Ticket #42533: Portfile

File Portfile, 15.2 KB (added by jul_bsd@…, 9 years ago)

2.8.1

Line 
1# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4
2# $Id$
3
4PortSystem          1.0
5
6PortGroup           github 1.0 
7
8github.setup        ossec ossec-hids 2.8.1
9categories          security
10platforms           darwin
11maintainers         yahoo.fr:jul_bsd openmaintainer
12license             GPL
13description         host-based intrusion detection system
14long_description    OSSEC is an Open Source Host-based Intrusion \
15                    Detection System that performs log analysis, \
16                    file integrity checking, policy monitoring, \
17                    rootkit detection, real-time alerting and \
18                    active response.
19homepage            http://www.ossec.net/
20
21worksrcdir          ${distname}/src
22conflicts           ${name}29
23
24checksums           rmd160  55a552339f1fc28178c76e7e5b6d18b27cbb76ba \
25                    sha256  ebc8a7bfc612ce8916e4f0d7730a3e7c29cbf15016539ff4b5f699522705b8cd
26
27## extra ?
28## https://raw.github.com/xme/alerts2afterglow/master/alerts2afterglow.pl
29
30depends_build-append port:openssl
31
32use_configure       no
33
34## https://groups.google.com/forum/#!topic/ossec-list/ZcF2SQAuNOE
35## http://dcid.me/texts/my-ossec-setup-manual.html
36
37### trying to build w homemade script install.sh: NOK
38##      need root from start
39##      merge all phase in one
40## http://ossec-docs.readthedocs.org/en/latest/manual/installation/install-source-unattended.html
41#build.asroot        yes
42#build.env-append    INSTALLDIR=${destroot}${prefix} USER_INSTALL_TYPE=local \
43#                    USER_ENABLE_ROOTCHECK=yes USER_language=en TERM=vt220 \
44#             USER_EMAIL_ADDRESS=root@localhost \
45#                    USER_NO_STOP="y"
46## OR
47#        reinplace "s|^#USER_NO_STOP=\"y\"|USER_NO_STOP=\"y\"|;s|^#USER_INSTALL_TYPE=\"agent\"|USER_INSTALL_TYPE=\"agent\"|;s|^#USER_DIR=\"/var/ossec\"|USER_DIR=\"${prefix}/var/ossec\"|;s|^#USER_ENABLE_ACTIVE_RESPONSE=\"y\"|USER_ENABLE_ACTIVE_RESPONSE=\"y\"|;s|^#USER_ENABLE_SYSCHECK=\"y\"|USER_ENABLE_SYSCHECK=\"y\"|;s|^#USER_ENABLE_ROOTCHECK=\"y\"|USER_ENABLE_ROOTCHECK=\"y\"|;" ${worksrcdir}/etc/preloaded-vars.conf
48#build.cmd           ./install.sh
49#build.target
50build.args          CC=${configure.cc}
51
52## Normally, only server install need those 3 users, Agent only need ossec but if doing that,
53## need to split post-destroot by subport
54add_users ossec group=ossec home=${prefix}/var/ossec shell=/sbin/nologin realname=ossec\ user
55## FIXME! it seems add_users is not handling multiple user, just doing the last call
56#add_users ossecm group=ossec home=${prefix}/var/ossec shell=/sbin/nologin realname=ossecm\ user
57#add_users ossecr group=ossec home=${prefix}/var/ossec shell=/sbin/nologin realname=ossecr\ user
58post-configure {
59    if {![variant_isset agent]} {
60        adduser ossecm gid=[existsgroup ossec] home=${prefix}/var/ossec shell=/sbin/nologin
61        adduser ossecr gid=[existsgroup ossec] home=${prefix}/var/ossec shell=/sbin/nologin
62    }
63}
64
65
66### trying to do without install.sh: OK
67patchfiles          patch-ossec-src-Config.os.diff
68patch.pre_args      -p1
69post-patch {
70    reinplace "s|/opt/local|${prefix}|g" ${worksrcpath}/Config.OS
71    reinplace "s|/var/ossec|${prefix}/var/ossec|g" ${worksrcpath}/LOCATION
72    reinplace "s|CC=gcc|CC=${configure.cc}|g" ${worksrcpath}/LOCATION
73    reinplace "s|CC=cc|CC=${configure.cc}|g" ${worksrcpath}/external/lua-5.2.3/src/Makefile
74    reinplace "s|OSSEC_INIT=\"/etc/ossec-init.conf\"|OSSEC_INIT=\"${prefix}/etc/ossec-init.conf\"|g" \
75        ${worksrcpath}/init/shared.sh
76    reinplace "s| \${CPATH} | -I\${CPATH} |g" ${worksrcpath}/Config.Make
77    if {[variant_isset agent]} {
78        #reinplace "s|CEXTRA=\(.*\) -DLOCAL|CEXTRA=\1 -DCLIENT|g" ${worksrcpath}/Config.OS
79        reinplace "s|-DLOCAL|-DCLIENT|g" ${worksrcpath}/Config.OS
80    } elseif {[variant_isset debug]} {
81        reinplace "s|CEXTRA=\(.*\)$|CEXTRA=\1 -DDEBUGAD|g" ${worksrcpath}/Config.OS
82    } elseif {![variant_isset local]} {
83        ## FIXME! (both) Error: org.macports.patch for port ossec returned: invalid command name " "
84        reinplace "s|CEXTRA=\(.*\) -DLOCAL|CEXTRA=\1|g" ${worksrcpath}/Config.OS
85        #reinplace "s|-DLOCAL||g" ${worksrcpath}/Config.OS
86    }
87    if {[variant_isset universal]} {
88        ## FIXME! Error: org.macports.patch for port ossec returned: invalid command name " "
89        #reinplace "s|EEXTRA=-DDarwin -DHIGHFIRST|EEXTRA=-DDarwin -DHIGHFIRST [get_canonical_archflags cc]|g" ${worksrcpath}/Config.OS
90        reinplace "s|-DOSSECHIDS|-DOSSECHIDS [get_canonical_archflags cc]|g" ${worksrcpath}/Config.Make
91    }
92}
93build.env-append           CPATH=""
94
95## Note: destroot will always failed if not as root, ok w root+privilege descalation
96##    also patch phase, strangely, fails as common user but works w sudo...
97destroot.asroot     yes
98install.asroot     yes
99
100pre-destroot {
101    reinplace "s|${prefix}|${destroot}${prefix}|g" \
102        ${worksrcpath}/LOCATION
103}
104
105post-destroot {
106    xinstall -d ${destroot}${prefix}/share/examples/${name}
107    reinplace "s|>/var/ossec|>${prefix}/var/ossec|g" \
108        ${destroot}${prefix}/var/ossec/etc/ossec.conf
109    move ${destroot}${prefix}/var/ossec/etc/ossec.conf ${destroot}${prefix}/share/examples/${name}
110    copy ${filespath}/ossec-client.conf ${destroot}${prefix}/share/examples/${name}/
111
112    copy ${filespath}/ossec.conf ${destroot}${prefix}/share/examples/${name}/ossec-mac.conf
113    copy ${filespath}/decoder_local_mac.xml ${destroot}${prefix}/share/examples/${name}/
114    copy ${filespath}/local_rules_mac.xml ${destroot}${prefix}/share/examples/${name}/
115    reinplace "s|/opt/local/|${prefix}/|g" \
116        ${destroot}${prefix}/share/examples/${name}/ossec-mac.conf \
117        ${destroot}${prefix}/share/examples/${name}/decoder_local_mac.xml \
118        ${destroot}${prefix}/share/examples/${name}/local_rules_mac.xml
119
120    xinstall -d -o ossec -m 755 ${destroot}${prefix}/var/ossec/var
121    xinstall -d -o ossec -m 755 ${destroot}${prefix}/var/ossec/queue
122    xinstall -d -o ossec -m 755 ${destroot}${prefix}/var/ossec/logs
123    if {[variant_isset agent]} {
124        delete ${destroot}${prefix}/var/ossec/logs/ossec.log
125    }
126    foreach d { /var/start-script-lock /queue/fts /queue/ossec \
127        /queue/agentless /queue/alerts /queue/diff /queue/rootcheck \
128        /queue/syscheck /stats /logs/archives /logs/alerts \
129        /logs/firewall } {
130        xinstall -d -o ossec -g ossec -m 755 ${destroot}${prefix}/var/ossec${d}
131        destroot.keepdirs-append ${destroot}${prefix}/var/ossec${d}
132    }
133    foreach d { /queue/agent-info /queue/rids } {
134        if {![variant_isset agent]} {
135            xinstall -d -o ossecr -g ossec -m 755 ${destroot}${prefix}/var/ossec${d}
136        } else {
137            xinstall -d -o ossec -g ossec -m 755 ${destroot}${prefix}/var/ossec${d}
138        }
139        destroot.keepdirs-append ${destroot}${prefix}/var/ossec${d}
140    }
141    if {![variant_isset agent]} {
142        xinstall -d -o ossec -g ossec -m 755 ${destroot}${prefix}/var/ossec/var/start-script-lock
143        destroot.keepdirs-append \
144            ${destroot}${prefix}/var/ossec/var/start-script-lock
145    }
146    ## this directory need to be write-able for ossec & ossecm users
147    xinstall -d -o ossec -g ossec -m 775 ${destroot}${prefix}/var/ossec/var/run
148    destroot.keepdirs-append ${destroot}${prefix}/var/ossec/var/run \
149        ${destroot}${prefix}/var/ossec/logs
150    ## solving chrooting serpent biting itself ...
151    xinstall -d ${destroot}${prefix}/var/ossec/${prefix}/var/
152    ln -s / ${destroot}${prefix}/var/ossec/${prefix}/var/ossec
153
154}
155
156post-activate {
157    if { ![file exists ${prefix}/var/ossec/etc/ossec.conf ] && ![variant_isset agent]} {
158        copy ${prefix}/share/examples/ossec/ossec-mac.conf ${prefix}/var/ossec/etc/ossec.conf
159    } elseif { ![file exists ${prefix}/var/ossec/etc/ossec.conf ] && [variant_isset agent]} {
160        copy ${prefix}/share/examples/ossec/ossec-client.conf ${prefix}/var/ossec/etc/ossec.conf
161    }
162    if ![file exists ${prefix}/var/ossec/etc/decoder_local_mac.xml ] {
163        copy ${prefix}/share/examples/ossec/decoder_local_mac.xml ${prefix}/var/ossec/etc/
164    }
165    if ![file exists ${prefix}/var/ossec/rules/local_rules_mac.xml ] {
166        copy ${prefix}/share/examples/ossec/local_rules_mac.xml ${prefix}/var/ossec/rules/
167    }
168    if {[variant_isset agent]} {
169        touch ${prefix}/var/ossec/logs/ossec.log
170        ## FIXME! on activate: "Error: org.macports.activate for port ossec returned: Unknown user given"
171        #chown ossec:ossec ${prefix}/var/ossec/logs/ossec.log
172        ## no chmod command
173        #chmod 664 ${prefix}/var/ossec/logs/ossec.log
174    }
175}
176
177## FIXME! universal
178##    fatal error: lipo: can't figure out the architecture type of: /Volumes/Data/opt/local/var/macports/build/_Volumes_Data_myports_security_ossec/ossec/work/.tmp/ccIo0aMB.out (sometimes?)
179variant universal {}
180#configure.cflags-append    "${configure.cflags} [get_canonical_archflags cc]"
181## This replace existing CFLAGS so no good = go for post-patch
182#build.args          CFLAGS+="${configure.cflags} [get_canonical_archflags cc]"
183
184## FIXME! error: /opt/local/bin/ranlib: file: cdb_make.a is not an archive (sometimes...)
185
186notes "
187
188    You have to customize yourself '${prefix}/var/ossec/etc/ossec.conf' to adjust configuration to your setup (local, server, agent; email, agent server ip) before launching ossec. Default one is local. If there is an existing config, it is preserved.
189    All ossec commands need to be launched as root.
190    Launchd script are included. You can start ossec either with 'port load ${name}' or launchctl.
191    No manpage are include, see online: http://www.ossec.net/doc/
192
193You may need to enable permanently postfix so ossec-maild can send email:
194  Edit /System/Library/LaunchDaemons/org.postfix.master.plist
195  Remove the two strings lines with '-e' '60'.
196  Add a '<key>KeepAlive</key><true/>'
197
198If you need to debug ossec, adjust configuration in
199    ${prefix}/var/ossec/etc/internal_options.conf
200AND
201    # ${prefix}/var/ossec/bin/ossec-control enable debug
202AND
203    restart ossec
204
205Note: Apple syslog files can be multi-line which is not handled out of the box by OSSEC:
206http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.localfile.html#id1
207http://johnlee48.wordpress.com/2012/08/23/ossec-setup-for-custom-logs-with-multi-line-entries-ala-tomoyo-linux-logs/
208"
209
210
211## Note: this is just a script to control the multiple daemons of ossec which exit after
212##    => launchd "Throttling respawn: Will start in 10 seconds"
213##    any way to say it's normal or need to create a startup item per daemon?
214startupitem.create      yes
215startupitem.logfile     ${prefix}/var/ossec/logs/ossec-launchd.log
216#startupitem.netchange   yes
217#startupitem.executable  ${prefix}/bin/ossec-control
218startupitem.start       "${prefix}/var/ossec/bin/ossec-control start"
219startupitem.stop        "${prefix}/var/ossec/bin/ossec-control stop"
220startupitem.restart     "${prefix}/var/ossec/bin/ossec-control restart"
221
222default_variants    +geoip
223
224## FIXME! can't manage to review defaults_variant so removing +local but if giving no variant what to do
225if {![variant_isset server] && ![variant_isset agent] && ![variant_isset hybrid]} {
226    default_variants +local
227}
228
229## Note: calling one of the 3 next variant superseded +local
230variant server description { install ossec server } conflicts hybrid local {
231    destroot.cmd   ./InstallServer.sh
232    default_variants-delete    +local
233}
234
235variant hybrid description { install ossec in hybrid mode } {
236
237    ## FIXME! hybrid is a local install w few others things to do/from install.pl
238    ##     use ossec-local.sh instead of ossec-server.sh as ossec-control
239    destroot.cmd   ./InstallServer.sh
240    destroot.args  local
241    default_variants-delete    +local
242}
243
244variant local description { install ossec in stand-alone mode } conflicts server hybrid agent {
245    ## include in patchfiles
246    #configure.env-append CEXTRA="$CEXTRA -DLOCAL"
247
248    destroot.cmd   ./InstallServer.sh
249    destroot.args  local
250}
251
252variant picviz description { picviz support } {
253    ## seems just a config option ?
254    depends_run    port:libpicviz
255}
256
257variant geoip description { geoip support } {
258    depends_build-append       port:libgeoip
259    notes-append "
260
261
262===>     To finish installation of geoip, you need to download following files,
263    gunzip them and copy them to ${prefix}/var/ossec/etc:
264        http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
265        http://geolite.maxmind.com/download/geoip/database/GeoLiteCityv6-beta/GeoLiteCityv6.dat.gz
266"
267}
268
269variant debug description { enable debug support } {
270    ## in post-patch
271    #configure.env-append CEXTRA="$CEXTRA -DDEBUGAD"
272}
273
274## Note: destroot will fail as common user, ok as root
275
276if {${subport} eq ${name}} {
277   
278    livecheck.type      regex
279    livecheck.url       ${homepage}?page_id=19
280    livecheck.regex     "Server\/Agent (\\d+(?:\\.\\d+)*) – Linux\/BSD"
281
282}
283
284variant agent description { install ossec in agent mode } conflicts server hybrid local {
285    ## from patchfiles + post-patch
286    #configure.env-append CEXTRA="$CEXTRA -DCLIENT"
287
288    ## FIXME! This is not executed!!! if subport, ok if variant
289    destroot.cmd   ./InstallAgent.sh
290    #default_variants-delete    +local
291    #default_variants    -local
292
293    ## "ERROR: Queue '/opt/local/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'." = bad configure/not in agent mode
294    ## Error (ossec-logtest) "clang: error: no such file or directory: 'alerts/alerts.a'" = seems to be a temporary error, re-execute usually solves it
295    ## Error have server manage_agents on agent install: CEXTRA was not adapted to variant
296
297notes-append "
298
299====>   For Agent to work, you have to follow procedure described here
300    http://ossec-docs.readthedocs.org/en/latest/manual/agent/agent-management.html
301        At least, review server IP address in ${prefix}/var/ossec/etc/ossec.conf
302
303        Basically
304    1) Add the agent on server with 'manage_agents'
305    2) Extract the corresponding key
306    3) Add the key on agent client either with client '${prefix}/var/ossec/bin/manage_agents' which will
307         create ${prefix}/var/ossec/etc/client.keys
308
309        Or if you deploy many agents:
310    server# openssl genrsa -out ${prefix}/var/ossec/etc/sslmanager.key 2048
311    server# openssl req -new -x509 -key ${prefix}/var/ossec/etc/sslmanager.key -out ${prefix}/var/ossec/etc/sslmanager.cert -days 365
312        During client deployements, execute the following commands
313    server# ${prefix}/var/ossec/bin/ossec-authd -p 1515
314    client# ${prefix}/var/ossec/bin/agent-auth -m serverIP -p 1515
315        And restart both client and server
316
317        In case of communication problem, review
318    http://ossec-docs.readthedocs.org/en/latest/faq/unexpected.html#the-communication-between-my-agent-and-the-server-is-not-working-what-to-do
319    server# /var/ossec/bin/manage_agents
320"
321
322}
323
324subport ${name}29 {
325    ## what about variants? duplicate or outside
326
327    github.setup        ossec ossec-hids 2.9.0-beta03
328    checksums           rmd160  b993cee0568e506b218445bafadb8698fb404d70 \
329                        sha256  ae4a1718fbdedab14331aa1fe7b630f7088645615444258fc74545069d692fa7
330
331    conflicts           ${name}
332    livecheck.type      none
333
334}
335
336#subport ${name}-devel {
337#    ## what about variants? duplicate or outside
338#
339#    version     20150327
340#    distname    5558a677d4d0670747ba36d10ea77f5168198b1a
341#
342#    conflicts ${name} ${name}-agent
343#    livecheck.type      none
344#
345#}
346