Summary: packet-sniffer/logger Name: snort Version: 1.7 Release: 0vl2 License: GPL Group: Applications/Internet Url: http://www.snort.org Source0: http://www.snort.org/Files/%{name}-%{version}.tar.gz Source1: snort-stat Source2: snortlog Source4: snortd Source5: snort.conf Source6: snortrules.tar.gz Source7: README-snort.EUC Requires: libpcap >= 0.4 BuildRequires: libpcap >= 0.4 Buildroot: %{_tmppath}/%{name}-%{version}-root %description Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. Snort has a real-time alerting capabilty, with alerts being sent to syslog, a seperate "alert" file, or as a WinPopup message via Samba's smbclient %description -l ja SnortとはIDSと呼ばれるソフトウェアで、侵入検知システムと言われます。 ホストに何らかの悪さをしてくる行為を検出して知らせてくれるソフトです。 いろいろな攻撃と調査（例えばバッファオーバフロー、 ステルス・ポート・スキャン、CGI攻撃、SMB調査、OS指紋鑑定試み、 その他たくさん）を見つけるために使うことができる。 %prep %setup -q cp -p %{SOURCE5} %{SOURCE7} . %build CFLAGS="$RPM_OPT_FLAGS" \ %configure --bindir=/usr/sbin --sysconfdir=/etc/snort --enable-smbalerts make %install rm -rf %{buildroot} mkdir -p %{buildroot}/usr/{bin,sbin} mkdir -p %{buildroot}/etc/snort mkdir -p %{buildroot}/etc/rc.d/init.d mkdir -p %{buildroot}/var/log/snort/archive %makeinstall \ prefix=%{buildroot}/usr \ bindir=%{buildroot}/usr/sbin \ sysconfdir=%{buildroot}/etc/snort install %{SOURCE1} %{buildroot}/usr/bin install %{SOURCE2} %{buildroot}/usr/bin install %{SOURCE4} %{buildroot}/etc/rc.d/init.d tar zxvf %{SOURCE6} -C %{buildroot}/etc/snort cat - << EOF >> %{buildroot}/etc/snort/snort.conf #################################################################### # Customize your rule set # # Up to date snort rules are available at the following web sites: # http://www.snort.org # http://www.whitehats.com # # The snort web site has documentation about how to # write your own custom snort rules. # # The rules included with this distribution generate alerts based on # on suspicious activity. Depending on your network environment, your # security policies, and what you consider to be suspicious, some of # these rules may either generate false positives ore may be detecting # activity you consider to be acceptable; therefore, you are # encouraged to comment out rules that are not applicable in your # environment. # # Note that using all of the rules at the same time may lead to # serious packet loss on slower machines. YMMV, use with caution, # standard disclaimers apply. :) # # The following individuals contributed many of rules in this # distribution. # # Credits: # Max Vision - www.whitehats.com # Ron Gula of Network Security Wizards # Martin Markgraf # CyberPsychotic # Nick Rogness # Jim Forster # Scott McIntyre # Tom Vandepoel # Brian Caswell # #=============================================== # Include all relevant rulesets here # by default virus, policy and info are disabled #=============================================== # Be sure you have created a local.rules file # for your includes/ignores, etc. #=============================================== #include /etc/snort/local.rules include /etc/snort/exploit.rules include /etc/snort/scan.rules include /etc/snort/finger.rules include /etc/snort/ftp.rules include /etc/snort/telnet.rules include /etc/snort/smtp.rules include /etc/snort/rpc.rules include /etc/snort/rservices.rules include /etc/snort/backdoor.rules include /etc/snort/dos.rules include /etc/snort/ddos.rules include /etc/snort/dns.rules include /etc/snort/netbios.rules include /etc/snort/sql.rules include /etc/snort/web-cgi.rules include /etc/snort/web-coldfusion.rules include /etc/snort/web-frontpage.rules include /etc/snort/web-misc.rules include /etc/snort/web-iis.rules include /etc/snort/icmp.rules include /etc/snort/misc.rules #include /etc/snort/policy.rules #include /etc/snort/info.rules #include /etc/snort/virus.rules # Ruleset, available (updated hourly) from: # # http://dev.whitehats.com/ids/vision.rules # include /etc/snort/vision.rules # # snort.conf with more options is located in /usr/doc/snort-1.7/snort.conf EOF %clean rm -rf %{buildroot} %post #don't do all this stuff if we are upgrading if [ "$1" = 1 ] ; then useradd -M -r -d /var/log/snort -s /bin/false -c "Snort" snort 2> /dev/null || : groupadd -r snort 2> /dev/null || : /sbin/chkconfig --add snortd fi #this only works on redhat ;/ perl -e 'open(f,"/etc/sysconfig/network-scripts/ifcfg-eth0"); while(){if (/IPADDR=(.*)/) {$internal=$1;}};close(f); open(f,"/etc/resolv.conf"); while(){if (/nameserver(.*)/) {$dns=$1;$dns=~s/[ ]+//g; $dns.="/32,"; push(@dns,$dns);}} close(f); $dns[$#dns]=~s/,$//g; open(f,">/etc/snort/snort.conf"); print f "var HOME_NET $internal/32\nvar EXTERNAL_NET any\nvar SMTP \$HOME_NET\nvar HTTP_SERVERS \$HOME_NET\nvar SQL_SERVERS \$HOME_NET\nvar DNS_SERVERS "; print f "["; foreach (@dns) {print f "$_";} print f "]"; print f "\n\npreprocessor defrag\npreprocessor http_decode: 80 8080\npreprocessor portscan: \$HOME_NET 4 3 /var/log/snort/portscan.log\npreprocessor portscan-ignorehosts: \$DNS_SERVERS\n\n"; close(f);' #add the rest of the stuff chown snort.snort /var/log/snort %if 0 echo -e " Be sure to fetch the latest snort rules file from the ArachNIDS database by Max Vision, or the one available from the snort.org web site. The snortlog and snort-stat perl scripts can be used to generate statistics from the snort syslog entries. Snort is currently configured to listen only on eth0, and uses the default rulesets. If this is not correct for your system, edit /etc/rc.d/init.d/snortd and /etc/snort/snort.conf A \"snort\" user and group have been created for snort to run as instead of running as root. You will likely need to create the /var/log/snort directory, and change ownership to the \"snort\" account. Built by: Dave Wreski dave@linuxsecurity.com and Wim Vandersmissen " %endif %preun /etc/rc.d/init.d/snortd stop if [ $1 = 0 ] ; then /sbin/chkconfig --del snortd fi exit 0 %postun #only if we are removing, not upgrading.. if [ $1 = 0 ] ; then userdel snort 2> /dev/null || : groupdel snort 2> /dev/null || : fi %files %defattr(-,root,root) %doc AUTHORS BUGS COPYING CREDITS ChangeLog INSTALL NEWS README* USAGE %doc snort.conf README-snort.EUC %attr(755,root,root) /usr/sbin/* %attr(755,root,root) /usr/bin/* %attr(750,root,wheel) %dir /var/log/snort %attr(750,root,wheel) %dir /var/log/snort/archive %attr(640,root,wheel) %config /etc/snort/*rules %attr(640,root,root) %config /etc/snort/snort.conf %attr(755,root,root) %config /etc/rc.d/init.d/snortd %changelog * Thu Sep 06 2001 Toru Sagami - 1.7-0vl2: was ported to VineSeedPlus with many spec fixes * Mon Apr 09 2001 net_hal - first buile for Vine2.1 - original ver 1.7 + 2001/03/28 Rules