Date: Mon, 27 Mar 2006 20:14:19 -0600 (CST) From: Paul Schmehl <pauls@utdallas.edu> To: FreeBSD-gnats-submit@FreeBSD.org Subject: ports/95018: security/sguil-sensor, new port submission Message-ID: <20060328021419.3D0E3261842@utd59514.utdallas.edu> Resent-Message-ID: <200603280220.k2S2KJ1b037972@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 95018 >Category: ports >Synopsis: security/sguil-sensor, new port submission >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Tue Mar 28 02:20:19 GMT 2006 >Closed-Date: >Last-Modified: >Originator: Paul Schmehl >Release: FreeBSD 6.0-SECURITY i386 >Organization: University of Texas at Dallas >Environment: System: FreeBSD hostname.utdallas.edu 6.0-SECURITY FreeBSD 6.0-SECURITY #0: Tue Feb 28 22:53:43 UTC 2006 root@builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386 >Description: Sguil is a network security monitoring system that uses snort >How-To-Repeat: >Fix: --- Makefile begins here --- # New ports collection makefile for: sguil-sensor # Date created: 23 Mar 2006 # Whom: Paul Schmehl <pauls@utdallas.edu> # # $FreeBSD$ # PORTNAME= sguil-sensor PORTVERSION= 0.6.1 CATEGORIES= security MASTER_SITES= ${MASTER_SITE_SOURCEFORGE} MASTER_SITE_SUBDIR= sguil MAINTAINER= pauls@utdallas.edu COMMENT= Squil is a network security management program RUN_DEPENDS= snort:${PORTSDIR}/security/snort \ barnyard:${PORTSDIR}/security/barnyard-sguil6 LIB_DEPENDS= tclx83:${PORTSDIR}/lang/tclX OPTIONS= SANCP "Include sancp support" off \ TLS "Include openssl support" off NO_BUILD= yes USE_RC_SUBR= sensor_agent.sh TCLSH_CMD?= tclsh8.4 WRKSRC= ${WRKDIR}/sguil-${PORTVERSION} SUB_LIST= SGUILDIR=${SGUILDIR} SUB_FILES= pkg-message sensor_agent.sh PLIST_SUB= SGUILDIR=${SGUILDIR} SGUILDIR?= sguil-sensor PORTDOCS= CHANGES FAQ INSTALL INSTALL.openbsd LICENSE.QPL \ OPENSSL.README TODO UPGRADE USAGE sguildb.dia .include <bsd.port.pre.mk> WITH_PCRE= true .if defined(WITH_SANCP) RUN_DEPENDS+= sancp:${PORTSDIR}/security/sancp .endif .if defined(WITH_TLS) LIB_DEPENDS+= tls:${PORTSDIR}/devel/tcltls .endif post-patch: .for f in sensor_agent.tcl @${REINPLACE_CMD} -e 's:exec tclsh:exec ${PREFIX}/bin/${TCLSH_CMD}:g' \ ${WRKSRC}/sensor/${f} .endfor do-install: @${MKDIR} ${PREFIX}/bin/${SGUILDIR} ${INSTALL_SCRIPT} -m 751 ${WRKSRC}/sensor/sensor_agent.tcl \ ${PREFIX}/bin/${SGUILDIR}/sensor_agent.tcl .for f in log_packets.sh ${INSTALL_SCRIPT} -m 751 ${WRKSRC}/sensor/${f} \ ${PREFIX}/bin/${SGUILDIR}/${f} .endfor .for f in sensor_agent.conf ${INSTALL_DATA} ${WRKSRC}/sensor/${f} \ ${PREFIX}/etc/${f}-sample .endfor .for f in log_packets.conf ${INSTALL_DATA} ${FILESDIR}/${f} \ ${PREFIX}/etc/${f}-sample .endfor .if defined(WITH_SANCP) .for f in sancp.conf ${INSTALL_DATA} ${WRKSRC}/sensor/sancp/${f} \ ${PREFIX}/etc/${f}-sample .endfor .endif .if !defined(NOPORTDOCS) @${MKDIR} ${DOCSDIR} cd ${WRKSRC}/doc && ${INSTALL_DATA} \ ${PORTDOCS} ${DOCSDIR} .endif @${CAT} ${PKGMESSAGE} .include <bsd.port.post.mk> --- Makefile ends here --- --- distinfo begins here --- MD5 (sguil-sensor-0.6.1.tar.gz) = 62be71b0aa41ccacb7872839dc4bf5ad SHA256 (sguil-sensor-0.6.1.tar.gz) = b1da0fffeaecd69b9d8eeeb27025fdc3493a2eabfec8ed4153f688f11ee226eb SIZE (sguil-sensor-0.6.1.tar.gz) = 103441 --- distinfo ends here --- --- pkg-descr begins here --- Sguil (pronounced "sgweel") is a graphical interface to snort (www.snort.org), an open source intrusion detection system. The actual interface and GUI server are written in tcl/tk (www.tcl.tk). Sguil also relies on other open source software in order to function properly. The sensor list includes security/barnyard, security/snort, security/sancp, tcpdump (a part of the OS) and devel/tcltls as well as lang/tcl84 and lang/tclX. Care has been taken to ensure that everything you need to build a working sguil operation is in the FreeBSD ports system or part of the OS already. Sguil currently functions as an analysis interface and has no snort sensor or rule management capabilities. WWW: http://sguil.sourceforge.net/index.php pauls@utdallas.edu --- pkg-descr ends here --- --- pkg-plist begins here --- bin/%%SGUILDIR%%/log_packets.sh-sample bin/%%SGUILDIR%%/sensor_agent.tcl etc/log_packets.conf-sample @unexec if [ -f %D/etc/sancp.conf-sample ]; then rm %D/etc/sancp.conf-sample; fi; @dirrm bin/%%SGUILDIR%% --- pkg-plist ends here --- --- log_packets.conf begins here --- # Conf file for the log_packets script # Make sure you verify the location of # each of the binaries on your OS HOSTNAME="myhost" # Path to snort binary SNORT_PATH="/usr/local/bin/snort" # Directory to log pcap data to (date dirs will be created in here) # Note: The path $HOSTNAME/dailylogs, will be appended to this. LOG_DIR="/snort_data" # Percentage of disk to try and maintain MAX_DISK_USE=90 # Interface to 'listen' to. INTERFACE="eth0" # Other options to use when starting snort #OPTIONS="-u sguil -g sguil -m 122" # Where to store the pid PIDFILE="/var/run/snort_log-${HOSTNAME}.pid" # How do we run ps PS="ps awx" # Where is grep GREP="/usr/bin/grep" #Add BPFs here. #The below is an example of a filter for ignoring outbound HTTP from my network # to the world. #FILTER='not \( src net 67.11.255.148/32 and dst port 80 and "tcp[0:2] > 1024" \) and not \( src port 80 and dst net 67.11.255.148/32 and "tcp[2:2] > 1024"\)' #Some installs may need these #LD_LIBRARY_PATH=/usr/local/lib/mysql #export LD_LIBRARY_PATH --- log_packets.conf ends here --- --- patch-log_packets.sh begins here --- --- sensor/log_packets.sh.orig Fri Mar 24 13:12:18 2006 +++ sensor/log_packets.sh Mon Mar 27 17:22:54 2006 @@ -23,37 +23,16 @@ ############################################################## -# Edit these for your setup +# You shouldn't need to edit anything in this script -# Sensors hostname. -# Note: If running multiple snort instances, then this must be different -# for each instance (ie sensor1, sensor2, sensor-eth0, sensor-eth1, etc) -HOSTNAME="myhost" -# Path to snort binary -SNORT_PATH="/usr/local/bin/snort" -# Directory to log pcap data to (date dirs will be created in here) -# Note: The path $HOSTNAME/dailylogs, will be appended to this. -LOG_DIR="/snort_data" -# Percentage of disk to try and maintain -MAX_DISK_USE=90 -# Interface to 'listen' to. -INTERFACE="eth0" -# Other options to use when starting snort -#OPTIONS="-u sguil -g sguil -m 122" -# Where to store the pid -PIDFILE="/var/run/snort_log-${HOSTNAME}.pid" -# How do we run ps -PS="ps awx" -# Where is grep -GREP="/usr/bin/grep" -#Add BPFs here. -#The below is an example of a filter for ignoring outbound HTTP from my network -# to the world. -#FILTER='not \( src net 67.11.255.148/32 and dst port 80 and "tcp[0:2] > 1024" \) and not \( src port 80 and dst net 67.11.255.148/32 and "tcp[2:2] > 1024"\)' - -#Some installs may need these -#LD_LIBRARY_PATH=/usr/local/lib/mysql -#export LD_LIBRARY_PATH +CONF=/path/to/log_packets.conf +if [ -r ${CONF} ]; then + . ${CONF} +else + echo "Your conf file is either missing or the path " + echo "in the log_packets.sh script is incorrect." + exit 1 +fi TZ=GMT export TZ --- patch-log_packets.sh ends here --- --- patch-sensor_agent.tcl begins here --- --- sensor/sensor_agent.tcl.orig Mon Mar 20 20:38:18 2006 +++ sensor/sensor_agent.tcl Mon Mar 20 20:40:06 2006 @@ -1005,16 +1005,16 @@ } } # Parse the config file here -# Default location is /etc/sensor_agent.conf or pwd +# Default location is /usr/local/etc/sensor_agent.conf or pwd if { ![info exists CONF_FILE] } { # No conf file specified check the defaults - if { [file exists /etc/sensor_agent.conf] } { - set CONF_FILE /etc/sensor_agent.conf + if { [file exists /usr/local/etc/sensor_agent.conf] } { + set CONF_FILE /usr/local/etc/sensor_agent.conf } elseif { [file exists ./sensor_agent.conf] } { set CONF_FILE ./sensor_agent.conf } else { puts "Couldn't determine where the sensor_agent.tcl config file is" - puts "Looked for /etc/sensor_agent.conf and ./sensor_agent.conf." + puts "Looked for /usr/local/etc/sensor_agent.conf and ./sensor_agent.conf." DisplayUsage $argv0 } } --- patch-sensor_agent.tcl ends here --- --- pkg-message.in begins here --- *********************************** * !!!!!!!!!!! WARNING !!!!!!!!!!! * *********************************** If you already had barnyard installed, this port will NOT deinstall it and install the barnyard-sguil6 port instead. You will need to deinstall the barnyard port and install the barnyard-sguil6 port yourself instead. This port WILL NOT WORK without the barnyard-sguil6 port!! You MUST edit the log_packets.conf file (located in %%PREFIX%%/etc/) to fit your configuration before running the log_packets.sh script. See the %%DOCSDIR%%/INSTALL doc for details on the configuration and for croning the script. WARNING!!! Sguil et al will fill up your /tmp directory very quickly. You should probably configure sguil et al to log to another partition/location (e.g. /nsm/tmp/). You must ALSO edit the sensor_agent.conf file (located in %%PREFIX%%/etc/) to reflect your configuration before starting the sensor_agent. If you chose to run sancp, and you already had a sancp.conf file in %%PREFIX%%/etc, copy it to sancp.conf.orig before creating the new one. The new sancp.conf-sample file contains the settings for squil. If you still want to maintain the customized sancp.conf file, then copy the new sancp.conf-sample file to sguild-sancp.conf (for example) and add sancp_conf=%%PREFIX%%/etc/sguild-sancp.conf to /etc/rc.conf. --- pkg-message.in ends here --- --- sensor_agent.sh.in begins here --- #!/bin/sh # # PROVIDE: sensor_agent # REQUIRE: DAEMON # KEYWORD: FreeBSD shutdown # Add the following lines to /etc/rc.conf to enable sensor_agent: # sensor_agent_enable (bool): Set to YES to enable sensor_agent # Default: NO # sensor_agent_flags (str): Extra flags passed to sensor_agent # Default: -D # sensor_agent_conf (str): Sensor_agent configuration file # Default: %%PREFIX%%/etc/sensor_agent.conf # . %%RC_SUBR%% name="sensor_agent" rcvar=`set_rcvar` command="%%PREFIX%%/bin/%%SGUILDIR%%/sensor_agent.tcl" pidfile="/var/run/${name}.pid" status_cmd="sensor_status" stop_cmd="sensor_stop" procname="%%PREFIX%%/bin/tclsh8.4" load_rc_config $name [ -z "$sensor_agent_enable" ] && sensor_agent_enable="NO" [ -z "$sensor_agent_conf" ] && sensor_agent_conf="%%PREFIX%%/etc/sensor_agent.conf" [ -z "$sensor_agent_flags" ] && sensor_agent_flags="-D" [ -n "$sensor_agent_conf" ] && sensor_agent_flags="$sensor_agent_flags -c $sensor_agent_conf" sensor_status() { pid=$(check_process ${procname}) if [ ${pid} ]; then echo "${name} is running as pid ${pid}." else echo "${name} is not running." rm -f ${pidfile} fi } sensor_stop() { pid=$(check_process ${procname}) if [ $pid ]; then echo "Stopping ${name}." kill -${sig_stop:-TERM} ${pid} wait_for_pids ${pid} rm -f ${pidfile} else echo "${name} not running?" fi } run_rc_command "$1" --- sensor_agent.sh.in ends here --- >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060328021419.3D0E3261842>