From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 175C1138334 for ; Sat, 6 Jul 2019 09:47:20 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 34040E079C; Sat, 6 Jul 2019 09:47:19 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 06626E079C for ; Sat, 6 Jul 2019 09:47:18 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id AD52034728C for ; Sat, 6 Jul 2019 09:47:17 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id CD9836D7 for ; Sat, 6 Jul 2019 09:47:15 +0000 (UTC) From: "Jeroen Roovers" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jeroen Roovers" Message-ID: <1562406434.2eda3f6bf2232bd09f53b55b1a45e8b31f18e237.jer@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: net-analyzer/sguil-sensor/ X-VCS-Repository: repo/gentoo X-VCS-Files: net-analyzer/sguil-sensor/Manifest net-analyzer/sguil-sensor/sguil-sensor-1.0.0.ebuild X-VCS-Directories: net-analyzer/sguil-sensor/ X-VCS-Committer: jer X-VCS-Committer-Name: Jeroen Roovers X-VCS-Revision: 2eda3f6bf2232bd09f53b55b1a45e8b31f18e237 X-VCS-Branch: master Date: Sat, 6 Jul 2019 09:47:15 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: a86d3833-d117-401d-a30e-1df86bf5c2d8 X-Archives-Hash: d7ff60795403ccdb2da79e9e5cb090f7 commit: 2eda3f6bf2232bd09f53b55b1a45e8b31f18e237 Author: Jeroen Roovers gentoo org> AuthorDate: Sat Jul 6 09:46:47 2019 +0000 Commit: Jeroen Roovers gentoo org> CommitDate: Sat Jul 6 09:47:14 2019 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2eda3f6b net-analyzer/sguil-sensor: Version 1.0.0 Package-Manager: Portage-2.3.68, Repoman-2.3.16 Signed-off-by: Jeroen Roovers gentoo.org> net-analyzer/sguil-sensor/Manifest | 1 + .../sguil-sensor/sguil-sensor-1.0.0.ebuild | 80 ++++++++++++++++++++++ 2 files changed, 81 insertions(+) diff --git a/net-analyzer/sguil-sensor/Manifest b/net-analyzer/sguil-sensor/Manifest index 4aab28bb783..c9b086c62dc 100644 --- a/net-analyzer/sguil-sensor/Manifest +++ b/net-analyzer/sguil-sensor/Manifest @@ -1,2 +1,3 @@ DIST sguil-0.9.0.tar.gz 464204 BLAKE2B 147b743fd8f70969ee560a3f6995775c40cfbaf543d8292f16aa6f02289edde54207a3cddb4969229e0a123dad2fb589eaef3bddb016e6ff408a3d9be4c7820d SHA512 3f300901d0f0260fbc950b4c7604e3dc3eeb2d088ff45171db84e2d58e281242bf3582eac51162968f1f3766961aec4d0a7af54e85773102ee643a52e879cfa6 +DIST sguil-1.0.0.tar.gz 892934 BLAKE2B 69459eed682d91a1b57ba08c141dd655dbbfaa0d9d2956e6a26065f1b6820307b0e0e4dcbcad89537eba7499aea38f81739c351246e3dd6c46cab46bdf0d054f SHA512 fc3007383f90c99a0ace3eeebac75864f9aa549676e784c7bf1d81222282e3a5a3d5290b121097ae3c027dee3dd35bbe8ac9dfede04dbd561edfd3948a0465ab DIST sguil-sensor-0.8.0.tar.gz 142829 BLAKE2B f753c1bf6a95ba7b12d3a91d2d6ddf506b9dfb09208d08ad5ffcea95210525f014c3807d3e79df10739b00466e5e10e88d2e2494cfbbbb7c7145f2800df62600 SHA512 9b90598f2a3fdcf8652ccb92123944ffbda61c00f131bc951b12a95002f84f555f8c63cc1235fd7bb90875d00edbecbda02750bcca3bba7d16e1b1a150eb74ae diff --git a/net-analyzer/sguil-sensor/sguil-sensor-1.0.0.ebuild b/net-analyzer/sguil-sensor/sguil-sensor-1.0.0.ebuild new file mode 100644 index 00000000000..cb9d1ed1994 --- /dev/null +++ b/net-analyzer/sguil-sensor/sguil-sensor-1.0.0.ebuild @@ -0,0 +1,80 @@ +# Copyright 1999-2019 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +inherit user + +MY_PV="${PV/_p/p}" +DESCRIPTION="Sensor part of sguil Network Security Monitoring" +HOMEPAGE="https://github.com/bammv/sguil" +SRC_URI="${HOMEPAGE}/archive/v${PV}.tar.gz -> ${P/-sensor}.tar.gz" + +LICENSE="GPL-2 QPL" +SLOT="0" +KEYWORDS="~x86" +IUSE="" + +RDEPEND=" + >=dev-lang/tcl-8.3:0=[-threads] + >=dev-tcltk/tclx-8.3 + >=net-analyzer/barnyard-0.2.0-r1 + >=net-analyzer/snort-2.4.1-r1 + dev-ml/pcre-ocaml + net-analyzer/sancp +" + +S="${WORKDIR}/sguil-${MY_PV}" + +pkg_setup() { + enewgroup sguil + enewuser sguil -1 -1 /var/lib/sguil sguil +} + +src_prepare() { + default + sed -i \ + -e "s:gateway:${HOSTNAME}:" \ + -e 's:/snort_data:/var/lib/sguil:' \ + -e 's:DAEMON 0:DAEMON 1:' \ + -e 's:DEBUG 1:DEBUG 0:g' \ + sensor/sensor_agent.conf || die + sed -i \ + -e 's:/var/run/sensor_agent.pid:/run/sguil-sensor.pid:' \ + sensor/sensor_agent.tcl || die +} + +src_install() { + dodoc doc/* + + dobin sensor/sensor_agent.tcl + + newinitd "${FILESDIR}/log_packets.initd" log_packets + newinitd "${FILESDIR}/sensor_agent.initd" sensor_agent + newconfd "${FILESDIR}/log_packets.confd" log_packets + insinto /etc/sguil + doins sensor/sensor_agent.conf + + # Create the directory structure + diropts -g sguil -o sguil + keepdir /var/lib/sguil /var/lib/sguil/archive \ + "/var/lib/sguil/${HOSTNAME}" \ + "/var/lib/sguil/${HOSTNAME}/portscans" \ + "/var/lib/sguil/${HOSTNAME}/ssn_logs" \ + "/var/lib/sguil/${HOSTNAME}/dailylogs" \ + "/var/lib/sguil/${HOSTNAME}/sancp" + +} + +pkg_postinst() { + elog + elog "You should check /etc/sguil/sensor_agent.conf and" + elog "/etc/init.d/logpackets and ensure that they are accurate" + elog "for your environment. They should work providing that you" + elog "are running the sensor on the same machine as the server." + elog "This ebuild assumes that you are running a single sensor" + elog "environment, if this is not the case then you must make sure" + elog "to modify /etc/sguil/sensor_agent.conf and change the HOSTNAME variable." + elog "You should crontab the /etc/init.d/log_packets script to restart" + elog "each hour." + elog +}