summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBenjamin Smee <strerror@gentoo.org>2005-10-08 14:04:11 +0000
committerBenjamin Smee <strerror@gentoo.org>2005-10-08 14:04:11 +0000
commitefc8875885a324350d929c954105c48b979ab02c (patch)
treec1e9952fc7f24accc373d0e8f262e4fed509311c /net-analyzer/sguil-sensor
parentremove amd64 keyword till bug #85454 is fixed (diff)
downloadhistorical-efc8875885a324350d929c954105c48b979ab02c.tar.gz
historical-efc8875885a324350d929c954105c48b979ab02c.tar.bz2
historical-efc8875885a324350d929c954105c48b979ab02c.zip
Initial import
Package-Manager: portage-2.0.51.22-r3
Diffstat (limited to 'net-analyzer/sguil-sensor')
-rw-r--r--net-analyzer/sguil-sensor/ChangeLog10
-rw-r--r--net-analyzer/sguil-sensor/Manifest4
-rw-r--r--net-analyzer/sguil-sensor/files/digest-sguil-sensor-0.5.31
-rw-r--r--net-analyzer/sguil-sensor/files/log_packets.initd91
-rw-r--r--net-analyzer/sguil-sensor/files/sensor_agent.initd30
-rw-r--r--net-analyzer/sguil-sensor/metadata.xml8
-rw-r--r--net-analyzer/sguil-sensor/sguil-sensor-0.5.3.ebuild88
7 files changed, 232 insertions, 0 deletions
diff --git a/net-analyzer/sguil-sensor/ChangeLog b/net-analyzer/sguil-sensor/ChangeLog
new file mode 100644
index 000000000000..c7fbef3b990c
--- /dev/null
+++ b/net-analyzer/sguil-sensor/ChangeLog
@@ -0,0 +1,10 @@
+# ChangeLog for net-analyzer/sguil-sensor
+# Copyright 1999-2005 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/ChangeLog,v 1.1 2005/10/08 14:04:11 strerror Exp $
+
+*sguil-sensor-0.5.3 (08 Oct 2005)
+
+ 08 Oct 2005; Benjamin Smee <strerror@gentoo.org> +files/log_packets.initd,
+ +files/sensor_agent.initd, +metadata.xml, +sguil-sensor-0.5.3.ebuild:
+ Initial import
+
diff --git a/net-analyzer/sguil-sensor/Manifest b/net-analyzer/sguil-sensor/Manifest
new file mode 100644
index 000000000000..a9f122ba1196
--- /dev/null
+++ b/net-analyzer/sguil-sensor/Manifest
@@ -0,0 +1,4 @@
+MD5 78e14d710be336f53152c5f9c06da4b7 sguil-sensor-0.5.3.ebuild 2341
+MD5 7dea1d8d6ed9dadaa3768e6ba138fe76 files/digest-sguil-sensor-0.5.3 69
+MD5 5c55306dbda0309d4c2602d9d85d544b files/log_packets.initd 2102
+MD5 eafeeec66dc5b155a58067d03baccc8b files/sensor_agent.initd 794
diff --git a/net-analyzer/sguil-sensor/files/digest-sguil-sensor-0.5.3 b/net-analyzer/sguil-sensor/files/digest-sguil-sensor-0.5.3
new file mode 100644
index 000000000000..e75aa2ff25cd
--- /dev/null
+++ b/net-analyzer/sguil-sensor/files/digest-sguil-sensor-0.5.3
@@ -0,0 +1 @@
+MD5 681fa7e99aa674c0e2be4788ef503d69 sguil-sensor-0.5.3.tar.gz 89816
diff --git a/net-analyzer/sguil-sensor/files/log_packets.initd b/net-analyzer/sguil-sensor/files/log_packets.initd
new file mode 100644
index 000000000000..470d34a5c306
--- /dev/null
+++ b/net-analyzer/sguil-sensor/files/log_packets.initd
@@ -0,0 +1,91 @@
+#!/sbin/runscript
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/files/log_packets.initd,v 1.1 2005/10/08 14:04:11 strerror Exp $
+
+opts="start stop cleandisk"
+
+[ -d "${LOG_DIR}" ] && LOGDIR="/var/log/sguild"
+
+
+start() {
+ ebegin "Starting Sensor Agent"
+ if [ ! -x /usr/bin/snort ]
+ then
+ eerror "No snort - cannot start"
+ eend 1
+ return 1
+ fi
+ if [ ! -d ${LOG_DIR} ]
+ then
+ mkdir -p ${LOG_DIR}
+ chmod 770 ${LOG_DIR}
+ fi
+
+ today=$(date '+%Y-%m-%d')
+
+ if [ ! -d "${LOG_DIR}/${today}" ]
+ then
+ mkdir "${LOG_DIR}/${today}"
+ chmod 770 "${LOG_DIR}/${today}"
+ fi
+ start-stop-daemon --start -c sguil --pidfile /var/run/sguil/logpackets.pid \
+ --exec /usr/bin/snort \
+ -- ${OPTIONS} -l "${LOG_DIR}/${today}" -b -i "${INTERFACE}" "${FILTER}"
+ real_cleandisk
+ eend $?
+}
+
+stop() {
+ ebegin "Stopping Sensor Agent"
+ start-stop-daemon --stop --quiet --pidfile /var/run/sguil/logpackets.pid
+ eend $?
+}
+
+cleandisk() {
+ ebegin "Cleaning Disk"
+ real_cleandisk
+ eend $?
+}
+
+# This func checks the current space being used by LOG_DIR
+# and rm's data as necessary.
+real_cleandisk() {
+ einfo "Checking disk space (limited to ${MAX_DISK_USE}%)..."
+ # grep, awk, tr...woohoo!
+ CUR_USE=$(df ${LOG_DIR} | grep -v -i filesystem | awk '{print $5}' | tr -d %)
+ einfo " Current Disk Use: ${CUR_USE}%"
+
+ if [ ${CUR_USE} -gt ${MAX_DISK_USE }]
+ then
+ # If we are here then we passed our disk limit
+ # First find the oldest DIR
+ cd "${LOG_DIR}"
+ # Can't use -t on the ls since the mod time changes each time we
+ # delete a file. Good thing we use YYYY-MM-DD so we can sort.
+ OLDEST_DIR=$(ls | sort | head -n 1)
+ cd "${OLDEST_DIR}"
+
+ OLDEST_FILE=$(ls -t | tail -n 1)
+
+ if [ -f "${OLDEST_FILE}" ]
+ then
+ einfo " Removing file: ${OLDEST_DIR}/${OLDEST_FILE}"
+ rm -f "${OLDEST_FILE}"
+ else
+ einfo " Removing empty dir: ${OLDEST_DIR}"
+ cd ..
+ rm -rf "${OLDEST_DIR}"
+ fi
+
+ # Run cleandisk again as rm'ing one file might been enough
+ # but we wait 5 secs in hopes any open writes are done.
+ sync
+ einfo " Waiting 5 secs for disk to sync..."
+ sleep 5
+ real_cleandisk
+ else
+ einfo "Done."
+ fi
+}
+
diff --git a/net-analyzer/sguil-sensor/files/sensor_agent.initd b/net-analyzer/sguil-sensor/files/sensor_agent.initd
new file mode 100644
index 000000000000..22f8ad372fc2
--- /dev/null
+++ b/net-analyzer/sguil-sensor/files/sensor_agent.initd
@@ -0,0 +1,30 @@
+#!/sbin/runscript
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header:
+
+depend() {
+ need net
+}
+
+checkconfig() {
+ if [ ! -e /etc/sguil/sensor_agent.conf ] ; then
+ eerror "You need an /etc/snort/sensor_agent.conf to run the Sensor Agent"
+ return 1
+ fi
+}
+
+start() {
+ checkconfig || return 1
+ ebegin "Starting Sensor Agent"
+ start-stop-daemon --start -c sguil --pidfile /var/run/sguil/sensor.pid \
+ --quiet --exec /usr/bin/sensor_agent.tcl -- -D -c "/etc/sguil/sensor_agent.conf">/dev/null 2>&1
+ eend $?
+}
+
+stop() {
+ ebegin "Stopping Sensor Agent"
+ start-stop-daemon --stop --quiet --pidfile /var/run/sguil/sensor.pid
+ eend $?
+}
+
diff --git a/net-analyzer/sguil-sensor/metadata.xml b/net-analyzer/sguil-sensor/metadata.xml
new file mode 100644
index 000000000000..49f20b1c1d96
--- /dev/null
+++ b/net-analyzer/sguil-sensor/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>netmon</herd>
+<maintainer>
+ <email>strerror@gentoo.org</email>
+</maintainer>
+</pkgmetadata>
diff --git a/net-analyzer/sguil-sensor/sguil-sensor-0.5.3.ebuild b/net-analyzer/sguil-sensor/sguil-sensor-0.5.3.ebuild
new file mode 100644
index 000000000000..05b6385227c3
--- /dev/null
+++ b/net-analyzer/sguil-sensor/sguil-sensor-0.5.3.ebuild
@@ -0,0 +1,88 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/sguil-sensor/sguil-sensor-0.5.3.ebuild,v 1.1 2005/10/08 14:04:11 strerror Exp $
+
+inherit eutils
+
+DESCRIPTION="Sensor part of sguil Network Security Monitoring"
+HOMEPAGE="http://sguil.sourceforge.net"
+SRC_URI="mirror://sourceforge/sguil/sguil-sensor-${PV}.tar.gz"
+
+LICENSE="QPL"
+SLOT="0"
+KEYWORDS="~x86"
+IUSE=""
+
+DEPEND=">=dev-lang/tcl-8.3"
+RDEPEND="${DEPEND}
+ >=net-analyzer/snort-2.4.1-r1
+ >=net-analyzer/barnyard-0.2.0-r1
+ net-analyzer/sancp
+ dev-ml/pcre-ocaml"
+
+S=${WORKDIR}/sguil-${PV}
+
+pkg_setup() {
+ if built_with_use tcl threads ; then
+ eerror
+ eerror "Sguil does not run when tcl was built with threading enabled."
+ eerror "Please rebuild tcl without threads and reemerge this ebuild."
+ eerror
+ die
+ fi
+
+ if ! built_with_use snort sguil ; then
+ eerror
+ eerror "You need to emerge snort with 'sguil' USE flag to get"
+ eerror "the full sguil functionality"
+ eerror
+ die
+ fi
+ enewgroup sguil
+ enewuser sguil -1 -1 /var/lib/sguil sguil
+
+}
+
+src_unpack() {
+ unpack ${A}
+ cd ${S}/sensor
+ sed -i -e 's:192.168.8.1:127.0.0.1:' -e "s:gateway:${HOSTNAME}:" \
+ -e 's:/snort_data:/var/lib/sguil:' -e 's:DAEMON 0:DAEMON 1:' \
+ -e 's:DEBUG 1:DEBUG 0:g' sensor_agent.conf || die "sed failed"
+}
+
+src_install() {
+
+ dodoc doc/*
+
+ dobin sensor/sensor_agent.tcl
+
+ newinitd "${FILESDIR}/log_packets.initd" log_packets
+ newinitd "${FILESDIR}/sensor_agent.initd" sensor_agent
+ insinto /etc/sguil
+ doins sensor/sensor_agent.conf
+
+ # Create the directory structure
+ diropts -g sguil -o sguil
+ keepdir /var/lib/sguil /var/run/sguil /var/run/sguil/archive \
+ "/var/lib/sguil/${HOSTNAME}" \
+ "/var/lib/sguil/${HOSTNAME}/portscans" \
+ "/var/lib/sguil/${HOSTNAME}/ssn_logs" \
+ "/var/lib/sguil/${HOSTNAME}/dailylogs" \
+ "/var/lib/sguil/${HOSTNAME}/sancp"
+
+}
+
+pkg_postinst() {
+ einfo
+ einfo "You should check /etc/sguil/sensor_agent.conf and"
+ einfo "/etc/init.d/logpackets and ensure that they are accurate"
+ einfo "for your environment. They should work providing that you"
+ einfo "are running the sensor on the same machine as the server."
+ einfo "This ebuild assumes that you are running a single sensor"
+ einfo "environment, if this is not the case then you must make sure"
+ einfo "to modify /etc/sguil/sensor_agent.conf and"
+ einfo "/etc/init.d/log_packets and change the HOSTNAME variable."
+ einfo
+}
+