm -rf %{buildroot}
|
|
|
|
-mkdir -p %{buildroot}/usr/{bin,sbin}
|
|
|
|
-mkdir -p %{buildroot}/etc/snort
|
|
|
|
-mkdir -p %{buildroot}/etc/rc.d/init.d
|
|
|
|
-mkdir -p %{buildroot}/var/log/snort/archive
|
|
|
|
-
|
|
|
|
-%makeinstall \
|
|
|
|
- prefix=%{buildroot}/usr \
|
|
|
|
- bindir=%{buildroot}/usr/sbin \
|
|
|
|
- sysconfdir=%{buildroot}/etc/snort
|
|
|
|
-install %{SOURCE1} %{buildroot}/usr/bin
|
|
|
|
-install %{SOURCE2} %{buildroot}/usr/bin
|
|
|
|
-install %{SOURCE4} %{buildroot}/etc/rc.d/init.d
|
|
|
|
-tar zxvf %{SOURCE6} -C %{buildroot}/etc/snort
|
|
|
|
-
|
|
|
|
-cat - << EOF >> %{buildroot}/etc/snort/snort.conf
|
|
|
|
-####################################################################
|
|
|
|
-# Customize your rule set
|
|
|
|
-#
|
|
|
|
-# Up to date snort rules are available at the following web sites:
|
|
|
|
-# http://www.snort.org
|
|
|
|
-# http://www.whitehats.com
|
|
|
|
-#
|
|
|
|
-# The snort web site has documentation about how to
|
|
|
|
-# write your own custom snort rules.
|
|
|
|
-#
|
|
|
|
-# The rules included with this distribution generate alerts based on
|
|
|
|
-# on suspicious activity. Depending on your network environment, your
|
|
|
|
-# security policies, and what you consider to be suspicious, some of
|
|
|
|
-# these rules may either generate false positives ore may be detecting
|
|
|
|
-# activity you consider to be acceptable; therefore, you are
|
|
|
|
-# encouraged to comment out rules that are not applicable in your
|
|
|
|
-# environment.
|
|
|
|
-#
|
|
|
|
-# Note that using all of the rules at the same time may lead to
|
|
|
|
-# serious packet loss on slower machines. YMMV, use with caution,
|
|
|
|
-# standard disclaimers apply. :)
|
|
|
|
-#
|
|
|
|
-# The following individuals contributed many of rules in this
|
|
|
|
-# distribution.
|
|
|
|
-#
|
|
|
|
-# Credits:
|
|
|
|
-# Max Vision <vision@whitehats.com> - www.whitehats.com
|
|
|
|
-# Ron Gula <rgula@securitywizards.com> of Network Security Wizards
|
|
|
|
-# Martin Markgraf <martin@mail.du.gtn.com>
|
|
|
|
-# CyberPsychotic <fygrave@tigerteam.net>
|
|
|
|
-# Nick Rogness <nick@rapidnet.com>
|
|
|
|
-# Jim Forster <jforster@rapidnet.com>
|
|
|
|
-# Scott McIntyre <scott@whoi.edu>
|
|
|
|
-# Tom Vandepoel <Tom.Vandepoel@ubizen.com>
|
|
|
|
-# Brian Caswell <bmc@mitre.org>
|
|
|
|
-#
|
|
|
|
-#===============================================
|
|
|
|
-# Include all relevant rulesets here
|
|
|
|
-# by default virus, policy and info are disabled
|
|
|
|
-#===============================================
|
|
|
|
-# Be sure you have created a local.rules file
|
|
|
|
-# for your includes/ignores, etc.
|
|
|
|
-#===============================================
|
|
|
|
-#include /etc/snort/local.rules
|
|
|
|
-include /etc/snort/exploit.rules
|
|
|
|
-include /etc/snort/scan.rules
|
|
|
|
-include /etc/snort/finger.rules
|
|
|
|
-include /etc/snort/ftp.rules
|
|
|
|
-include /etc/snort/telnet.rules
|
|
|
|
-include /etc/snort/smtp.rules
|
|
|
|
-include /etc/snort/rpc.rules
|
|
|
|
-include /etc/snort/rservices.rules
|
|
|
|
-include /etc/snort/backdoor.rules
|
|
|
|
-include /etc/snort/dos.rules
|
|
|
|
-include /etc/snort/ddos.rules
|
|
|
|
-include /etc/snort/dns.rules
|
|
|
|
-include /etc/snort/netbios.rules
|
|
|
|
-include /etc/snort/sql.rules
|
|
|
|
-include /etc/snort/web-cgi.rules
|
|
|
|
-include /etc/snort/web-coldfusion.rules
|
|
|
|
-include /etc/snort/web-frontpage.rules
|
|
|
|
-include /etc/snort/web-misc.rules
|
|
|
|
-include /etc/snort/web-iis.rules
|
|
|
|
-include /etc/snort/icmp.rules
|
|
|
|
-include /etc/snort/misc.rules
|
|
|
|
-#include /etc/snort/policy.rules
|
|
|
|
-#include /etc/snort/info.rules
|
|
|
|
-#include /etc/snort/virus.rules
|
|
|
|
-
|
|
|
|
-# Ruleset, available (updated hourly) from:
|
|
|
|
-#
|
|
|
|
-# http://dev.whitehats.com/ids/vision.rules
|
|
|
|
-# include /etc/snort/vision.rules
|
|
|
|
-#
|
|
|
|
-# snort.conf with more options is located in /usr/doc/snort-1.7/snort.conf
|
|
|
|
|
|
|
|
-EOF
|
|
+# Remove leftover CVS files in the tarball, if any...
|
|
|
|
+find . -type 'd' -name "CVS" -print | xargs %{__rm} -rf
|
|
|
|
+
|
|
|
|
+InstallSnort() {
|
|
|
|
+ if [ "$1" = "mysql" ]; then
|
|
|
|
+ %__install -p -m 0755 %{name}-mysql %{buildroot}%{_sbindir}/%{name}-mysql
|
|
|
|
+ fi
|
|
|
|
+
|
|
|
|
+ if [ "$1" = "postgresql" ]; then
|
|
|
|
+ %__install -p -m 0755 %{name}-postgresql %{buildroot}%{_sbindir}/%{name}-postgresql
|
|
|
|
+ fi
|
|
|
|
+
|
|
|
|
+ if [ "$1" = "unixODBC" ]; then
|
|
|
|
+ %__install -p -m 0755 %{name}-unixODBC %{buildroot}%{_sbindir}/%{name}-unixODBC
|
|
|
|
+ fi
|
|
|
|
+
|
|
|
|
+ if [ "$1" = "oracle" ]; then
|
|
|
|
+ %__install -p -m 0755 %{name}-oracle %{buildroot}%{_sbindir}/%{name}-oracle
|
|
|
|
+ fi
|
|
|
|
+
|
|
|
|
+ if [ "$1" = "plain" ]; then
|
|
|
|
+ %__rm -rf %{buildroot}
|
|
|
|
+
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{_sbindir}
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{SnortRulesDir}
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{_sysconfdir}/snort
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{_sysconfdir}/sysconfig
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{_sysconfdir}/logrotate.d
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{_var}/log/snort
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{_initrddir}
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{_mandir}/man8
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{_docdir}/%{realname}-%{version}
|
|
|
|
+
|
|
|
|
+ %__install -p -m 0755 %{name}-plain %{buildroot}%{_sbindir}/%{name}-plain
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{_libdir}/%{realname}-%{version}_dynamicengine
|
|
|
|
+ %__mkdir_p -m 0755 %{buildroot}%{_libdir}/%{realname}-%{version}_dynamicpreprocessor
|
|
|
|
+ %__install -p -m 0755 plain/src/dynamic-plugins/sf_engine/.libs/libsf_engine.so.0 %{buildroot}%{_libdir}/%{realname}-%{version}_dynamicengine
|
|
|
|
+ %__ln_s -f %{_libdir}/%{realname}-%{version}_dynamicengine/libsf_engine.so.0 %{buildroot}%{_libdir}/%{realname}-%{version}_dynamicengine/libsf_engine.so
|
|
|
|
+ %__install -p -m 0755 plain/src/dynamic-preprocessors/build/%{_prefix}/lib/snort_dynamicpreprocessor/*.so* %{buildroot}%{_libdir}/%{realname}-%{version}_dynamicpreprocessor
|
|
|
|
+
|
|
|
|
+ for file in %{buildroot}%{_libdir}/%{realname}-%{version}_dynamicpreprocessor/*.so; do
|
|
|
|
+ preprocessor=`basename $file`
|
|
|
|
+ %__ln_s -f %{_libdir}/%{realname}-%{version}_dynamicpreprocessor/$preprocessor.0 $file
|
|
|
|
+ done
|
|
|
|
+
|
|
|
|
+ %__install -p -m 0644 snort.8 %{buildroot}%{_mandir}/man8
|
|
|
|
+ %__gzip %{buildroot}%{_mandir}/man8/snort.8
|
|
|
|
+ %__install -p -m 0755 rpm/snortd %{buildroot}%{_initrddir}
|
|
|
|
+ %__install -p -m 0644 rpm/snort.sysconfig %{buildroot}/%{_sysconfdir}/sysconfig/%{realname}
|
|
|
|
+ %__install -p -m 0644 rpm/snort.logrotate %{buildroot}/%{_sysconfdir}/logrotate.d/snort
|
|
|
|
+ %__install -p -m 0644 etc/reference.config etc/classification.config \
|
|
|
|
+ etc/unicode.map etc/gen-msg.map \
|
|
|
|
+ etc/threshold.conf etc/snort.conf \
|
|
|
|
+ %{buildroot}/%{_sysconfdir}/snort
|
|
|
|
+ find doc -maxdepth 1 -type f -not -name 'Makefile*' -exec %__install -p -m 0644 {} %{buildroot}%{_docdir}/%{realname}-%{version} \;
|
|
|
|
+
|
|
|
|
+ %__rm -f %{buildroot}%{_docdir}/%{realname}-%{version}/Makefile.*
|
|
|
|
+ fi
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+# Fix the RULE_PATH
|
|
|
|
+%__sed -e 's;var RULE_PATH ../rules;var RULE_PATH %{SnortRulesDir};' \
|
|
|
|
+ < etc/snort.conf > etc/snort.conf.new
|
|
|
|
+%__rm -f etc/snort.conf
|
|
|
|
+%__mv etc/snort.conf.new etc/snort.conf
|
|
|
|
+
|
|
|
|
+# Fix dynamic-preproc paths
|
|
|
|
+%__sed -e 's;dynamicpreprocessor directory \/usr\/local/lib\/snort_dynamicpreprocessor;dynamicpreprocessor directory %{_libdir}\/%{realname}-%{version}_dynamicpreprocessor;' < etc/snort.conf > etc/snort.conf.new
|
|
|
|
+%__rm -f etc/snort.conf
|
|
|
|
+%__mv etc/snort.conf.new etc/snort.conf
|
|
|
|
+
|
|
|
|
+# Fix dynamic-engine paths
|
|
|
|
+%__sed -e 's;dynamicengine \/usr\/local/lib\/snort_dynamicengine;dynamicengine %{_libdir}\/%{realname}-%{version}_dynamicengine;' < etc/snort.conf > etc/snort.conf.new
|
|
|
|
+%__rm -f etc/snort.conf
|
|
|
|
+%__mv etc/snort.conf.new etc/snort.conf
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+# Always install snort-plain
|
|
|
|
+InstallSnort plain
|
|
|
|
+
|
|
|
|
+# Maybe install the others
|
|
|
|
+%if %{mysql}
|
|
|
|
+ InstallSnort mysql
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%if %{postgresql}
|
|
|
|
+ InstallSnort postgresql
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%if %{unixODBC}
|
|
|
|
+ InstallSnort unixODBC
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%if %{oracle}
|
|
|
|
+ InstallSnort oracle
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
|
|
%clean
|
|
%clean
|
|
-rm -rf %{buildroot}
|
|
+%__rm -rf %{buildroot}
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+%pre
|
|
|
|
+# Don't do all this stuff if we are upgrading
|
|
|
|
+if [ $1 = 1 ] ; then
|
|
|
|
+ /usr/sbin/groupadd snort 2> /dev/null || true
|
|
|
|
+ /usr/sbin/useradd -M -d %{_var}/log/snort -s %{noShell} -c "Snort" -g snort snort 2>/dev/null || true
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
+%post mysql
|
|
|
|
+if [ -L %{_sbindir}/snort ] || [ ! -e %{_sbindir}/snort ] ; then
|
|
|
|
+ %__rm -f %{_sbindir}/snort; %__ln_s -f %{_sbindir}/%{name}-mysql %{_sbindir}/snort
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
+%post postgresql
|
|
|
|
+if [ -L %{_sbindir}/snort ] || [ ! -e %{_sbindir}/snort ] ; then
|
|
|
|
+ %__rm -f %{_sbindir}/snort; %__ln_s -f %{_sbindir}/%{name}-postgresql %{_sbindir}/snort
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
+%post unixODBC
|
|
|
|
+if [ -L %{_sbindir}/snort ] || [ ! -e %{_sbindir}/snort ] ; then
|
|
|
|
+ %__rm -f %{_sbindir}/snort; %__ln_s -f %{_sbindir}/%{name}-unixODBC %{_sbindir}/snort
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+%post oracle
|
|
|
|
+if [ -L %{_sbindir}/snort ] || [ ! -e %{_sbindir}/snort ] ; then
|
|
|
|
+ %__rm -f %{_sbindir}/snort; %__ln_s %{_sbindir}/%{name}-oracle %{_sbindir}/snort
|
|
|
|
+fi
|
|
|
|
|
|
%post
|
|
%post
|
|
-#don't do all this stuff if we are upgrading
|
|
+# Make a symlink if there is no link for snort-plain
|
|
-if [ "$1" = 1 ] ; then
|
|
+if [ -L %{_sbindir}/snort ] || [ ! -e %{_sbindir}/snort ] ; then \
|
|
-useradd -M -r -d /var/log/snort -s /bin/false -c "Snort" snort 2> /dev/null || :
|
|
+ %__rm -f %{_sbindir}/snort; %__ln_s %{_sbindir}/%{name}-plain %{_sbindir}/snort; fi
|
|
-groupadd -r snort 2> /dev/null || :
|
|
+
|
|
-/sbin/chkconfig --add snortd
|
|
+# We should restart it to activate the new binary if it was upgraded
|
|
|
|
+%{_initrddir}/snortd condrestart 1>/dev/null 2>/dev/null
|
|
|
|
+
|
|
|
|
+# Don't do all this stuff if we are upgrading
|
|
|
|
+if [ $1 = 1 ] ; then
|
|
|
|
+ %__chown -R snort.snort %{_var}/log/snort
|
|
|
|
+ /sbin/chkconfig --add snortd
|
|
fi
|
|
fi
|
|
-#this only works on redhat ;/
|
|
+
|
|
-perl -e 'open(f,"/etc/sysconfig/network-scripts/ifcfg-eth0");
|
|
|
|
- while(<f>){if (/IPADDR=(.*)/) {$internal=$1;}};close(f);
|
|
|
|
- open(f,"/etc/resolv.conf");
|
|
|
|
- while(<f>){if (/nameserver(.*)/) {$dns=$1;$dns=~s/[ ]+//g;
|
|
|
|
- $dns.="/32,"; push(@dns,$dns);}} close(f);
|
|
|
|
- $dns[$#dns]=~s/,$//g;
|
|
|
|
- open(f,">/etc/snort/snort.conf");
|
|
|
|
- print f "var HOME_NET $internal/32\nvar EXTERNAL_NET any\nvar SMTP \$HOME_NET\nvar HTTP_SERVERS \$HOME_NET\nvar SQL_SERVERS \$HOME_NET\nvar DNS_SERVERS ";
|
|
|
|
- print f "[";
|
|
|
|
- foreach (@dns) {print f "$_";}
|
|
|
|
- print f "]";
|
|
|
|
- print f "\n\npreprocessor defrag\npreprocessor http_decode: 80 8080\npreprocessor portscan: \$HOME_NET 4 3 /var/log/snort/portscan.log\npreprocessor portscan-ignorehosts: \$DNS_SERVERS\n\n";
|
|
|
|
- close(f);'
|
|
|
|
-#add the rest of the stuff
|
|
|
|
-
|
|
|
|
-chown snort.snort /var/log/snort
|
|
|
|
-
|
|
|
|
-%if 0
|
|
|
|
-echo -e "
|
|
|
|
-Be sure to fetch the latest snort rules file from the ArachNIDS
|
|
|
|
-database by Max Vision, or the one available from the snort.org web
|
|
|
|
-site.
|
|
|
|
-
|
|
|
|
-The snortlog and snort-stat perl scripts can be used to generate
|
|
|
|
-statistics from the snort syslog entries.
|
|
|
|
-
|
|
|
|
-Snort is currently configured to listen only on eth0, and uses the
|
|
|
|
-default rulesets. If this is not correct for your
|
|
|
|
-system, edit /etc/rc.d/init.d/snortd and /etc/snort/snort.conf
|
|
|
|
-
|
|
|
|
-A \"snort\" user and group have been created for snort to run as instead
|
|
|
|
-of running as root. You will likely need to create the /var/log/snort
|
|
|
|
-directory, and change ownership to the \"snort\" account.
|
|
|
|
-
|
|
|
|
-Built by: Dave Wreski
|
|
|
|
-dave@linuxsecurity.com
|
|
|
|
-and Wim Vandersmissen <wim@bofh.be>
|
|
|
|
-"
|
|
|
|
-%endif
|
|
|
|
|
|
|
|
%preun
|
|
%preun
|
|
-/etc/rc.d/init.d/snortd stop
|
|
|
|
if [ $1 = 0 ] ; then
|
|
if [ $1 = 0 ] ; then
|
|
|
|
+ # We get errors about not running, but we don't care
|
|
|
|
+ %{_initrddir}/snortd stop 2>/dev/null 1>/dev/null
|
|
/sbin/chkconfig --del snortd
|
|
/sbin/chkconfig --del snortd
|
|
fi
|
|
fi
|
|
-exit 0
|
|
|
|
|
|
|
|
%postun
|
|
%postun
|
|
-#only if we are removing, not upgrading..
|
|
+# Try and restart, but don't bail if it fails
|
|
|
|
+if [ $1 -ge 1 ] ; then
|
|
|
|
+ %{_initrddir}/snortd condrestart 1>/dev/null 2>/dev/null || :
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
+# Only do this if we are actually removing snort
|
|
if [ $1 = 0 ] ; then
|
|
if [ $1 = 0 ] ; then
|
|
- userdel snort 2> /dev/null || :
|
|
+ if [ -L %{_sbindir}/snort ]; then
|
|
- groupdel snort 2> /dev/null || :
|
|
+ %__rm -f %{_sbindir}/snort
|
|
|
|
+ fi
|
|
|
|
+
|
|
|
|
+ /usr/sbin/userdel snort 2>/dev/null
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
+%postun mysql
|
|
|
|
+if [ -L %{_sbindir}/snort ]; then
|
|
|
|
+ %__rm -f %{_sbindir}/snort
|
|
|
|
+ %__ln_s -f %{_sbindir}/%{name}-plain %{_sbindir}/snort
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
+%postun postgresql
|
|
|
|
+if [ -L %{_sbindir}/snort ]; then
|
|
|
|
+ %__rm -f %{_sbindir}/snort
|
|
|
|
+ %__ln_s -f %{_sbindir}/%{name}-plain %{_sbindir}/snort
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
+%postun unixODBC
|
|
|
|
+if [ -L %{_sbindir}/snort ]; then
|
|
|
|
+ %__rm -f %{_sbindir}/snort
|
|
|
|
+ %__ln_s -f %{_sbindir}/%{name}-plain %{_sbindir}/snort
|
|
|
|
+fi
|
|
|
|
+
|
|
|
|
+%postun oracle
|
|
|
|
+if [ -L %{_sbindir}/snort ]; then
|
|
|
|
+ %__rm -f %{_sbindir}/snort
|
|
|
|
+ %__ln_s -f %{_sbindir}/%{name}-plain %{_sbindir}/snort
|
|
fi
|
|
fi
|
|
|
|
|
|
%files
|
|
%files
|
|
-%defattr(-,root,root)
|
|
+%defattr(-,root,root,-)
|
|
-%doc AUTHORS BUGS COPYING CREDITS ChangeLog INSTALL NEWS README* USAGE
|
|
+%{_sbindir}/%{name}-plain
|
|
-%doc snort.conf README-snort.EUC
|
|
+%{_mandir}/man8/snort.8.*
|
|
-%attr(755,root,root) /usr/sbin/*
|
|
+%dir %{SnortRulesDir}
|
|
-%attr(755,root,root) /usr/bin/*
|
|
+%config(noreplace) %{_sysconfdir}/snort/classification.config
|
|
-%attr(750,root,wheel) %dir /var/log/snort
|
|
+%config(noreplace) %{_sysconfdir}/snort/reference.config
|
|
-%attr(750,root,wheel) %dir /var/log/snort/archive
|
|
+%config(noreplace) %{_sysconfdir}/snort/threshold.conf
|
|
-%attr(640,root,wheel) %config /etc/snort/*rules
|
|
+%config(noreplace) %{_sysconfdir}/snort/*.map
|
|
-%attr(640,root,root) %config /etc/snort/snort.conf
|
|
+%config(noreplace) %{_sysconfdir}/logrotate.d/snort
|
|
-%attr(755,root,root) %config /etc/rc.d/init.d/snortd
|
|
+%config(noreplace) %{_sysconfdir}/snort/snort.conf
|
|
|
|
+%config(noreplace) %{_sysconfdir}/sysconfig/snort
|
|
|
|
+%config(noreplace) %{_initrddir}/snortd
|
|
|
|
+%attr(0755,snort,snort) %dir %{_var}/log/snort
|
|
|
|
+%dir %{_sysconfdir}/snort
|
|
|
|
+%{_docdir}/%{realname}-%{version}/*
|
|
|
|
+%dir %{_libdir}/%{realname}-%{version}_dynamicengine
|
|
|
|
+%{_libdir}/%{realname}-%{version}_dynamicengine/libsf_engine.*
|
|
|
|
+%dir %{_libdir}/%{realname}-%{version}_dynamicpreprocessor
|
|
|
|
+%{_libdir}/%{realname}-%{version}_dynamicpreprocessor/libsf_*_preproc.*
|
|
|
|
+
|
|
|
|
+%dir %{_docdir}/%{realname}-%{version}
|
|
|
|
+%docdir %{_docdir}/%{realname}-%{version}
|
|
|
|
+
|
|
|
|
+%if %{mysql}
|
|
|
|
+%files mysql
|
|
|
|
+%defattr(-,root,root,-)
|
|
|
|
+%{_sbindir}/%{name}-mysql
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%if %{postgresql}
|
|
|
|
+%files postgresql
|
|
|
|
+%defattr(-,root,root,-)
|
|
|
|
+%{_sbindir}/%{name}-postgresql
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%if %{unixODBC}
|
|
|
|
+%files unixODBC
|
|
|
|
+%defattr(-,root,root,-)
|
|
|
|
+%{_sbindir}/%{name}-unixODBC
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
+%if %{oracle}
|
|
|
|
+%files oracle
|
|
|
|
+%defattr(-,root,root,-)
|
|
|
|
+%{_sbindir}/%{name}-oracle
|
|
|
|
+%endif
|
|
|
|
+
|
|
|
|
|
|
%changelog
|
|
%changelog
|
|
-* Thu Sep 06 2001 Toru Sagami <sagami@vinelinux.org>
|
|
+* Wed Jan 15 2014 Yoji TOYODA <bsyamato@sea.plala.or.jp> - 2.9.5.6-1
|
|
-- 1.7-0vl2: was ported to VineSeedPlus with many spec fixes
|
|
+- new upstream release
|
|
|
|
|
|
-* Mon Apr 09 2001 net_hal <net_hal@cwa.bai.ne.jp>
|
|
+* Fri Mar 16 2012 MATSUBAYASHI Kohji <shaolin@vinelinux.org> - 2.9.2.1-1
|
|
-- first buile for Vine2.1
|
|
+- initial build for Vine Linux (based on official srpm)
|
|
-- original ver 1.7 + 2001/03/28 Rules
|
|
|