diff options
author | Benjamin Smee <strerror@gentoo.org> | 2005-10-08 14:04:11 +0000 |
---|---|---|
committer | Benjamin Smee <strerror@gentoo.org> | 2005-10-08 14:04:11 +0000 |
commit | efc8875885a324350d929c954105c48b979ab02c (patch) | |
tree | c1e9952fc7f24accc373d0e8f262e4fed509311c /net-analyzer/sguil-sensor | |
parent | remove amd64 keyword till bug #85454 is fixed (diff) | |
download | historical-efc8875885a324350d929c954105c48b979ab02c.tar.gz historical-efc8875885a324350d929c954105c48b979ab02c.tar.bz2 historical-efc8875885a324350d929c954105c48b979ab02c.zip |
Initial import
Package-Manager: portage-2.0.51.22-r3
Diffstat (limited to 'net-analyzer/sguil-sensor')
-rw-r--r-- | net-analyzer/sguil-sensor/ChangeLog | 10 | ||||
-rw-r--r-- | net-analyzer/sguil-sensor/Manifest | 4 | ||||
-rw-r--r-- | net-analyzer/sguil-sensor/files/digest-sguil-sensor-0.5.3 | 1 | ||||
-rw-r--r-- | net-analyzer/sguil-sensor/files/log_packets.initd | 91 | ||||
-rw-r--r-- | net-analyzer/sguil-sensor/files/sensor_agent.initd | 30 | ||||
-rw-r--r-- | net-analyzer/sguil-sensor/metadata.xml | 8 | ||||
-rw-r--r-- | net-analyzer/sguil-sensor/sguil-sensor-0.5.3.ebuild | 88 |
7 files changed, 232 insertions, 0 deletions
diff --git a/net-analyzer/sguil-sensor/ChangeLog b/net-analyzer/sguil-sensor/ChangeLog new file mode 100644 index 000000000000..c7fbef3b990c --- /dev/null +++ b/net-analyzer/sguil-sensor/ChangeLog @@ -0,0 +1,10 @@ +# ChangeLog for net-analyzer/sguil-sensor +# Copyright 1999-2005 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/ChangeLog,v 1.1 2005/10/08 14:04:11 strerror Exp $ + +*sguil-sensor-0.5.3 (08 Oct 2005) + + 08 Oct 2005; Benjamin Smee <strerror@gentoo.org> +files/log_packets.initd, + +files/sensor_agent.initd, +metadata.xml, +sguil-sensor-0.5.3.ebuild: + Initial import + diff --git a/net-analyzer/sguil-sensor/Manifest b/net-analyzer/sguil-sensor/Manifest new file mode 100644 index 000000000000..a9f122ba1196 --- /dev/null +++ b/net-analyzer/sguil-sensor/Manifest @@ -0,0 +1,4 @@ +MD5 78e14d710be336f53152c5f9c06da4b7 sguil-sensor-0.5.3.ebuild 2341 +MD5 7dea1d8d6ed9dadaa3768e6ba138fe76 files/digest-sguil-sensor-0.5.3 69 +MD5 5c55306dbda0309d4c2602d9d85d544b files/log_packets.initd 2102 +MD5 eafeeec66dc5b155a58067d03baccc8b files/sensor_agent.initd 794 diff --git a/net-analyzer/sguil-sensor/files/digest-sguil-sensor-0.5.3 b/net-analyzer/sguil-sensor/files/digest-sguil-sensor-0.5.3 new file mode 100644 index 000000000000..e75aa2ff25cd --- /dev/null +++ b/net-analyzer/sguil-sensor/files/digest-sguil-sensor-0.5.3 @@ -0,0 +1 @@ +MD5 681fa7e99aa674c0e2be4788ef503d69 sguil-sensor-0.5.3.tar.gz 89816 diff --git a/net-analyzer/sguil-sensor/files/log_packets.initd b/net-analyzer/sguil-sensor/files/log_packets.initd new file mode 100644 index 000000000000..470d34a5c306 --- /dev/null +++ b/net-analyzer/sguil-sensor/files/log_packets.initd @@ -0,0 +1,91 @@ +#!/sbin/runscript +# Copyright 1999-2005 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/files/log_packets.initd,v 1.1 2005/10/08 14:04:11 strerror Exp $ + +opts="start stop cleandisk" + +[ -d "${LOG_DIR}" ] && LOGDIR="/var/log/sguild" + + +start() { + ebegin "Starting Sensor Agent" + if [ ! -x /usr/bin/snort ] + then + eerror "No snort - cannot start" + eend 1 + return 1 + fi + if [ ! -d ${LOG_DIR} ] + then + mkdir -p ${LOG_DIR} + chmod 770 ${LOG_DIR} + fi + + today=$(date '+%Y-%m-%d') + + if [ ! -d "${LOG_DIR}/${today}" ] + then + mkdir "${LOG_DIR}/${today}" + chmod 770 "${LOG_DIR}/${today}" + fi + start-stop-daemon --start -c sguil --pidfile /var/run/sguil/logpackets.pid \ + --exec /usr/bin/snort \ + -- ${OPTIONS} -l "${LOG_DIR}/${today}" -b -i "${INTERFACE}" "${FILTER}" + real_cleandisk + eend $? +} + +stop() { + ebegin "Stopping Sensor Agent" + start-stop-daemon --stop --quiet --pidfile /var/run/sguil/logpackets.pid + eend $? +} + +cleandisk() { + ebegin "Cleaning Disk" + real_cleandisk + eend $? +} + +# This func checks the current space being used by LOG_DIR +# and rm's data as necessary. +real_cleandisk() { + einfo "Checking disk space (limited to ${MAX_DISK_USE}%)..." + # grep, awk, tr...woohoo! + CUR_USE=$(df ${LOG_DIR} | grep -v -i filesystem | awk '{print $5}' | tr -d %) + einfo " Current Disk Use: ${CUR_USE}%" + + if [ ${CUR_USE} -gt ${MAX_DISK_USE }] + then + # If we are here then we passed our disk limit + # First find the oldest DIR + cd "${LOG_DIR}" + # Can't use -t on the ls since the mod time changes each time we + # delete a file. Good thing we use YYYY-MM-DD so we can sort. + OLDEST_DIR=$(ls | sort | head -n 1) + cd "${OLDEST_DIR}" + + OLDEST_FILE=$(ls -t | tail -n 1) + + if [ -f "${OLDEST_FILE}" ] + then + einfo " Removing file: ${OLDEST_DIR}/${OLDEST_FILE}" + rm -f "${OLDEST_FILE}" + else + einfo " Removing empty dir: ${OLDEST_DIR}" + cd .. + rm -rf "${OLDEST_DIR}" + fi + + # Run cleandisk again as rm'ing one file might been enough + # but we wait 5 secs in hopes any open writes are done. + sync + einfo " Waiting 5 secs for disk to sync..." + sleep 5 + real_cleandisk + else + einfo "Done." + fi +} + diff --git a/net-analyzer/sguil-sensor/files/sensor_agent.initd b/net-analyzer/sguil-sensor/files/sensor_agent.initd new file mode 100644 index 000000000000..22f8ad372fc2 --- /dev/null +++ b/net-analyzer/sguil-sensor/files/sensor_agent.initd @@ -0,0 +1,30 @@ +#!/sbin/runscript +# Copyright 1999-2005 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: + +depend() { + need net +} + +checkconfig() { + if [ ! -e /etc/sguil/sensor_agent.conf ] ; then + eerror "You need an /etc/snort/sensor_agent.conf to run the Sensor Agent" + return 1 + fi +} + +start() { + checkconfig || return 1 + ebegin "Starting Sensor Agent" + start-stop-daemon --start -c sguil --pidfile /var/run/sguil/sensor.pid \ + --quiet --exec /usr/bin/sensor_agent.tcl -- -D -c "/etc/sguil/sensor_agent.conf">/dev/null 2>&1 + eend $? +} + +stop() { + ebegin "Stopping Sensor Agent" + start-stop-daemon --stop --quiet --pidfile /var/run/sguil/sensor.pid + eend $? +} + diff --git a/net-analyzer/sguil-sensor/metadata.xml b/net-analyzer/sguil-sensor/metadata.xml new file mode 100644 index 000000000000..49f20b1c1d96 --- /dev/null +++ b/net-analyzer/sguil-sensor/metadata.xml @@ -0,0 +1,8 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>netmon</herd> +<maintainer> + <email>strerror@gentoo.org</email> +</maintainer> +</pkgmetadata> diff --git a/net-analyzer/sguil-sensor/sguil-sensor-0.5.3.ebuild b/net-analyzer/sguil-sensor/sguil-sensor-0.5.3.ebuild new file mode 100644 index 000000000000..05b6385227c3 --- /dev/null +++ b/net-analyzer/sguil-sensor/sguil-sensor-0.5.3.ebuild @@ -0,0 +1,88 @@ +# Copyright 1999-2005 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/sguil-sensor-0.5.3.ebuild,v 1.1 2005/10/08 14:04:11 strerror Exp $ + +inherit eutils + +DESCRIPTION="Sensor part of sguil Network Security Monitoring" +HOMEPAGE="http://sguil.sourceforge.net" +SRC_URI="mirror://sourceforge/sguil/sguil-sensor-${PV}.tar.gz" + +LICENSE="QPL" +SLOT="0" +KEYWORDS="~x86" +IUSE="" + +DEPEND=">=dev-lang/tcl-8.3" +RDEPEND="${DEPEND} + >=net-analyzer/snort-2.4.1-r1 + >=net-analyzer/barnyard-0.2.0-r1 + net-analyzer/sancp + dev-ml/pcre-ocaml" + +S=${WORKDIR}/sguil-${PV} + +pkg_setup() { + if built_with_use tcl threads ; then + eerror + eerror "Sguil does not run when tcl was built with threading enabled." + eerror "Please rebuild tcl without threads and reemerge this ebuild." + eerror + die + fi + + if ! built_with_use snort sguil ; then + eerror + eerror "You need to emerge snort with 'sguil' USE flag to get" + eerror "the full sguil functionality" + eerror + die + fi + enewgroup sguil + enewuser sguil -1 -1 /var/lib/sguil sguil + +} + +src_unpack() { + unpack ${A} + cd ${S}/sensor + sed -i -e 's:192.168.8.1:127.0.0.1:' -e "s:gateway:${HOSTNAME}:" \ + -e 's:/snort_data:/var/lib/sguil:' -e 's:DAEMON 0:DAEMON 1:' \ + -e 's:DEBUG 1:DEBUG 0:g' sensor_agent.conf || die "sed failed" +} + +src_install() { + + dodoc doc/* + + dobin sensor/sensor_agent.tcl + + newinitd "${FILESDIR}/log_packets.initd" log_packets + newinitd "${FILESDIR}/sensor_agent.initd" sensor_agent + insinto /etc/sguil + doins sensor/sensor_agent.conf + + # Create the directory structure + diropts -g sguil -o sguil + keepdir /var/lib/sguil /var/run/sguil /var/run/sguil/archive \ + "/var/lib/sguil/${HOSTNAME}" \ + "/var/lib/sguil/${HOSTNAME}/portscans" \ + "/var/lib/sguil/${HOSTNAME}/ssn_logs" \ + "/var/lib/sguil/${HOSTNAME}/dailylogs" \ + "/var/lib/sguil/${HOSTNAME}/sancp" + +} + +pkg_postinst() { + einfo + einfo "You should check /etc/sguil/sensor_agent.conf and" + einfo "/etc/init.d/logpackets and ensure that they are accurate" + einfo "for your environment. They should work providing that you" + einfo "are running the sensor on the same machine as the server." + einfo "This ebuild assumes that you are running a single sensor" + einfo "environment, if this is not the case then you must make sure" + einfo "to modify /etc/sguil/sensor_agent.conf and" + einfo "/etc/init.d/log_packets and change the HOSTNAME variable." + einfo +} + |