mirror of
https://github.com/Ponce/slackbuilds
synced 2024-11-25 10:03:03 +01:00
network/snort: Removed (download link broken)
This commit is contained in:
dsomero
David Somero
parent
b15ff21f36
commit
b32fe885a5
7 changed files with 0 additions and 303 deletions
|
|
@ -1,16 +0,0 @@
|
|||
Snort is an open source network intrusion detection and prevention system. It
|
||||
is capable of performing real-time traffic analysis, alerting, blocking and
|
||||
packet logging on IP networks. It utilizes a combination of protocol analysis
|
||||
and pattern matchingin order to detect a anomalies, misuse and attacks.
|
||||
Snort uses a flexible rules language to describe activity that can be considered
|
||||
malicious or anomalous as well as an analysis engine that incorporates a modular
|
||||
plugin architecture. Snort is capable of detecting and responding in real-time,
|
||||
sending alerts, performing session sniping, logging packets, or dropping
|
||||
sessions/packets when deployed in-line.
|
||||
|
||||
Snort has three primary functional modes. It can be used as a packet sniffer
|
||||
like tcpdump(1), a packet logger (useful for network traffic debugging, etc),
|
||||
or as a full blown network intrusion detection and prevention system.
|
||||
|
||||
Note that --libdir seems to be ignored on Slackware64; libraries are installed
|
||||
to /usr/lib anyway.
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
Snort has three primary functional modes. It can be used as a packet sniffer
|
||||
like tcpdump(1), a packet logger (useful for network traffic debugging, etc),
|
||||
or as a full blown network intrusion detection and prevention system.
|
||||
|
||||
Please read the snort_manual.pdf file that should be included with this
|
||||
distribution for full documentation on the program as well as a guide to
|
||||
getting started.
|
||||
|
||||
This package builds a very basic snort implimentation useful for monitoring
|
||||
traffic as an IDS or packet logger and as a sort of improved tcpdump (which
|
||||
is what I use it for). MySQL support is included, so you should have little
|
||||
trouble hooking snort up to a database or ACID. For more information on
|
||||
these, check out snort's homepage at:
|
||||
|
||||
http://www.snort.org/
|
||||
http://www.snort.org/docs/
|
||||
|
||||
snort.org has a nasty habit of changing the location of their source
|
||||
code, which means there's no garauntee that the link in snort.info is
|
||||
correct. If you can't get that link to work, look for the source code at:
|
||||
|
||||
http://www.snort.org/dl/old/
|
||||
|
||||
In order for Snort to function properly, you need to provide rule files.
|
||||
I recommend registering for free at http://www.snorg.org so you can get these
|
||||
files. Once you have done that, go to http://snort.org/pub-bin/downloads.cgi
|
||||
and get the latest 2.8 series VRT Certified Rules. You need to untar this
|
||||
file and place follow files from etc in the tarball in to your /etc/snort
|
||||
directory :
|
||||
|
||||
generators
|
||||
gen-msg.map
|
||||
sid
|
||||
sid-msg.map
|
||||
|
||||
If you are going to use a front end like Base, you should copy the
|
||||
dog/signatures directory from the tarball in to
|
||||
/usr/doc/snort-$VERSION/ . Last, but certainly not least, you must
|
||||
copy the contents of the rules/ directory in the tarball to
|
||||
/etc/snort/rules/ . After you've done this, you can safely restart
|
||||
snort or send a HUP to snort to reload the files (killall -HUP snort).
|
||||
|
||||
A rc.snort file has been included for your convenience, but it needs to be
|
||||
added to your init script of choice to run on boot. You should modify the
|
||||
variables in /etc/rc.d/rc.snort to reflect the interface you want to monitor.
|
||||
This Slackbuild is no longer maintained by Alan Hicks, but rather me
|
||||
(Thomas York), so email me instead if you have any questions.
|
||||
--Thomas York (straterra@fuhell.com)
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
config() {
|
||||
NEW="$1"
|
||||
OLD="$(dirname $NEW)/$(basename $NEW .new)"
|
||||
# If there's no config file by that name, mv it over:
|
||||
if [ ! -r $OLD ]; then
|
||||
mv $NEW $OLD
|
||||
elif [ "$(cat $OLD | md5sum)" = "$(cat $NEW | md5sum)" ]; then # toss the redundant copy
|
||||
rm $NEW
|
||||
fi
|
||||
# Otherwise, we leave the .new copy for the admin to consider...
|
||||
}
|
||||
|
||||
# Keep same perms on rc.snort.new:
|
||||
if [ -e etc/rc.d/rc.snort ]; then
|
||||
cp -a etc/rc.d/rc.snort etc/rc.d/rc.snort.new.incoming
|
||||
cat etc/rc.d/rc.snort.new > etc/rc.d/rc.snort.new.incoming
|
||||
mv etc/rc.d/rc.snort.new.incoming etc/rc.d/rc.snort.new
|
||||
fi
|
||||
|
||||
config etc/rc.d/rc.snort.new
|
||||
config etc/snort/snort.conf.new
|
||||
config etc/snort/reference.config.new
|
||||
config etc/snort/threshold.conf.new
|
||||
config etc/snort/attribute_table.dtd.new
|
||||
config etc/snort/classification.config.new
|
||||
config etc/snort/gen-msg.map.new
|
||||
config etc/snort/sid-msg.map.new
|
||||
config etc/snort/unicode.map.new
|
||||
|
||||
|
|
@ -1,53 +0,0 @@
|
|||
#!/bin/sh
|
||||
# Start/stop/restart snort
|
||||
|
||||
# This tell snort which interface to listen on (any for every interface)
|
||||
IFACE=${IFACE:-any}
|
||||
|
||||
# Make sure this matches your IFACE
|
||||
PIDFILE=/var/run/snort_$IFACE.pid
|
||||
|
||||
# You probably don't want to change this, but in case you do
|
||||
LOGDIR="/var/log/snort"
|
||||
|
||||
# Probably not this either
|
||||
CONF=/etc/snort/snort.conf
|
||||
|
||||
# Start snort:
|
||||
snort_start() {
|
||||
CMDLINE="/usr/bin/snort -d -D -i $IFACE"
|
||||
echo -n "Starting Snort daemon: $CMDLINE"
|
||||
$CMDLINE --pid-path /var/run --create-pidfile -l $LOGDIR -c $CONF
|
||||
echo
|
||||
}
|
||||
|
||||
# Stop snort:
|
||||
snort_stop() {
|
||||
echo -n "Stopping Snort daemon ($IFACE)..."
|
||||
kill $(cat $PIDFILE)
|
||||
echo
|
||||
sleep 1
|
||||
rm -f $PIDFILE
|
||||
}
|
||||
|
||||
# Restart snort:
|
||||
snort_restart() {
|
||||
snort_stop
|
||||
sleep 1
|
||||
snort_start
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
'start')
|
||||
snort_start
|
||||
;;
|
||||
'stop')
|
||||
snort_stop
|
||||
;;
|
||||
'restart')
|
||||
snort_restart
|
||||
;;
|
||||
*)
|
||||
echo "usage $0 start|stop|restart"
|
||||
esac
|
||||
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
# HOW TO EDIT THIS FILE:
|
||||
# The "handy ruler" below makes it easier to edit a package description. Line
|
||||
# up the first '|' above the ':' following the base package name, and the '|'
|
||||
# on the right side marks the last column you can put a character in. You must
|
||||
# make exactly 11 lines for the formatting to be correct. It's also
|
||||
# customary to leave one space after the ':'.
|
||||
|
||||
|-------handy-ruler-----------------------------------------------------|
|
||||
snort: Snort (Intrusion Detection and Prevention System)
|
||||
snort:
|
||||
snort: Snort is an open source network intrusion detection and prevention
|
||||
snort: system. It is capable of performing real-time traffic analysis,
|
||||
snort: alerting, blocking and packet logging on IP networks. It utilizes a
|
||||
snort: combination of protocol analysis and pattern matchingin order to
|
||||
snort: detect anomalies, misuse and attacks.
|
||||
snort: Snort is capable of detecting and responding in real-time, sending
|
||||
snort: alerts, performing session sniping, logging packets, or dropping
|
||||
snort: sessions/packets when deployed in-line.
|
||||
snort:
|
||||
|
|
@ -1,128 +0,0 @@
|
|||
#!/bin/sh
|
||||
|
||||
# Copyright 2006-2009, Alan Hicks, Lizella, GA,
|
||||
# Copyright 2009, Thomas York, Beech Grove, In.
|
||||
# All rights reserved.
|
||||
#
|
||||
# Redistribution and use of this script, with or without modification, is
|
||||
# permitted provided that the following conditions are met:
|
||||
#
|
||||
# 1. Redistributions of this script must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
|
||||
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
|
||||
# EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
||||
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
|
||||
# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
# Modified by the SlackBuilds.org project
|
||||
|
||||
PRGNAM=snort
|
||||
VERSION=2.8.4.1
|
||||
ARCH=${ARCH:-i486}
|
||||
BUILD=${BUILD:-1}
|
||||
TAG=${TAG:-_SBo}
|
||||
|
||||
CWD=$(pwd)
|
||||
TMP=${TMP:-/tmp/SBo}
|
||||
PKG=$TMP/package-$PRGNAM
|
||||
OUTPUT=${OUTPUT:-/tmp}
|
||||
|
||||
if [ "$ARCH" = "i486" ]; then
|
||||
SLKCFLAGS="-O2 -march=i486 -mtune=i686"
|
||||
LIBDIRSUFFIX=""
|
||||
elif [ "$ARCH" = "i686" ]; then
|
||||
SLKCFLAGS="-O2 -march=i686 -mtune=i686"
|
||||
LIBDIRSUFFIX=""
|
||||
elif [ "$ARCH" = "x86_64" ]; then
|
||||
SLKCFLAGS="-O2 -fPIC"
|
||||
LIBDIRSUFFIX="64"
|
||||
fi
|
||||
|
||||
set -e
|
||||
|
||||
rm -rf $PKG
|
||||
mkdir -p $TMP $PKG $OUTPUT
|
||||
cd $TMP
|
||||
rm -rf $PRGNAM-$VERSION
|
||||
tar xvf $CWD/$PRGNAM-$VERSION.tar.gz
|
||||
cd $PRGNAM-$VERSION
|
||||
|
||||
chown -R root:root .
|
||||
find . \
|
||||
\( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \
|
||||
-exec chmod 755 {} \; -o \
|
||||
\( -perm 666 -o -perm 664 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \
|
||||
-exec chmod 644 {} \;
|
||||
|
||||
CFLAGS="$SLKCFLAGS" \
|
||||
CXXFLAGS="$SLKCFLAGS" \
|
||||
./configure \
|
||||
--prefix=/usr \
|
||||
--libdir=/usr/lib${LIBDIRSUFFIX} \
|
||||
--sysconfdir=/etc \
|
||||
--mandir=/usr/man \
|
||||
--localstatedir=/var \
|
||||
--docdir=/usr/doc/$PRGNAM-$VERSION \
|
||||
--enable-pthread \
|
||||
--enable-linux-smp-stats \
|
||||
--with-mysql-libraries=/usr/lib${LIBDIRSUFFIX}/mysql \
|
||||
--with-mysql-includes=/usr/include/mysql \
|
||||
--build=$ARCH-slackware-linux
|
||||
|
||||
make
|
||||
make install-strip DESTDIR=$PKG
|
||||
|
||||
( cd $PKG/usr/man
|
||||
find . -type f -exec gzip -9 {} \;
|
||||
for i in $(find . -type l) ; do ln -s $(readlink $i).gz $i.gz ; rm $i ; done
|
||||
)
|
||||
|
||||
# Set up a sane config directory - snort won't do this on its own
|
||||
mkdir -p $PKG/etc/$PRGNAM
|
||||
# Fix paths for libraries in snort.conf
|
||||
sed -e 's%usr/local%usr%g' etc/snort.conf > $PKG/etc/snort/snort.conf.new
|
||||
cat etc/threshold.conf > $PKG/etc/snort/threshold.conf.new
|
||||
cat etc/reference.config > $PKG/etc/snort/reference.config.new
|
||||
cat etc/classification.config > $PKG/etc/snort/classification.config.new
|
||||
cat etc/attribute_table.dtd > $PKG/etc/snort/attribute_table.dtd.new
|
||||
cat etc/gen-msg.map > $PKG/etc/snort/gen-msg.map.new
|
||||
cat etc/sid-msg.map > $PKG/etc/snort/sid-msg.map.new
|
||||
cat etc/unicode.map > $PKG/etc/snort/unicode.map.new
|
||||
|
||||
# Create default, empty directory for rules
|
||||
mkdir -p $PKG/etc/snort/rules
|
||||
mkdir -p $PKG/etc/snort/preproc_rules
|
||||
|
||||
# Include the rc.snort file
|
||||
mkdir -p $PKG/etc/rc.d
|
||||
cat $CWD/rc.snort > $PKG/etc/rc.d/rc.snort.new
|
||||
chmod 0755 $PKG/etc/rc.d/rc.snort.new
|
||||
|
||||
# Create directory for logging
|
||||
mkdir -p $PKG/var/log/snort
|
||||
|
||||
# Bundle the SQL schemas and install the docs
|
||||
mkdir -p $PKG/usr/doc/$PRGNAM-$VERSION/schemas
|
||||
for file in schemas/create_*; do
|
||||
cat $file > $PKG/usr/doc/$PRGNAM-$VERSION/$file
|
||||
done
|
||||
cp -a COPYING ChangeLog LICENSE RELEASE.NOTES doc/* \
|
||||
$PKG/usr/doc/$PRGNAM-$VERSION
|
||||
cat $CWD/$PRGNAM.SlackBuild > $PKG/usr/doc/$PRGNAM-$VERSION/$PRGNAM.SlackBuild
|
||||
cat $CWD/README.SLACKWARE > $PKG/usr/doc/$PRGNAM-$VERSION/README.SLACKWARE
|
||||
find $PKG/usr/doc -name "Makefile*" -exec rm -f {} \;
|
||||
rm -rf $PKG/usr/share
|
||||
|
||||
mkdir -p $PKG/install
|
||||
cat $CWD/slack-desc > $PKG/install/slack-desc
|
||||
cat $CWD/doinst.sh > $PKG/install/doinst.sh
|
||||
|
||||
cd $PKG
|
||||
/sbin/makepkg -l y -c n $OUTPUT/$PRGNAM-$VERSION-$ARCH-$BUILD$TAG.${PKGTYPE:-tgz}
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
PRGNAM="snort"
|
||||
VERSION="2.8.4.1"
|
||||
HOMEPAGE="http://www.snort.org/"
|
||||
DOWNLOAD="http://dl.snort.org/snort-current/snort-2.8.4.1.tar.gz"
|
||||
MD5SUM="63f4e76ae96a2d133f4c7b741bad5458"
|
||||
DOWNLOAD_x86_64=""
|
||||
MD5SUM_x86_64=""
|
||||
MAINTAINER="Thomas_York"
|
||||
EMAIL="straterra@fuhell.com"
|
||||
APPROVED="rworkman"
|
||||
Loading…
Reference in a new issue