summaryrefslogtreecommitdiffstats
path: root/recipes-ids
diff options
context:
space:
mode:
authorArmin Kuster <akuster808@gmail.com>2019-03-30 14:14:13 -0700
committerArmin Kuster <akuster808@gmail.com>2019-03-31 10:37:09 -0700
commit1460d9b86dfc8100cf6bd112ec01dfc0ce19da39 (patch)
treee75d67841f27dbd7370b7c5e8994c731f024e026 /recipes-ids
parent75e609f7b14b57b27143ec9e8d818fc5fab6d106 (diff)
downloadmeta-security-1460d9b86dfc8100cf6bd112ec01dfc0ce19da39.tar.gz
reorg ids: move ids recipes to recipes-ids
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'recipes-ids')
-rwxr-xr-xrecipes-ids/samhain/files/run-ptest3
-rw-r--r--recipes-ids/samhain/files/samhain-add-LDFLAGS-variable-for-samhain_setpwd.patch28
-rw-r--r--recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch134
-rw-r--r--recipes-ids/samhain/files/samhain-client.default3
-rw-r--r--recipes-ids/samhain/files/samhain-client.init122
-rw-r--r--recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch108
-rw-r--r--recipes-ids/samhain/files/samhain-cross-compile.patch51
-rw-r--r--recipes-ids/samhain/files/samhain-mips64-aarch64-dnmalloc-hash-fix.patch44
-rw-r--r--recipes-ids/samhain/files/samhain-not-run-ptest-on-host.patch24
-rw-r--r--recipes-ids/samhain/files/samhain-pid-path.patch27
-rw-r--r--recipes-ids/samhain/files/samhain-samhainrc-fix-files-dirs-path.patch61
-rw-r--r--recipes-ids/samhain/files/samhain-samhainrc.patch158
-rw-r--r--recipes-ids/samhain/files/samhain-server-volatiles1
-rw-r--r--recipes-ids/samhain/files/samhain-server.default3
-rw-r--r--recipes-ids/samhain/files/samhain-server.init116
-rw-r--r--recipes-ids/samhain/files/samhain-sha256-big-endian.patch22
-rw-r--r--recipes-ids/samhain/files/samhain-standalone.default3
-rw-r--r--recipes-ids/samhain/files/samhain-standalone.init123
-rw-r--r--recipes-ids/samhain/files/samhain.service12
-rw-r--r--recipes-ids/samhain/samhain-client_4.3.2.bb11
-rw-r--r--recipes-ids/samhain/samhain-server_4.3.2.bb20
-rw-r--r--recipes-ids/samhain/samhain-standalone_4.3.2.bb31
-rw-r--r--recipes-ids/samhain/samhain.inc163
-rw-r--r--recipes-ids/suricata/files/emerging.rules.tar.gzbin0 -> 2252393 bytes
-rw-r--r--recipes-ids/suricata/files/no_libhtp_build.patch38
-rw-r--r--recipes-ids/suricata/files/run-ptest3
-rw-r--r--recipes-ids/suricata/files/suricata.service20
-rw-r--r--recipes-ids/suricata/files/suricata.yaml1326
-rw-r--r--recipes-ids/suricata/files/volatiles.03_suricata2
-rw-r--r--recipes-ids/suricata/libhtp_0.5.29.bb15
-rw-r--r--recipes-ids/suricata/suricata.inc9
-rw-r--r--recipes-ids/suricata/suricata_4.1.3.bb97
-rw-r--r--recipes-ids/tripwire/files/add_armeb_arch.patch18
-rw-r--r--recipes-ids/tripwire/files/run-ptest3
-rw-r--r--recipes-ids/tripwire/files/tripwire.cron8
-rw-r--r--recipes-ids/tripwire/files/tripwire.sh9
-rw-r--r--recipes-ids/tripwire/files/tripwire.txt69
-rw-r--r--recipes-ids/tripwire/files/twcfg.txt15
-rw-r--r--recipes-ids/tripwire/files/twinstall.sh320
-rw-r--r--recipes-ids/tripwire/files/twpol-yocto.txt1107
-rw-r--r--recipes-ids/tripwire/tripwire_2.4.3.7.bb74
41 files changed, 4401 insertions, 0 deletions
diff --git a/recipes-ids/samhain/files/run-ptest b/recipes-ids/samhain/files/run-ptest
new file mode 100755
index 0000000..2a4a765
--- /dev/null
+++ b/recipes-ids/samhain/files/run-ptest
@@ -0,0 +1,3 @@
1#!/bin/sh
2current_dir=$(dirname $(readlink -f $0))
3$current_dir/cutest
diff --git a/recipes-ids/samhain/files/samhain-add-LDFLAGS-variable-for-samhain_setpwd.patch b/recipes-ids/samhain/files/samhain-add-LDFLAGS-variable-for-samhain_setpwd.patch
new file mode 100644
index 0000000..088a938
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-add-LDFLAGS-variable-for-samhain_setpwd.patch
@@ -0,0 +1,28 @@
1From ae79606a6745dbbd429d1d4671dfe3045d735057 Mon Sep 17 00:00:00 2001
2From: Jackie Huang <jackie.huang@windriver.com>
3Date: Thu, 14 Sep 2017 13:26:55 +0800
4Subject: [PATCH] Add LDFLAGS variable for compiling samhain_setpwd
5
6Upstream-Status: Pending
7
8Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
9---
10 Makefile.in | 2 +-
11 1 file changed, 1 insertion(+), 1 deletion(-)
12
13diff --git a/Makefile.in b/Makefile.in
14index 01de987..49356cf 100644
15--- a/Makefile.in
16+++ b/Makefile.in
17@@ -1128,7 +1128,7 @@ sh_tiger_i.o: $(srcsrc)/$(TIGER_SRC) Makefile config_xor.h
18 samhain_setpwd: encode config_xor.h $(srcsrc)/samhain_setpwd.c
19 @echo '$(COMPILE) -o samhain_setpwd $(srcsrc)/samhain_setpwd.c'; \
20 ./encode $(XOR_CODE) $(srcsrc)/samhain_setpwd.c; \
21- $(COMPILE) -o samhain_setpwd x_samhain_setpwd.c; \
22+ $(COMPILE) $(LDFLAGS) -o samhain_setpwd x_samhain_setpwd.c; \
23 rm x_samhain_setpwd.c
24
25 samhain_stealth: encode config_xor.h $(srcsrc)/samhain_stealth.c
26--
272.11.0
28
diff --git a/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch b/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch
new file mode 100644
index 0000000..6bf67e0
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch
@@ -0,0 +1,134 @@
1From 3e2ca7e06b16ceff6d12beb5113312f6525df595 Mon Sep 17 00:00:00 2001
2From: Jackie Huang <jackie.huang@windriver.com>
3Date: Thu, 14 Sep 2017 11:02:12 +0800
4Subject: [PATCH] configure.ac: avoid searching host for postgresql
5
6Upstream-Status: Inappropriate [cross compile specific]
7
8Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
9---
10 configure.ac | 101 +++--------------------------------------------------------
11 1 file changed, 5 insertions(+), 96 deletions(-)
12
13diff --git a/configure.ac b/configure.ac
14index a224c68..f658d53 100644
15--- a/configure.ac
16+++ b/configure.ac
17@@ -1278,90 +1278,11 @@ AC_ARG_WITH(database,
18 AC_DEFINE(WITH_POSTGRES)
19 AC_DEFINE(WITH_DATABASE)
20 #
21- PGCONF="no"
22- MY_PATH="${PATH}:/usr/local/bin:/usr/local/pgsql/bin"
23- OLD_IFS="$IFS"
24- IFS=":"
25- for ff in ${MY_PATH}
26- do
27- if test -f "$ff/pg_config"
28- then
29- PGCONF="$ff/pg_config"
30- fi
31- done
32- IFS="${OLD_IFS}"
33- #
34- #
35- if test "x${PGCONF}" = "xno"
36- then
37- AC_MSG_CHECKING(for PostgreSQL in /usr/local/pgsql /usr/pgsql /usr/local /usr PGSQL_HOME)
38- pgsql_directory="/usr/local/pgsql /usr/pgsql /usr/local /usr ${PGSQL_HOME}"
39- for i in $pgsql_directory; do
40- if test -r $i/include/pgsql/libpq-fe.h; then
41- PGSQL_INC_DIR=$i/include
42- PGSQL_DIR=$i
43- # use AC_CHECK_HEADERS to check for pgsql/libpq-fe.h
44- fi
45- done
46- if test -z "$PGSQL_DIR"; then
47- for i in $pgsql_directory; do
48- if test -r $i/include/postgresql/libpq-fe.h; then
49- PGSQL_INC_DIR=$i/include
50- PGSQL_DIR=$i
51- fi
52- done
53- fi
54- if test -z "$PGSQL_DIR"; then
55- for i in $pgsql_directory; do
56- if test -r $i/include/libpq-fe.h; then
57- PGSQL_INC_DIR=$i/include
58- PGSQL_DIR=$i
59- fi
60- done
61- fi
62-
63- if test -z "$PGSQL_DIR"; then
64- tmp=""
65- for i in $pgsql_directory; do
66- tmp="$tmp $i/include $i/include/pgsql $i/include/postgresql"
67- done
68- FAIL_MESSAGE("PostgreSQL header file (libpq-fe.h)", $tmp)
69- fi
70-
71- for i in lib lib/pgsql lib/postgresql; do
72- str="$PGSQL_DIR/$i/libpq.*"
73- for j in `echo $str`; do
74- if test -r $j; then
75- PGSQL_LIB_DIR="$PGSQL_DIR/$i"
76- break 2
77- fi
78- done
79- done
80-
81- if test -z "$PGSQL_LIB_DIR"; then
82- for ff in $pgsql_directory; do
83- for i in lib lib/pgsql lib/postgresql; do
84- str="$ff/$i/libpq.*"
85- for j in `echo $str`; do
86- if test -r $j; then
87- PGSQL_LIB_DIR="$ff/$i"
88- break 3
89- fi
90- done
91- done
92- done
93- fi
94-
95- if test -z "$PGSQL_LIB_DIR"; then
96- tmp=""
97- for i in $pgsql_directory; do
98- tmp="$i/lib $i/lib/pgsql $i/lib/postgresql"
99- done
100- FAIL_MESSAGE("postgresql library libpq", $tmp)
101- fi
102-
103- AC_MSG_RESULT(yes)
104-
105+ if test -z "${PGSQL_LIB_DIR}" ; then
106+ FAIL_MESSAGE("PGSQL_LIB_DIR is not set!")
107+ elif test -z "${PGSQL_INC_DIR}" ; then
108+ FAIL_MESSAGE("PGSQL_INC_DIR is not set!")
109+ else
110 LIBS="$LIBS -L${PGSQL_LIB_DIR} -lpq -lm"
111 if test x"$enable_static" = xyes; then
112 LIBS="$LIBS -L${PGSQL_LIB_DIR} -lpq -lcrypt -lm"
113@@ -1370,18 +1291,6 @@ AC_ARG_WITH(database,
114 fi
115 # CFLAGS="$CFLAGS -I${PGSQL_INC_DIR}"
116 CPPFLAGS="$CPPFLAGS -I${PGSQL_INC_DIR}"
117- AC_CHECK_HEADERS(pgsql/libpq-fe.h)
118- AC_CHECK_HEADERS(postgresql/libpq-fe.h)
119- else
120- pg_lib_dir=`${PGCONF} --libdir`
121- if test x"$enable_static" = xyes; then
122- LIBS="$LIBS -L${pg_lib_dir} -lpq -lcrypt -lm"
123- else
124- LIBS="$LIBS -L${pg_lib_dir} -lpq -lm"
125- fi
126- pg_inc_dir=`${PGCONF} --includedir`
127- # CFLAGS="$CFLAGS -I${pg_inc_dir}"
128- CPPFLAGS="$CPPFLAGS -I${pg_inc_dir}"
129 fi
130 elif test "x${withval}" = "xodbc"; then
131 AC_MSG_CHECKING(for odbc in /usr /usr/local ODBC_HOME)
132--
1332.11.0
134
diff --git a/recipes-ids/samhain/files/samhain-client.default b/recipes-ids/samhain/files/samhain-client.default
new file mode 100644
index 0000000..9899577
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-client.default
@@ -0,0 +1,3 @@
1# Set this to "yes" to start the server, after you configure it, of
2# course.
3SAMHAIN_CLIENT_START="no" \ No newline at end of file
diff --git a/recipes-ids/samhain/files/samhain-client.init b/recipes-ids/samhain/files/samhain-client.init
new file mode 100644
index 0000000..d5fabed
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-client.init
@@ -0,0 +1,122 @@
1#!/bin/bash
2# chkconfig: 2345 99 10
3# description: File Integrity Checking Daemon
4#
5# processname: samhain
6# config : /etc/samhainrc
7# logfile : /var/log/samhain_log
8# database: /var/lib/samhain/samhain_file
9#
10
11NAME=samhain
12DAEMON=/usr/sbin/samhain
13RETVAL=0
14PIDFILE=/var/run/samhain.pid
15
16. /etc/default/rcS
17
18. /etc/default/samhain-client
19
20if [ "x$SAMHAIN_CLIENT_START" != "xyes" ]; then
21 echo "${0}: client disabled in /etc/default/samhain-client"
22 exit 0
23fi
24
25if [ -x $DAEMON ]; then
26 :
27else
28 echo "${0}: executable ${DAEMON} not found"
29 exit 1
30fi
31
32if [ ! -e /var/lib/samhain/samhain_file ]; then
33 echo "${0}: /var/lib/samhain/samhain_file does not exist. You must"
34 echo " run 'samhain -t init' before samhian-client can start."
35 exit 1
36fi
37
38samhain_done()
39{
40 if [ $RETVAL -eq 0 ]; then
41 echo "."
42 else
43 echo " failed."
44 fi
45}
46
47log_stat_msg () {
48case "$1" in
49 0)
50 echo "Service $NAME: Running";
51 ;;
52 1)
53 echo "Service $NAME: Stopped and /var/run pid file exists";
54 ;;
55 3)
56 echo "Service $NAME: Stopped";
57 ;;
58 *)
59 echo "Service $NAME: Status unknown";
60 ;;
61esac
62}
63
64case "$1" in
65 start)
66 #
67 # Remove a stale PID file, if found
68 #
69 if test -f ${PIDFILE}; then
70 /bin/rm -f ${PIDFILE}
71 fi
72 #
73 echo -n "Starting ${NAME}"
74 start-stop-daemon --start --quiet --exec $DAEMON
75 RETVAL=$?
76 samhain_done
77 ;;
78
79 stop)
80 echo -n "Stopping $NAME"
81 start-stop-daemon --stop --quiet --exec $DAEMON
82 RETVAL=$?
83
84 #
85 # Remove a stale PID file, if found
86 #
87 if test -f ${PIDFILE}; then
88 /bin/rm -f ${PIDFILE}
89 fi
90 if test -S /var/run/${NAME}.sock; then
91 /bin/rm -f /var/run/${NAME}.sock
92 fi
93 samhain_done
94 ;;
95
96 restart)
97 $0 stop
98 sleep 3
99 $0 start
100 RETVAL=$?
101 ;;
102
103 reload|force-reload)
104 echo -n "Reloading $NAME configuration files"
105 start-stop-daemon --stop --signal 1 --quiet --exec $DAEMON
106 RETVAL=$?
107 samhain_done
108 ;;
109
110 status)
111 $DAEMON status
112 RETVAL=$?
113 log_stat_msg ${RETVAL}
114 ;;
115
116 *)
117 echo "$0 usage: {start|stop|status|restart|reload}"
118 exit 1
119 ;;
120esac
121
122exit $RETVAL
diff --git a/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch b/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch
new file mode 100644
index 0000000..8de0735
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch
@@ -0,0 +1,108 @@
1From 02a143f0068cbc6cea71359169210fbb3606d4bb Mon Sep 17 00:00:00 2001
2From: Jackie Huang <jackie.huang@windriver.com>
3Date: Mon, 18 Jan 2016 00:24:57 -0500
4Subject: [PATCH] configure: add option for ps
5
6The configure searches hardcoded host paths for PSPATH
7and run ps commands to decide PSARG which will fail
8on host without ps:
9| configure: error: Cannot find ps in any of /usr/ucb /bin /usr/bin
10
11So add an option so we can specify the ps at configure
12to avoid host contamination.
13
14Upstream-Status: Inappropriate [cross compile specific]
15
16Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
17---
18 aclocal.m4 | 2 +-
19 configure.ac | 60 ++++++++++--------------------------------------------------
20 2 files changed, 11 insertions(+), 51 deletions(-)
21
22diff --git a/aclocal.m4 b/aclocal.m4
23index a2e59a6..cd20a2f 100644
24--- a/aclocal.m4
25+++ b/aclocal.m4
26@@ -409,7 +409,7 @@ x_includes=NONE
27 x_libraries=NONE
28 DESTDIR=
29 SH_ENABLE_OPTS="selinux posix-acl asm ssp db-reload xml-log message-queue login-watch process-check port-check mounts-check logfile-monitor userfiles debug ptrace static network udp nocl stealth micro-stealth install-name identity khide suidcheck base largefile mail external-scripts encrypt srp dnmalloc ipv6 shellexpand suid"
30-SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file"
31+SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file ps-path"
32
33 # Installation directory options.
34 # These are left unexpanded so users can "make install exec_prefix=/foo"
35diff --git a/configure.ac b/configure.ac
36index 5910b1f..8c3e087 100644
37--- a/configure.ac
38+++ b/configure.ac
39@@ -730,56 +730,16 @@ then
40 fi
41 AC_CHECK_HEADERS(gmp.h)
42
43-AC_MSG_CHECKING([for ps])
44-PS=
45-for ff in /usr/ucb /bin /usr/bin; do
46- if test -x "$ff/ps"; then
47- PS="$ff/ps"
48- AC_MSG_RESULT([$PS])
49- break
50- fi
51-done
52-if test x$PS = x
53-then
54- AC_MSG_RESULT([no])
55- AC_MSG_ERROR([Cannot find ps in any of /usr/ucb /bin /usr/bin])
56-fi
57-AC_DEFINE_UNQUOTED([PSPATH], _("$PS"), [Path to ps])
58-
59-AC_MSG_CHECKING([how to use ps])
60-$PS ax >/dev/null 2>&1
61-if test $? -eq 0; then
62- case "$host_os" in
63- *openbsd*)
64- one=`$PS akx | wc -l`
65- ;;
66- *)
67- one=`$PS ax | wc -l`
68- ;;
69- esac
70-else
71- one=0
72-fi
73-$PS -e >/dev/null 2>&1
74-if test $? -eq 0; then
75- two=`$PS -e | wc -l`
76-else
77- two=0
78-fi
79-if test $one -ge $two
80-then
81- case "$host_os" in
82- *openbsd*)
83- PSARG="akx"
84- ;;
85- *)
86- PSARG="ax"
87- ;;
88- esac
89-else
90- PSARG="-e"
91-fi
92-AC_DEFINE_UNQUOTED([PSARG], _("$PSARG"), [Argument for ps])
93+AC_ARG_WITH(ps-path,
94+ [ --with-ps-path=PATH set path to ps command ],
95+ [
96+ if test "x${withval}" != xno; then
97+ pspath="${withval}"
98+ AC_DEFINE_UNQUOTED([PSPATH], _("${pspath}"), [Path to ps])
99+ AC_DEFINE_UNQUOTED([PSARG], _("ax"), [Argument for ps])
100+ fi
101+ ])
102+
103 AC_MSG_RESULT([$PS $PSARG])
104
105 dnl *****************************************
106--
1071.9.1
108
diff --git a/recipes-ids/samhain/files/samhain-cross-compile.patch b/recipes-ids/samhain/files/samhain-cross-compile.patch
new file mode 100644
index 0000000..7f80a5c
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-cross-compile.patch
@@ -0,0 +1,51 @@
1From f63908427b2adb1792c59edbe38618e14ef5bc7b Mon Sep 17 00:00:00 2001
2From: Jackie Huang <jackie.huang@windriver.com>
3Date: Fri, 15 Jan 2016 00:48:58 -0500
4Subject: [PATCH] Enable obfuscating binaries natively.
5
6Enable obfuscating binaries natively.
7
8The samhain build process involves an obfuscation step that attempts to
9defeat decompilation or other binary analysis techniques which might reveal
10secret information that should be known only to the system administrator.
11The obfuscation step builds several applications which run on the build host
12and then generate target code, which is then built into target binaries.
13
14This patch creates a basic infrastructure that supports building the
15obfuscation binaries natively then cross-compiling the target code by adding
16a special configure option. In the absence of this option the old behaviour
17is preserved.
18
19Upstream-Status: Inappropriate [cross compile specific]
20
21Signed-off-by: Aws Ismail <aws.ismail@windriver.com>
22Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
23---
24 Makefile.in | 4 +---
25 1 file changed, 1 insertion(+), 3 deletions(-)
26
27diff --git a/Makefile.in b/Makefile.in
28index 684e92b..fb090e2 100644
29--- a/Makefile.in
30+++ b/Makefile.in
31@@ -54,7 +54,7 @@ selectconfig = @selectconfig@
32 top_builddir = .
33
34 INSTALL = @INSTALL@
35-INSTALL_PROGRAM = @INSTALL@ -s -m 700
36+INSTALL_PROGRAM = @INSTALL@ -m 700
37 INSTALL_SHELL = @INSTALL@ -m 700
38 INSTALL_DATA = @INSTALL@ -m 600
39 INSTALL_MAN = @INSTALL@ -m 644
40@@ -525,8 +525,6 @@ install-program: $(PROGRAMS) sstrip
41 echo " $(INSTALL_PROGRAM) $$p $$target"; \
42 $(INSTALL_PROGRAM) $$p $$target; \
43 chmod 0700 $$target; \
44- echo " ./sstrip $$target"; \
45- ./sstrip $$target; \
46 else \
47 echo " $(INSTALL_SHELL) $$p $$target"; \
48 $(INSTALL_SHELL) $$p $$target; \
49--
501.9.1
51
diff --git a/recipes-ids/samhain/files/samhain-mips64-aarch64-dnmalloc-hash-fix.patch b/recipes-ids/samhain/files/samhain-mips64-aarch64-dnmalloc-hash-fix.patch
new file mode 100644
index 0000000..0608660
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-mips64-aarch64-dnmalloc-hash-fix.patch
@@ -0,0 +1,44 @@
1commit 0f6bdc219e598de08a3f37887efa5dfa50e2b996
2Author: Aws Ismail <aws.ismail@windriver.com>
3Date: Fri Jun 22 15:47:08 2012 -0400
4
5Hash fix for MIPS64 and AARCH64
6
7Samhain uses the addresses of local variables in generating hash
8values. The hashing function is designed only for 32-bit values.
9For MIPS64 when a 64-bit address is passed in the resulting hash
10exceeds the limits of the underlying mechanism and samhain
11ultimately fails. The solution is to simply take the lower
1232-bits of the address and use that in generating hash values.
13
14Signed-off-by: Greg Moffatt <greg.moffatt@windriver.com>
15
16Upstream-Status: Pending
17
18Signed-off-by: Aws Ismail <aws.ismail@windriver.com>
19Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
20
21diff --git a/src/dnmalloc.c b/src/dnmalloc.c
22index da9a5c5..fc91400 100644
23--- a/src/dnmalloc.c
24+++ b/src/dnmalloc.c
25@@ -2703,11 +2703,19 @@ static void freecilst_add(chunkinfoptr p) {
26 }
27
28 /* Calculate the hash table entry for a chunk */
29+#if defined(CONFIG_ARCH_MIPS64) || defined(CONFIG_ARCH_AARCH64)
30+#ifdef STARTHEAP_IS_ZERO
31+#define hash(p) ((((unsigned long) p) & 0x7fffffff) >> 7)
32+#else
33+#define hash(p) ((((unsigned long) p - (unsigned long) startheap) & 0x7fffffff) >> 7)
34+#endif
35+#else
36 #ifdef STARTHEAP_IS_ZERO
37 #define hash(p) (((unsigned long) p) >> 7)
38 #else
39 #define hash(p) (((unsigned long) p - (unsigned long) startheap) >> 7)
40 #endif
41+#endif /* CONFIG_ARCH_MIPS64 */
42
43 static void
44 hashtable_add (chunkinfoptr ci)
diff --git a/recipes-ids/samhain/files/samhain-not-run-ptest-on-host.patch b/recipes-ids/samhain/files/samhain-not-run-ptest-on-host.patch
new file mode 100644
index 0000000..5284313
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-not-run-ptest-on-host.patch
@@ -0,0 +1,24 @@
1not run test on host, since we are doing cross-compile
2
3Upstream-status: Inappropriate [cross compile specific]
4
5Signed-off-by: Roy Li <rongqing.li@windriver.com>
6---
7 Makefile.in | 1 -
8 1 file changed, 1 deletion(-)
9
10diff --git a/Makefile.in b/Makefile.in
11index e1b32a8..74bfdc9 100644
12--- a/Makefile.in
13+++ b/Makefile.in
14@@ -1234,7 +1234,6 @@ intcutest: internal.h $(OBJECTS) $(CUTEST_OBJECTS) sh_tiger_i.o $(srcsrc)/CuTest
15 rm x_samhain.c; \
16 $(LINK) sh_tiger_i.o $(CUTEST_OBJECTS) CuTestMain.o CuTest.o $(OBJECTS) $(LIBS_TRY); \
17 test -f ./intcutest && mv ./intcutest ./cutest; \
18- ./cutest
19
20 runcutest:
21 gdb ./cutest
22--
231.7.10.4
24
diff --git a/recipes-ids/samhain/files/samhain-pid-path.patch b/recipes-ids/samhain/files/samhain-pid-path.patch
new file mode 100644
index 0000000..592bd16
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-pid-path.patch
@@ -0,0 +1,27 @@
1commit a932b03b65edeb02ccad2fce06bfa68a8f2fbb04
2Author: Aws Ismail <aws.ismail@windriver.com>
3Date: Thu Jan 10 16:29:05 2013 -0500
4
5 Set the PID Lock path for samhain.pid
6
7 The explicit path for samhain.pid inorder
8 for samhain to work properly after it initial
9 database build.
10
11 Upstream-Status: Inappropriate [configuration]
12
13 Signed-off-by: Aws Ismail <aws.ismail@windriver.com>
14
15diff --git a/samhainrc.linux b/samhainrc.linux
16index 10a8176..a7b06e6 100644
17--- a/samhainrc.linux
18+++ b/samhainrc.linux
19@@ -639,7 +639,7 @@ SetFileCheckTime = 86400
20
21 ## Path to the PID file
22 #
23-# SetLockfilePath = (default: compiled-in)
24+SetLockfilePath = /run/samhain.pid
25
26
27 ## The digest/checksum/hash algorithm
diff --git a/recipes-ids/samhain/files/samhain-samhainrc-fix-files-dirs-path.patch b/recipes-ids/samhain/files/samhain-samhainrc-fix-files-dirs-path.patch
new file mode 100644
index 0000000..dad6b15
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-samhainrc-fix-files-dirs-path.patch
@@ -0,0 +1,61 @@
1From 00fb527e45da42550156197647e01de9a6b1ad52 Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Mon, 3 Mar 2014 01:50:01 -0500
4Subject: [PATCH] fix real path for some files/dirs
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9---
10 samhainrc.linux | 15 +++++++--------
11 1 file changed, 7 insertions(+), 8 deletions(-)
12
13diff --git a/samhainrc.linux b/samhainrc.linux
14index e9727b4..7775d83 100644
15--- a/samhainrc.linux
16+++ b/samhainrc.linux
17@@ -93,7 +93,6 @@ dir = 99/etc
18 ##
19 file = /etc/mtab
20 file = /etc/fstab
21-file = /etc/adjtime
22 file = /etc/motd
23 file = /etc/lvm/lvm.conf
24
25@@ -153,11 +152,11 @@ dir = 99/var
26
27 [IgnoreAll]
28 dir = -1/var/cache
29-dir = -1/var/lock
30-dir = -1/var/mail
31-dir = -1/var/run
32+dir = -1/run/lock
33+dir = -1/var/spool/mail
34+dir = -1/run
35 dir = -1/var/spool
36-dir = -1/var/tmp
37+dir = -1/var/volatile/tmp
38
39
40 [Attributes]
41@@ -167,7 +166,7 @@ dir = -1/var/tmp
42 file = /var/lib/rpm/__db.00?
43
44 file = /var/lib/logrotate.status
45-file = /var/lib/random-seed
46+file = /var/lib/urandom/random-seed
47
48
49 [GrowingLogFiles]
50@@ -176,7 +175,7 @@ file = /var/lib/random-seed
51 ## are ignored. Logfile rotation will cause a report because of shrinking
52 ## size and different inode.
53 ##
54-dir = 99/var/log
55+dir = 99/var/volatile/log
56
57 [Attributes]
58 #
59--
601.7.9.5
61
diff --git a/recipes-ids/samhain/files/samhain-samhainrc.patch b/recipes-ids/samhain/files/samhain-samhainrc.patch
new file mode 100644
index 0000000..145700a
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-samhainrc.patch
@@ -0,0 +1,158 @@
1commit 4c6658441eb3ffc4e51ed70f78cbdab046957580
2Author: Aws Ismail <aws.ismail@windriver.com>
3Date: Fri Jun 22 16:38:20 2012 -0400
4
5Make samhainrc OE-friendly.
6
7Patch the samhainrc that will be installed
8as part of the 'make install' step to more
9accurately reflect what will be found, and
10what will be of concern, on a OE install.
11
12Upstream-Status: Inappropriate [configuration]
13
14Signed-off-by: Aws Ismail <aws.ismail@windriver.com>
15
16diff --git a/samhainrc.linux b/samhainrc.linux
17index 9bc5ca4..10a8176 100644
18--- a/samhainrc.linux
19+++ b/samhainrc.linux
20@@ -74,7 +74,6 @@ dir = 0/
21 [Attributes]
22 file = /tmp
23 file = /dev
24-file = /media
25 file = /proc
26 file = /sys
27
28@@ -93,19 +92,10 @@ dir = 99/etc
29 ## check permission and ownership
30 ##
31 file = /etc/mtab
32+file = /etc/fstab
33 file = /etc/adjtime
34 file = /etc/motd
35-file = /etc/lvm/.cache
36-
37-# On Ubuntu, these are in /var/lib rather than /etc
38-file = /etc/cups/certs
39-file = /etc/cups/certs/0
40-
41-# managed by fstab-sync on Fedora Core
42-file = /etc/fstab
43-
44-# modified when booting
45-file = /etc/sysconfig/hwconf
46+file = /etc/lvm/lvm.conf
47
48 # There are files in /etc that might change, thus changing the directory
49 # timestamps. Put it here as 'file', and in the ReadOnly section as 'dir'.
50@@ -147,10 +137,6 @@ dir = 99/dev
51 ##
52 dir = -1/dev/pts
53
54-# dir = -1/dev/.udevdb
55-
56-file = /dev/ppp
57-
58 #
59 # --------- /usr -----------
60 #
61@@ -167,50 +153,21 @@ dir = 99/var
62
63 [IgnoreAll]
64 dir = -1/var/cache
65-dir = -1/var/backups
66-dir = -1/var/games
67-dir = -1/var/gdm
68 dir = -1/var/lock
69 dir = -1/var/mail
70 dir = -1/var/run
71 dir = -1/var/spool
72 dir = -1/var/tmp
73-dir = -1/var/lib/texmf
74-dir = -1/var/lib/scrollkeeper
75
76
77 [Attributes]
78
79-dir = /var/lib/nfs
80-dir = /var/lib/pcmcia
81-
82 # /var/lib/rpm changes if packets are installed;
83 # /var/lib/rpm/__db.00[123] even more frequently
84 file = /var/lib/rpm/__db.00?
85
86-file = /var/lib/acpi-support/vbestate
87-file = /var/lib/alsa/asound.state
88-file = /var/lib/apt/lists/lock
89-file = /var/lib/apt/lists/partial
90-file = /var/lib/cups/certs
91-file = /var/lib/cups/certs/0
92-file = /var/lib/dpkg/lock
93-file = /var/lib/gdm
94-file = /var/lib/gdm/.cookie
95-file = /var/lib/gdm/.gdmfifo
96-file = /var/lib/gdm/:0.Xauth
97-file = /var/lib/gdm/:0.Xservers
98-file = /var/lib/logrotate/status
99-file = /var/lib/mysql
100-file = /var/lib/mysql/ib_logfile0
101-file = /var/lib/mysql/ibdata1
102-file = /var/lib/slocate
103-file = /var/lib/slocate/slocate.db
104-file = /var/lib/slocate/slocate.db.tmp
105-file = /var/lib/urandom
106-file = /var/lib/urandom/random-seed
107+file = /var/lib/logrotate.status
108 file = /var/lib/random-seed
109-file = /var/lib/xkb
110
111
112 [GrowingLogFiles]
113@@ -325,7 +282,7 @@ IgnoreMissing = /var/lib/slocate/slocate.db.tmp
114
115 ## Console
116 ##
117-# PrintSeverity=info
118+PrintSeverity=warn
119
120 ## Logfile
121 ##
122@@ -333,7 +290,7 @@ IgnoreMissing = /var/lib/slocate/slocate.db.tmp
123
124 ## Syslog
125 ##
126-# SyslogSeverity=none
127+SyslogSeverity=info
128
129 ## Remote server (yule)
130 ##
131@@ -556,7 +513,8 @@ ChecksumTest=check
132 ## and I/O limit (kilobytes per second; 0 == off)
133 ## to reduce load on host.
134 #
135-# SetNiceLevel = 0
136+# By default we configure samhain to be nice with everything else on the system
137+SetNiceLevel = 10
138 # SetIOLimit = 0
139
140 ## The version string to embed in file signature databases
141@@ -565,13 +523,14 @@ ChecksumTest=check
142
143 ## Interval between time stamp messages
144 #
145-# SetLoopTime = 60
146-SetLoopTime = 600
147+# Log a timestamp every hour
148+SetLoopTime = 3600
149
150 ## Interval between file checks
151 #
152 # SetFileCheckTime = 600
153-SetFileCheckTime = 7200
154+# One file system check per day
155+SetFileCheckTime = 86400
156
157 ## Alternative: crontab-like schedule
158 #
diff --git a/recipes-ids/samhain/files/samhain-server-volatiles b/recipes-ids/samhain/files/samhain-server-volatiles
new file mode 100644
index 0000000..6b80709
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-server-volatiles
@@ -0,0 +1 @@
d daemon daemon 0775 /var/log/yule none
diff --git a/recipes-ids/samhain/files/samhain-server.default b/recipes-ids/samhain/files/samhain-server.default
new file mode 100644
index 0000000..bc3d67c
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-server.default
@@ -0,0 +1,3 @@
1# Set this to "yes" to start the server, after you configure it, of
2# course.
3SAMHAIN_SERVER_START="no" \ No newline at end of file
diff --git a/recipes-ids/samhain/files/samhain-server.init b/recipes-ids/samhain/files/samhain-server.init
new file mode 100644
index 0000000..c456e51
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-server.init
@@ -0,0 +1,116 @@
1#!/bin/bash
2# chkconfig: 2345 98 11
3# description: File Integrity Checking Daemon
4#
5# processname: yule
6# config : /etc/yulerc
7# logfile : /var/log/yule/yule_log
8# database: /var/lib/yule/yule_file
9#
10
11NAME=yule
12DAEMON=/usr/sbin/yule
13RETVAL=0
14PIDFILE=/var/run/yule.pid
15
16. /etc/default/rcS
17
18. /etc/default/samhain-server
19
20if [ "x$SAMHAIN_SERVER_START" != "xyes" ]; then
21 echo "${0}: server disabled in /etc/default/samhain-server"
22 exit 0
23fi
24
25if [ -x $DAEMON ]; then
26 :
27else
28 echo "${0}: executable ${DAEMON} not found"
29 exit 1
30fi
31
32samhain_done()
33{
34 if [ $RETVAL -eq 0 ]; then
35 echo "."
36 else
37 echo " failed."
38 fi
39}
40
41log_stat_msg () {
42case "$1" in
43 0)
44 echo "Service $NAME: Running";
45 ;;
46 1)
47 echo "Service $NAME: Stopped and /var/run pid file exists";
48 ;;
49 3)
50 echo "Service $NAME: Stopped";
51 ;;
52 *)
53 echo "Service $NAME: Status unknown";
54 ;;
55esac
56}
57
58case "$1" in
59 start)
60 #
61 # Remove a stale PID file, if found
62 #
63 if test -f ${PIDFILE}; then
64 /bin/rm -f ${PIDFILE}
65 fi
66 #
67 echo -n "Starting ${NAME}"
68 start-stop-daemon --start --quiet --exec $DAEMON
69 RETVAL=$?
70 samhain_done
71 ;;
72
73 stop)
74 echo -n "Stopping $NAME"
75 start-stop-daemon --stop --quiet --exec $DAEMON
76 RETVAL=$?
77
78 #
79 # Remove a stale PID file, if found
80 #
81 if test -f ${PIDFILE}; then
82 /bin/rm -f ${PIDFILE}
83 fi
84 if test -S /var/run/${NAME}.sock; then
85 /bin/rm -f /var/run/${NAME}.sock
86 fi
87 samhain_done
88 ;;
89
90 restart)
91 $0 stop
92 sleep 3
93 $0 start
94 RETVAL=$?
95 ;;
96
97 reload|force-reload)
98 echo -n "Reloading $NAME configuration files"
99 start-stop-daemon --stop --signal 1 --quiet --exec $DAEMON
100 RETVAL=$?
101 samhain_done
102 ;;
103
104 status)
105 $DAEMON status
106 RETVAL=$?
107 log_stat_msg ${RETVAL}
108 ;;
109
110 *)
111 echo "$0 usage: {start|stop|status|restart|reload}"
112 exit 1
113 ;;
114esac
115
116exit $RETVAL
diff --git a/recipes-ids/samhain/files/samhain-sha256-big-endian.patch b/recipes-ids/samhain/files/samhain-sha256-big-endian.patch
new file mode 100644
index 0000000..3065c73
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-sha256-big-endian.patch
@@ -0,0 +1,22 @@
1samhain: fix sha256 for big-endian machines
2
3After computing the digest, big-endian machines would
4memset() the digest to the first byte of state instead
5of using memcpy() to transfer it.
6
7Upstream-Status: Pending
8
9Signed-off-by: Joe Slater <jslater@windriver.com>
10
11
12--- a/src/sh_checksum.c
13+++ b/src/sh_checksum.c
14@@ -468,7 +468,7 @@ void SHA256_Final(sha2_byte digest[], SH
15 }
16 }
17 #else
18- memset(d, context->state, SHA256_DIGEST_LENGTH);
19+ memcpy(d, context->state, SHA256_DIGEST_LENGTH);
20 /* bcopy(context->state, d, SHA256_DIGEST_LENGTH); */
21 #endif
22 }
diff --git a/recipes-ids/samhain/files/samhain-standalone.default b/recipes-ids/samhain/files/samhain-standalone.default
new file mode 100644
index 0000000..507a59f
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-standalone.default
@@ -0,0 +1,3 @@
1# Set this to "yes" to start the server, after you configure it, of
2# course.
3SAMHAIN_STANDALONE_START="no"
diff --git a/recipes-ids/samhain/files/samhain-standalone.init b/recipes-ids/samhain/files/samhain-standalone.init
new file mode 100644
index 0000000..2f23bff
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain-standalone.init
@@ -0,0 +1,123 @@
1#!/bin/sh
2# chkconfig: 2345 99 10
3# description: File Integrity Checking Daemon
4#
5# processname: samhain
6# config : /etc/samhainrc
7# logfile : /var/log/samhain_log
8# database: /var/lib/samhain/samhain_file
9#
10
11NAME=samhain
12DAEMON=/usr/sbin/samhain
13RETVAL=0
14VERBOSE=yes
15PIDFILE=/var/run/samhain.pid
16
17. /etc/default/samhain-standalone
18
19if [ "x$SAMHAIN_STANDALONE_START" != "xyes" ]; then
20 echo "${0}: samhain disabled in /etc/default/samhain-standalone"
21 exit 0
22fi
23
24if [ -x $DAEMON ]; then
25 :
26else
27 echo "${0}: executable ${DAEMON} not found"
28 exit 1
29fi
30
31if [ ! -e /var/lib/samhain/samhain_file ]; then
32 echo "${0}: /var/lib/samhain/samhain_file does not exist. You must"
33 echo " run 'samhain -t init' before samhian can start."
34 exit 1
35fi
36
37samhain_done()
38{
39 if [ $RETVAL -eq 0 ]; then
40 echo "."
41 else
42 echo " failed."
43 fi
44}
45
46log_stat_msg () {
47case "$1" in
48 0)
49 echo "Service $NAME: Running";
50 ;;
51 1)
52 echo "Service $NAME: Stopped and /var/run pid file exists";
53 ;;
54 3)
55 echo "Service $NAME: Stopped";
56 ;;
57 *)
58 echo "Service $NAME: Status unknown";
59 ;;
60esac
61}
62
63case "$1" in
64 start)
65 #
66 # Remove a stale PID file, if found
67 #
68 if test -f ${PIDFILE}; then
69 /bin/rm -f ${PIDFILE}
70 fi
71
72 echo -n "Starting ${NAME}"
73 start-stop-daemon --start --quiet --exec $DAEMON
74 RETVAL=$?
75 samhain_done
76 exit $RETVAL
77 ;;
78 stop)
79 echo -n "Stopping $NAME"
80 start-stop-daemon --stop --quiet --exec $DAEMON
81 RETVAL=$?
82 samhain_done
83 #
84 # Remove a stale PID file, if found
85 #
86 if test -f ${PIDFILE}; then
87 /bin/rm -f ${PIDFILE}
88 fi
89 if test -S /var/run/${NAME}.sock; then
90 /bin/rm -f /var/run/${NAME}.sock
91 fi
92 ;;
93
94 restart)
95 $0 stop
96 sleep 3
97 $0 start
98 RETVAL=$?
99 ;;
100
101 reload|force-reload)
102 echo -n "Reloading $NAME configuration files"
103 start-stop-daemon --stop --signal 1 --quiet --exec $DAEMON
104 RETVAL=$?
105 samhain_done
106 ;;
107
108 status)
109 if pidof -o %PPID $DAEMON > /dev/null; then
110 echo "Samhain running"
111 RETVAL=0
112 else
113 echo "Samhain not running"
114 RETVAL=1
115 fi
116 ;;
117 *)
118 echo "$0 usage: {start|stop|status|restart|reload}"
119 exit 1
120 ;;
121esac
122
123exit $RETVAL
diff --git a/recipes-ids/samhain/files/samhain.service b/recipes-ids/samhain/files/samhain.service
new file mode 100644
index 0000000..e4f216a
--- /dev/null
+++ b/recipes-ids/samhain/files/samhain.service
@@ -0,0 +1,12 @@
1[Unit]
2Description=Samhain @MODE_NAME@ Daemon
3After=syslog.target network.target
4
5[Service]
6Type=forking
7RemainAfterExit=yes
8ExecStart=@LIBDIR@/@SAMHAIN_HELPER@ start
9ExecStop=@LIBDIR@/@SAMHAIN_HELPER@ stop
10
11[Install]
12WantedBy=multi-user.target
diff --git a/recipes-ids/samhain/samhain-client_4.3.2.bb b/recipes-ids/samhain/samhain-client_4.3.2.bb
new file mode 100644
index 0000000..812408e
--- /dev/null
+++ b/recipes-ids/samhain/samhain-client_4.3.2.bb
@@ -0,0 +1,11 @@
1INITSCRIPT_PARAMS = "defaults 15 85"
2
3require samhain.inc
4
5# Let the default Logserver be 127.0.0.1
6EXTRA_OECONF += " \
7 --with-logserver=${SAMHAIN_SERVER} \
8 --with-port=${SAMHAIN_PORT} \
9 "
10
11RDEPENDS_${PN} = "acl zlib attr bash"
diff --git a/recipes-ids/samhain/samhain-server_4.3.2.bb b/recipes-ids/samhain/samhain-server_4.3.2.bb
new file mode 100644
index 0000000..9341d44
--- /dev/null
+++ b/recipes-ids/samhain/samhain-server_4.3.2.bb
@@ -0,0 +1,20 @@
1INITSCRIPT_PARAMS = "defaults 14 86"
2
3require samhain.inc
4
5DEPENDS = "gmp"
6
7SRC_URI += "file://samhain-server-volatiles"
8
9TARGET_CC_ARCH += "${LDFLAGS}"
10
11do_install_append() {
12 install -d ${D}${sysconfdir}/default/volatiles
13 install -m 0644 ${WORKDIR}/samhain-server-volatiles \
14 ${D}${sysconfdir}/default/volatiles/samhain-server
15
16 install -m 700 samhain-install.sh init/samhain.startLinux \
17 init/samhain.startLSB ${D}/var/lib/samhain
18}
19
20RDEPENDS_${PN} += "gmp bash perl"
diff --git a/recipes-ids/samhain/samhain-standalone_4.3.2.bb b/recipes-ids/samhain/samhain-standalone_4.3.2.bb
new file mode 100644
index 0000000..4fed9e9
--- /dev/null
+++ b/recipes-ids/samhain/samhain-standalone_4.3.2.bb
@@ -0,0 +1,31 @@
1require samhain.inc
2
3SRC_URI += "file://samhain-not-run-ptest-on-host.patch \
4 file://run-ptest \
5"
6
7PROVIDES += "samhain"
8
9SYSTEMD_SERVICE_${PN} = "samhain.service"
10
11inherit ptest
12
13do_compile() {
14 if [ "${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'yes', 'no', d)}" = "yes" ]; then
15 oe_runmake cutest
16 rm -f ${S}*.o config_xor.h internal.h
17 fi
18 oe_runmake "$@"
19}
20
21do_install_append() {
22 ln -sf ${INITSCRIPT_NAME} ${D}${sysconfdir}/init.d/samhain
23}
24
25do_install_ptest() {
26 mkdir -p ${D}${PTEST_PATH}
27 install ${S}/cutest ${D}${PTEST_PATH}
28}
29
30RPROVIDES_${PN} += "samhain"
31RCONFLICTS_${PN} = "samhain-client samhain-server"
diff --git a/recipes-ids/samhain/samhain.inc b/recipes-ids/samhain/samhain.inc
new file mode 100644
index 0000000..1b9af39
--- /dev/null
+++ b/recipes-ids/samhain/samhain.inc
@@ -0,0 +1,163 @@
1DESCRIPTION = "Provides file integrity checking and log file monitoring/analysis"
2HOMEPAGE = "http://www.la-samhna.de/samhain/"
3LICENSE = "GPLv2"
4LIC_FILES_CHKSUM = "file://LICENSE;md5=8ca43cbc842c2336e835926c2166c28b"
5
6
7SRC_URI = "http://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \
8 file://samhain-cross-compile.patch \
9 file://samhain-mips64-aarch64-dnmalloc-hash-fix.patch \
10 file://samhain-samhainrc.patch \
11 file://samhain-samhainrc-fix-files-dirs-path.patch \
12 file://samhain-pid-path.patch \
13 file://samhain-sha256-big-endian.patch \
14 file://samhain-configure-add-option-for-ps.patch \
15 file://samhain-avoid-searching-host-for-postgresql.patch \
16 file://samhain-add-LDFLAGS-variable-for-samhain_setpwd.patch \
17 file://${INITSCRIPT_NAME}.init \
18 file://${INITSCRIPT_NAME}.default \
19 file://samhain.service \
20 "
21
22SRC_URI[md5sum] = "eae4674164d7c78f5bb39c72b7029c8b"
23SRC_URI[sha256sum] = "0582864ef56ab796031e8e611ed66c48adeb3a30ec34e1a8d0088572442035fc"
24
25UPSTREAM_CHECK_URI = "https://www.la-samhna.de/samhain/archive.html"
26UPSTREAM_CHECK_REGEX = "samhain_signed-(?P<pver>(\d+(\.\d+)+))\.tar"
27
28S = "${WORKDIR}/samhain-${PV}"
29
30inherit autotools-brokensep update-rc.d pkgconfig systemd
31
32SAMHAIN_PORT ??= "49777"
33SAMHAIN_SERVER ??= "NULL"
34
35INITSCRIPT_NAME = "${BPN}"
36INITSCRIPT_PARAMS ?= "defaults"
37
38SYSTEMD_PACKAGES = "${PN}"
39SYSTEMD_SERVICE_${PN} = "${INITSCRIPT_NAME}.service"
40SYSTEMD_AUTO_ENABLE = "disable"
41
42# mode mapping:
43# BPN MODE_NAME SAMHAIN_MODE
44# samhain-standalone standalone no
45# samhain-client client client
46# samhain-server server server
47MODE_NAME = "${@d.getVar('BPN').split('-')[1]}"
48SAMHAIN_MODE = "${@oe.utils.ifelse(d.getVar('MODE_NAME') == 'standalone', 'no', '${MODE_NAME}')}"
49
50# supports mysql|postgresql|oracle|odbc but postgresql is the only one available
51
52PACKAGECONFIG ??= "postgresql ps \
53 ${@bb.utils.contains('DISTRO_FEATURES', 'ipv6', 'ipv6', '', d)} \
54 ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux audit', '', d)} \
55 ${@bb.utils.contains('DISTRO_FEATURES', 'acl', 'acl', '', d)} \
56"
57
58PACKAGECONFIG[postgresql] = "--with-database=postgresql --enable-xml-log PGSQL_INC_DIR=${STAGING_INCDIR} PGSQL_LIB_DIR=${STAGING_LIBDIR}, , postgresql"
59PACKAGECONFIG[suidcheck] = "--enable-suidcheck, , "
60PACKAGECONFIG[logwatch] = "--enable-login-watch, , "
61PACKAGECONFIG[mounts] = "--enable-mounts-check, , "
62PACKAGECONFIG[userfiles] = "--enable-userfiles, , "
63PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6,"
64PACKAGECONFIG[selinux] = "--enable-selinux, --disable-selinux, libselinux attr"
65PACKAGECONFIG[acl] = " --enable-posix-acl , --disable-posix-acl, acl"
66PACKAGECONFIG[audit] = "ac_cv_header_auparse_h=yes,ac_cv_header_auparse_h=no,audit"
67PACKAGECONFIG[ps] = "--with-ps-path=${base_bindir}/ps,,,procps"
68
69do_unpack_samhain() {
70 cd ${WORKDIR}
71 tar -xzvf samhain-${PV}.tar.gz
72}
73
74python do_unpack_append() {
75 bb.build.exec_func('do_unpack_samhain', d)
76}
77
78do_configure_prepend_arm() {
79 export sh_cv___va_copy=yes
80}
81
82do_configure_prepend_aarch64() {
83 export sh_cv___va_copy=yes
84}
85
86# If we use oe_runconf in do_configure() it will by default
87# use the prefix --oldincludedir=/usr/include which is not
88# recognized by Samhain's configure script and would invariably
89# throw back the error "unrecognized option: --oldincludedir=/usr/include"
90do_configure_prepend () {
91 cat << EOF > ${S}/config-site.${BP}
92ssp_cv_lib=no
93sh_cv_va_copy=yes
94EOF
95 export CONFIG_SITE=${S}/config-site.${BP}
96}
97
98do_configure () {
99 autoconf -f
100 ./configure \
101 --build=${BUILD_SYS} \
102 --host=${HOST_SYS} \
103 --target=${TARGET_SYS} \
104 --prefix=${prefix} \
105 --exec_prefix=${exec_prefix} \
106 --bindir=${bindir} \
107 --sbindir=${sbindir} \
108 --libexecdir=${libexecdir} \
109 --datadir=${datadir} \
110 --sysconfdir=${sysconfdir} \
111 --sharedstatedir=${sharedstatedir} \
112 --localstatedir=${localstatedir} \
113 --libdir=${libdir} \
114 --includedir=${includedir} \
115 --infodir=${infodir} \
116 --mandir=${mandir} \
117 --enable-network=${SAMHAIN_MODE} \
118 --with-pid-file=${localstatedir}/run/samhain.pid \
119 --with-data-file=${localstatedir}/lib/samhain/samhain_file \
120 --disable-dnmalloc \
121 ${EXTRA_OECONF}
122}
123
124do_compile_prepend_libc-musl () {
125 sed -i 's/^#define HAVE_MALLOC_H.*//' ${B}/config.h
126}
127
128# Install the init script, it's default file, and the extraneous
129# documentation.
130do_install_append () {
131 oe_runmake install DESTDIR='${D}' INSTALL=install-boot
132
133 install -D -m 755 ${WORKDIR}/${INITSCRIPT_NAME}.init \
134 ${D}${sysconfdir}/init.d/${INITSCRIPT_NAME}
135
136 install -D -m 755 ${WORKDIR}/${INITSCRIPT_NAME}.default \
137 ${D}${sysconfdir}/default/${INITSCRIPT_NAME}
138
139 if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then
140 if [ "${SAMHAIN_MODE}" = "no" ]; then
141 install -D -m 0644 ${WORKDIR}/samhain.service ${D}/${systemd_system_unitdir}/samhain.service
142 else
143 install -D -m 0644 ${WORKDIR}/samhain.service ${D}/${systemd_system_unitdir}/${BPN}.service
144 fi
145 install -D -m 0755 ${WORKDIR}/${BPN}.init ${D}/${libexecdir}/${BPN}
146 sed -i -e 's,@LIBDIR@,${libexecdir},' \
147 -e 's,@SAMHAIN_HELPER@,${BPN},' \
148 -e 's,@MODE_NAME@,${MODE_NAME},' \
149 ${D}${systemd_system_unitdir}/samhain*.service
150 fi
151
152 install -d ${D}${docdir}/${BPN}
153 cp -r docs/* ${D}${docdir}/${BPN}
154 cp -r scripts ${D}${docdir}/${BPN}
155 install -d -m 755 ${D}${localstatedir}/samhain
156
157 # Prevent QA warnings about installed ${localstatedir}/run
158 if [ -d ${D}${localstatedir}/run ]; then
159 rmdir ${D}${localstatedir}/run
160 fi
161}
162
163FILES_${PN} += "${systemd_system_unitdir}"
diff --git a/recipes-ids/suricata/files/emerging.rules.tar.gz b/recipes-ids/suricata/files/emerging.rules.tar.gz
new file mode 100644
index 0000000..aed3754
--- /dev/null
+++ b/recipes-ids/suricata/files/emerging.rules.tar.gz
Binary files differ
diff --git a/recipes-ids/suricata/files/no_libhtp_build.patch b/recipes-ids/suricata/files/no_libhtp_build.patch
new file mode 100644
index 0000000..2ebf021
--- /dev/null
+++ b/recipes-ids/suricata/files/no_libhtp_build.patch
@@ -0,0 +1,38 @@
1Upstream-Status: Inappropriate [configuration]
2
3Signed-of_by: Armin Kuster <akuster808@gmail.com>
4
5Index: suricata-2.0.5/Makefile.am
6===================================================================
7--- suricata-2.0.5.orig/Makefile.am
8+++ suricata-2.0.5/Makefile.am
9@@ -5,7 +5,7 @@ ACLOCAL_AMFLAGS = -I m4
10 EXTRA_DIST = ChangeLog COPYING LICENSE suricata.yaml.in \
11 classification.config threshold.config \
12 reference.config
13-SUBDIRS = $(HTP_DIR) src qa rules doc contrib scripts
14+SUBDIRS = src qa rules doc contrib scripts
15
16 CLEANFILES = stamp-h[0-9]*
17
18Index: suricata-2.0.5/Makefile.in
19===================================================================
20--- suricata-2.0.5.orig/Makefile.in
21+++ suricata-2.0.5/Makefile.in
22@@ -229,7 +229,6 @@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@
23 HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@
24 HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@
25 HAVE_WGET = @HAVE_WGET@
26-HTP_DIR = @HTP_DIR@
27 HTP_LDADD = @HTP_LDADD@
28 INSTALL = @INSTALL@
29 INSTALL_DATA = @INSTALL_DATA@
30@@ -369,7 +368,7 @@ EXTRA_DIST = ChangeLog COPYING LICENSE s
31 classification.config threshold.config \
32 reference.config
33
34-SUBDIRS = $(HTP_DIR) src qa rules doc contrib scripts
35+SUBDIRS = src qa rules doc contrib scripts
36 CLEANFILES = stamp-h[0-9]*
37 all: config.h
38 $(MAKE) $(AM_MAKEFLAGS) all-recursive
diff --git a/recipes-ids/suricata/files/run-ptest b/recipes-ids/suricata/files/run-ptest
new file mode 100644
index 0000000..666ba9c
--- /dev/null
+++ b/recipes-ids/suricata/files/run-ptest
@@ -0,0 +1,3 @@
1#!/bin/sh
2
3suricata -u
diff --git a/recipes-ids/suricata/files/suricata.service b/recipes-ids/suricata/files/suricata.service
new file mode 100644
index 0000000..a99a76e
--- /dev/null
+++ b/recipes-ids/suricata/files/suricata.service
@@ -0,0 +1,20 @@
1[Unit]
2Description=Suricata IDS/IDP daemon
3After=network.target
4Requires=network.target
5Documentation=man:suricata(8) man:suricatasc(8)
6Documentation=https://redmine.openinfosecfoundation.org/projects/suricata/wiki
7
8[Service]
9Type=simple
10CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
11RestrictAddressFamilies=
12ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml eth0
13ExecReload=/bin/kill -HUP $MAINPID
14PrivateTmp=yes
15ProtectHome=yes
16ProtectSystem=yes
17
18[Install]
19WantedBy=multi-user.target
20
diff --git a/recipes-ids/suricata/files/suricata.yaml b/recipes-ids/suricata/files/suricata.yaml
new file mode 100644
index 0000000..8d06a27
--- /dev/null
+++ b/recipes-ids/suricata/files/suricata.yaml
@@ -0,0 +1,1326 @@
1%YAML 1.1
2---
3
4# Suricata configuration file. In addition to the comments describing all
5# options in this file, full documentation can be found at:
6# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml
7
8
9# Number of packets allowed to be processed simultaneously. Default is a
10# conservative 1024. A higher number will make sure CPU's/CPU cores will be
11# more easily kept busy, but may negatively impact caching.
12#
13# If you are using the CUDA pattern matcher (mpm-algo: ac-cuda), different rules
14# apply. In that case try something like 60000 or more. This is because the CUDA
15# pattern matcher buffers and scans as many packets as possible in parallel.
16#max-pending-packets: 1024
17
18# Runmode the engine should use. Please check --list-runmodes to get the available
19# runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned
20# load balancing).
21#runmode: autofp
22
23# Specifies the kind of flow load balancer used by the flow pinned autofp mode.
24#
25# Supported schedulers are:
26#
27# round-robin - Flows assigned to threads in a round robin fashion.
28# active-packets - Flows assigned to threads that have the lowest number of
29# unprocessed packets (default).
30# hash - Flow alloted usihng the address hash. More of a random
31# technique. Was the default in Suricata 1.2.1 and older.
32#
33#autofp-scheduler: active-packets
34
35# If suricata box is a router for the sniffed networks, set it to 'router'. If
36# it is a pure sniffing setup, set it to 'sniffer-only'.
37# If set to auto, the variable is internally switch to 'router' in IPS mode
38# and 'sniffer-only' in IDS mode.
39# This feature is currently only used by the reject* keywords.
40host-mode: auto
41
42# Run suricata as user and group.
43#run-as:
44# user: suri
45# group: suri
46
47# Default pid file.
48# Will use this file if no --pidfile in command options.
49#pid-file: /var/run/suricata.pid
50
51# Daemon working directory
52# Suricata will change directory to this one if provided
53# Default: "/"
54#daemon-directory: "/"
55
56# Preallocated size for packet. Default is 1514 which is the classical
57# size for pcap on ethernet. You should adjust this value to the highest
58# packet size (MTU + hardware header) on your system.
59#default-packet-size: 1514
60
61# The default logging directory. Any log or output file will be
62# placed here if its not specified with a full path name. This can be
63# overridden with the -l command line parameter.
64default-log-dir: /var/log/suricata/
65
66# Unix command socket can be used to pass commands to suricata.
67# An external tool can then connect to get information from suricata
68# or trigger some modifications of the engine. Set enabled to yes
69# to activate the feature. You can use the filename variable to set
70# the file name of the socket.
71unix-command:
72 enabled: no
73 #filename: custom.socket
74
75# Configure the type of alert (and other) logging you would like.
76outputs:
77
78 # a line based alerts log similar to Snort's fast.log
79 - fast:
80 enabled: yes
81 filename: fast.log
82 append: yes
83 #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
84
85 # Extensible Event Format (nicknamed EVE) event log in JSON format
86 - eve-log:
87 enabled: yes
88 type: file #file|syslog|unix_dgram|unix_stream
89 filename: eve.json
90 # the following are valid when type: syslog above
91 #identity: "suricata"
92 #facility: local5
93 #level: Info ## possible levels: Emergency, Alert, Critical,
94 ## Error, Warning, Notice, Info, Debug
95 types:
96 - alert
97 - http:
98 extended: yes # enable this for extended logging information
99 # custom allows additional http fields to be included in eve-log
100 # the example below adds three additional fields when uncommented
101 #custom: [Accept-Encoding, Accept-Language, Authorization]
102 - dns
103 - tls:
104 extended: yes # enable this for extended logging information
105 - files:
106 force-magic: no # force logging magic on all logged files
107 force-md5: no # force logging of md5 checksums
108 #- drop
109 - ssh
110
111 # alert output for use with Barnyard2
112 - unified2-alert:
113 enabled: yes
114 filename: unified2.alert
115
116 # File size limit. Can be specified in kb, mb, gb. Just a number
117 # is parsed as bytes.
118 #limit: 32mb
119
120 # Sensor ID field of unified2 alerts.
121 #sensor-id: 0
122
123 # HTTP X-Forwarded-For support by adding the unified2 extra header that
124 # will contain the actual client IP address or by overwriting the source
125 # IP address (helpful when inspecting traffic that is being reversed
126 # proxied).
127 xff:
128 enabled: no
129 # Two operation modes are available, "extra-data" and "overwrite". Note
130 # that in the "overwrite" mode, if the reported IP address in the HTTP
131 # X-Forwarded-For header is of a different version of the packet
132 # received, it will fall-back to "extra-data" mode.
133 mode: extra-data
134 # Header name were the actual IP address will be reported, if more than
135 # one IP address is present, the last IP address will be the one taken
136 # into consideration.
137 header: X-Forwarded-For
138
139 # a line based log of HTTP requests (no alerts)
140 - http-log:
141 enabled: yes
142 filename: http.log
143 append: yes
144 #extended: yes # enable this for extended logging information
145 #custom: yes # enabled the custom logging format (defined by customformat)
146 #customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P"
147 #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
148
149 # a line based log of TLS handshake parameters (no alerts)
150 - tls-log:
151 enabled: no # Log TLS connections.
152 filename: tls.log # File to store TLS logs.
153 append: yes
154 #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
155 #extended: yes # Log extended information like fingerprint
156 certs-log-dir: certs # directory to store the certificates files
157
158 # a line based log of DNS requests and/or replies (no alerts)
159 - dns-log:
160 enabled: no
161 filename: dns.log
162 append: yes
163 #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
164
165 # a line based log to used with pcap file study.
166 # this module is dedicated to offline pcap parsing (empty output
167 # if used with another kind of input). It can interoperate with
168 # pcap parser like wireshark via the suriwire plugin.
169 - pcap-info:
170 enabled: no
171
172 # Packet log... log packets in pcap format. 2 modes of operation: "normal"
173 # and "sguil".
174 #
175 # In normal mode a pcap file "filename" is created in the default-log-dir,
176 # or are as specified by "dir". In Sguil mode "dir" indicates the base directory.
177 # In this base dir the pcaps are created in th directory structure Sguil expects:
178 #
179 # $sguil-base-dir/YYYY-MM-DD/$filename.<timestamp>
180 #
181 # By default all packets are logged except:
182 # - TCP streams beyond stream.reassembly.depth
183 # - encrypted streams after the key exchange
184 #
185 - pcap-log:
186 enabled: no
187 filename: log.pcap
188
189 # File size limit. Can be specified in kb, mb, gb. Just a number
190 # is parsed as bytes.
191 limit: 1000mb
192
193 # If set to a value will enable ring buffer mode. Will keep Maximum of "max-files" of size "limit"
194 max-files: 2000
195
196 mode: normal # normal or sguil.
197 #sguil-base-dir: /nsm_data/
198 #ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec
199 use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
200
201 # a full alerts log containing much information for signature writers
202 # or for investigating suspected false positives.
203 - alert-debug:
204 enabled: no
205 filename: alert-debug.log
206 append: yes
207 #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
208
209 # alert output to prelude (http://www.prelude-technologies.com/) only
210 # available if Suricata has been compiled with --enable-prelude
211 - alert-prelude:
212 enabled: no
213 profile: suricata
214 log-packet-content: no
215 log-packet-header: yes
216
217 # Stats.log contains data from various counters of the suricata engine.
218 # The interval field (in seconds) tells after how long output will be written
219 # on the log file.
220 - stats:
221 enabled: yes
222 filename: stats.log
223 interval: 8
224
225 # a line based alerts log similar to fast.log into syslog
226 - syslog:
227 enabled: no
228 # reported identity to syslog. If ommited the program name (usually
229 # suricata) will be used.
230 #identity: "suricata"
231 facility: local5
232 #level: Info ## possible levels: Emergency, Alert, Critical,
233 ## Error, Warning, Notice, Info, Debug
234
235 # a line based information for dropped packets in IPS mode
236 - drop:
237 enabled: no
238 filename: drop.log
239 append: yes
240 #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
241
242 # output module to store extracted files to disk
243 #
244 # The files are stored to the log-dir in a format "file.<id>" where <id> is
245 # an incrementing number starting at 1. For each file "file.<id>" a meta
246 # file "file.<id>.meta" is created.
247 #
248 # File extraction depends on a lot of things to be fully done:
249 # - stream reassembly depth. For optimal results, set this to 0 (unlimited)
250 # - http request / response body sizes. Again set to 0 for optimal results.
251 # - rules that contain the "filestore" keyword.
252 - file-store:
253 enabled: no # set to yes to enable
254 log-dir: files # directory to store the files
255 force-magic: no # force logging magic on all stored files
256 force-md5: no # force logging of md5 checksums
257 #waldo: file.waldo # waldo file to store the file_id across runs
258
259 # output module to log files tracked in a easily parsable json format
260 - file-log:
261 enabled: no
262 filename: files-json.log
263 append: yes
264 #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
265
266 force-magic: no # force logging magic on all logged files
267 force-md5: no # force logging of md5 checksums
268
269# Magic file. The extension .mgc is added to the value here.
270#magic-file: /usr/share/file/magic
271magic-file: /usr/share/misc/magic.mgc
272
273# When running in NFQ inline mode, it is possible to use a simulated
274# non-terminal NFQUEUE verdict.
275# This permit to do send all needed packet to suricata via this a rule:
276# iptables -I FORWARD -m mark ! --mark $MARK/$MASK -j NFQUEUE
277# And below, you can have your standard filtering ruleset. To activate
278# this mode, you need to set mode to 'repeat'
279# If you want packet to be sent to another queue after an ACCEPT decision
280# set mode to 'route' and set next-queue value.
281# On linux >= 3.1, you can set batchcount to a value > 1 to improve performance
282# by processing several packets before sending a verdict (worker runmode only).
283# On linux >= 3.6, you can set the fail-open option to yes to have the kernel
284# accept the packet if suricata is not able to keep pace.
285nfq:
286# mode: accept
287# repeat-mark: 1
288# repeat-mask: 1
289# route-queue: 2
290# batchcount: 20
291# fail-open: yes
292
293#nflog support
294nflog:
295 # netlink multicast group
296 # (the same as the iptables --nflog-group param)
297 # Group 0 is used by the kernel, so you can't use it
298 - group: 2
299 # netlink buffer size
300 buffer-size: 18432
301 # put default value here
302 - group: default
303 # set number of packet to queue inside kernel
304 qthreshold: 1
305 # set the delay before flushing packet in the queue inside kernel
306 qtimeout: 100
307 # netlink max buffer size
308 max-size: 20000
309
310# af-packet support
311# Set threads to > 1 to use PACKET_FANOUT support
312af-packet:
313 - interface: eth0
314 # Number of receive threads (>1 will enable experimental flow pinned
315 # runmode)
316 threads: 1
317 # Default clusterid. AF_PACKET will load balance packets based on flow.
318 # All threads/processes that will participate need to have the same
319 # clusterid.
320 cluster-id: 99
321 # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
322 # This is only supported for Linux kernel > 3.1
323 # possible value are:
324 # * cluster_round_robin: round robin load balancing
325 # * cluster_flow: all packets of a given flow are send to the same socket
326 # * cluster_cpu: all packets treated in kernel by a CPU are send to the same socket
327 cluster-type: cluster_flow
328 # In some fragmentation case, the hash can not be computed. If "defrag" is set
329 # to yes, the kernel will do the needed defragmentation before sending the packets.
330 defrag: yes
331 # To use the ring feature of AF_PACKET, set 'use-mmap' to yes
332 use-mmap: yes
333 # Ring size will be computed with respect to max_pending_packets and number
334 # of threads. You can set manually the ring size in number of packets by setting
335 # the following value. If you are using flow cluster-type and have really network
336 # intensive single-flow you could want to set the ring-size independantly of the number
337 # of threads:
338 #ring-size: 2048
339 # On busy system, this could help to set it to yes to recover from a packet drop
340 # phase. This will result in some packets (at max a ring flush) being non treated.
341 #use-emergency-flush: yes
342 # recv buffer size, increase value could improve performance
343 # buffer-size: 32768
344 # Set to yes to disable promiscuous mode
345 # disable-promisc: no
346 # Choose checksum verification mode for the interface. At the moment
347 # of the capture, some packets may be with an invalid checksum due to
348 # offloading to the network card of the checksum computation.
349 # Possible values are:
350 # - kernel: use indication sent by kernel for each packet (default)
351 # - yes: checksum validation is forced
352 # - no: checksum validation is disabled
353 # - auto: suricata uses a statistical approach to detect when
354 # checksum off-loading is used.
355 # Warning: 'checksum-validation' must be set to yes to have any validation
356 #checksum-checks: kernel
357 # BPF filter to apply to this interface. The pcap filter syntax apply here.
358 #bpf-filter: port 80 or udp
359 # You can use the following variables to activate AF_PACKET tap od IPS mode.
360 # If copy-mode is set to ips or tap, the traffic coming to the current
361 # interface will be copied to the copy-iface interface. If 'tap' is set, the
362 # copy is complete. If 'ips' is set, the packet matching a 'drop' action
363 # will not be copied.
364 #copy-mode: ips
365 #copy-iface: eth1
366 - interface: eth1
367 threads: 1
368 cluster-id: 98
369 cluster-type: cluster_flow
370 defrag: yes
371 # buffer-size: 32768
372 # disable-promisc: no
373 # Put default values here
374 - interface: default
375 #threads: 2
376 #use-mmap: yes
377
378legacy:
379 uricontent: enabled
380
381# You can specify a threshold config file by setting "threshold-file"
382# to the path of the threshold config file:
383# threshold-file: /etc/suricata/threshold.config
384
385# The detection engine builds internal groups of signatures. The engine
386# allow us to specify the profile to use for them, to manage memory on an
387# efficient way keeping a good performance. For the profile keyword you
388# can use the words "low", "medium", "high" or "custom". If you use custom
389# make sure to define the values at "- custom-values" as your convenience.
390# Usually you would prefer medium/high/low.
391#
392# "sgh mpm-context", indicates how the staging should allot mpm contexts for
393# the signature groups. "single" indicates the use of a single context for
394# all the signature group heads. "full" indicates a mpm-context for each
395# group head. "auto" lets the engine decide the distribution of contexts
396# based on the information the engine gathers on the patterns from each
397# group head.
398#
399# The option inspection-recursion-limit is used to limit the recursive calls
400# in the content inspection code. For certain payload-sig combinations, we
401# might end up taking too much time in the content inspection code.
402# If the argument specified is 0, the engine uses an internally defined
403# default limit. On not specifying a value, we use no limits on the recursion.
404detect-engine:
405 - profile: medium
406 - custom-values:
407 toclient-src-groups: 2
408 toclient-dst-groups: 2
409 toclient-sp-groups: 2
410 toclient-dp-groups: 3
411 toserver-src-groups: 2
412 toserver-dst-groups: 4
413 toserver-sp-groups: 2
414 toserver-dp-groups: 25
415 - sgh-mpm-context: auto
416 - inspection-recursion-limit: 3000
417 # When rule-reload is enabled, sending a USR2 signal to the Suricata process
418 # will trigger a live rule reload. Experimental feature, use with care.
419 #- rule-reload: true
420 # If set to yes, the loading of signatures will be made after the capture
421 # is started. This will limit the downtime in IPS mode.
422 #- delayed-detect: yes
423
424# Suricata is multi-threaded. Here the threading can be influenced.
425threading:
426 # On some cpu's/architectures it is beneficial to tie individual threads
427 # to specific CPU's/CPU cores. In this case all threads are tied to CPU0,
428 # and each extra CPU/core has one "detect" thread.
429 #
430 # On Intel Core2 and Nehalem CPU's enabling this will degrade performance.
431 #
432 set-cpu-affinity: no
433 # Tune cpu affinity of suricata threads. Each family of threads can be bound
434 # on specific CPUs.
435 cpu-affinity:
436 - management-cpu-set:
437 cpu: [ 0 ] # include only these cpus in affinity settings
438 - receive-cpu-set:
439 cpu: [ 0 ] # include only these cpus in affinity settings
440 - decode-cpu-set:
441 cpu: [ 0, 1 ]
442 mode: "balanced"
443 - stream-cpu-set:
444 cpu: [ "0-1" ]
445 - detect-cpu-set:
446 cpu: [ "all" ]
447 mode: "exclusive" # run detect threads in these cpus
448 # Use explicitely 3 threads and don't compute number by using
449 # detect-thread-ratio variable:
450 # threads: 3
451 prio:
452 low: [ 0 ]
453 medium: [ "1-2" ]
454 high: [ 3 ]
455 default: "medium"
456 - verdict-cpu-set:
457 cpu: [ 0 ]
458 prio:
459 default: "high"
460 - reject-cpu-set:
461 cpu: [ 0 ]
462 prio:
463 default: "low"
464 - output-cpu-set:
465 cpu: [ "all" ]
466 prio:
467 default: "medium"
468 #
469 # By default Suricata creates one "detect" thread per available CPU/CPU core.
470 # This setting allows controlling this behaviour. A ratio setting of 2 will
471 # create 2 detect threads for each CPU/CPU core. So for a dual core CPU this
472 # will result in 4 detect threads. If values below 1 are used, less threads
473 # are created. So on a dual core CPU a setting of 0.5 results in 1 detect
474 # thread being created. Regardless of the setting at a minimum 1 detect
475 # thread will always be created.
476 #
477 detect-thread-ratio: 1.5
478
479# Cuda configuration.
480cuda:
481 # The "mpm" profile. On not specifying any of these parameters, the engine's
482 # internal default values are used, which are same as the ones specified in
483 # in the default conf file.
484 mpm:
485 # The minimum length required to buffer data to the gpu.
486 # Anything below this is MPM'ed on the CPU.
487 # Can be specified in kb, mb, gb. Just a number indicates it's in bytes.
488 # A value of 0 indicates there's no limit.
489 data-buffer-size-min-limit: 0
490 # The maximum length for data that we would buffer to the gpu.
491 # Anything over this is MPM'ed on the CPU.
492 # Can be specified in kb, mb, gb. Just a number indicates it's in bytes.
493 data-buffer-size-max-limit: 1500
494 # The ring buffer size used by the CudaBuffer API to buffer data.
495 cudabuffer-buffer-size: 500mb
496 # The max chunk size that can be sent to the gpu in a single go.
497 gpu-transfer-size: 50mb
498 # The timeout limit for batching of packets in microseconds.
499 batching-timeout: 2000
500 # The device to use for the mpm. Currently we don't support load balancing
501 # on multiple gpus. In case you have multiple devices on your system, you
502 # can specify the device to use, using this conf. By default we hold 0, to
503 # specify the first device cuda sees. To find out device-id associated with
504 # the card(s) on the system run "suricata --list-cuda-cards".
505 device-id: 0
506 # No of Cuda streams used for asynchronous processing. All values > 0 are valid.
507 # For this option you need a device with Compute Capability > 1.0.
508 cuda-streams: 2
509
510# Select the multi pattern algorithm you want to run for scan/search the
511# in the engine. The supported algorithms are b2g, b2gc, b2gm, b3g, wumanber,
512# ac and ac-gfbs.
513#
514# The mpm you choose also decides the distribution of mpm contexts for
515# signature groups, specified by the conf - "detect-engine.sgh-mpm-context".
516# Selecting "ac" as the mpm would require "detect-engine.sgh-mpm-context"
517# to be set to "single", because of ac's memory requirements, unless the
518# ruleset is small enough to fit in one's memory, in which case one can
519# use "full" with "ac". Rest of the mpms can be run in "full" mode.
520#
521# There is also a CUDA pattern matcher (only available if Suricata was
522# compiled with --enable-cuda: b2g_cuda. Make sure to update your
523# max-pending-packets setting above as well if you use b2g_cuda.
524
525mpm-algo: ac
526
527# The memory settings for hash size of these algorithms can vary from lowest
528# (2048) - low (4096) - medium (8192) - high (16384) - higher (32768) - max
529# (65536). The bloomfilter sizes of these algorithms can vary from low (512) -
530# medium (1024) - high (2048).
531#
532# For B2g/B3g algorithms, there is a support for two different scan/search
533# algorithms. For B2g the scan algorithms are B2gScan & B2gScanBNDMq, and
534# search algorithms are B2gSearch & B2gSearchBNDMq. For B3g scan algorithms
535# are B3gScan & B3gScanBNDMq, and search algorithms are B3gSearch &
536# B3gSearchBNDMq.
537#
538# For B2g the different scan/search algorithms and, hash and bloom
539# filter size settings. For B3g the different scan/search algorithms and, hash
540# and bloom filter size settings. For wumanber the hash and bloom filter size
541# settings.
542
543pattern-matcher:
544 - b2gc:
545 search-algo: B2gSearchBNDMq
546 hash-size: low
547 bf-size: medium
548 - b2gm:
549 search-algo: B2gSearchBNDMq
550 hash-size: low
551 bf-size: medium
552 - b2g:
553 search-algo: B2gSearchBNDMq
554 hash-size: low
555 bf-size: medium
556 - b3g:
557 search-algo: B3gSearchBNDMq
558 hash-size: low
559 bf-size: medium
560 - wumanber:
561 hash-size: low
562 bf-size: medium
563
564# Defrag settings:
565
566defrag:
567 memcap: 32mb
568 hash-size: 65536
569 trackers: 65535 # number of defragmented flows to follow
570 max-frags: 65535 # number of fragments to keep (higher than trackers)
571 prealloc: yes
572 timeout: 60
573
574# Enable defrag per host settings
575# host-config:
576#
577# - dmz:
578# timeout: 30
579# address: [192.168.1.0/24, 127.0.0.0/8, 1.1.1.0/24, 2.2.2.0/24, "1.1.1.1", "2.2.2.2", "::1"]
580#
581# - lan:
582# timeout: 45
583# address:
584# - 192.168.0.0/24
585# - 192.168.10.0/24
586# - 172.16.14.0/24
587
588# Flow settings:
589# By default, the reserved memory (memcap) for flows is 32MB. This is the limit
590# for flow allocation inside the engine. You can change this value to allow
591# more memory usage for flows.
592# The hash-size determine the size of the hash used to identify flows inside
593# the engine, and by default the value is 65536.
594# At the startup, the engine can preallocate a number of flows, to get a better
595# performance. The number of flows preallocated is 10000 by default.
596# emergency-recovery is the percentage of flows that the engine need to
597# prune before unsetting the emergency state. The emergency state is activated
598# when the memcap limit is reached, allowing to create new flows, but
599# prunning them with the emergency timeouts (they are defined below).
600# If the memcap is reached, the engine will try to prune flows
601# with the default timeouts. If it doens't find a flow to prune, it will set
602# the emergency bit and it will try again with more agressive timeouts.
603# If that doesn't work, then it will try to kill the last time seen flows
604# not in use.
605# The memcap can be specified in kb, mb, gb. Just a number indicates it's
606# in bytes.
607
608flow:
609 memcap: 64mb
610 hash-size: 65536
611 prealloc: 10000
612 emergency-recovery: 30
613
614# This option controls the use of vlan ids in the flow (and defrag)
615# hashing. Normally this should be enabled, but in some (broken)
616# setups where both sides of a flow are not tagged with the same vlan
617# tag, we can ignore the vlan id's in the flow hashing.
618vlan:
619 use-for-tracking: true
620
621# Specific timeouts for flows. Here you can specify the timeouts that the
622# active flows will wait to transit from the current state to another, on each
623# protocol. The value of "new" determine the seconds to wait after a hanshake or
624# stream startup before the engine free the data of that flow it doesn't
625# change the state to established (usually if we don't receive more packets
626# of that flow). The value of "established" is the amount of
627# seconds that the engine will wait to free the flow if it spend that amount
628# without receiving new packets or closing the connection. "closed" is the
629# amount of time to wait after a flow is closed (usually zero).
630#
631# There's an emergency mode that will become active under attack circumstances,
632# making the engine to check flow status faster. This configuration variables
633# use the prefix "emergency-" and work similar as the normal ones.
634# Some timeouts doesn't apply to all the protocols, like "closed", for udp and
635# icmp.
636
637flow-timeouts:
638
639 default:
640 new: 30
641 established: 300
642 closed: 0
643 emergency-new: 10
644 emergency-established: 100
645 emergency-closed: 0
646 tcp:
647 new: 60
648 established: 3600
649 closed: 120
650 emergency-new: 10
651 emergency-established: 300
652 emergency-closed: 20
653 udp:
654 new: 30
655 established: 300
656 emergency-new: 10
657 emergency-established: 100
658 icmp:
659 new: 30
660 established: 300
661 emergency-new: 10
662 emergency-established: 100
663
664# Stream engine settings. Here the TCP stream tracking and reassembly
665# engine is configured.
666#
667# stream:
668# memcap: 32mb # Can be specified in kb, mb, gb. Just a
669# # number indicates it's in bytes.
670# checksum-validation: yes # To validate the checksum of received
671# # packet. If csum validation is specified as
672# # "yes", then packet with invalid csum will not
673# # be processed by the engine stream/app layer.
674# # Warning: locally generated trafic can be
675# # generated without checksum due to hardware offload
676# # of checksum. You can control the handling of checksum
677# # on a per-interface basis via the 'checksum-checks'
678# # option
679# prealloc-sessions: 2k # 2k sessions prealloc'd per stream thread
680# midstream: false # don't allow midstream session pickups
681# async-oneside: false # don't enable async stream handling
682# inline: no # stream inline mode
683# max-synack-queued: 5 # Max different SYN/ACKs to queue
684#
685# reassembly:
686# memcap: 64mb # Can be specified in kb, mb, gb. Just a number
687# # indicates it's in bytes.
688# depth: 1mb # Can be specified in kb, mb, gb. Just a number
689# # indicates it's in bytes.
690# toserver-chunk-size: 2560 # inspect raw stream in chunks of at least
691# # this size. Can be specified in kb, mb,
692# # gb. Just a number indicates it's in bytes.
693# # The max acceptable size is 4024 bytes.
694# toclient-chunk-size: 2560 # inspect raw stream in chunks of at least
695# # this size. Can be specified in kb, mb,
696# # gb. Just a number indicates it's in bytes.
697# # The max acceptable size is 4024 bytes.
698# randomize-chunk-size: yes # Take a random value for chunk size around the specified value.
699# # This lower the risk of some evasion technics but could lead
700# # detection change between runs. It is set to 'yes' by default.
701# randomize-chunk-range: 10 # If randomize-chunk-size is active, the value of chunk-size is
702# # a random value between (1 - randomize-chunk-range/100)*randomize-chunk-size
703# # and (1 + randomize-chunk-range/100)*randomize-chunk-size. Default value
704# # of randomize-chunk-range is 10.
705#
706# raw: yes # 'Raw' reassembly enabled or disabled.
707# # raw is for content inspection by detection
708# # engine.
709#
710# chunk-prealloc: 250 # Number of preallocated stream chunks. These
711# # are used during stream inspection (raw).
712# segments: # Settings for reassembly segment pool.
713# - size: 4 # Size of the (data)segment for a pool
714# prealloc: 256 # Number of segments to prealloc and keep
715# # in the pool.
716#
717stream:
718 memcap: 32mb
719 checksum-validation: yes # reject wrong csums
720 inline: auto # auto will use inline mode in IPS mode, yes or no set it statically
721 reassembly:
722 memcap: 128mb
723 depth: 1mb # reassemble 1mb into a stream
724 toserver-chunk-size: 2560
725 toclient-chunk-size: 2560
726 randomize-chunk-size: yes
727 #randomize-chunk-range: 10
728 #raw: yes
729 #chunk-prealloc: 250
730 #segments:
731 # - size: 4
732 # prealloc: 256
733 # - size: 16
734 # prealloc: 512
735 # - size: 112
736 # prealloc: 512
737 # - size: 248
738 # prealloc: 512
739 # - size: 512
740 # prealloc: 512
741 # - size: 768
742 # prealloc: 1024
743 # - size: 1448
744 # prealloc: 1024
745 # - size: 65535
746 # prealloc: 128
747
748# Host table:
749#
750# Host table is used by tagging and per host thresholding subsystems.
751#
752host:
753 hash-size: 4096
754 prealloc: 1000
755 memcap: 16777216
756
757# Logging configuration. This is not about logging IDS alerts, but
758# IDS output about what its doing, errors, etc.
759logging:
760
761 # The default log level, can be overridden in an output section.
762 # Note that debug level logging will only be emitted if Suricata was
763 # compiled with the --enable-debug configure option.
764 #
765 # This value is overriden by the SC_LOG_LEVEL env var.
766 default-log-level: notice
767
768 # The default output format. Optional parameter, should default to
769 # something reasonable if not provided. Can be overriden in an
770 # output section. You can leave this out to get the default.
771 #
772 # This value is overriden by the SC_LOG_FORMAT env var.
773 #default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- "
774
775 # A regex to filter output. Can be overridden in an output section.
776 # Defaults to empty (no filter).
777 #
778 # This value is overriden by the SC_LOG_OP_FILTER env var.
779 default-output-filter:
780
781 # Define your logging outputs. If none are defined, or they are all
782 # disabled you will get the default - console output.
783 outputs:
784 - console:
785 enabled: yes
786 - file:
787 enabled: no
788 filename: /var/log/suricata.log
789 - syslog:
790 enabled: yes
791 facility: local5
792 format: "[%i] <%d> -- "
793
794# Tilera mpipe configuration. for use on Tilera TILE-Gx.
795mpipe:
796
797 # Load balancing modes: "static", "dynamic", "sticky", or "round-robin".
798 load-balance: dynamic
799
800 # Number of Packets in each ingress packet queue. Must be 128, 512, 2028 or 65536
801 iqueue-packets: 2048
802
803 # List of interfaces we will listen on.
804 inputs:
805 - interface: xgbe2
806 - interface: xgbe3
807 - interface: xgbe4
808
809
810 # Relative weight of memory for packets of each mPipe buffer size.
811 stack:
812 size128: 0
813 size256: 9
814 size512: 0
815 size1024: 0
816 size1664: 7
817 size4096: 0
818 size10386: 0
819 size16384: 0
820
821# PF_RING configuration. for use with native PF_RING support
822# for more info see http://www.ntop.org/PF_RING.html
823pfring:
824 - interface: eth0
825 # Number of receive threads (>1 will enable experimental flow pinned
826 # runmode)
827 threads: 1
828
829 # Default clusterid. PF_RING will load balance packets based on flow.
830 # All threads/processes that will participate need to have the same
831 # clusterid.
832 cluster-id: 99
833
834 # Default PF_RING cluster type. PF_RING can load balance per flow or per hash.
835 # This is only supported in versions of PF_RING > 4.1.1.
836 cluster-type: cluster_flow
837 # bpf filter for this interface
838 #bpf-filter: tcp
839 # Choose checksum verification mode for the interface. At the moment
840 # of the capture, some packets may be with an invalid checksum due to
841 # offloading to the network card of the checksum computation.
842 # Possible values are:
843 # - rxonly: only compute checksum for packets received by network card.
844 # - yes: checksum validation is forced
845 # - no: checksum validation is disabled
846 # - auto: suricata uses a statistical approach to detect when
847 # checksum off-loading is used. (default)
848 # Warning: 'checksum-validation' must be set to yes to have any validation
849 #checksum-checks: auto
850 # Second interface
851 #- interface: eth1
852 # threads: 3
853 # cluster-id: 93
854 # cluster-type: cluster_flow
855 # Put default values here
856 - interface: default
857 #threads: 2
858
859pcap:
860 - interface: eth0
861 # On Linux, pcap will try to use mmaped capture and will use buffer-size
862 # as total of memory used by the ring. So set this to something bigger
863 # than 1% of your bandwidth.
864 #buffer-size: 16777216
865 #bpf-filter: "tcp and port 25"
866 # Choose checksum verification mode for the interface. At the moment
867 # of the capture, some packets may be with an invalid checksum due to
868 # offloading to the network card of the checksum computation.
869 # Possible values are:
870 # - yes: checksum validation is forced
871 # - no: checksum validation is disabled
872 # - auto: suricata uses a statistical approach to detect when
873 # checksum off-loading is used. (default)
874 # Warning: 'checksum-validation' must be set to yes to have any validation
875 #checksum-checks: auto
876 # With some accelerator cards using a modified libpcap (like myricom), you
877 # may want to have the same number of capture threads as the number of capture
878 # rings. In this case, set up the threads variable to N to start N threads
879 # listening on the same interface.
880 #threads: 16
881 # set to no to disable promiscuous mode:
882 #promisc: no
883 # set snaplen, if not set it defaults to MTU if MTU can be known
884 # via ioctl call and to full capture if not.
885 #snaplen: 1518
886 # Put default values here
887 - interface: default
888 #checksum-checks: auto
889
890pcap-file:
891 # Possible values are:
892 # - yes: checksum validation is forced
893 # - no: checksum validation is disabled
894 # - auto: suricata uses a statistical approach to detect when
895 # checksum off-loading is used. (default)
896 # Warning: 'checksum-validation' must be set to yes to have checksum tested
897 checksum-checks: auto
898
899# For FreeBSD ipfw(8) divert(4) support.
900# Please make sure you have ipfw_load="YES" and ipdivert_load="YES"
901# in /etc/loader.conf or kldload'ing the appropriate kernel modules.
902# Additionally, you need to have an ipfw rule for the engine to see
903# the packets from ipfw. For Example:
904#
905# ipfw add 100 divert 8000 ip from any to any
906#
907# The 8000 above should be the same number you passed on the command
908# line, i.e. -d 8000
909#
910ipfw:
911
912 # Reinject packets at the specified ipfw rule number. This config
913 # option is the ipfw rule number AT WHICH rule processing continues
914 # in the ipfw processing system after the engine has finished
915 # inspecting the packet for acceptance. If no rule number is specified,
916 # accepted packets are reinjected at the divert rule which they entered
917 # and IPFW rule processing continues. No check is done to verify
918 # this will rule makes sense so care must be taken to avoid loops in ipfw.
919 #
920 ## The following example tells the engine to reinject packets
921 # back into the ipfw firewall AT rule number 5500:
922 #
923 # ipfw-reinjection-rule-number: 5500
924
925# Set the default rule path here to search for the files.
926# if not set, it will look at the current working dir
927default-rule-path: /etc/suricata/rules
928rule-files:
929 - botcc.rules
930 - ciarmy.rules
931 - compromised.rules
932 - drop.rules
933 - dshield.rules
934 - emerging-activex.rules
935 - emerging-attack_response.rules
936 - emerging-chat.rules
937 - emerging-current_events.rules
938 - emerging-dns.rules
939 - emerging-dos.rules
940 - emerging-exploit.rules
941 - emerging-ftp.rules
942 - emerging-games.rules
943 - emerging-icmp_info.rules
944# - emerging-icmp.rules
945 - emerging-imap.rules
946 - emerging-inappropriate.rules
947 - emerging-malware.rules
948 - emerging-misc.rules
949 - emerging-mobile_malware.rules
950 - emerging-netbios.rules
951 - emerging-p2p.rules
952 - emerging-policy.rules
953 - emerging-pop3.rules
954 - emerging-rpc.rules
955 - emerging-scada.rules
956 - emerging-scan.rules
957 - emerging-shellcode.rules
958 - emerging-smtp.rules
959 - emerging-snmp.rules
960 - emerging-sql.rules
961 - emerging-telnet.rules
962 - emerging-tftp.rules
963 - emerging-trojan.rules
964 - emerging-user_agents.rules
965 - emerging-voip.rules
966 - emerging-web_client.rules
967 - emerging-web_server.rules
968 - emerging-web_specific_apps.rules
969 - emerging-worm.rules
970 - tor.rules
971 - decoder-events.rules # available in suricata sources under rules dir
972 - stream-events.rules # available in suricata sources under rules dir
973 - http-events.rules # available in suricata sources under rules dir
974 - smtp-events.rules # available in suricata sources under rules dir
975 - dns-events.rules # available in suricata sources under rules dir
976 - tls-events.rules # available in suricata sources under rules dir
977
978classification-file: /etc/suricata/classification.config
979reference-config-file: /etc/suricata/reference.config
980
981# Holds variables that would be used by the engine.
982vars:
983
984 # Holds the address group vars that would be passed in a Signature.
985 # These would be retrieved during the Signature address parsing stage.
986 address-groups:
987
988 HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
989
990 EXTERNAL_NET: "!$HOME_NET"
991
992 HTTP_SERVERS: "$HOME_NET"
993
994 SMTP_SERVERS: "$HOME_NET"
995
996 SQL_SERVERS: "$HOME_NET"
997
998 DNS_SERVERS: "$HOME_NET"
999
1000 TELNET_SERVERS: "$HOME_NET"
1001
1002 AIM_SERVERS: "$EXTERNAL_NET"
1003
1004 DNP3_SERVER: "$HOME_NET"
1005
1006 DNP3_CLIENT: "$HOME_NET"
1007
1008 MODBUS_CLIENT: "$HOME_NET"
1009
1010 MODBUS_SERVER: "$HOME_NET"
1011
1012 ENIP_CLIENT: "$HOME_NET"
1013
1014 ENIP_SERVER: "$HOME_NET"
1015
1016 # Holds the port group vars that would be passed in a Signature.
1017 # These would be retrieved during the Signature port parsing stage.
1018 port-groups:
1019
1020 HTTP_PORTS: "80"
1021
1022 SHELLCODE_PORTS: "!80"
1023
1024 ORACLE_PORTS: 1521
1025
1026 SSH_PORTS: 22
1027
1028 DNP3_PORTS: 20000
1029
1030# Set the order of alerts bassed on actions
1031# The default order is pass, drop, reject, alert
1032action-order:
1033 - pass
1034 - drop
1035 - reject
1036 - alert
1037
1038# IP Reputation
1039#reputation-categories-file: /etc/suricata/iprep/categories.txt
1040#default-reputation-path: /etc/suricata/iprep
1041#reputation-files:
1042# - reputation.list
1043
1044# Host specific policies for defragmentation and TCP stream
1045# reassembly. The host OS lookup is done using a radix tree, just
1046# like a routing table so the most specific entry matches.
1047host-os-policy:
1048 # Make the default policy windows.
1049 windows: [0.0.0.0/0]
1050 bsd: []
1051 bsd-right: []
1052 old-linux: []
1053 linux: [10.0.0.0/8, 192.168.1.100, "8762:2352:6241:7245:E000:0000:0000:0000"]
1054 old-solaris: []
1055 solaris: ["::1"]
1056 hpux10: []
1057 hpux11: []
1058 irix: []
1059 macos: []
1060 vista: []
1061 windows2k3: []
1062
1063
1064# Limit for the maximum number of asn1 frames to decode (default 256)
1065asn1-max-frames: 256
1066
1067# When run with the option --engine-analysis, the engine will read each of
1068# the parameters below, and print reports for each of the enabled sections
1069# and exit. The reports are printed to a file in the default log dir
1070# given by the parameter "default-log-dir", with engine reporting
1071# subsection below printing reports in its own report file.
1072engine-analysis:
1073 # enables printing reports for fast-pattern for every rule.
1074 rules-fast-pattern: yes
1075 # enables printing reports for each rule
1076 rules: yes
1077
1078#recursion and match limits for PCRE where supported
1079pcre:
1080 match-limit: 3500
1081 match-limit-recursion: 1500
1082
1083# Holds details on the app-layer. The protocols section details each protocol.
1084# Under each protocol, the default value for detection-enabled and "
1085# parsed-enabled is yes, unless specified otherwise.
1086# Each protocol covers enabling/disabling parsers for all ipprotos
1087# the app-layer protocol runs on. For example "dcerpc" refers to the tcp
1088# version of the protocol as well as the udp version of the protocol.
1089# The option "enabled" takes 3 values - "yes", "no", "detection-only".
1090# "yes" enables both detection and the parser, "no" disables both, and
1091# "detection-only" enables detection only(parser disabled).
1092app-layer:
1093 protocols:
1094 tls:
1095 enabled: yes
1096 detection-ports:
1097 dp: 443
1098
1099 #no-reassemble: yes
1100 dcerpc:
1101 enabled: yes
1102 ftp:
1103 enabled: yes
1104 ssh:
1105 enabled: yes
1106 smtp:
1107 enabled: yes
1108 imap:
1109 enabled: detection-only
1110 msn:
1111 enabled: detection-only
1112 smb:
1113 enabled: yes
1114 detection-ports:
1115 dp: 139
1116 # smb2 detection is disabled internally inside the engine.
1117 #smb2:
1118 # enabled: yes
1119 dns:
1120 # memcaps. Globally and per flow/state.
1121 #global-memcap: 16mb
1122 #state-memcap: 512kb
1123
1124 # How many unreplied DNS requests are considered a flood.
1125 # If the limit is reached, app-layer-event:dns.flooded; will match.
1126 #request-flood: 500
1127
1128 tcp:
1129 enabled: yes
1130 detection-ports:
1131 dp: 53
1132 udp:
1133 enabled: yes
1134 detection-ports:
1135 dp: 53
1136 http:
1137 enabled: yes
1138 # memcap: 64mb
1139
1140 ###########################################################################
1141 # Configure libhtp.
1142 #
1143 #
1144 # default-config: Used when no server-config matches
1145 # personality: List of personalities used by default
1146 # request-body-limit: Limit reassembly of request body for inspection
1147 # by http_client_body & pcre /P option.
1148 # response-body-limit: Limit reassembly of response body for inspection
1149 # by file_data, http_server_body & pcre /Q option.
1150 # double-decode-path: Double decode path section of the URI
1151 # double-decode-query: Double decode query section of the URI
1152 #
1153 # server-config: List of server configurations to use if address matches
1154 # address: List of ip addresses or networks for this block
1155 # personalitiy: List of personalities used by this block
1156 # request-body-limit: Limit reassembly of request body for inspection
1157 # by http_client_body & pcre /P option.
1158 # response-body-limit: Limit reassembly of response body for inspection
1159 # by file_data, http_server_body & pcre /Q option.
1160 # double-decode-path: Double decode path section of the URI
1161 # double-decode-query: Double decode query section of the URI
1162 #
1163 # uri-include-all: Include all parts of the URI. By default the
1164 # 'scheme', username/password, hostname and port
1165 # are excluded. Setting this option to true adds
1166 # all of them to the normalized uri as inspected
1167 # by http_uri, urilen, pcre with /U and the other
1168 # keywords that inspect the normalized uri.
1169 # Note that this does not affect http_raw_uri.
1170 # Also, note that including all was the default in
1171 # 1.4 and 2.0beta1.
1172 #
1173 # meta-field-limit: Hard size limit for request and response size
1174 # limits. Applies to request line and headers,
1175 # response line and headers. Does not apply to
1176 # request or response bodies. Default is 18k.
1177 # If this limit is reached an event is raised.
1178 #
1179 # Currently Available Personalities:
1180 # Minimal
1181 # Generic
1182 # IDS (default)
1183 # IIS_4_0
1184 # IIS_5_0
1185 # IIS_5_1
1186 # IIS_6_0
1187 # IIS_7_0
1188 # IIS_7_5
1189 # Apache_2
1190 ###########################################################################
1191 libhtp:
1192
1193 default-config:
1194 personality: IDS
1195
1196 # Can be specified in kb, mb, gb. Just a number indicates
1197 # it's in bytes.
1198 request-body-limit: 3072
1199 response-body-limit: 3072
1200
1201 # inspection limits
1202 request-body-minimal-inspect-size: 32kb
1203 request-body-inspect-window: 4kb
1204 response-body-minimal-inspect-size: 32kb
1205 response-body-inspect-window: 4kb
1206 # Take a random value for inspection sizes around the specified value.
1207 # This lower the risk of some evasion technics but could lead
1208 # detection change between runs. It is set to 'yes' by default.
1209 #randomize-inspection-sizes: yes
1210 # If randomize-inspection-sizes is active, the value of various
1211 # inspection size will be choosen in the [1 - range%, 1 + range%]
1212 # range
1213 # Default value of randomize-inspection-range is 10.
1214 #randomize-inspection-range: 10
1215
1216 # decoding
1217 double-decode-path: no
1218 double-decode-query: no
1219
1220 server-config:
1221
1222 #- apache:
1223 # address: [192.168.1.0/24, 127.0.0.0/8, "::1"]
1224 # personality: Apache_2
1225 # # Can be specified in kb, mb, gb. Just a number indicates
1226 # # it's in bytes.
1227 # request-body-limit: 4096
1228 # response-body-limit: 4096
1229 # double-decode-path: no
1230 # double-decode-query: no
1231
1232 #- iis7:
1233 # address:
1234 # - 192.168.0.0/24
1235 # - 192.168.10.0/24
1236 # personality: IIS_7_0
1237 # # Can be specified in kb, mb, gb. Just a number indicates
1238 # # it's in bytes.
1239 # request-body-limit: 4096
1240 # response-body-limit: 4096
1241 # double-decode-path: no
1242 # double-decode-query: no
1243
1244# Profiling settings. Only effective if Suricata has been built with the
1245# the --enable-profiling configure flag.
1246#
1247profiling:
1248 # Run profiling for every xth packet. The default is 1, which means we
1249 # profile every packet. If set to 1000, one packet is profiled for every
1250 # 1000 received.
1251 #sample-rate: 1000
1252
1253 # rule profiling
1254 rules:
1255
1256 # Profiling can be disabled here, but it will still have a
1257 # performance impact if compiled in.
1258 enabled: yes
1259 filename: rule_perf.log
1260 append: yes
1261
1262 # Sort options: ticks, avgticks, checks, matches, maxticks
1263 sort: avgticks
1264
1265 # Limit the number of items printed at exit.
1266 limit: 100
1267
1268 # per keyword profiling
1269 keywords:
1270 enabled: yes
1271 filename: keyword_perf.log
1272 append: yes
1273
1274 # packet profiling
1275 packets:
1276
1277 # Profiling can be disabled here, but it will still have a
1278 # performance impact if compiled in.
1279 enabled: yes
1280 filename: packet_stats.log
1281 append: yes
1282
1283 # per packet csv output
1284 csv:
1285
1286 # Output can be disabled here, but it will still have a
1287 # performance impact if compiled in.
1288 enabled: no
1289 filename: packet_stats.csv
1290
1291 # profiling of locking. Only available when Suricata was built with
1292 # --enable-profiling-locks.
1293 locks:
1294 enabled: no
1295 filename: lock_stats.log
1296 append: yes
1297
1298# Suricata core dump configuration. Limits the size of the core dump file to
1299# approximately max-dump. The actual core dump size will be a multiple of the
1300# page size. Core dumps that would be larger than max-dump are truncated. On
1301# Linux, the actual core dump size may be a few pages larger than max-dump.
1302# Setting max-dump to 0 disables core dumping.
1303# Setting max-dump to 'unlimited' will give the full core dump file.
1304# On 32-bit Linux, a max-dump value >= ULONG_MAX may cause the core dump size
1305# to be 'unlimited'.
1306
1307coredump:
1308 max-dump: unlimited
1309
1310napatech:
1311 # The Host Buffer Allowance for all streams
1312 # (-1 = OFF, 1 - 100 = percentage of the host buffer that can be held back)
1313 hba: -1
1314
1315 # use_all_streams set to "yes" will query the Napatech service for all configured
1316 # streams and listen on all of them. When set to "no" the streams config array
1317 # will be used.
1318 use-all-streams: yes
1319
1320 # The streams to listen on
1321 streams: [1, 2, 3]
1322
1323# Includes. Files included here will be handled as if they were
1324# inlined in this configuration file.
1325#include: include1.yaml
1326#include: include2.yaml
diff --git a/recipes-ids/suricata/files/volatiles.03_suricata b/recipes-ids/suricata/files/volatiles.03_suricata
new file mode 100644
index 0000000..4627bd3
--- /dev/null
+++ b/recipes-ids/suricata/files/volatiles.03_suricata
@@ -0,0 +1,2 @@
1# <type> <owner> <group> <mode> <path> <linksource>
2d root root 0755 /var/log/suricata none
diff --git a/recipes-ids/suricata/libhtp_0.5.29.bb b/recipes-ids/suricata/libhtp_0.5.29.bb
new file mode 100644
index 0000000..8305f70
--- /dev/null
+++ b/recipes-ids/suricata/libhtp_0.5.29.bb
@@ -0,0 +1,15 @@
1SUMMARY = "LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces."
2
3require suricata.inc
4
5LIC_FILES_CHKSUM = "file://../LICENSE;beginline=1;endline=2;md5=c70d8d3310941dcdfcd1e02800a1f548"
6
7DEPENDS = "zlib"
8
9inherit autotools pkgconfig
10
11CFLAGS += "-D_DEFAULT_SOURCE"
12
13S = "${WORKDIR}/suricata-${VER}/${BPN}"
14
15RDEPENDS_${PN} += "zlib"
diff --git a/recipes-ids/suricata/suricata.inc b/recipes-ids/suricata/suricata.inc
new file mode 100644
index 0000000..7be403c
--- /dev/null
+++ b/recipes-ids/suricata/suricata.inc
@@ -0,0 +1,9 @@
1HOMEPAGE = "http://suricata-ids.org/"
2SECTION = "security Monitor/Admin"
3LICENSE = "GPLv2"
4
5VER = "4.1.3"
6SRC_URI = "http://www.openinfosecfoundation.org/download/suricata-${VER}.tar.gz"
7
8SRC_URI[md5sum] = "35c4a8e6be3910831649a073950195df"
9SRC_URI[sha256sum] = "6cda6c80b753ce36483c6be535358b971f3890b9aa27a58c2d2f7e89dd6c6aa0"
diff --git a/recipes-ids/suricata/suricata_4.1.3.bb b/recipes-ids/suricata/suricata_4.1.3.bb
new file mode 100644
index 0000000..d6f5937
--- /dev/null
+++ b/recipes-ids/suricata/suricata_4.1.3.bb
@@ -0,0 +1,97 @@
1SUMMARY = "The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine"
2
3require suricata.inc
4
5LIC_FILES_CHKSUM = "file://LICENSE;beginline=1;endline=2;md5=c70d8d3310941dcdfcd1e02800a1f548"
6
7SRC_URI += "file://emerging.rules.tar.gz;name=rules"
8
9SRC_URI += " \
10 file://volatiles.03_suricata \
11 file://suricata.yaml \
12 file://suricata.service \
13 file://run-ptest \
14 "
15
16SRC_URI[rules.md5sum] = "205c5e5b54e489207ed892c03ad75b33"
17SRC_URI[rules.sha256sum] = "4aa81011b246875a57181c6a0569ca887845e366904bcaf0043220f33bd69798"
18
19inherit autotools-brokensep pkgconfig python3-dir systemd ptest
20
21CFLAGS += "-D_DEFAULT_SOURCE"
22
23CACHED_CONFIGUREVARS = "ac_cv_header_htp_htp_h=yes ac_cv_lib_htp_htp_conn_create=yes \
24 ac_cv_path_HAVE_WGET=no ac_cv_path_HAVE_CURL=no "
25
26EXTRA_OECONF += " --disable-debug \
27 --enable-non-bundled-htp \
28 --disable-gccmarch-native \
29 --disable-suricata-update \
30 "
31
32PACKAGECONFIG ??= "htp jansson file pcre yaml pcap cap-ng net nfnetlink nss nspr"
33PACKAGECONFIG_append = " ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'unittests', '', d)}"
34
35PACKAGECONFIG[htp] = "--with-libhtp-includes=${STAGING_INCDIR} --with-libhtp-libraries=${STAGING_LIBDIR}, ,libhtp,"
36PACKAGECONFIG[pcre] = "--with-libpcre-includes=${STAGING_INCDIR} --with-libpcre-libraries=${STAGING_LIBDIR}, ,libpcre ,"
37PACKAGECONFIG[yaml] = "--with-libyaml-includes=${STAGING_INCDIR} --with-libyaml-libraries=${STAGING_LIBDIR}, ,libyaml ,"
38PACKAGECONFIG[pcap] = "--with-libpcap-includes=${STAGING_INCDIR} --with-libpcap-libraries=${STAGING_LIBDIR}, ,libpcap ,"
39PACKAGECONFIG[cap-ng] = "--with-libcap_ng-includes=${STAGING_INCDIR} --with-libcap_ng-libraries=${STAGING_LIBDIR}, ,libcap-ng , "
40PACKAGECONFIG[net] = "--with-libnet-includes=${STAGING_INCDIR} --with-libnet-libraries=${STAGING_LIBDIR}, , libnet,"
41PACKAGECONFIG[nfnetlink] = "--with-libnfnetlink-includes=${STAGING_INCDIR} --with-libnfnetlink-libraries=${STAGING_LIBDIR}, ,libnfnetlink ,"
42PACKAGECONFIG[nfq] = "--enable-nfqueue, --disable-nfqueue,libnetfilter-queue,"
43
44PACKAGECONFIG[jansson] = "--with-libjansson-includes=${STAGING_INCDIR} --with-libjansson-libraries=${STAGING_LIBDIR},,jansson, jansson"
45PACKAGECONFIG[file] = ",,file, file"
46PACKAGECONFIG[nss] = "--with-libnss-includes=${STAGING_INCDIR} --with-libnss-libraries=${STAGING_LIBDIR}, nss, nss,"
47PACKAGECONFIG[nspr] = "--with-libnspr-includes=${STAGING_INCDIR} --with-libnspr-libraries=${STAGING_LIBDIR}, nspr, nspr,"
48PACKAGECONFIG[python] = "--enable-python, --disable-python, python3, python3"
49PACKAGECONFIG[unittests] = "--enable-unittests, --disable-unittests,"
50
51export logdir = "${localstatedir}/log"
52
53do_install_append () {
54
55 install -d ${D}${sysconfdir}/suricata
56
57 oe_runmake install-conf DESTDIR=${D}
58
59 # mimic move of downloaded rules to e_sysconfrulesdir
60 cp -rf ${WORKDIR}/rules ${D}${sysconfdir}/suricata
61
62 oe_runmake install-rules DESTDIR=${D}
63
64 install -d ${D}${sysconfdir}/suricata ${D}${sysconfdir}/default/volatiles
65 install -m 0644 ${WORKDIR}/volatiles.03_suricata ${D}${sysconfdir}/default/volatiles/volatiles.03_suricata
66
67 install -m 0644 ${S}/threshold.config ${D}${sysconfdir}/suricata
68
69 install -d ${D}${systemd_unitdir}/system
70 sed -e s:/etc:${sysconfdir}:g \
71 -e s:/var/run:/run:g \
72 -e s:/var:${localstatedir}:g \
73 -e s:/usr/bin:${bindir}:g \
74 -e s:/bin/kill:${base_bindir}/kill:g \
75 -e s:/usr/lib:${libdir}:g \
76 ${WORKDIR}/suricata.service > ${D}${systemd_unitdir}/system/suricata.service
77
78 # Remove /var/run as it is created on startup
79 rm -rf ${D}${localstatedir}/run
80
81}
82
83pkg_postinst_ontarget_${PN} () {
84if [ -e /etc/init.d/populate-volatile.sh ] ; then
85 ${sysconfdir}/init.d/populate-volatile.sh update
86fi
87}
88
89SYSTEMD_PACKAGES = "${PN}"
90
91PACKAGES =+ "${PN}-socketcontrol"
92FILES_${PN} += "${systemd_unitdir}"
93FILES_${PN}-socketcontrol = "${bindir}/suricatasc ${PYTHON_SITEPACKAGES_DIR}"
94
95CONFFILES_${PN} = "${sysconfdir}/suricata/suricata.yaml"
96
97RDEPENDS_${PN}-python = "python"
diff --git a/recipes-ids/tripwire/files/add_armeb_arch.patch b/recipes-ids/tripwire/files/add_armeb_arch.patch
new file mode 100644
index 0000000..2379d66
--- /dev/null
+++ b/recipes-ids/tripwire/files/add_armeb_arch.patch
@@ -0,0 +1,18 @@
1tripwire: Add armeb support
2
3Upstream-Status: Submitted to tripwire-dev
4
5Signed-off-by: Armin Kuster <akuster@mvista.com>
6
7diff -Naurp tripwire-2.4.2.2-src_org/config.sub tripwire-2.4.2.2-src/config.sub
8--- tripwire-2.4.2.2-src_org/config.sub 2015-07-20 15:03:04.161452573 +0530
9+++ tripwire-2.4.2.2-src/config.sub 2015-07-20 15:06:07.077673139 +0530
10@@ -268,7 +268,7 @@ case $basic_machine in
11 # FIXME: clean up the formatting here.
12 vax-* | tahoe-* | i*86-* | i860-* | ia64-* | m32r-* | m68k-* | m68000-* \
13 | m88k-* | sparc-* | ns32k-* | fx80-* | arc-* | c[123]* | aarch64-* | aarch64be-* \
14- | arm-* | armbe-* | armle-* | armv*-* | strongarm-* | xscale-* \
15+ | arm-* | armeb-* | armbe-* | armle-* | armv*-* | strongarm-* | xscale-* \
16 | mips-* | pyramid-* | tron-* | a29k-* | romp-* | rs6000-* \
17 | power-* | none-* | 580-* | cray2-* | h8300-* | h8500-* | i960-* \
18 | xmp-* | ymp-* \
diff --git a/recipes-ids/tripwire/files/run-ptest b/recipes-ids/tripwire/files/run-ptest
new file mode 100644
index 0000000..aedfddc
--- /dev/null
+++ b/recipes-ids/tripwire/files/run-ptest
@@ -0,0 +1,3 @@
1#!/bin/sh
2
3./twtest.pl
diff --git a/recipes-ids/tripwire/files/tripwire.cron b/recipes-ids/tripwire/files/tripwire.cron
new file mode 100644
index 0000000..2035508
--- /dev/null
+++ b/recipes-ids/tripwire/files/tripwire.cron
@@ -0,0 +1,8 @@
1#!/bin/sh
2HOST_NAME=`uname -n`
3if [ ! -e /var/lib/tripwire/${HOST_NAME}.twd ] ; then
4 echo "**** Error: Tripwire database for ${HOST_NAME} not found. ****"
5 echo "**** Run "/etc/tripwire/twinstall.sh" and/or "tripwire --init". ****"
6else
7 test -f /etc/tripwire/tw.cfg && /usr/sbin/tripwire --check
8fi
diff --git a/recipes-ids/tripwire/files/tripwire.sh b/recipes-ids/tripwire/files/tripwire.sh
new file mode 100644
index 0000000..4276d10
--- /dev/null
+++ b/recipes-ids/tripwire/files/tripwire.sh
@@ -0,0 +1,9 @@
1#!/bin/sh
2HOST_NAME=`uname -n`
3if [ ! -e /var/lib/tripwire/${HOST_NAME}.twd ] ; then
4 echo "**** WARNING: Tripwire database for ${HOST_NAME} not found. ****"
5 echo "**** Run "/etc/tripwire/twinstall.sh" and/or "tripwire --init". ****"
6 # Note: /etc/tripwire/twinstall.sh creates and initializes tripwire
7 # database (i.e tripwire --init).
8 # Example: . /etc/tripwire/twinstall.sh 2> /dev/null
9fi
diff --git a/recipes-ids/tripwire/files/tripwire.txt b/recipes-ids/tripwire/files/tripwire.txt
new file mode 100644
index 0000000..332d004
--- /dev/null
+++ b/recipes-ids/tripwire/files/tripwire.txt
@@ -0,0 +1,69 @@
1Post-Installation Instructions
21. Run the configuration script: /etc/tripwire/twinstall.sh to sign these files. This script walks you through the processes of setting passphrases and signing the Tripwire policy and configuration files.
3Note: Once encoded and signed, the configuration file should not be renamed or moved.
42. Initialize the Tripwire database file. (/usr/sbin/tripwire--init)
53. Run the first integrity check. (/usr/sbin/tripwire--check)
64. Edit the configuration file (twcfg.txt) with a text editor, if desired.
75. Edit the policy file (twpol.txt) with a text editor, if desired.
8
9Note: If you plan to modify the policy file, we recommend you do so before running the configuration script. If you modify the policy file after running the configuration script, you must re-run the configuration file before initializing the database file.
10
11Modifying the Policy File
12You can specify how Tripwire software checks your system in the Tripwire policy file (twpol.txt). A default policy file is included in the Tripwire software installation. We recommend you tailor this policy file to fit your particular system. Tailoring the policy file greatly increases Tripwire software's ability to ensure the integrity of your system.
13
14Locate the default policy file at /etc/tripwire/twpol.txt. An example policy file (located at /usr/doc/tripwire-VER#-REL#/policyguide.txt) is included to help you learn the policy language. Read the sample policy file and the comments in the sample policy file to learn the policy language.
15
16After you modify the policy file, follow the Post-Installation Instructions (run the configuration script). This script signs the modified policy file and renames it to tw.pol. This is the active policy file that runs as part of the Tripwire software.
17
18Selecting Passphrases
19Tripwire files are signed or encrypted using site or local keys. These keys are protected by passphrases. When selecting passphrases, the following recommendations apply:
20Use at least eight alphanumeric and symbolic characters for each passphrase. The maximum length of a passphrase is 1023 characters. Quotes should not be used as passphrase characters.
21
22Assign a unique passphrase for the site key. The site key passphrase protects the site key, which is used to sign Tripwire software configuration and policy files. Assign a unique passphrase for the local key. The local key signs Tripwire database files. The local key may sign the Tripwire report files also.
23
24Store the passphrases in a secure location. There is no way to remove encryption from a signed file if you forget your passphrase. If you forget the passphrases, the files are unusable. In that case you must reinitialize the baseline database.
25
26Initializing the Database
27In Database Initialization mode, Tripwire software builds a database of filesystem objects based on the rules in the policy file. This database serves as the baseline for integrity checks. The syntax for Database Initialization mode is:
28tripwire --init
29
30Running an Integrity Check
31The Integrity Check mode compares the current file system objects with their properties recorded in the Tripwire database. Violations are printed to stdout. The report file is saved and can later be accessed by twprint. An email option enables you to send email. The syntax for Integrity Check mode is:
32tripwire --check
33
34Printing Reports - twprint Print Report Mode
35The twprint --print-report mode prints the contents of a Tripwire report. If you do not specify a report with the --twrfile or -r command-line argument, the default report file specified by the configuration file REPORTFILE variable is used.
36Example: On a machine named LIGHTHOUSE, the command would be:
37./twprint -m r --twrfile LIGHTHOUSE-19990622-021212.twr
38
39Updating the Database after an Integrity Check
40Database Update mode enables you to update the Tripwire database after an integrity check if you determine that the violations discovered are valid. This update process saves time by enabling you to update the database without having to re-initialize it. It also enables selective updating, which cannot be done through re-initialization. The syntax for Database Update mode is:
41tripwire --update
42
43Updating the Policy File
44Change the way that Tripwire software scans the system by changing the rules in the policy file. You can then update the database without a complete re-initialization. This saves a significant amount of time and preserves security by keeping the policy file synchronized with the database it uses. The syntax for Policy Update mode is:
45tripwire --update-policy
46
47Testing email functions
48Test mode tests the software's email notification system, using the settings currently specified in the configuration file. The syntax for Email Test Reporting mode is:
49tripwire --test
50
51Tripwire Components
52The policy file begins as a text file containing comments, rules, directives, and variables. These dictate the way Tripwire software checks your system. Each rule in the policy file specifies a system object to be monitored. Rules also describe which changes to the object to report, and which to ignore.
53
54System objects are the files and directories you wish to monitor. Each object is identified by an object name. A property refers to a single characteristic of an object that Tripwire software can monitor. Directives control conditional processing of sets of rules in a policy file. During installation, the text policy file is encrypted and renamed, and becomes the active policy file.
55
56The database file is an important component of Tripwire software. When first installed, Tripwire software uses the policy file rules to create the database file. The database file is a baseline "snapshot" of the system in a known secure state. Tripwire software compares this baseline against the current system to determine what changes have occurred. This is an integrity check.
57
58When you perform an integrity check, Tripwire software produces report files. Report files summarize any changes that violated the policy file rules during the integrity check. You can view the report file in a variety of formats, at varying levels of detail.
59
60The Tripwire configuration file stores system-specific information, such as the location of Tripwire data files. Tripwire software generates some of the configuration file information during installation. The system administrator can change parameters in the configuration file at any time. The configuration file variables POLFILE, DBFILE, REPORTFILE, SITEKEYFILE, and LOCALKEYFILE specify where the policy file, database file, report files, and site and local key files reside. These variables must be defined or the configuration file is invalid. If any of these variables are undefined, an error occurs on execution of Tripwire software and the program exits.
61
62Tripwire Help
63All Tripwire commands support the help arguments. Example: To get help with Create Configuration File mode, type: ./twadmin --help --create-cfgfile
64
65-? Display usage and version information
66--help Display all command modes
67--help all Display help for all command modes
68--help [mode] Display help for current command mode
69--version Display version information
diff --git a/recipes-ids/tripwire/files/twcfg.txt b/recipes-ids/tripwire/files/twcfg.txt
new file mode 100644
index 0000000..224e920
--- /dev/null
+++ b/recipes-ids/tripwire/files/twcfg.txt
@@ -0,0 +1,15 @@
1ROOT =/usr/sbin
2POLFILE =/etc/tripwire/tw.pol
3DBFILE =/var/lib/tripwire/$(HOSTNAME).twd
4REPORTFILE =/var/lib/tripwire/report/$(HOSTNAME)-$(DATE).twr
5SITEKEYFILE =/etc/tripwire/site.key
6LOCALKEYFILE =/etc/tripwire/$(HOSTNAME)-local.key
7EDITOR =/usr/bin/nano
8LATEPROMPTING =false
9LOOSEDIRECTORYCHECKING =false
10MAILNOVIOLATIONS =true
11EMAILREPORTLEVEL =3
12REPORTLEVEL =3
13MAILMETHOD =SENDMAIL
14SYSLOGREPORTING =false
15MAILPROGRAM =/usr/lib/sendmail -t
diff --git a/recipes-ids/tripwire/files/twinstall.sh b/recipes-ids/tripwire/files/twinstall.sh
new file mode 100644
index 0000000..7d1b63f
--- /dev/null
+++ b/recipes-ids/tripwire/files/twinstall.sh
@@ -0,0 +1,320 @@
1#!/bin/sh
2
3########################################################################
4########################################################################
5##
6## Tripwire(R) 2.3 for LINUX(R) Post-RPM installation script
7##
8## Copyleft information contained in footer
9##
10########################################################################
11########################################################################
12
13##=======================================================
14## Setup
15##=======================================================
16
17# We can assume all the correct tools are in place because the
18# RPM installed, didn't it?
19
20##-------------------------------------------------------
21## Set HOST_NAME variable
22##-------------------------------------------------------
23HOST_NAME='localhost'
24if uname -n > /dev/null 2> /dev/null ; then
25 HOST_NAME=`uname -n`
26fi
27
28##-------------------------------------------------------
29## Program variables - edited by RPM during initial install
30##-------------------------------------------------------
31
32# Site Passphrase variable
33TW_SITE_PASS="tripwire"
34
35# Complete path to site key
36SITE_KEY="/etc/tripwire/site.key"
37
38# Local Passphrase variable
39TW_LOCAL_PASS="tripwire"
40
41# Complete path to local key
42LOCAL_KEY="/etc/tripwire/${HOST_NAME}-local.key"
43
44# If clobber==true, overwrite files; if false, do not overwrite files.
45CLOBBER="false"
46
47# If prompt==true, ask for confirmation before continuing with install.
48PROMPT="true"
49
50# Name of twadmin executeable
51TWADMIN="twadmin"
52
53# Path to twadmin executeable
54TWADMPATH=/usr/sbin
55
56# Path to configuration directory
57CONF_PATH="/etc/tripwire"
58
59# Name of clear text policy file
60TXT_POL=$CONF_PATH/twpol.txt
61
62# Name of clear text configuration file
63TXT_CFG=$CONF_PATH/twcfg.txt
64
65# Name of encrypted configuration file
66CONFIG_FILE=$CONF_PATH/tw.cfg
67
68# Path of the final Tripwire policy file (signed)
69SIGNED_POL=`grep POLFILE $TXT_CFG | sed -e 's/^.*=\(.*\)/\1/'`
70
71
72##=======================================================
73## Create Key Files
74##=======================================================
75
76##-------------------------------------------------------
77## If user has to enter a passphrase, give some
78## advice about what is appropriate.
79##-------------------------------------------------------
80
81if [ -z "$TW_SITE_PASS" ] || [ -z "$TW_LOCAL_PASS" ]; then
82cat << END_OF_TEXT
83
84----------------------------------------------
85The Tripwire site and local passphrases are used to
86sign a variety of files, such as the configuration,
87policy, and database files.
88
89Passphrases should be at least 8 characters in length
90and contain both letters and numbers.
91
92See the Tripwire manual for more information.
93END_OF_TEXT
94fi
95
96##=======================================================
97## Generate keys.
98##=======================================================
99
100echo
101echo "----------------------------------------------"
102echo "Creating key files..."
103
104##-------------------------------------------------------
105## Site key file.
106##-------------------------------------------------------
107
108# If clobber is true, and prompting is off (unattended operation)
109# and the key file already exists, remove it. Otherwise twadmin
110# will prompt with an "are you sure?" message.
111
112if [ "$CLOBBER" = "true" ] && [ "$PROMPT" = "false" ] && [ -f "$SITE_KEY" ] ; then
113 rm -f "$SITE_KEY"
114fi
115
116if [ -f "$SITE_KEY" ] && [ "$CLOBBER" = "false" ] ; then
117 echo "The site key file \"$SITE_KEY\""
118 echo 'exists and will not be overwritten.'
119else
120 cmdargs="--generate-keys --site-keyfile \"$SITE_KEY\""
121 if [ -n "$TW_SITE_PASS" ] ; then
122 cmdargs="$cmdargs --site-passphrase \"$TW_SITE_PASS\""
123 fi
124 eval "\"$TWADMPATH/$TWADMIN\" $cmdargs"
125 if [ $? -ne 0 ] ; then
126 echo "Error: site key generation failed"
127 exit 1
128 else chmod 640 "$SITE_KEY"
129 fi
130fi
131
132##-------------------------------------------------------
133## Local key file.
134##-------------------------------------------------------
135
136# If clobber is true, and prompting is off (unattended operation)
137# and the key file already exists, remove it. Otherwise twadmin
138# will prompt with an "are you sure?" message.
139
140if [ "$CLOBBER" = "true" ] && [ "$PROMPT" = "false" ] && [ -f "$LOCAL_KEY" ] ; then
141 rm -f "$LOCAL_KEY"
142fi
143
144if [ -f "$LOCAL_KEY" ] && [ "$CLOBBER" = "false" ] ; then
145 echo "The site key file \"$LOCAL_KEY\""
146 echo 'exists and will not be overwritten.'
147else
148 cmdargs="--generate-keys --local-keyfile \"$LOCAL_KEY\""
149 if [ -n "$TW_LOCAL_PASS" ] ; then
150 cmdargs="$cmdargs --local-passphrase \"$TW_LOCAL_PASS\""
151 fi
152 eval "\"$TWADMPATH/$TWADMIN\" $cmdargs"
153 if [ $? -ne 0 ] ; then
154 echo "Error: local key generation failed"
155 exit 1
156 else chmod 640 "$LOCAL_KEY"
157 fi
158fi
159
160##=======================================================
161## Sign the Configuration File
162##=======================================================
163
164echo
165echo "----------------------------------------------"
166echo "Signing configuration file..."
167
168##-------------------------------------------------------
169## If noclobber, then backup any existing config file.
170##-------------------------------------------------------
171
172if [ "$CLOBBER" = "false" ] && [ -s "$CONFIG_FILE" ] ; then
173 backup="${CONFIG_FILE}.$$.bak"
174 echo "Backing up $CONFIG_FILE"
175 echo " to $backup"
176 `mv "$CONFIG_FILE" "$backup"`
177 if [ $? -ne 0 ] ; then
178 echo "Error: backup of configuration file failed."
179 exit 1
180 fi
181fi
182
183##-------------------------------------------------------
184## Build command line.
185##-------------------------------------------------------
186
187cmdargs="--create-cfgfile"
188cmdargs="$cmdargs --cfgfile \"$CONFIG_FILE\""
189cmdargs="$cmdargs --site-keyfile \"$SITE_KEY\""
190if [ -n "$TW_SITE_PASS" ] ; then
191 cmdargs="$cmdargs --site-passphrase \"$TW_SITE_PASS\""
192fi
193
194##-------------------------------------------------------
195## Sign the file.
196##-------------------------------------------------------
197
198eval "\"$TWADMPATH/$TWADMIN\" $cmdargs \"$TXT_CFG\""
199if [ $? -ne 0 ] ; then
200 echo "Error: signing of configuration file failed."
201 exit 1
202fi
203
204# Set the rights properly
205chmod 640 "$CONFIG_FILE"
206
207##-------------------------------------------------------
208## We keep the cleartext version around.
209##-------------------------------------------------------
210
211cat << END_OF_TEXT
212
213A clear-text version of the Tripwire configuration file
214$TXT_CFG
215has been preserved for your inspection. It is recommended
216that you delete this file manually after you have examined it.
217
218END_OF_TEXT
219
220##=======================================================
221## Sign tripwire policy file.
222##=======================================================
223
224echo
225echo "----------------------------------------------"
226echo "Signing policy file..."
227
228##-------------------------------------------------------
229## If noclobber, then backup any existing policy file.
230##-------------------------------------------------------
231
232if [ "$CLOBBER" = "false" ] && [ -s "$POLICY_FILE" ] ; then
233 backup="${POLICY_FILE}.$$.bak"
234 echo "Backing up $POLICY_FILE"
235 echo " to $backup"
236 mv "$POLICY_FILE" "$backup"
237 if [ $? -ne 0 ] ; then
238 echo "Error: backup of policy file failed."
239 exit 1
240 fi
241fi
242
243##-------------------------------------------------------
244## Build command line.
245##-------------------------------------------------------
246
247cmdargs="--create-polfile"
248cmdargs="$cmdargs --cfgfile \"$CONFIG_FILE\""
249cmdargs="$cmdargs --site-keyfile \"$SITE_KEY\""
250if [ -n "$TW_SITE_PASS" ] ; then
251 cmdargs="$cmdargs --site-passphrase \"$TW_SITE_PASS\""
252fi
253
254##-------------------------------------------------------
255## Sign the file.
256##-------------------------------------------------------
257
258eval "\"$TWADMPATH/$TWADMIN\" $cmdargs \"$TXT_POL\""
259if [ $? -ne 0 ] ; then
260 echo "Error: signing of policy file failed."
261 exit 1
262fi
263
264# Set the proper rights on the newly signed policy file.
265chmod 0640 "$SIGNED_POL"
266
267##-------------------------------------------------------
268## We keep the cleartext version around.
269##-------------------------------------------------------
270
271cat << END_OF_TEXT
272
273A clear-text version of the Tripwire policy file
274$TXT_POL
275has been preserved for your inspection. This implements
276a minimal policy, intended only to test essential
277Tripwire functionality. You should edit the policy file
278to describe your system, and then use twadmin to generate
279a new signed copy of the Tripwire policy.
280
281END_OF_TEXT
282
283# Initialize tripwire database
284/usr/sbin/tripwire --init --cfgfile $CONFIG_FILE --site-keyfile $SITE_KEY \
285--local-passphrase $TW_LOCAL_PASS 2> /dev/null
286
287########################################################################
288########################################################################
289#
290# TRIPWIRE GPL NOTICES
291#
292# The developer of the original code and/or files is Tripwire, Inc.
293# Portions created by Tripwire, Inc. are copyright 2000 Tripwire, Inc.
294# Tripwire is a registered trademark of Tripwire, Inc. All rights reserved.
295#
296# This program is free software. The contents of this file are subject to
297# the terms of the GNU General Public License as published by the Free
298# Software Foundation; either version 2 of the License, or (at your option)
299# any later version. You may redistribute it and/or modify it only in
300# compliance with the GNU General Public License.
301#
302# This program is distributed in the hope that it will be useful. However,
303# this program is distributed "AS-IS" WITHOUT ANY WARRANTY; INCLUDING THE
304# IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
305# Please see the GNU General Public License for more details.
306#
307# You should have received a copy of the GNU General Public License along
308# with this program; if not, write to the Free Software Foundation, Inc.,
309# 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
310#
311# Nothing in the GNU General Public License or any other license to use the
312# code or files shall permit you to use Tripwire's trademarks,
313# service marks, or other intellectual property without Tripwire's
314# prior written consent.
315#
316# If you have any questions, please contact Tripwire, Inc. at either
317# info@tripwire.org or www.tripwire.org.
318#
319########################################################################
320########################################################################
diff --git a/recipes-ids/tripwire/files/twpol-yocto.txt b/recipes-ids/tripwire/files/twpol-yocto.txt
new file mode 100644
index 0000000..65f5f75
--- /dev/null
+++ b/recipes-ids/tripwire/files/twpol-yocto.txt
@@ -0,0 +1,1107 @@
1 ##############################################################################
2 # ##
3############################################################################## #
4# # #
5# Generic Policy file # #
6# V1.2.0rh # #
7# August 9, 2001 # #
8# ##
9##############################################################################
10
11
12 ##############################################################################
13 # ##
14############################################################################## #
15# # #
16# This is the example Tripwire Policy file. It is intended as a place to # #
17# start creating your own custom Tripwire Policy file. Referring to it as # #
18# well as the Tripwire Policy Guide should give you enough information to # #
19# make a good custom Tripwire Policy file that better covers your # #
20# configuration and security needs. A text version of this policy file is # #
21# called twpol.txt. # #
22# # #
23# Note that this file is tuned to an 'everything' install of Red Hat Linux. # #
24# If run unmodified, this file should create no errors on database # #
25# creation, or violations on a subsiquent integrity check. However, it is # #
26# impossible for there to be one policy file for all machines, so this # #
27# existing one errs on the side of security. Your Linux configuration will # #
28# most likey differ from the one our policy file was tuned to, and will # #
29# therefore require some editing of the default Tripwire Policy file. # #
30# # #
31# The example policy file is best run with 'Loose Directory Checking' # #
32# enabled. Set LOOSEDIRECTORYCHECKING=TRUE in the Tripwire Configuration # #
33# file. # #
34# # #
35# Email support is not included and must be added to this file. # #
36# Add the 'emailto=' to the rule directive section of each rule (add a comma # #
37# after the 'severity=' line and add an 'emailto=' and include the email # #
38# addresses you want the violation reports to go to). Addresses are # #
39# semi-colon delimited. # #
40# ##
41##############################################################################
42
43
44
45 ##############################################################################
46 # ##
47############################################################################## #
48# # #
49# Global Variable Definitions # #
50# # #
51# These are defined at install time by the installation script. You may # #
52# Manually edit these if you are using this file directly and not from the # #
53# installation script itself. # #
54# ##
55##############################################################################
56
57@@section GLOBAL
58TWROOT=/usr/sbin;
59TWBIN=/usr/sbin;
60TWPOL="/etc/tripwire";
61TWDB="/var/lib/tripwire";
62TWSKEY="/etc/tripwire";
63TWLKEY="/etc/tripwire";
64TWREPORT="/var/lib/tripwire/report";
65HOSTNAME=localhost;
66
67@@section FS
68SEC_CRIT = $(IgnoreNone)-SHa ; # Critical files that cannot change
69SEC_SUID = $(IgnoreNone)-SHa ; # Binaries with the SUID or SGID flags set
70SEC_BIN = $(ReadOnly) ; # Binaries that should not change
71SEC_CONFIG = $(Dynamic) ; # Config files that are changed infrequently but accessed often
72SEC_LOG = $(Growing) ; # Files that grow, but that should never change ownership
73SEC_INVARIANT = +tpug ; # Directories that should never change permission or ownership
74SIG_LOW = 33 ; # Non-critical files that are of minimal security impact
75SIG_MED = 66 ; # Non-critical files that are of significant security impact
76SIG_HI = 100 ; # Critical files that are significant points of vulnerability
77
78
79# Tripwire Binaries
80(
81 rulename = "Tripwire Binaries",
82 severity = $(SIG_HI)
83)
84{
85 $(TWBIN)/siggen -> $(SEC_BIN) ;
86 $(TWBIN)/tripwire -> $(SEC_BIN) ;
87 $(TWBIN)/twadmin -> $(SEC_BIN) ;
88 $(TWBIN)/twprint -> $(SEC_BIN) ;
89}
90
91# Tripwire Data Files - Configuration Files, Policy Files, Keys, Reports, Databases
92(
93 rulename = "Tripwire Data Files",
94 severity = $(SIG_HI)
95)
96{
97 # NOTE: We remove the inode attribute because when Tripwire creates a backup,
98 # it does so by renaming the old file and creating a new one (which will
99 # have a new inode number). Inode is left turned on for keys, which shouldn't
100 # ever change.
101
102 # NOTE: The first integrity check triggers this rule and each integrity check
103 # afterward triggers this rule until a database update is run, since the
104 # database file does not exist before that point.
105
106 $(TWDB) -> $(SEC_CONFIG) -i ;
107 $(TWPOL)/tw.pol -> $(SEC_BIN) -i ;
108 $(TWPOL)/tw.cfg -> $(SEC_BIN) -i ;
109 $(TWLKEY)/$(HOSTNAME)-local.key -> $(SEC_BIN) ;
110 $(TWSKEY)/site.key -> $(SEC_BIN) ;
111
112 #don't scan the individual reports
113 $(TWREPORT) -> $(SEC_CONFIG) (recurse=0) ;
114}
115
116
117# Tripwire HQ Connector Binaries
118#(
119# rulename = "Tripwire HQ Connector Binaries",
120# severity = $(SIG_HI)
121#)
122#{
123# $(TWBIN)/hqagent -> $(SEC_BIN) ;
124#}
125#
126# Tripwire HQ Connector - Configuration Files, Keys, and Logs
127
128 ##############################################################################
129 # ##
130############################################################################## #
131# # #
132# Note: File locations here are different than in a stock HQ Connector # #
133# installation. This is because Tripwire 2.3 uses a different path # #
134# structure than Tripwire 2.2.1. # #
135# # #
136# You may need to update your HQ Agent configuation file (or this policy # #
137# file) to correct the paths. We have attempted to support the FHS standard # #
138# here by placing the HQ Agent files similarly to the way Tripwire 2.3 # #
139# places them. # #
140# ##
141##############################################################################
142
143#(
144# rulename = "Tripwire HQ Connector Data Files",
145# severity = $(SIG_HI)
146#)
147#{
148# #############################################################################
149# ##############################################################################
150# # NOTE: Removing the inode attribute because when Tripwire creates a backup ##
151# # it does so by renaming the old file and creating a new one (which will ##
152# # have a new inode number). Leaving inode turned on for keys, which ##
153# # shouldn't ever change. ##
154# #############################################################################
155#
156# $(TWBIN)/agent.cfg -> $(SEC_BIN) -i ;
157# $(TWLKEY)/authentication.key -> $(SEC_BIN) ;
158# $(TWDB)/tasks.dat -> $(SEC_CONFIG) ;
159# $(TWDB)/schedule.dat -> $(SEC_CONFIG) ;
160#
161# # Uncomment if you have agent logging enabled.
162# #/var/log/tripwire/agent.log -> $(SEC_LOG) ;
163#}
164
165
166
167# Commonly accessed directories that should remain static with regards to owner and group
168(
169 rulename = "Invariant Directories",
170 severity = $(SIG_MED)
171)
172{
173 / -> $(SEC_INVARIANT) (recurse = 0) ;
174 /home -> $(SEC_INVARIANT) (recurse = 0) ;
175 /etc -> $(SEC_INVARIANT) (recurse = 0) ;
176}
177 ################################################
178 # ##
179################################################ #
180# # #
181# File System and Disk Administration Programs # #
182# ##
183################################################
184
185(
186 rulename = "File System and Disk Administraton Programs",
187 severity = $(SIG_HI)
188)
189{
190 /sbin/accton -> $(SEC_CRIT) ;
191 /sbin/badblocks -> $(SEC_CRIT) ;
192 /sbin/busybox -> $(SEC_CRIT) ;
193 /sbin/busybox.anaconda -> $(SEC_CRIT) ;
194 /sbin/convertquota -> $(SEC_CRIT) ;
195 /sbin/dosfsck -> $(SEC_CRIT) ;
196 /sbin/debugfs -> $(SEC_CRIT) ;
197 /sbin/debugreiserfs -> $(SEC_CRIT) ;
198 /sbin/dumpe2fs -> $(SEC_CRIT) ;
199 /sbin/dump -> $(SEC_CRIT) ;
200 /sbin/dump.static -> $(SEC_CRIT) ;
201 # /sbin/e2fsadm -> $(SEC_CRIT) ; tune2fs?
202 /sbin/e2fsck -> $(SEC_CRIT) ;
203 /sbin/e2label -> $(SEC_CRIT) ;
204 /sbin/fdisk -> $(SEC_CRIT) ;
205 /sbin/fsck -> $(SEC_CRIT) ;
206 /sbin/fsck.ext2 -> $(SEC_CRIT) ;
207 /sbin/fsck.ext3 -> $(SEC_CRIT) ;
208 /sbin/fsck.minix -> $(SEC_CRIT) ;
209 /sbin/fsck.msdos -> $(SEC_CRIT) ;
210 /sbin/fsck.vfat -> $(SEC_CRIT) ;
211 /sbin/ftl_check -> $(SEC_CRIT) ;
212 /sbin/ftl_format -> $(SEC_CRIT) ;
213 /sbin/hdparm -> $(SEC_CRIT) ;
214 #/sbin/lvchange -> $(SEC_CRIT) ;
215 #/sbin/lvcreate -> $(SEC_CRIT) ;
216 #/sbin/lvdisplay -> $(SEC_CRIT) ;
217 #/sbin/lvextend -> $(SEC_CRIT) ;
218 #/sbin/lvmchange -> $(SEC_CRIT) ;
219 #/sbin/lvmcreate_initrd -> $(SEC_CRIT) ;
220 #/sbin/lvmdiskscan -> $(SEC_CRIT) ;
221 #/sbin/lvmsadc -> $(SEC_CRIT) ;
222 #/sbin/lvmsar -> $(SEC_CRIT) ;
223 #/sbin/lvreduce -> $(SEC_CRIT) ;
224 #/sbin/lvremove -> $(SEC_CRIT) ;
225 #/sbin/lvrename -> $(SEC_CRIT) ;
226 #/sbin/lvscan -> $(SEC_CRIT) ;
227 /sbin/mkbootdisk -> $(SEC_CRIT) ;
228 /sbin/mkdosfs -> $(SEC_CRIT) ;
229 /sbin/mke2fs -> $(SEC_CRIT) ;
230 /sbin/mkfs -> $(SEC_CRIT) ;
231 /sbin/mkfs.bfs -> $(SEC_CRIT) ;
232 /sbin/mkfs.ext2 -> $(SEC_CRIT) ;
233 /sbin/mkfs.minix -> $(SEC_CRIT) ;
234 /sbin/mkfs.msdos -> $(SEC_CRIT) ;
235 /sbin/mkfs.vfat -> $(SEC_CRIT) ;
236 /sbin/mkinitrd -> $(SEC_CRIT) ;
237 #/sbin/mkpv -> $(SEC_CRIT) ;
238 /sbin/mkraid -> $(SEC_CRIT) ;
239 /sbin/mkreiserfs -> $(SEC_CRIT) ;
240 /sbin/mkswap -> $(SEC_CRIT) ;
241 #/sbin/mtx -> $(SEC_CRIT) ;
242 /sbin/pam_console_apply -> $(SEC_CRIT) ;
243 /sbin/parted -> $(SEC_CRIT) ;
244 /sbin/pcinitrd -> $(SEC_CRIT) ;
245 #/sbin/pvchange -> $(SEC_CRIT) ;
246 #/sbin/pvcreate -> $(SEC_CRIT) ;
247 #/sbin/pvdata -> $(SEC_CRIT) ;
248 #/sbin/pvdisplay -> $(SEC_CRIT) ;
249 #/sbin/pvmove -> $(SEC_CRIT) ;
250 #/sbin/pvscan -> $(SEC_CRIT) ;
251 /sbin/quotacheck -> $(SEC_CRIT) ;
252 /sbin/quotaon -> $(SEC_CRIT) ;
253 /sbin/raidstart -> $(SEC_CRIT) ;
254 /sbin/reiserfsck -> $(SEC_CRIT) ;
255 /sbin/resize2fs -> $(SEC_CRIT) ;
256 /sbin/resize_reiserfs -> $(SEC_CRIT) ;
257 /sbin/restore -> $(SEC_CRIT) ;
258 /sbin/restore.static -> $(SEC_CRIT) ;
259 /sbin/scsi_info -> $(SEC_CRIT) ;
260 /sbin/sfdisk -> $(SEC_CRIT) ;
261 /sbin/stinit -> $(SEC_CRIT) ;
262 #/sbin/tapeinfo -> $(SEC_CRIT) ;
263 /sbin/tune2fs -> $(SEC_CRIT) ;
264 /sbin/unpack -> $(SEC_CRIT) ;
265 /sbin/update -> $(SEC_CRIT) ;
266 #/sbin/vgcfgbackup -> $(SEC_CRIT) ;
267 #/sbin/vgcfgrestore -> $(SEC_CRIT) ;
268 #/sbin/vgchange -> $(SEC_CRIT) ;
269 #/sbin/vgck -> $(SEC_CRIT) ;
270 #/sbin/vgcreate -> $(SEC_CRIT) ;
271 #/sbin/vgdisplay -> $(SEC_CRIT) ;
272 #/sbin/vgexport -> $(SEC_CRIT) ;
273 #/sbin/vgextend -> $(SEC_CRIT) ;
274 #/sbin/vgimport -> $(SEC_CRIT) ;
275 #/sbin/vgmerge -> $(SEC_CRIT) ;
276 #/sbin/vgmknodes -> $(SEC_CRIT) ;
277 #/sbin/vgreduce -> $(SEC_CRIT) ;
278 #/sbin/vgremove -> $(SEC_CRIT) ;
279 #/sbin/vgrename -> $(SEC_CRIT) ;
280 #/sbin/vgscan -> $(SEC_CRIT) ;
281 #/sbin/vgsplit -> $(SEC_CRIT) ;
282 /bin/chgrp -> $(SEC_CRIT) ;
283 /bin/chmod -> $(SEC_CRIT) ;
284 /bin/chown -> $(SEC_CRIT) ;
285 /bin/cp -> $(SEC_CRIT) ;
286 /bin/cpio -> $(SEC_CRIT) ;
287 /bin/mount -> $(SEC_CRIT) ;
288 /bin/umount -> $(SEC_CRIT) ;
289 /bin/mkdir -> $(SEC_CRIT) ;
290 /bin/mknod -> $(SEC_CRIT) ;
291 /bin/mktemp -> $(SEC_CRIT) ;
292 /bin/rm -> $(SEC_CRIT) ;
293 /bin/rmdir -> $(SEC_CRIT) ;
294 /bin/touch -> $(SEC_CRIT) ;
295}
296
297 ##################################
298 # ##
299################################## #
300# # #
301# Kernel Administration Programs # #
302# ##
303##################################
304
305(
306 rulename = "Kernel Administration Programs",
307 severity = $(SIG_HI)
308)
309{
310 /sbin/adjtimex -> $(SEC_CRIT) ;
311 /sbin/ctrlaltdel -> $(SEC_CRIT) ;
312 /sbin/depmod -> $(SEC_CRIT) ;
313 /sbin/insmod -> $(SEC_CRIT) ;
314 /sbin/insmod.static -> $(SEC_CRIT) ;
315 /sbin/insmod_ksymoops_clean -> $(SEC_CRIT) ;
316 /sbin/klogd -> $(SEC_CRIT) ;
317 /sbin/ldconfig -> $(SEC_CRIT) ;
318 /sbin/minilogd -> $(SEC_CRIT) ;
319 /sbin/modinfo -> $(SEC_CRIT) ;
320 #/sbin/nuactlun -> $(SEC_CRIT) ;
321 #/sbin/nuscsitcpd -> $(SEC_CRIT) ;
322 /sbin/pivot_root -> $(SEC_CRIT) ;
323 /sbin/sndconfig -> $(SEC_CRIT) ;
324 /sbin/sysctl -> $(SEC_CRIT) ;
325}
326
327 #######################
328 # ##
329####################### #
330# # #
331# Networking Programs # #
332# ##
333#######################
334
335(
336 rulename = "Networking Programs",
337 severity = $(SIG_HI)
338)
339{
340 /etc/sysconfig/network-scripts/ifdown -> $(SEC_CRIT) ;
341 /etc/sysconfig/network-scripts/ifdown-cipcb -> $(SEC_CRIT) ;
342 /etc/sysconfig/network-scripts/ifdown-ippp -> $(SEC_CRIT) ;
343 /etc/sysconfig/network-scripts/ifdown-ipv6 -> $(SEC_CRIT) ;
344 /etc/sysconfig/network-scripts/ifdown-isdn -> $(SEC_CRIT) ;
345 /etc/sysconfig/network-scripts/ifdown-post -> $(SEC_CRIT) ;
346 /etc/sysconfig/network-scripts/ifdown-ppp -> $(SEC_CRIT) ;
347 /etc/sysconfig/network-scripts/ifdown-sit -> $(SEC_CRIT) ;
348 /etc/sysconfig/network-scripts/ifdown-sl -> $(SEC_CRIT) ;
349 /etc/sysconfig/network-scripts/ifup -> $(SEC_CRIT) ;
350 /etc/sysconfig/network-scripts/ifup-aliases -> $(SEC_CRIT) ;
351 /etc/sysconfig/network-scripts/ifup-cipcb -> $(SEC_CRIT) ;
352 /etc/sysconfig/network-scripts/ifup-ippp -> $(SEC_CRIT) ;
353 /etc/sysconfig/network-scripts/ifup-ipv6 -> $(SEC_CRIT) ;
354 /etc/sysconfig/network-scripts/ifup-isdn -> $(SEC_CRIT) ;
355 /etc/sysconfig/network-scripts/ifup-plip -> $(SEC_CRIT) ;
356 /etc/sysconfig/network-scripts/ifup-plusb -> $(SEC_CRIT) ;
357 /etc/sysconfig/network-scripts/ifup-post -> $(SEC_CRIT) ;
358 /etc/sysconfig/network-scripts/ifup-ppp -> $(SEC_CRIT) ;
359 /etc/sysconfig/network-scripts/ifup-routes -> $(SEC_CRIT) ;
360 /etc/sysconfig/network-scripts/ifup-sit -> $(SEC_CRIT) ;
361 /etc/sysconfig/network-scripts/ifup-sl -> $(SEC_CRIT) ;
362 /etc/sysconfig/network-scripts/ifup-wireless -> $(SEC_CRIT) ;
363 /etc/sysconfig/network-scripts/network-functions -> $(SEC_CRIT) ;
364 /etc/sysconfig/network-scripts/network-functions-ipv6 -> $(SEC_CRIT) ;
365 /bin/ping -> $(SEC_CRIT) ;
366 /sbin/agetty -> $(SEC_CRIT) ;
367 /sbin/arp -> $(SEC_CRIT) ;
368 /sbin/arping -> $(SEC_CRIT) ;
369 /sbin/dhcpcd -> $(SEC_CRIT) ;
370 /sbin/ether-wake -> $(SEC_CRIT) ;
371 #/sbin/getty -> $(SEC_CRIT) ;
372 /sbin/ifcfg -> $(SEC_CRIT) ;
373 /sbin/ifconfig -> $(SEC_CRIT) ;
374 /sbin/ifdown -> $(SEC_CRIT) ;
375 /sbin/ifenslave -> $(SEC_CRIT) ;
376 /sbin/ifport -> $(SEC_CRIT) ;
377 /sbin/ifup -> $(SEC_CRIT) ;
378 /sbin/ifuser -> $(SEC_CRIT) ;
379 /sbin/ip -> $(SEC_CRIT) ;
380 /sbin/ip6tables -> $(SEC_CRIT) ;
381 /sbin/ipchains -> $(SEC_CRIT) ;
382 /sbin/ipchains-restore -> $(SEC_CRIT) ;
383 /sbin/ipchains-save -> $(SEC_CRIT) ;
384 /sbin/ipfwadm -> $(SEC_CRIT) ;
385 /sbin/ipmaddr -> $(SEC_CRIT) ;
386 /sbin/iptables -> $(SEC_CRIT) ;
387 /sbin/iptables-restore -> $(SEC_CRIT) ;
388 /sbin/iptables-save -> $(SEC_CRIT) ;
389 /sbin/iptunnel -> $(SEC_CRIT) ;
390 #/sbin/ipvsadm -> $(SEC_CRIT) ;
391 #/sbin/ipvsadm-restore -> $(SEC_CRIT) ;
392 #/sbin/ipvsadm-save -> $(SEC_CRIT) ;
393 /sbin/ipx_configure -> $(SEC_CRIT) ;
394 /sbin/ipx_interface -> $(SEC_CRIT) ;
395 /sbin/ipx_internal_net -> $(SEC_CRIT) ;
396 /sbin/iwconfig -> $(SEC_CRIT) ;
397 /sbin/iwgetid -> $(SEC_CRIT) ;
398 /sbin/iwlist -> $(SEC_CRIT) ;
399 /sbin/iwpriv -> $(SEC_CRIT) ;
400 /sbin/iwspy -> $(SEC_CRIT) ;
401 /sbin/mgetty -> $(SEC_CRIT) ;
402 /sbin/mingetty -> $(SEC_CRIT) ;
403 /sbin/nameif -> $(SEC_CRIT) ;
404 /sbin/netreport -> $(SEC_CRIT) ;
405 /sbin/plipconfig -> $(SEC_CRIT) ;
406 /sbin/portmap -> $(SEC_CRIT) ;
407 /sbin/ppp-watch -> $(SEC_CRIT) ;
408 #/sbin/rarp -> $(SEC_CRIT) ;
409 /sbin/route -> $(SEC_CRIT) ;
410 /sbin/slattach -> $(SEC_CRIT) ;
411 /sbin/tc -> $(SEC_CRIT) ;
412 #/sbin/uugetty -> $(SEC_CRIT) ;
413 /sbin/vgetty -> $(SEC_CRIT) ;
414 /sbin/ypbind -> $(SEC_CRIT) ;
415}
416
417 ##################################
418 # ##
419################################## #
420# # #
421# System Administration Programs # #
422# ##
423##################################
424
425(
426 rulename = "System Administration Programs",
427 severity = $(SIG_HI)
428)
429{
430 /sbin/chkconfig -> $(SEC_CRIT) ;
431 /sbin/fuser -> $(SEC_CRIT) ;
432 /sbin/halt -> $(SEC_CRIT) ;
433 /sbin/init -> $(SEC_CRIT) ;
434 /sbin/initlog -> $(SEC_CRIT) ;
435 /sbin/install-info -> $(SEC_CRIT) ;
436 /sbin/killall5 -> $(SEC_CRIT) ;
437 #/sbin/linuxconf -> $(SEC_CRIT) ;
438 #/sbin/linuxconf-auth -> $(SEC_CRIT) ;
439 /sbin/pam_tally -> $(SEC_CRIT) ;
440 /sbin/pwdb_chkpwd -> $(SEC_CRIT) ;
441 #/sbin/remadmin -> $(SEC_CRIT) ;
442 /sbin/rescuept -> $(SEC_CRIT) ;
443 /sbin/rmt -> $(SEC_CRIT) ;
444 /sbin/rpc.lockd -> $(SEC_CRIT) ;
445 /sbin/rpc.statd -> $(SEC_CRIT) ;
446 /sbin/rpcdebug -> $(SEC_CRIT) ;
447 /sbin/service -> $(SEC_CRIT) ;
448 /sbin/setsysfont -> $(SEC_CRIT) ;
449 /sbin/shutdown -> $(SEC_CRIT) ;
450 /sbin/sulogin -> $(SEC_CRIT) ;
451 /sbin/swapon -> $(SEC_CRIT) ;
452 /sbin/syslogd -> $(SEC_CRIT) ;
453 /sbin/unix_chkpwd -> $(SEC_CRIT) ;
454 /bin/pwd -> $(SEC_CRIT) ;
455 /bin/uname -> $(SEC_CRIT) ;
456}
457
458 ########################################
459 # ##
460######################################## #
461# # #
462# Hardware and Device Control Programs # #
463# ##
464########################################
465(
466 rulename = "Hardware and Device Control Programs",
467 severity = $(SIG_HI)
468)
469{
470 /bin/setserial -> $(SEC_CRIT) ;
471 /bin/sfxload -> $(SEC_CRIT) ;
472 /sbin/blockdev -> $(SEC_CRIT) ;
473 /sbin/cardctl -> $(SEC_CRIT) ;
474 /sbin/cardmgr -> $(SEC_CRIT) ;
475 /sbin/cbq -> $(SEC_CRIT) ;
476 /sbin/dump_cis -> $(SEC_CRIT) ;
477 /sbin/elvtune -> $(SEC_CRIT) ;
478 /sbin/hotplug -> $(SEC_CRIT) ;
479 /sbin/hwclock -> $(SEC_CRIT) ;
480 /sbin/ide_info -> $(SEC_CRIT) ;
481 #/sbin/isapnp -> $(SEC_CRIT) ;
482 /sbin/kbdrate -> $(SEC_CRIT) ;
483 /sbin/losetup -> $(SEC_CRIT) ;
484 /sbin/lspci -> $(SEC_CRIT) ;
485 /sbin/lspnp -> $(SEC_CRIT) ;
486 /sbin/mii-tool -> $(SEC_CRIT) ;
487 /sbin/pack_cis -> $(SEC_CRIT) ;
488 #/sbin/pnpdump -> $(SEC_CRIT) ;
489 /sbin/probe -> $(SEC_CRIT) ;
490 /sbin/pump -> $(SEC_CRIT) ;
491 /sbin/setpci -> $(SEC_CRIT) ;
492 /sbin/shapecfg -> $(SEC_CRIT) ;
493}
494
495 ###############################
496 # ##
497############################### #
498# # #
499# System Information Programs # #
500# ##
501###############################
502(
503 rulename = "System Information Programs",
504 severity = $(SIG_HI)
505)
506{
507 /sbin/consoletype -> $(SEC_CRIT) ;
508 /sbin/kernelversion -> $(SEC_CRIT) ;
509 /sbin/runlevel -> $(SEC_CRIT) ;
510}
511
512 ####################################
513 # ##
514#################################### #
515# # #
516# Application Information Programs # #
517# ##
518####################################
519
520(
521 rulename = "Application Information Programs",
522 severity = $(SIG_HI)
523)
524{
525 /sbin/genksyms -> $(SEC_CRIT) ;
526 #/sbin/genksyms.old -> $(SEC_CRIT) ;
527 /sbin/rtmon -> $(SEC_CRIT) ;
528}
529
530 ##########################
531 # ##
532########################## #
533# # #
534# Shell Related Programs # #
535# ##
536##########################
537(
538 rulename = "Shell Related Programs",
539 severity = $(SIG_HI)
540)
541{
542 /sbin/getkey -> $(SEC_CRIT) ;
543 /sbin/nash -> $(SEC_CRIT) ;
544 /sbin/sash -> $(SEC_CRIT) ;
545}
546
547
548 ################
549 # ##
550################ #
551# # #
552# OS Utilities # #
553# ##
554################
555(
556 rulename = "Operating System Utilities",
557 severity = $(SIG_HI)
558)
559{
560 /bin/arch -> $(SEC_CRIT) ;
561 /bin/ash -> $(SEC_CRIT) ;
562 /bin/ash.static -> $(SEC_CRIT) ;
563 /bin/aumix-minimal -> $(SEC_CRIT) ;
564 /bin/basename -> $(SEC_CRIT) ;
565 /bin/cat -> $(SEC_CRIT) ;
566 /bin/consolechars -> $(SEC_CRIT) ;
567 /bin/cut -> $(SEC_CRIT) ;
568 /bin/date -> $(SEC_CRIT) ;
569 /bin/dd -> $(SEC_CRIT) ;
570 /bin/df -> $(SEC_CRIT) ;
571 /bin/dmesg -> $(SEC_CRIT) ;
572 /bin/doexec -> $(SEC_CRIT) ;
573 /bin/echo -> $(SEC_CRIT) ;
574 /bin/ed -> $(SEC_CRIT) ;
575 /bin/egrep -> $(SEC_CRIT) ;
576 /bin/false -> $(SEC_CRIT) ;
577 /bin/fgrep -> $(SEC_CRIT) ;
578 /bin/gawk -> $(SEC_CRIT) ;
579 /bin/gawk-3.1.0 -> $(SEC_CRIT) ;
580 /bin/gettext -> $(SEC_CRIT) ;
581 /bin/grep -> $(SEC_CRIT) ;
582 /bin/gunzip -> $(SEC_CRIT) ;
583 /bin/gzip -> $(SEC_CRIT) ;
584 /bin/hostname -> $(SEC_CRIT) ;
585 /bin/igawk -> $(SEC_CRIT) ;
586 /bin/ipcalc -> $(SEC_CRIT) ;
587 /bin/kill -> $(SEC_CRIT) ;
588 /bin/ln -> $(SEC_CRIT) ;
589 /bin/loadkeys -> $(SEC_CRIT) ;
590 /bin/login -> $(SEC_CRIT) ;
591 /bin/ls -> $(SEC_CRIT) ;
592 /bin/mail -> $(SEC_CRIT) ;
593 /bin/more -> $(SEC_CRIT) ;
594 /bin/mt -> $(SEC_CRIT) ;
595 /bin/mv -> $(SEC_CRIT) ;
596 /bin/netstat -> $(SEC_CRIT) ;
597 /bin/nice -> $(SEC_CRIT) ;
598 /bin/pgawk -> $(SEC_CRIT) ;
599 /bin/ps -> $(SEC_CRIT) ;
600 /bin/rpm -> $(SEC_CRIT) ;
601 /bin/sed -> $(SEC_CRIT) ;
602 /bin/sleep -> $(SEC_CRIT) ;
603 /bin/sort -> $(SEC_CRIT) ;
604 /bin/stty -> $(SEC_CRIT) ;
605 /bin/su -> $(SEC_CRIT) ;
606 /bin/sync -> $(SEC_CRIT) ;
607 /bin/tar -> $(SEC_CRIT) ;
608 /bin/true -> $(SEC_CRIT) ;
609 /bin/usleep -> $(SEC_CRIT) ;
610 /bin/vi -> $(SEC_CRIT) ;
611 /bin/zcat -> $(SEC_CRIT) ;
612 /bin/zsh -> $(SEC_CRIT) ;
613 #/bin/zsh-4.0.2 -> $(SEC_CRIT) ;
614 /sbin/sln -> $(SEC_CRIT) ;
615 /usr/bin/vimtutor -> $(SEC_CRIT) ;
616}
617
618 ##############################
619 # ##
620############################## #
621# # #
622# Critical Utility Sym-Links # #
623# ##
624##############################
625(
626 rulename = "Critical Utility Sym-Links",
627 severity = $(SIG_HI)
628)
629{
630 #/sbin/askrunlevel -> $(SEC_CRIT) ;
631 /sbin/clock -> $(SEC_CRIT) ;
632 #/sbin/fixperm -> $(SEC_CRIT) ;
633 /sbin/fsck.reiserfs -> $(SEC_CRIT) ;
634 #/sbin/fsconf -> $(SEC_CRIT) ;
635 /sbin/ipfwadm-wrapper -> $(SEC_CRIT) ;
636 /sbin/kallsyms -> $(SEC_CRIT) ;
637 /sbin/ksyms -> $(SEC_CRIT) ;
638 /sbin/lsmod -> $(SEC_CRIT) ;
639 #/sbin/mailconf -> $(SEC_CRIT) ;
640 /sbin/mkfs.reiserfs -> $(SEC_CRIT) ;
641 #/sbin/modemconf -> $(SEC_CRIT) ;
642 /sbin/modprobe -> $(SEC_CRIT) ;
643 /sbin/mount.ncp -> $(SEC_CRIT) ;
644 /sbin/mount.ncpfs -> $(SEC_CRIT) ;
645 /sbin/mount.smb -> $(SEC_CRIT) ;
646 /sbin/mount.smbfs -> $(SEC_CRIT) ;
647 #/sbin/netconf -> $(SEC_CRIT) ;
648 /sbin/pidof -> $(SEC_CRIT) ;
649 /sbin/poweroff -> $(SEC_CRIT) ;
650 /sbin/quotaoff -> $(SEC_CRIT) ;
651 /sbin/raid0run -> $(SEC_CRIT) ;
652 /sbin/raidhotadd -> $(SEC_CRIT) ;
653 /sbin/raidhotgenerateerror -> $(SEC_CRIT) ;
654 /sbin/raidhotremove -> $(SEC_CRIT) ;
655 /sbin/raidstop -> $(SEC_CRIT) ;
656 /sbin/rdump -> $(SEC_CRIT) ;
657 /sbin/rdump.static -> $(SEC_CRIT) ;
658 /sbin/reboot -> $(SEC_CRIT) ;
659 /sbin/rmmod -> $(SEC_CRIT) ;
660 /sbin/rrestore -> $(SEC_CRIT) ;
661 /sbin/rrestore.static -> $(SEC_CRIT) ;
662 /sbin/swapoff -> $(SEC_CRIT) ;
663 /sbin/telinit -> $(SEC_CRIT) ;
664 #/sbin/userconf -> $(SEC_CRIT) ;
665 #/sbin/uucpconf -> $(SEC_CRIT) ;
666 #/sbin/vregistry -> $(SEC_CRIT) ;
667 /bin/awk -> $(SEC_CRIT) ;
668 /bin/bash2 -> $(SEC_CRIT) ;
669 /bin/bsh -> $(SEC_CRIT) ;
670 /bin/csh -> $(SEC_CRIT) ;
671 /bin/dnsdomainname -> $(SEC_CRIT) ;
672 /bin/domainname -> $(SEC_CRIT) ;
673 /bin/ex -> $(SEC_CRIT) ;
674 /bin/gtar -> $(SEC_CRIT) ;
675 /bin/nisdomainname -> $(SEC_CRIT) ;
676 /bin/red -> $(SEC_CRIT) ;
677 /bin/rvi -> $(SEC_CRIT) ;
678 /bin/rview -> $(SEC_CRIT) ;
679 /bin/view -> $(SEC_CRIT) ;
680 /bin/ypdomainname -> $(SEC_CRIT) ;
681}
682
683
684 #########################
685 # ##
686######################### #
687# # #
688# Temporary directories # #
689# ##
690#########################
691(
692 rulename = "Temporary directories",
693 recurse = false,
694 severity = $(SIG_LOW)
695)
696{
697 /usr/tmp -> $(SEC_INVARIANT) ;
698 /var/tmp -> $(SEC_INVARIANT) ;
699 /tmp -> $(SEC_INVARIANT) ;
700}
701
702 ###############
703 # ##
704############### #
705# # #
706# Local files # #
707# ##
708###############
709(
710 rulename = "User binaries",
711 severity = $(SIG_MED)
712)
713{
714 /sbin -> $(SEC_BIN) (recurse = 1) ;
715 /usr/bin -> $(SEC_BIN) (recurse = 1) ;
716 /usr/sbin -> $(SEC_BIN) (recurse = 1) ;
717 /usr/local/bin -> $(SEC_BIN) (recurse = 1) ;
718}
719
720(
721 rulename = "Shell Binaries",
722 severity = $(SIG_HI)
723)
724{
725 /bin/bash -> $(SEC_BIN) ;
726 /bin/ksh -> $(SEC_BIN) ;
727 # /bin/psh -> $(SEC_BIN) ; # No longer used?
728 # /bin/Rsh -> $(SEC_BIN) ; # No longer used?
729 /bin/sh -> $(SEC_BIN) ;
730 # /bin/shell -> $(SEC_SUID) ; # No longer used?
731 # /bin/tsh -> $(SEC_BIN) ; # No longer used?
732 /bin/tcsh -> $(SEC_BIN) ;
733 /sbin/nologin -> $(SEC_BIN) ;
734}
735
736(
737 rulename = "Security Control",
738 severity = $(SIG_HI)
739)
740{
741 /etc/group -> $(SEC_CRIT) ;
742 /etc/security -> $(SEC_CRIT) ;
743 #/var/spool/cron/crontabs -> $(SEC_CRIT) ; # Uncomment when this file exists
744}
745
746#(
747# rulename = "Boot Scripts",
748# severity = $(SIG_HI)
749#)
750#{
751# /etc/rc -> $(SEC_CONFIG) ;
752# /etc/rc.bsdnet -> $(SEC_CONFIG) ;
753# /etc/rc.dt -> $(SEC_CONFIG) ;
754# /etc/rc.net -> $(SEC_CONFIG) ;
755# /etc/rc.net.serial -> $(SEC_CONFIG) ;
756# /etc/rc.nfs -> $(SEC_CONFIG) ;
757# /etc/rc.powerfail -> $(SEC_CONFIG) ;
758# /etc/rc.tcpip -> $(SEC_CONFIG) ;
759# /etc/trcfmt.Z -> $(SEC_CONFIG) ;
760#}
761
762(
763 rulename = "Login Scripts",
764 severity = $(SIG_HI)
765)
766{
767 /etc/bashrc -> $(SEC_CONFIG) ;
768 /etc/csh.cshrc -> $(SEC_CONFIG) ;
769 /etc/csh.login -> $(SEC_CONFIG) ;
770 /etc/inputrc -> $(SEC_CONFIG) ;
771 # /etc/tsh_profile -> $(SEC_CONFIG) ; #Uncomment when this file exists
772 /etc/profile -> $(SEC_CONFIG) ;
773}
774
775# Libraries
776(
777 rulename = "Libraries",
778 severity = $(SIG_MED)
779)
780{
781 /usr/lib -> $(SEC_BIN) ;
782 /usr/local/lib -> $(SEC_BIN) ;
783}
784
785
786 ######################################################
787 # ##
788###################################################### #
789# # #
790# Critical System Boot Files # #
791# These files are critical to a correct system boot. # #
792# ##
793######################################################
794
795(
796 rulename = "Critical system boot files",
797 severity = $(SIG_HI)
798)
799{
800 /boot -> $(SEC_CRIT) ;
801 #/sbin/devfsd -> $(SEC_CRIT) ;
802 /sbin/grub -> $(SEC_CRIT) ;
803 /sbin/grub-install -> $(SEC_CRIT) ;
804 /sbin/grub-md5-crypt -> $(SEC_CRIT) ;
805 /sbin/installkernel -> $(SEC_CRIT) ;
806 /sbin/lilo -> $(SEC_CRIT) ;
807 /sbin/mkkerneldoth -> $(SEC_CRIT) ;
808 !/boot/System.map ;
809 !/boot/module-info ;
810 /usr/share/grub/i386-redhat/e2fs_stage1_5 -> $(SEC_CRIT) ;
811 /usr/share/grub/i386-redhat/fat_stage1_5 -> $(SEC_CRIT) ;
812 /usr/share/grub/i386-redhat/ffs_stage1_5 -> $(SEC_CRIT) ;
813 /usr/share/grub/i386-redhat/minix_stage1_5 -> $(SEC_CRIT) ;
814 /usr/share/grub/i386-redhat/reiserfs_stage1_5 -> $(SEC_CRIT) ;
815 /usr/share/grub/i386-redhat/stage1 -> $(SEC_CRIT) ;
816 /usr/share/grub/i386-redhat/stage2 -> $(SEC_CRIT) ;
817 /usr/share/grub/i386-redhat/vstafs_stage1_5 -> $(SEC_CRIT) ;
818 # other boot files may exist. Look for:
819 #/ufsboot -> $(SEC_CRIT) ;
820}
821 ##################################################
822 ###################################################
823 # These files change every time the system boots ##
824 ##################################################
825(
826 rulename = "System boot changes",
827 severity = $(SIG_HI)
828)
829{
830 !/var/run/ftp.pids-all ; # Comes and goes on reboot.
831 !/root/.enlightenment ;
832 /dev/log -> $(SEC_CONFIG) ;
833 /dev/cua0 -> $(SEC_CONFIG) ;
834 # /dev/printer -> $(SEC_CONFIG) ; # Uncomment if you have a printer device
835 /dev/console -> $(SEC_CONFIG) -u ; # User ID may change on console login/logout.
836 /dev/tty1 -> $(SEC_CONFIG) ; # tty devices
837 /dev/tty2 -> $(SEC_CONFIG) ; # tty devices
838 /dev/tty3 -> $(SEC_CONFIG) ; # are extremely
839 /dev/tty4 -> $(SEC_CONFIG) ; # variable
840 /dev/tty5 -> $(SEC_CONFIG) ;
841 /dev/tty6 -> $(SEC_CONFIG) ;
842 /dev/urandom -> $(SEC_CONFIG) ;
843 /dev/initctl -> $(SEC_CONFIG) ;
844 /var/lock/subsys -> $(SEC_CONFIG) ;
845 #/var/lock/subsys/amd -> $(SEC_CONFIG) ;
846 /var/lock/subsys/anacron -> $(SEC_CONFIG) ;
847 /var/lock/subsys/apmd -> $(SEC_CONFIG) ;
848 #/var/lock/subsys/arpwatch -> $(SEC_CONFIG) ;
849 /var/lock/subsys/atd -> $(SEC_CONFIG) ;
850 /var/lock/subsys/autofs -> $(SEC_CONFIG) ;
851 #/var/lock/subsys/bcm5820 -> $(SEC_CONFIG) ;
852 #/var/lock/subsys/bgpd -> $(SEC_CONFIG) ;
853 #/var/lock/subsys/bootparamd -> $(SEC_CONFIG) ;
854 #/var/lock/subsys/canna -> $(SEC_CONFIG) ;
855 /var/lock/subsys/crond -> $(SEC_CONFIG) ;
856 #/var/lock/subsys/cWnn -> $(SEC_CONFIG) ;
857 #/var/lock/subsys/dhcpd -> $(SEC_CONFIG) ;
858 #/var/lock/subsys/firewall -> $(SEC_CONFIG) ;
859 #/var/lock/subsys/freeWnn -> $(SEC_CONFIG) ;
860 #/var/lock/subsys/gated -> $(SEC_CONFIG) ;
861 /var/lock/subsys/gpm -> $(SEC_CONFIG) ;
862 #/var/lock/subsys/httpd -> $(SEC_CONFIG) ;
863 #/var/lock/subsys/identd -> $(SEC_CONFIG) ;
864 #/var/lock/subsys/innd -> $(SEC_CONFIG) ;
865 /var/lock/subsys/ipchains -> $(SEC_CONFIG) ;
866 #/var/lock/subsys/iptables -> $(SEC_CONFIG) ;
867 #/var/lock/subsys/ipvsadm -> $(SEC_CONFIG) ;
868 #/var/lock/subsys/irda -> $(SEC_CONFIG) ;
869 #/var/lock/subsys/iscsi -> $(SEC_CONFIG) ;
870 #/var/lock/subsys/isdn -> $(SEC_CONFIG) ;
871 #/var/lock/subsys/junkbuster -> $(SEC_CONFIG) ;
872 #/var/lock/subsys/kadmin -> $(SEC_CONFIG) ;
873 /var/lock/subsys/keytable -> $(SEC_CONFIG) ;
874 #/var/lock/subsys/kprop -> $(SEC_CONFIG) ;
875 #/var/lock/subsys/krb524 -> $(SEC_CONFIG) ;
876 #/var/lock/subsys/krb5kdc -> $(SEC_CONFIG) ;
877 /var/lock/subsys/kudzu -> $(SEC_CONFIG) ;
878 #/var/lock/subsys/kWnn -> $(SEC_CONFIG) ;
879 #/var/lock/subsys/ldap -> $(SEC_CONFIG) ;
880 #/var/lock/subsys/linuxconf -> $(SEC_CONFIG) ;
881 #/var/lock/subsys/lpd -> $(SEC_CONFIG) ;
882 #/var/lock/subsys/mars_nwe -> $(SEC_CONFIG) ;
883 #/var/lock/subsys/mcserv -> $(SEC_CONFIG) ;
884 #/var/lock/subsys/mysqld -> $(SEC_CONFIG) ;
885 #/var/lock/subsys/named -> $(SEC_CONFIG) ;
886 /var/lock/subsys/netfs -> $(SEC_CONFIG) ;
887 /var/lock/subsys/network -> $(SEC_CONFIG) ;
888 #/var/lock/subsys/nfs -> $(SEC_CONFIG) ;
889 /var/lock/subsys/nfslock -> $(SEC_CONFIG) ;
890 #/var/lock/subsys/nscd -> $(SEC_CONFIG) ;
891 #/var/lock/subsys/ntpd -> $(SEC_CONFIG) ;
892 #/var/lock/subsys/ospf6d -> $(SEC_CONFIG) ;
893 #/var/lock/subsys/ospfd -> $(SEC_CONFIG) ;
894 /var/lock/subsys/pcmcia -> $(SEC_CONFIG) ;
895 /var/lock/subsys/portmap -> $(SEC_CONFIG) ;
896 #/var/lock/subsys/postgresql -> $(SEC_CONFIG) ;
897 #/var/lock/subsys/pxe -> $(SEC_CONFIG) ;
898 #/var/lock/subsys/radvd -> $(SEC_CONFIG) ;
899 /var/lock/subsys/random -> $(SEC_CONFIG) ;
900 #/var/lock/subsys/rarpd -> $(SEC_CONFIG) ;
901 /var/lock/subsys/reconfig -> $(SEC_CONFIG) ;
902 /var/lock/subsys/rhnsd -> $(SEC_CONFIG) ;
903 #/var/lock/subsys/ripd -> $(SEC_CONFIG) ;
904 #/var/lock/subsys/ripngd -> $(SEC_CONFIG) ;
905 #/var/lock/subsys/routed -> $(SEC_CONFIG) ;
906 #/var/lock/subsys/rstatd -> $(SEC_CONFIG) ;
907 #/var/lock/subsys/rusersd -> $(SEC_CONFIG) ;
908 #/var/lock/subsys/rwalld -> $(SEC_CONFIG) ;
909 #/var/lock/subsys/rwhod -> $(SEC_CONFIG) ;
910 /var/lock/subsys/sendmail -> $(SEC_CONFIG) ;
911 #/var/lock/subsys/smb -> $(SEC_CONFIG) ;
912 #/var/lock/subsys/snmpd -> $(SEC_CONFIG) ;
913 #/var/lock/subsys/squid -> $(SEC_CONFIG) ;
914 /var/lock/subsys/sshd -> $(SEC_CONFIG) ;
915 /var/lock/subsys/syslog -> $(SEC_CONFIG) ;
916 #/var/lock/subsys/tux -> $(SEC_CONFIG) ;
917 #/var/lock/subsys/tWnn -> $(SEC_CONFIG) ;
918 #/var/lock/subsys/ups -> $(SEC_CONFIG) ;
919 #/var/lock/subsys/vncserver -> $(SEC_CONFIG) ;
920 #/var/lock/subsys/wine -> $(SEC_CONFIG) ;
921 /var/lock/subsys/xfs -> $(SEC_CONFIG) ;
922 /var/lock/subsys/xinetd -> $(SEC_CONFIG) ;
923 /var/lock/subsys/ypbind -> $(SEC_CONFIG) ;
924 #/var/lock/subsys/yppasswdd -> $(SEC_CONFIG) ;
925 #/var/lock/subsys/ypserv -> $(SEC_CONFIG) ;
926 #/var/lock/subsys/ypxfrd -> $(SEC_CONFIG) ;
927 #/var/lock/subsys/zebra -> $(SEC_CONFIG) ;
928 /var/run -> $(SEC_CONFIG) ;
929 /var/log -> $(SEC_CONFIG) ;
930 /etc/ioctl.save -> $(SEC_CONFIG) ;
931 /etc/issue.net -> $(SEC_CONFIG) -i ; # Inode number changes
932 /etc/issue -> $(SEC_CONFIG) ;
933 /etc/mtab -> $(SEC_CONFIG) -i ; # Inode number changes on any mount/unmount
934 /lib/modules -> $(SEC_CONFIG) ;
935 /etc/.pwd.lock -> $(SEC_CONFIG) ;
936 # /lib/modules/preferred -> $(SEC_CONFIG) ; #Uncomment when this file exists
937}
938
939# These files change the behavior of the root account
940(
941 rulename = "Root config files",
942 severity = 100
943)
944{
945 /root -> $(SEC_CRIT) ; # Catch all additions to /root
946 #/root/.Xresources -> $(SEC_CONFIG) ;
947 /root/.bashrc -> $(SEC_CONFIG) ;
948 /root/.bash_profile -> $(SEC_CONFIG) ;
949 /root/.bash_logout -> $(SEC_CONFIG) ;
950 /root/.cshrc -> $(SEC_CONFIG) ;
951 /root/.tcshrc -> $(SEC_CONFIG) ;
952 /root/Mail -> $(SEC_CONFIG) ;
953 #/root/mail -> $(SEC_CONFIG) ;
954 #/root/.amandahosts -> $(SEC_CONFIG) ;
955 #/root/.addressbook.lu -> $(SEC_CONFIG) ;
956 #/root/.addressbook -> $(SEC_CONFIG) ;
957 /root/.bash_history -> $(SEC_CONFIG) ;
958 /root/.elm -> $(SEC_CONFIG) ;
959 #/root/.esd_auth -> $(SEC_CONFIG) ;
960 /root/.gnome_private -> $(SEC_CONFIG) ;
961 /root/.gnome-desktop -> $(SEC_CONFIG) ;
962 /root/.gnome -> $(SEC_CONFIG) ;
963 /root/.ICEauthority -> $(SEC_CONFIG) ;
964 #/root/.mc -> $(SEC_CONFIG) ;
965 #/root/.pinerc -> $(SEC_CONFIG) ;
966 /root/.sawfish -> $(SEC_CONFIG) ;
967 /root/.Xauthority -> $(SEC_CONFIG) -i ; # Changes Inode number on login
968 #/root/.xauth -> $(SEC_CONFIG) ;
969 /root/.xsession-errors -> $(SEC_CONFIG) ;
970}
971
972 ################################
973 # ##
974################################ #
975# # #
976# Critical configuration files # #
977# ##
978################################
979(
980 rulename = "Critical configuration files",
981 severity = $(SIG_HI)
982)
983{
984 #/etc/conf.linuxconf -> $(SEC_BIN) ;
985 /etc/crontab -> $(SEC_BIN) ;
986 /etc/cron.hourly -> $(SEC_BIN) ;
987 /etc/cron.daily -> $(SEC_BIN) ;
988 /etc/cron.weekly -> $(SEC_BIN) ;
989 /etc/cron.monthly -> $(SEC_BIN) ;
990 /etc/default -> $(SEC_BIN) ;
991 /etc/fstab -> $(SEC_BIN) ;
992 /etc/exports -> $(SEC_BIN) ;
993 /etc/group- -> $(SEC_BIN) ; # changes should be infrequent
994 /etc/host.conf -> $(SEC_BIN) ;
995 /etc/hosts.allow -> $(SEC_BIN) ;
996 /etc/hosts.deny -> $(SEC_BIN) ;
997 /etc/httpd/conf -> $(SEC_BIN) ; # changes should be infrequent
998 /etc/protocols -> $(SEC_BIN) ;
999 /etc/services -> $(SEC_BIN) ;
1000 /etc/rc.d/init.d -> $(SEC_BIN) ;
1001 /etc/rc.d -> $(SEC_BIN) ;
1002 /etc/mail.rc -> $(SEC_BIN) ;
1003 /etc/modules.conf -> $(SEC_BIN) ;
1004 /etc/motd -> $(SEC_BIN) ;
1005 /etc/named.conf -> $(SEC_BIN) ;
1006 /etc/passwd -> $(SEC_CONFIG) ;
1007 /etc/passwd- -> $(SEC_CONFIG) ;
1008 /etc/profile.d -> $(SEC_BIN) ;
1009 /var/lib/nfs/rmtab -> $(SEC_BIN) ;
1010 /usr/sbin/fixrmtab -> $(SEC_BIN) ;
1011 /etc/rpc -> $(SEC_BIN) ;
1012 /etc/sysconfig -> $(SEC_BIN) ;
1013 /etc/samba/smb.conf -> $(SEC_CONFIG) ;
1014 #/etc/gettydefs -> $(SEC_BIN) ;
1015 /etc/nsswitch.conf -> $(SEC_BIN) ;
1016 /etc/yp.conf -> $(SEC_BIN) ;
1017 /etc/hosts -> $(SEC_CONFIG) ;
1018 /etc/xinetd.conf -> $(SEC_CONFIG) ;
1019 /etc/inittab -> $(SEC_CONFIG) ;
1020 /etc/resolv.conf -> $(SEC_CONFIG) ;
1021 /etc/syslog.conf -> $(SEC_CONFIG) ;
1022}
1023
1024 ####################
1025 # ##
1026#################### #
1027# # #
1028# Critical devices # #
1029# ##
1030####################
1031(
1032 rulename = "Critical devices",
1033 severity = $(SIG_HI),
1034 recurse = false
1035)
1036{
1037 /dev/kmem -> $(Device) ;
1038 /dev/mem -> $(Device) ;
1039 /dev/null -> $(Device) ;
1040 /dev/zero -> $(Device) ;
1041 /proc/devices -> $(Device) ;
1042 /proc/net -> $(Device) ;
1043 /proc/sys -> $(Device) ;
1044 /proc/cpuinfo -> $(Device) ;
1045 /proc/modules -> $(Device) ;
1046 /proc/mounts -> $(Device) ;
1047 /proc/dma -> $(Device) ;
1048 /proc/filesystems -> $(Device) ;
1049 /proc/pci -> $(Device) ;
1050 /proc/interrupts -> $(Device) ;
1051 /proc/driver/rtc -> $(Device) ;
1052 /proc/ioports -> $(Device) ;
1053 #/proc/scsi -> $(Device) ;
1054 /proc/kcore -> $(Device) ;
1055 /proc/self -> $(Device) ;
1056 /proc/kmsg -> $(Device) ;
1057 /proc/stat -> $(Device) ;
1058 /proc/ksyms -> $(Device) ;
1059 /proc/loadavg -> $(Device) ;
1060 /proc/uptime -> $(Device) ;
1061 /proc/locks -> $(Device) ;
1062 /proc/version -> $(Device) ;
1063 /proc/mdstat -> $(Device) ;
1064 /proc/meminfo -> $(Device) ;
1065 /proc/cmdline -> $(Device) ;
1066 /proc/misc -> $(Device) ;
1067}
1068
1069# Rest of critical system binaries
1070(
1071 rulename = "OS executables and libraries",
1072 severity = $(SIG_HI)
1073)
1074{
1075 /bin -> $(SEC_BIN) ;
1076 /lib -> $(SEC_BIN) ;
1077}
1078
1079#=============================================================================
1080#
1081# Copyright 2000 Tripwire, Inc. Tripwire is a registered trademark of Tripwire,
1082# Inc. in the United States and other countries. All rights reserved.
1083#
1084# Linux is a registered trademark of Linus Torvalds.
1085#
1086# UNIX is a registered trademark of The Open Group.
1087#
1088#=============================================================================
1089#
1090# Permission is granted to make and distribute verbatim copies of this document
1091# provided the copyright notice and this permission notice are preserved on all
1092# copies.
1093#
1094# Permission is granted to copy and distribute modified versions of this
1095# document under the conditions for verbatim copying, provided that the entire
1096# resulting derived work is distributed under the terms of a permission notice
1097# identical to this one.
1098#
1099# Permission is granted to copy and distribute translations of this document
1100# into another language, under the above conditions for modified versions,
1101# except that this permission notice may be stated in a translation approved by
1102# Tripwire, Inc.
1103#
1104# DCM
1105#
1106# $Id: twpol-GENERIC.txt,v 1.1 2003/06/08 02:00:06 pherman Exp $
1107#
diff --git a/recipes-ids/tripwire/tripwire_2.4.3.7.bb b/recipes-ids/tripwire/tripwire_2.4.3.7.bb
new file mode 100644
index 0000000..c26392a
--- /dev/null
+++ b/recipes-ids/tripwire/tripwire_2.4.3.7.bb
@@ -0,0 +1,74 @@
1SUMMARY = "Tripwire: A system integrity assessment tool (IDS)"
2DESCRIPTION = "Open Source Tripwire® software is a security and data \
3integrity tool useful for monitoring and alerting on specific file change(s) on a range of systems"
4HOMEPAGE="http://sourceforge.net/projects/tripwire"
5SECTION = "security Monitor/Admin"
6LICENSE = "GPLv2"
7LIC_FILES_CHKSUM = "file://COPYING;md5=1c069be8dbbe48e89b580ab4ed86c127"
8
9SRCREV = "6e64a9e5b70a909ec439bc5a099e3fcf38c614b0"
10
11SRC_URI = "\
12 git://github.com/Tripwire/tripwire-open-source.git \
13 file://tripwire.cron \
14 file://tripwire.sh \
15 file://tripwire.txt \
16 file://twcfg.txt \
17 file://twinstall.sh \
18 file://twpol-yocto.txt \
19 file://run-ptest \
20 "
21
22S = "${WORKDIR}/git"
23
24inherit autotools-brokensep update-rc.d ptest
25
26INITSCRIPT_NAME = "tripwire"
27INITSCRIPT_PARAMS = "start 40 S ."
28TRIPWIRE_HOST = "${HOST_SYS}"
29TRIPWIRE_TARGET = "${TARGET_SYS}"
30
31CXXFLAGS += "-fno-strict-aliasing"
32EXTRA_OECONF = "--disable-openssl --enable-static --sysconfdir=/etc/tripwire"
33
34do_install () {
35 install -d ${D}${libdir} ${D}${datadir} ${D}${base_libdir}
36 install -d ${D}${sysconfdir} ${D}${mandir} ${D}${sbindir}
37 install -d ${D}${sysconfdir}/${PN}
38 install -d ${D}${localstatedir}/lib/${PN} ${D}${localstatedir}/lib/${BPN}/report
39 install -d ${D}${mandir}/man4 ${D}${mandir}/man5 ${D}${mandir}/man8
40 install -d ${D}${docdir}/${BPN} ${D}${docdir}/${BPN}/templates
41 install -d ${D}${sysconfdir}/init.d
42
43 install -m 0755 ${S}/bin/* ${D}${sbindir}
44 install -m 0644 ${S}/lib/* ${D}${base_libdir}
45 install -m 0644 ${S}/lib/* ${D}${localstatedir}/lib/${PN}
46 install -m 0755 ${WORKDIR}/tripwire.cron ${D}${sysconfdir}
47 install -m 0755 ${WORKDIR}/tripwire.sh ${D}${sysconfdir}/init.d/tripwire
48 install -m 0755 ${WORKDIR}/twinstall.sh ${D}${sysconfdir}/${PN}
49 install -m 0644 ${WORKDIR}/twpol-yocto.txt ${D}${sysconfdir}/${PN}/twpol.txt
50 install -m 0644 ${WORKDIR}/twcfg.txt ${D}${sysconfdir}/${PN}
51
52 install -m 0644 ${S}/man/man4/* ${D}${mandir}/man4
53 install -m 0644 ${S}/man/man5/* ${D}${mandir}/man5
54 install -m 0644 ${S}/man/man8/* ${D}${mandir}/man8
55 install -m 0644 ${S}/policy/templates/* ${D}${docdir}/${BPN}/templates
56 install -m 0644 ${S}/policy/*txt ${D}${docdir}/${BPN}
57 install -m 0644 ${S}/COPYING ${D}${docdir}/${BPN}
58 install -m 0644 ${S}/TRADEMARK ${D}${docdir}/${BPN}
59 install -m 0644 ${WORKDIR}/tripwire.txt ${D}${docdir}/${BPN}
60}
61
62do_install_ptest_append () {
63 install -d ${D}${PTEST_PATH}/tests
64 cp -a ${S}/src/test-harness/* ${D}${PTEST_PATH}
65 sed -i -e 's@../../../../bin@${sbindir}@' ${D}${PTEST_PATH}/twtools.pm
66}
67
68FILES_${PN} += "${libdir} ${docdir}/${PN}/*"
69FILES_${PN}-dbg += "${sysconfdir}/${PN}/.debug"
70FILES_${PN}-staticdev += "${localstatedir}/lib/${PN}/lib*.a"
71FILES_${PN}-ptest += "${PTEST_PATH}/tests "
72
73RDEPENDS_${PN} += " perl nano msmtp cronie"
74RDEPENDS_${PN}-ptest = " perl lib-perl perl-modules "
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-07-04 04:26:51 +0000