ports/77690: new port submission - security/sguil-server
Paul Schmehl
pauls at utdallas.edu
Fri Feb 18 20:40:25 UTC 2005
>Number: 77690
>Category: ports
>Synopsis: new port submission - security/sguil-server
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Fri Feb 18 20:40:25 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: Paul Schmehl
>Release: FreeBSD 5.3-SECURITY i386
>Organization:
University of Texas at Dallas
>Environment:
System: FreeBSD unknown.utdallas.edu 5.3-SECURITY FreeBSD 5.3-SECURITY #0: Fri Jan 7 04:09:28 UTC 2005 root at builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386
>Description:
This is a new port submission - security/sguil-server
Suild is a network security monitoring system used to
analyze logs and snort data to focus in on critical
attacks and determine the method of breakin
>How-To-Repeat:
>Fix:
--- new_port_sguil-server begins here ---
# This is a shell archive. Save it in a file, remove anything before
# this line, and then unpack it by entering "sh file". Note, it may
# create directories; files and directories will be owned by you and
# have default permissions.
#
# This archive contains:
#
# /usr/ports/security/sguil-server/
# /usr/ports/security/sguil-server/Makefile
# /usr/ports/security/sguil-server/pkg-descr
# /usr/ports/security/sguil-server/distinfo
# /usr/ports/security/sguil-server/pkg-install
# /usr/ports/security/sguil-server/pkg-plist
# /usr/ports/security/sguil-server/pkg-message
# /usr/ports/security/sguil-server/files
# /usr/ports/security/sguil-server/files/serveragent.sh
# /usr/ports/security/sguil-server/files/patch-sguild
# /usr/ports/security/sguil-server/files/patch-sguild.conf
# /usr/ports/security/sguil-server/files/patch-archive_sguildb.tcl
# /usr/ports/security/sguil-server/files/patch-sguild.access
#
echo c - /usr/ports/security/sguil-server/
mkdir -p /usr/ports/security/sguil-server/ > /dev/null 2>&1
echo x - /usr/ports/security/sguil-server/Makefile
sed 's/^X//' >/usr/ports/security/sguil-server/Makefile << 'END-of-/usr/ports/security/sguil-server/Makefile'
X# New ports collection makefile for: sguil-server
X# Date created: 14 Feb 2005
X# Whom: Paul Schmehl <pauls at utdallas.edu>
X#
X# $FreeBSD$
X#
X
XPORTNAME= sguil-server
XPORTVERSION= 0.5.3
XCATEGORIES= security
XMASTER_SITES= ${MASTER_SITE_SOURCEFORGE}sguil/
X
XMAINTAINER= pauls at utdallas.edu
XCOMMENT= Squil is a network security management program
X
XRUN_DEPENDS+= ${LOCALBASE}/bin/p0f:${PORTSDIR}/net-mgmt/p0f \
X ${LOCALBASE}/bin/tcpflow:${PORTSDIR}/net/tcpflow \
X ${LOCALBASE}/bin/dtplite:${PORTSDIR}/devel/tcllib \
X ${LOCALBASE}/lib/tls:${PORTSDIR}/devel/tcltls
X
XNO_BUILD= yes
XWITHOUT_X11= yes
XWITH_MYSQL= yes
XWANT_MSQL_VER= 41
XWRKSRC= ${WRKDIR}/sguil-${PORTVERSION}
X
XPORTDOCS= CHANGES INSTALL INSTALL.openbsd LICENSE.QPL \
X OPENSSL.README TODO USAGE sguildb.dia
X
XINSTALL_WRKSRC= ${WRKSRC}/ \
X ${WRKSRC}/docs \
X ${WRKSRC}/server \
X ${WRKSRC}/server/lib \
X ${WRKSRC}/server/sql_scripts
X
X.if defined(WITHOUT_X11)
XRUN_DEPENDS+= ${LOCALBASE}/lib/tclX8.3/tclx.tcl:${PORTSDIR}/lang/tclX
XDEPENDS_ARGS+= WITHOUT_X11=yes
X.endif
X.if defined(WITH_MYSQL)
XRUN_DEPENDS+= ${LOCALBASE}/lib/mysql/libmysqlclient.so:${PORTSDIR}/databases/mysql41-client
XDEPENDS_ARGS+= WITH_OPENSSL=yes
XRUN_DEPENDS+= ${LOCALBASE}/lib/tcl8.4/mysqltcl/libmysqltcl.so.2:${PORTSDIR}/databases/mysqltcl
X.endif
X
Xdo-install:
X @${SED} "s|%%PREFIX%%|${PREFIX}|g" < ${FILESDIR}/serveragent.sh > ${WRKDIR}/serveragent.sh
X @${MKDIR} ${PREFIX}/etc/sguil-server
X @${MKDIR} ${PREFIX}/bin/sguil-server
X @${MKDIR} ${PREFIX}/bin/sguil-server/lib
X
Xpost-install:
X ${SH} ${PKGINSTALL}
X ${INSTALL_SCRIPT} -m 751 ${WRKSRC}/server/sguild ${PREFIX}/bin/sguil-server/sguild
X ${INSTALL_SCRIPT} -m 751 ${WRKDIR}/serveragent.sh ${PREFIX}/etc/rc.d/serveragent.sh
X ${INSTALL_SCRIPT} -m 751 ${WRKSRC}/server/archive_sguildb.tcl ${PREFIX}/bin/sguil-server/archive_sguildb.tcl
X ${INSTALL_DATA} ${WRKSRC}/server/lib/*.tcl ${PREFIX}/bin/sguil-server/lib/
X ${INSTALL_DATA} ${WRKSRC}/server/sql_scripts/*.sql ${PREFIX}/etc/sguil-server/
X.for f in autocat.conf sguild.conf sguild.access sguild.queries sguild.reports sguild.users
X ${INSTALL_DATA} ${WRKSRC}/server/${f} ${PREFIX}/etc/sguil-server/${f}-sample
X [ -f ${PREFIX}/etc/sguil-server/${f} ] || \
X ${INSTALL_DATA} ${WRKSRC}/server/${f} ${PREFIX}/etc/sguil-server/${f}
X.endfor
X.if !defined(NOPORTDOCS)
X @${MKDIR} ${DOCSDIR}
X cd ${WRKSRC}/doc && ${INSTALL_DATA} ${PORTDOCS} ${DOCSDIR}
X.endif
X @${SED} 's|%%PREFIX%%|${PREFIX}|' ${PKGMESSAGE}
X @${CHOWN} -R sguil:sguil ${PREFIX}/bin/sguil-server
X @${CHOWN} -R sguil:sguil ${PREFIX}/etc/sguil-server
X @${CHOWN} sguil:sguil ${PREFIX}/etc/rc.d/serveragent.sh
X
X.include <bsd.port.mk>
END-of-/usr/ports/security/sguil-server/Makefile
echo x - /usr/ports/security/sguil-server/pkg-descr
sed 's/^X//' >/usr/ports/security/sguil-server/pkg-descr << 'END-of-/usr/ports/security/sguil-server/pkg-descr'
XSguil is a network security management system.
X
XSguil is an open source tool to implement Network
XSecurity Monitoring (NSM). NSM is the collection,
Xanalysis, and escalation of indications and warnings
Xto detect and respond to intrusions. NSM tools are
Xused more for network audit and specialized
Xapplications than traditional alert-centric "intrusion
Xdetection" systems.
X
XWant to learn more about Network Security Monitoring
X(NSM)? Then check out Richard Bejtlich's recently
Xreleased book, The Tao of Network Security Monitoring:
XBeyond Intrusion Detection. An excerpt reads:
X
X"Network security monitoring (NSM) equips security
Xstaff to deal with the inevitable consequences of too
Xfew resources and too many responsibilities. NSM collects
Xthe data needed to generate better assessment, detection,
Xand response processes--resulting in decreased impact from
Xunauthorized activities."
END-of-/usr/ports/security/sguil-server/pkg-descr
echo x - /usr/ports/security/sguil-server/distinfo
sed 's/^X//' >/usr/ports/security/sguil-server/distinfo << 'END-of-/usr/ports/security/sguil-server/distinfo'
XMD5 (sguil-server-0.5.3.tar.gz) = 7270f457a36f45bd41866ebddcb45e45
XSIZE (sguil-server-0.5.3.tar.gz) = 62861
END-of-/usr/ports/security/sguil-server/distinfo
echo x - /usr/ports/security/sguil-server/pkg-install
sed 's/^X//' >/usr/ports/security/sguil-server/pkg-install << 'END-of-/usr/ports/security/sguil-server/pkg-install'
X#!/bin/sh
X
XPATH=/bin:/usr/sbin
X
XUSER=sguil
XGROUP=${USER}
XPREFIX=/usr/local
XHOMEDIR="${PREFIX}/bin/sguil-server"
X
Xif pw group show "${GROUP}" 2>/dev/null; then
X echo "You already have a group \"${GROUP}\", so I will use it."
Xelse
X if pw groupadd ${GROUP}; then
X echo "Added group \"${GROUP}\"."
X else
X echo "Adding group \"${GROUP}\" failed..."
X exit 1
X fi
Xfi
X
Xif pw user show "${USER}" 2>/dev/null; then
X echo "You already have a user \"${USER}\", so I will use it."
X if pw usermod ${USER} -d ${HOMEDIR}
X then
X chown -R ${USER}:${GROUP} ${HOMEDIR}
X chmod 750 ${HOMEDIR}
X echo "Changed home directory of \"${USER}\" to \"${HOMEDIR}\""
X else
X echo "Changing home directory of \"${USER}\" to \"${HOMEDIR}\" failed..."
X exit 1
X fi
Xelse
X if pw useradd ${USER} -g ${GROUP} -h - \
X -d ${HOMEDIR} -s /sbin/nologin -c "Sguil Sensor"
X chown -R ${USER}:${GROUP} ${HOMEDIR}
X chmod 750 ${HOMEDIR}
X then
X echo "Added user \"${USER}\"."
X else
X echo "Adding user \"${USER}\" failed..."
X exit 1
X fi
Xfi
END-of-/usr/ports/security/sguil-server/pkg-install
echo x - /usr/ports/security/sguil-server/pkg-plist
sed 's/^X//' >/usr/ports/security/sguil-server/pkg-plist << 'END-of-/usr/ports/security/sguil-server/pkg-plist'
X at unexec if cmp -s %D/etc/sguil-server/autocat.conf %D/etc/sguil-server/autocat.conf-sample; then rm -f %D/etc/sguil-server/autocat.conf; fi
X at unexec if cmp -s %D/etc/sguil-server/sguild.access %D/etc/sguil-server/sguild.access-sample; then rm -f %D/etc/sguil-server/sguild.access; fi
X at unexec if cmp -s %D/etc/sguil-server/sguild.conf %D/etc/sguil-server/sguild.conf-sample; then rm -f %D/etc/sguil-server/sguild.conf; fi
X at unexec if cmp -s %D/etc/sguil-server/sguild.queries %D/etc/sguil-server/sguild.queries-sample; then rm -f %D/etc/sguil-server/sguild.queries; fi
X at unexec if cmp -s %D/etc/sguil-server/sguild.reports %D/etc/sguil-server/sguild.reports-sample; then rm -f %D/etc/sguil-server/sguild.reports; fi
X at unexec if cmp -s %D/etc/sguil-server/sguild.users %D/etc/sguil-server/sguild.users-sample; then rm -f %D/etc/sguil-server/sguild.users; fi
X at unexec rm -f %D/etc/sguil-server/*-sample
X at unexec rm -f %D/etc/sguil-server/*.sql
X at unexec if [ ! -f %D/etc/sguil-server/* ]; then rm -fr %D/etc/sguil-server; fi
Xetc/rc.d/serveragent.sh
X at unexec rm -fr %D/bin/sguil-server
X at unexec rm -fr %%DOCSDIR%%
X at unexec if [ -d %D/etc/sguil-server ]; then echo "The %D/etc/sguil-server directory was not removed,"; fi
X at unexec if [ -d %D/etc/sguil-server ]; then echo "because some of the config files have been changed."; fi
X at unexec if [ -d %D/etc/sguil-server ]; then echo "If you don't want to retain the config files,"; fi
X at unexec if [ -d %D/etc/sguil-server ]; then echo "then remove the directory manually."; fi
END-of-/usr/ports/security/sguil-server/pkg-plist
echo x - /usr/ports/security/sguil-server/pkg-message
sed 's/^X//' >/usr/ports/security/sguil-server/pkg-message << 'END-of-/usr/ports/security/sguil-server/pkg-message'
X ***********************************
X * !!!!!!!!!!! WARNING !!!!!!!!!!! *
X ***********************************
X
XIf you had existing config files in %%PREFIX%%/etc/sguil-server
Xthey were not overwritten. If this is a first time install, you
Xmust edit the various config files for your site. See the INSTALL
Xdoc in %%PREFIX%%/${DOCSDIR} for details.
X
XThe sql scripts for creating database tables were also placed in
Xthe %%PREFIX%%/etc/sguil-server directory. PLEASE NOTE: LOG_DIR
Xis not set by this install. You MUST create the correct LOG_DIRS
Xand put a copy of the snort rules you use in LOG_DIR/rules.
X
XA startup script, named serveragent.sh-sample was installed in
X%%PREFIX%%/etc/rc.d/. Create a copy named serveragent.sh in the
Xsame directory and enable the script in /etc/rc.conf using the
Xusual rc.subr syntax. See rc.conf(5) for details or go to
Xhttp://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/configtuning-rcng.html
X
XFor general questions, see the sguil faq: http://sguil.sourceforge.net/index.php?page=faq
XFor detailed install instructions see Richard Bejtlich's excellent guide
Xat http://sguil.sourceforge.net/sguil_guide_latest.txt.
END-of-/usr/ports/security/sguil-server/pkg-message
echo c - /usr/ports/security/sguil-server/files
mkdir -p /usr/ports/security/sguil-server/files > /dev/null 2>&1
echo x - /usr/ports/security/sguil-server/files/serveragent.sh
sed 's/^X//' >/usr/ports/security/sguil-server/files/serveragent.sh << 'END-of-/usr/ports/security/sguil-server/files/serveragent.sh'
X#!/bin/sh
X
XPROG=/usr/local/bin/sguil-server/sguild
XPIDFILE=/var/run/sguild.pid
XCONF=/usr/local/etc/sguil-server/sguild.conf
XFLAGS="-D -c ${CONF} -P ${PID}"
X
Xcase "$1" in
X start)
X ${PROG} ${FLAGS}
X echo "Starting SGUILD......."
X ;;
X stop)
X kill -TERM `cat ${PIDFILE}`
X ;;
X restart)
X kill -HUP `cat ${PIDFILE}`
X ;;
X status)
X if [ -f ${PIDFILE} ]; then
X echo "Sguild appears to be running."
X else
X echo "Sguild does not appear to be running."
X fi
X ;;
X *)
X echo ""
X echo "Usage: `basename $0` { start | stop | restart | status }"
X echo ""
X exit 64
X ;;
Xesac
END-of-/usr/ports/security/sguil-server/files/serveragent.sh
echo x - /usr/ports/security/sguil-server/files/patch-sguild
sed 's/^X//' >/usr/ports/security/sguil-server/files/patch-sguild << 'END-of-/usr/ports/security/sguil-server/files/patch-sguild'
X--- server/sguild.orig Mon Nov 22 16:42:40 2004
X+++ server/sguild Fri Feb 18 01:13:20 2005
X@@ -1,6 +1,6 @@
X #!/bin/sh
X # Run tcl from users PATH \
X-exec tclsh "$0" "$@"
X+exec tclsh8.4 "$0" "$@"
X
X # $Id: sguild,v 1.133 2004/11/22 22:42:40 bamm Exp $ #
X
X@@ -178,7 +178,7 @@
X package require tls
X # Check for certs
X if {![info exists CERTS_PATH]} {
X- set CERTS_PATH /etc/sguild/certs
X+ set CERTS_PATH /usr/local/etc/sguil-server/certs
X }
X if {![file exists $CERTS_PATH] || ![file isdirectory $CERTS_PATH]} {
X puts "ERROR: $CERTS_PATH does not exist or is not a directory"
X@@ -205,13 +205,13 @@
X
X if { ![info exists CONF_FILE] } {
X # No conf file specified check the defaults
X- if { [file exists /etc/sguild/sguild.conf] } {
X- set CONF_FILE /etc/sguild/sguild.conf
X+ if { [file exists /usr/local/etc/sguil-server/sguild.conf] } {
X+ set CONF_FILE /usr/local/etc/sguil-server/sguild.conf
X } elseif { [file exists ./sguild.conf] } {
X set CONF_FILE ./sguild.conf
X } else {
X puts "Couldn't determine where the sguil config file is"
X- puts "Looked for ./sguild.conf and /etc/sguild/sguild.conf."
X+ puts "Looked for ./sguild.conf and /usr/local/etc/sguil-server/sguild.conf."
X DisplayUsage $argv0
X }
X }
X@@ -286,17 +286,17 @@
X # Check for a valid USERS file
X if { ![info exists USERS_FILE] } {
X # No users file was specified. Go with the defaults
X- if { [file exists /etc/sguild/sguild.users] } {
X- set USERS_FILE "/etc/sguild/sguild.users"
X+ if { [file exists /usr/local/etc/sguil-server/sguild.users] } {
X+ set USERS_FILE "/usr/local/etc/sguil-server/sguild.users"
X } elseif { [file exists ./sguild.users] } {
X set USERS_FILE "./sguild.users"
X } else {
X if { [info exists ADDUSER] && $ADDUSER } {
X- CreateUsersFile "/etc/sguild/sguil.users"
X+ CreateUsersFile "/usr/local/etc/sguil-server/sguil.users"
X } else {
X set DEBUG 2
X LogMessage "ERROR: Could not find a sguild.users file."
X- LogMessage " Checked in ./ and /etc/sguild/"
X+ LogMessage " Checked in ./ and /usr/local/etc/sguil-server/"
X DisplayUsage $argv0
X }
X }
X@@ -324,8 +324,8 @@
X # Load accessfile
X if { ![info exists ACCESS_FILE] } {
X # Check the defaults
X- if { [file exists /etc/sguild/sguild.access] } {
X- set ACCESS_FILE "/etc/sguild/sguild.access"
X+ if { [file exists /usr/local/etc/sguil-server/sguild.access] } {
X+ set ACCESS_FILE "/usr/local/etc/sguil-server/sguild.access"
X } elseif { [file exists ./sguild.access] } {
X set ACCESS_FILE "./sguild.access"
X } else {
X@@ -339,8 +339,8 @@
X }
X # Load auto cat config
X if { ![info exists AUTOCAT_FILE] } {
X- if { [file exists /etc/sguild/autocat.conf] } {
X- set AUTOCAT_FILE "/etc/sguild/autocat.conf"
X+ if { [file exists /usr/local/etc/sguil-server/autocat.conf] } {
X+ set AUTOCAT_FILE "/usr/local/etc/sguil-server/autocat.conf"
X } else {
X set AUTOCAT_FILE "./autocat.conf"
X }
X@@ -350,8 +350,8 @@
X }
X # Load global queries.
X if { ![info exists GLOBAL_QRY_FILE] } {
X- if { [file exists /etc/sguild/sguild.queries] } {
X- set GLOBAL_QRY_FILE "/etc/sguild/sguild.queries"
X+ if { [file exists /usr/local/etc/sguil-server/sguild.queries] } {
X+ set GLOBAL_QRY_FILE "/usr/local/etc/sguil-server/sguild.queries"
X } else {
X set GLOBAL_QRY_FILE "./sguild.queries"
X }
X@@ -363,8 +363,8 @@
X }
X # Load report queries.
X if { ![info exists REPORT_QRY_FILE] } {
X- if { [file exists /etc/sguild/sguild.reports] } {
X- set REPORT_QRY_FILE "/etc/sguild/sguild.reports"
X+ if { [file exists /usr/local/etc/sguil-server/sguild.reports] } {
X+ set REPORT_QRY_FILE "/usr/local/etc/sguil-server/sguild.reports"
X } else {
X set REPORT_QRY_FILE "./sguild.reports"
X }
END-of-/usr/ports/security/sguil-server/files/patch-sguild
echo x - /usr/ports/security/sguil-server/files/patch-sguild.conf
sed 's/^X//' >/usr/ports/security/sguil-server/files/patch-sguild.conf << 'END-of-/usr/ports/security/sguil-server/files/patch-sguild.conf'
X--- server/sguild.conf.orig Mon Nov 22 17:53:57 2004
X+++ server/sguild.conf Fri Feb 18 01:13:32 2005
X@@ -1,7 +1,7 @@
X # $Id: sguild.conf,v 1.24 2004/11/22 23:53:57 bamm Exp $ #
X
X # Path the sguild libs
X-set SGUILD_LIB_PATH ./lib
X+set SGUILD_LIB_PATH /usr/local/bin/sguil-server/lib/
X
X # DEBUG 0=off 1=important stuff 2=everything. Option 2 is VERY chatty.
X set DEBUG 2
X@@ -9,7 +9,7 @@
X # Run sguild in daemon mode. 1=on 0=off
X # This overrides above and will set DEBUG off.
X # set DAEMON 1 is the same as using -D
X-set DAEMON 0
X+set DAEMON 1
X
X # Syslog Facility to log to in DAEMON mode
X # Note the Errors will go to SYSLOGFACILITY.err
X@@ -60,7 +60,7 @@
X
X # You MUST have tcpflow installed to get xscripts
X # http://www.circlemud.org/~jelson/software/tcpflow/
X-set TCPFLOW "/usr/bin/tcpflow"
X+set TCPFLOW "/usr/local/bin/tcpflow"
X
X # p0f - (C) Michal Zalewski <lcamtuf at gis.net>, William Stearns <wstearns at pobox.com>
X # If you have p0f (a passive OS fingerprinting system) installed, you can have
X@@ -71,7 +71,7 @@
X
X # Path the the p0f binary. Switches -q and -s <filename> are appended on exec,
X # add any others you may need here.
X-set P0F_PATH "/usr/sbin/p0f"
X+set P0F_PATH "/usr/local/bin/p0f"
X
X # Enable the emailing of events. Don't worry about the other email options if this
X # is NOT enabled.
END-of-/usr/ports/security/sguil-server/files/patch-sguild.conf
echo x - /usr/ports/security/sguil-server/files/patch-archive_sguildb.tcl
sed 's/^X//' >/usr/ports/security/sguil-server/files/patch-archive_sguildb.tcl << 'END-of-/usr/ports/security/sguil-server/files/patch-archive_sguildb.tcl'
X--- server/archive_sguildb.tcl.orig Mon Dec 6 12:27:55 2004
X+++ server/archive_sguildb.tcl Fri Feb 18 01:13:11 2005
X@@ -1,6 +1,6 @@
X #!/bin/sh
X # Run tcl from users PATH \
X-exec tclsh "$0" "$@"
X+exec tclsh8.4 "$0" "$@"
X
X # $Id #
X
END-of-/usr/ports/security/sguil-server/files/patch-archive_sguildb.tcl
echo x - /usr/ports/security/sguil-server/files/patch-sguild.access
sed 's/^X//' >/usr/ports/security/sguil-server/files/patch-sguild.access << 'END-of-/usr/ports/security/sguil-server/files/patch-sguild.access'
X--- server/sguild.access.orig Fri Feb 18 12:56:34 2005
X+++ server/sguild.access Fri Feb 18 12:58:05 2005
X@@ -4,7 +4,8 @@
X # This file is used by sguild for access control. It is read upon init #
X # or when sguild receives a HUP signal. #
X # #
X-# By default, sguild will look first for /etc/sguild/sguild.access, #
X+# By default, sguild will look first for #
X+# /usr/local/etc/sguild/sguild.access, #
X # then ./sguild.access unless the -A /path/to/sguild.access switch #
X # is used. #
X # #
END-of-/usr/ports/security/sguil-server/files/patch-sguild.access
exit
--- new_port_sguil-server ends here ---
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-ports-bugs
mailing list