80831 2005-02-05 00:07 0000 snort-2.3.0_rc2.ebuild (update) 2005-02-06 05:21:13 0000 1 1 1 Unclassified Gentoo Linux Ebuilds unspecified All All RESOLVED FIXED P2 enhancement --- 1 bjhowell@gmail.com netmon@gentoo.org bjhowell@gmail.com bjhowell@gmail.com 2005-02-05 00:07:17 0000 Hi! Please find attached snort-2.3.0_rc2.ebuild modified for sguil support. Patches: spp_portscan_sguil.patch spp_stream4_sguil.patch SGUIL - The Analyst Console for Network Security Monitoring. The patch for spp_stream4 allows you to configure snort to write session data in a pipe delimiated text file for easy loading by sensor_agent.tcl into the DB. The patch for spp_portscan adds a configuration option to write portscan data to a pipe deliminated file, again for easy loading into the DB. The spp_portscan patch also facilitates the logging of portscan events to log_unified as well as establishes a 'priority' of 5 to those alerts. bjhowell@gmail.com 2005-02-05 00:31:54 0000 Created an attachment (id=50422) snort-2.3.0_rc2.ebuild modified to apply two SGUIL reporting patches SGUIL patches are only available for download from sourceforge (and CVS) and are buried in the source package sguil-sensor-0.5.3.tar.gz. Due to this, the entire source for sguil-sensor-0.5.3.tar.gz is downloaded (Length: 89,816 kB) and patches extracted from there. ka0ttic@gentoo.org 2005-02-06 05:21:13 0000 Thanks. 2.3.0-r1 is in cvs. 50422 2005-02-05 00:31 0000 snort-2.3.0_rc2.ebuild modified to apply two SGUIL reporting patches snort-2.3.0_rc2.ebuild text/plain IyBDb3B5cmlnaHQgMTk5OS0yMDA1IEdlbnRvbyBGb3VuZGF0aW9uCiMgRGlzdHJpYnV0ZWQgdW5k ZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSB2MgojICRIZWFk ZXI6IC92YXIvY3Zzcm9vdC9nZW50b28teDg2L25ldC1hbmFseXplci9zbm9ydC9zbm9ydC0yLjMu MF9yYzIuZWJ1aWxkLHYgMS40IDIwMDUvMDEvMTIgMDI6MDg6MTMgd2VldmUgRXhwICQKCmluaGVy aXQgZXV0aWxzIGdudWNvbmZpZwoKTVlfUD0ke1AvX3JjL1JDfQoKREVTQ1JJUFRJT049IkxpYnBj YXAtYmFzZWQgcGFja2V0IHNuaWZmZXIvbG9nZ2VyL2xpZ2h0d2VpZ2h0IElEUyIKSE9NRVBBR0U9 Imh0dHA6Ly93d3cuc25vcnQub3JnLyIKU1JDX1VSST0iaHR0cDovL3d3dy5zbm9ydC5vcmcvZGwv JHtNWV9QfS50YXIuZ3oKCXNub3J0c2FtPyAoIG1pcnJvcjovL2dlbnRvby9zbm9ydHNhbS0yMDA1 MDExMC50YXIuZ3ogKQoJcHJlbHVkZT8gKCBodHRwOi8vd3d3LnByZWx1ZGUtaWRzLm9yZy9kb3du bG9hZC9yZWxlYXNlcy9zbm9ydC1wcmVsdWRlLXJlcG9ydGluZy1wYXRjaC0wLjMuNi50YXIuZ3og KQoJc2d1aWw/ICggaHR0cDovL29wdHVzbmV0LmRsLnNvdXJjZWZvcmdlLm5ldC9zb3VyY2Vmb3Jn ZS9zZ3VpbC9zZ3VpbC1zZW5zb3ItMC41LjMudGFyLmd6ICkiCgojCXNub3J0c2FtPyAoIGh0dHA6 Ly93d3cuc25vcnRzYW0ubmV0L2ZpbGVzL3Nub3J0LXBsdWdpbi9zbm9ydHNhbS1wYXRjaC50YXIu Z3ogKQojIEdlbnRvbyBtaXJyb3JlZCBiZWNhdXNlIG9mIG5hbWluZyBjb25mbGljdCB3aXRoIHBy ZXZpb3VzIHZlcnNpb24KCkxJQ0VOU0U9IkdQTC0yIgpTTE9UPSIwIgpLRVlXT1JEUz0ieDg2IC1z cGFyYyAtYWxwaGEgfmFtZDY0IHBwYyIKSVVTRT0ic3NsIHBvc3RncmVzIG15c3FsIGZsZXhyZXNw IHNlbGludXggc25vcnRzYW0gb2RiYyBwcmVsdWRlIHNndWlsIgoKUz0ke1dPUktESVJ9LyR7TVlf UH0KCiMgTG9jYWwgdXNlZmxhZyBzbm9ydHNhbTogcGF0Y2ggc25vcnQgZm9yIHVzZSB3aXRoIHNu b3J0c2FtIHBhY2thZ2UuCgoKREVQRU5EPSJ2aXJ0dWFsL2xpYmMKCT49ZGV2LWxpYnMvbGlicGNy ZS00LjItcjEKCT49bmV0LWxpYnMvbGlicGNhcC0wLjcKCWZsZXhyZXNwPyAoIH5uZXQtbGlicy9s aWJuZXQtMS4wLjJhICkKCXBvc3RncmVzPyAoID49ZGV2LWRiL3Bvc3RncmVzcWwtNy4yICkKCW15 c3FsPyAoID49ZGV2LWRiL215c3FsLTMuMjMuMjYgKQoJc3NsPyAoID49ZGV2LWxpYnMvb3BlbnNz bC0wLjkuNmIgKQoJcHJlbHVkZT8gKCA+PWRldi1saWJzL2xpYnByZWx1ZGUtMC44ICkKCW9kYmM/ ICggZGV2LWRiL3VuaXhPREJDICkiCgpSREVQRU5EPSIke0RFUEVORH0KCWRldi1sYW5nL3BlcmwK CXNlbGludXg/ICggc2VjLXBvbGljeS9zZWxpbnV4LXNub3J0ICkKCXNub3J0c2FtPyAoIG5ldC1h bmFseXplci9zbm9ydHNhbSApIgoKc3JjX3VucGFjaygpIHsKCXVucGFjayAke0F9CgljZCAke1N9 CglnbnVjb25maWdfdXBkYXRlCgoJaWYgdXNlIGZsZXhyZXNwCgl0aGVuCgkJZXBhdGNoICR7RklM RVNESVJ9LyR7UFZ9LWxpYm5ldC0xLjAucGF0Y2ggfHwgZGllICJsaWJuZXQgcGF0Y2ggZmFpbGVk IgoJZmkKCgllaW5mbyAiUGF0Y2hpbmcgL2V0Yy9zbm9ydC5jb25mIgoJc2VkIC1pICJzOnZhciBS VUxFX1BBVEggLi4vcnVsZXM6dmFyIFJVTEVfUEFUSCAvZXRjL3Nub3J0OiIgZXRjL3Nub3J0LmNv bmYKCglpZiB1c2UgcHJlbHVkZQoJdGhlbgoJCWVwYXRjaCAuLi9zbm9ydC0yLjIuMC1wcmVsdWRl LTAuMy42LmRpZmYgfHwgZGllICJwcmVsdWRlIHBhdGNoIGZhaWxlZCIKCQlzZWQgLWkgLWUgInM6 QUNfUFJPR19SQU5MSUI6QUNfUFJPR19MSUJUT09MOiIgY29uZmlndXJlLmluCglmaQoKCWlmIHVz ZSBzZ3VpbAoJdGhlbgoJCWNkICR7U30vc3JjL3ByZXByb2Nlc3NvcnMKCQllcGF0Y2ggJHtXT1JL RElSfS9zZ3VpbC0wLjUuMy9zZW5zb3Ivc25vcnRfbW9kcy8yXzEvc3BwX3BvcnRzY2FuX3NndWls LnBhdGNoIHx8IGRpZQoJCWVwYXRjaCAke1dPUktESVJ9L3NndWlsLTAuNS4zL3NlbnNvci9zbm9y dF9tb2RzLzJfMS9zcHBfc3RyZWFtNF9zZ3VpbC5wYXRjaCB8fCBkaWUKCQljZCAke1N9CglmaQoK CSMgbmVlZCB0byBwaWNrIHVwIHByZWx1ZGUgYW5kIG9yIGZsZXhyZXNwIHBhdGNoZXMKCWVpbmZv ICJSZWdlbmVyYXRpbmcgYXV0b2NvbmYvYXV0b21ha2UgZmlsZXMiCglzaCAuL2F1dG9nZW4uc2gK CglpZiB1c2Ugc25vcnRzYW0KCXRoZW4KCQljZCAuLgoJCWVpbmZvICJBcHBseWluZyBzbm9ydHNh bSBwYXRjaCIKCQkuL3BhdGNoc25vcnQuc2ggJHtTfSB8fCBkaWUgInNub3J0c2FtIHBhdGNoIGZh aWxlZCIKCQljZCAke1N9CglmaQp9CgpzcmNfY29tcGlsZSgpIHsKCWxvY2FsIG15Y29uZgoKCSMg VGhlcmUgaXMgbm8gLS1kaWFibGUtZmxleHJlc3AsIGNhbm5vdCB1c2UgdXNlX2VuYWJsZQoJdXNl IGZsZXhyZXNwICYmIG15Y29uZj0iJHtteWNvbmZ9IC0tZW5hYmxlLWZsZXhyZXNwIgoKCWVjb25m IFwKCQlgdXNlX3dpdGggcG9zdGdyZXMgcG9zdGdyZXNxbGAgXAoJCWB1c2Vfd2l0aCBteXNxbGAg XAoJCWB1c2Vfd2l0aCBzc2wgb3BlbnNzbGAgXAoJCWB1c2Vfd2l0aCBvZGJjYCBcCgkJLS13aXRo b3V0LW9yYWNsZSBcCgkJYHVzZV93aXRoIHByZWx1ZGVgIFwKCQlgdXNlX3dpdGggc2d1aWxgIFwK CQkke215Y29uZn0gfHwgZGllICJiYWQgLi9jb25maWd1cmUiCgoJZW1ha2UgfHwgZGllICJjb21w aWxlIHByb2JsZW0iCn0KCnBrZ19wcmVpbnN0KCkgewoJZW5ld2dyb3VwIHNub3J0CgllbmV3dXNl ciBzbm9ydCAtMSAvZGV2L251bGwgL3Zhci9sb2cvc25vcnQgc25vcnQKCXVzZXJtb2QgLWQgIi92 YXIvbG9nL3Nub3J0IiBzbm9ydCB8fCBkaWUgInVzZXJtb2QgcHJvYmxlbSIKCXVzZXJtb2QgLWcg InNub3J0IiBzbm9ydCB8fCBkaWUgInVzZXJtb2QgcHJvYmxlbSIKCXVzZXJtb2QgLXMgIi9kZXYv bnVsbCIgc25vcnQgfHwgZGllICJ1c2VybW9kIHByb2JsZW0iCgllY2hvICJpZ25vcmUgYW55IG1l c3NhZ2UgYWJvdXQgQ1JFQVRFX0hPTUUgYWJvdmUuLi4iCn0KCnNyY19pbnN0YWxsKCkgewoJbWFr ZSBERVNURElSPSR7RH0gaW5zdGFsbCB8fCBkaWUKCglrZWVwZGlyIC92YXIvbG9nL3Nub3J0LwoK CWRvZG9jIENPUFlJTkcgTElDRU5TRSBkb2MvKgoJZG9jaW50byBzY2hlbWFzIDsgZG9kb2Mgc2No ZW1hcy8qCgoJaW5zaW50byAvZXRjL3Nub3J0Cglkb2lucyBldGMvcmVmZXJlbmNlLmNvbmZpZyBl dGMvY2xhc3NpZmljYXRpb24uY29uZmlnIHJ1bGVzLyoucnVsZXMgZXRjLyoubWFwIGV0Yy90aHJl c2hvbGQuY29uZgoJbmV3aW5zIGV0Yy9zbm9ydC5jb25mIHNub3J0LmNvbmYuZGlzdHJpYgoKCXVz ZSBwcmVsdWRlICYmIGRvaW5zIGV0Yy9wcmVsdWRlLWNsYXNzaWZpY2F0aW9uLmNvbmZpZwoKCWV4 ZWludG8gL2V0Yy9pbml0LmQgOyBuZXdleGUgJHtGSUxFU0RJUn0vc25vcnQucmM2IHNub3J0Cglp bnNpbnRvIC9ldGMvY29uZi5kIDsgbmV3aW5zICR7RklMRVNESVJ9L3Nub3J0LmNvbmZkIHNub3J0 CgoJY2hvd24gc25vcnQ6c25vcnQgJHtEfS92YXIvbG9nL3Nub3J0CgljaG1vZCAwNzcwICR7RH0v dmFyL2xvZy9zbm9ydAp9Cgpwa2dfcG9zdGluc3QoKSB7CglpZiB1c2UgbXlzcWwgfHwgdXNlIHBv c3RncmVzIHx8IHVzZSBvZGJjCgl0aGVuCgkJZWluZm8gIlRvIHVzZSBhIGRhdGFiYXNlIGFzIGEg YmFja2VuZCBmb3Igc25vcnQgeW91IHdpbGwgaGF2ZSB0byIKCQllaW5mbyAiaW1wb3J0IHRoZSBj b3JyZWN0IHRhYmxlcyB0byB0aGUgZGF0YWJhc2UuIgoJCWVpbmZvICJZb3Ugd2lsbCBoYXZlIHRv IHNldHVwIGEgZGF0YWJhc2UgY2FsbGVkIHNub3J0IGZpcnN0LiIKCQllaW5mbyAiIgoJCXVzZSBt eXNxbCAmJiBcCgkJCWVpbmZvICIgIE15U1FMOiB6Y2F0IC91c3Ivc2hhcmUvZG9jLyR7UEZ9L3Nj aGVtYS9jcmVhdGVfbXlzcWwuZ3ogfCBteXNxbCAtcCBzbm9ydCIKCQl1c2UgcG9zdGdyZXMgJiYg XAoJCQllaW5mbyAiICBQb3N0Z3JlU1FMOiBpbXBvcnQgL3Vzci9zaGFyZS9kb2MvJHtQRn0vc2No ZW1hcy9jcmVhdGVfcG9zdGdyZXNxbC5neiIKCQl1c2Ugb2RiYyAmJiBlaW5mbyAiU1FMIHRhYmxl cyBuZWVkIHRvIGJlIGNyZWF0ZWQgLSBsb29rIGF0IC91c3Ivc2hhcmUvZG9jLyR7UEZ9L3NjaGVt YXMvIgoJCWVpbmZvICIiCgkJZWluZm8gIkFsc28sIHJlYWQgdGhlIGZvbGxvd2luZyBHZW50b28g Zm9ydW1zIGFydGljbGU6IgoJCWVpbmZvICcgICBodHRwOi8vZm9ydW1zLmdlbnRvby5vcmcvdmll d3RvcGljLnBocD90PTc4NzE4JwoJZmkKfQo=