summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGuillermo Gomez S. (Gomix) <guillermo.gomez@gmail.com>2010-01-05 15:55:04 -0430
committerGuillermo Gomez S. (Gomix) <guillermo.gomez@gmail.com>2010-01-05 15:55:04 -0430
commit13305ca7e5a64cb1c968469068ebdb3fbc1f5483 (patch)
tree10687797094633eb59aba2340de916208dc7e2cd
parente082c59435b22cc8c56369b44204290f48a174da (diff)
downloadfwsnort-13305ca7e5a64cb1c968469068ebdb3fbc1f5483.tar.gz
fwsnort-13305ca7e5a64cb1c968469068ebdb3fbc1f5483.tar.xz
fwsnort-13305ca7e5a64cb1c968469068ebdb3fbc1f5483.zip
Versionado basado en las versiones fwsnort & release de Fedora
-rw-r--r--1.0.6-1/fc12/fwsnort-1.0.6-1.fc12.src.rpmbin0 -> 547397 bytes
-rw-r--r--1.0.6-1/fc12/fwsnort.spec108
2 files changed, 108 insertions, 0 deletions
diff --git a/1.0.6-1/fc12/fwsnort-1.0.6-1.fc12.src.rpm b/1.0.6-1/fc12/fwsnort-1.0.6-1.fc12.src.rpm
new file mode 100644
index 0000000..2f240e4
--- /dev/null
+++ b/1.0.6-1/fc12/fwsnort-1.0.6-1.fc12.src.rpm
Binary files differ
diff --git a/1.0.6-1/fc12/fwsnort.spec b/1.0.6-1/fc12/fwsnort.spec
new file mode 100644
index 0000000..df0f002
--- /dev/null
+++ b/1.0.6-1/fc12/fwsnort.spec
@@ -0,0 +1,108 @@
+%define name fwsnort
+%define version 1.0.6
+%define release 1
+%define fwsnortlogdir /var/log/fwsnort
+
+### get the first @INC directory that includes the string "linux".
+### This may be 'i386-linux', or 'i686-linux-thread-multi', etc.
+%define fwsnortmoddir `perl -e '$path='i386-linux'; for (@INC) { if($_ =~ m|.*/(.*linux.*)|) {$path = $1; last; }} print $path'`
+
+Summary: Translates Snort rules into equivalent iptables rules
+Name: %name
+Version: %version
+Release: %release%{?dist}
+License: GPLv2
+Group: System Environment/Daemons
+Url: http://www.cipherdyne.org/fwsnort/
+Source0: http://www.cipherdyne.org/fwsnort/download/%name-%version.tar.gz
+Source1: logrotate.fwsnort
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+BuildArch: noarch
+Requires: iptables,perl-Net-IPv4Addr, perl-IPTables-Parse, perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
+
+%description
+fwsnort translates Snort rules into equivalent iptables rules and generates
+a Bourne shell script that implements the resulting iptables commands. This
+ruleset allows network traffic that exhibits Snort signatures to be logged
+and/or dropped by iptables directly without putting any interface into
+promiscuous mode or queuing packets from kernel to user space. In addition,
+fwsnort (optionally) uses the IPTables::Parse module to parse the iptables
+ruleset on the machine to determine which Snort rules are applicable to the
+specific iptables policy. After all, if iptables is blocking all inbound
+http traffic from external addresses, it is probably not of much use to try
+detecting inbound attacks against against tcp/80. By default fwsnort
+generates iptables rules that log Snort sid's with --log-prefix to klogd
+where the messages can be analyzed with a log watcher such as logwatch or
+psad (see http://www.cipherdyne.org/psad). fwsnort relies on the iptables
+string match module to match Snort content fields in the application portion
+of ip traffic. Since Snort rules can contain hex data in content fields,
+fwsnort implements a patch against iptables-1.2.7a which adds a
+"--hex-string" option which will accept content fields such as
+"|0d0a5b52504c5d3030320d0a|". fwsnort is able to translate approximately 60%
+of all rules from the Snort-2.3.3 IDS into equivalent iptables rules. For
+more information about the translation strategy as well as
+advantages/disadvantages of the method used by fwsnort to obtain intrusion
+detection data, see the README included with the fwsnort sources or browse
+to: http://www.cipherdyne.org/fwsnort/
+
+%prep
+
+%setup -q
+cp -p %SOURCE1 .
+
+%build
+
+%install
+rm -rf $RPM_BUILD_ROOT
+### log directory
+mkdir -p $RPM_BUILD_ROOT%fwsnortlogdir
+
+### fwsnort config
+mkdir -p $RPM_BUILD_ROOT%_sysconfdir/%name
+
+mkdir -p $RPM_BUILD_ROOT%_bindir
+mkdir -p $RPM_BUILD_ROOT%{_mandir}/man8
+mkdir -p $RPM_BUILD_ROOT%_sbindir
+
+install -m 755 fwsnort $RPM_BUILD_ROOT%_sbindir/
+install -m 644 fwsnort.conf $RPM_BUILD_ROOT%_sysconfdir/%name/
+install -m 644 fwsnort.8 $RPM_BUILD_ROOT%{_mandir}/man8/
+
+### install snort rules files
+cp -r deps/snort_rules $RPM_BUILD_ROOT%_sysconfdir/%name
+
+mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d
+install -p -m 644 logrotate.fwsnort $RPM_BUILD_ROOT/etc/logrotate.d/fwsnort
+
+%clean
+[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
+
+%pre
+### not used
+
+%post
+### not used
+
+%preun
+### not used
+
+%files
+%defattr(-,root,root)
+%dir %fwsnortlogdir
+%_sbindir/*
+%{_mandir}/man8/*
+
+%dir %_sysconfdir/%name
+%config(noreplace) %_sysconfdir/%name/fwsnort.conf
+
+%dir %_sysconfdir/logrotate.d
+%config(noreplace) %_sysconfdir/logrotate.d/fwsnort
+
+%dir %_sysconfdir/%name/snort_rules
+%config(noreplace) %_sysconfdir/%name/snort_rules/*
+
+%changelog
+* Sat Jan 2 2010 Guillermo Gómez <ggomez@neotechgw.com> - 1.0.6-1
+- First Fedora spec compliant version, several modifications
+- No deps included
+- Free snort rules included