| 1 | # -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4 |
|---|
| 2 | # $Id$ |
|---|
| 3 | |
|---|
| 4 | PortSystem 1.0 |
|---|
| 5 | |
|---|
| 6 | name oinkmaster |
|---|
| 7 | version 2.0 |
|---|
| 8 | categories-append security net |
|---|
| 9 | platforms darwin |
|---|
| 10 | |
|---|
| 11 | maintainers yahoo.fr:jul_bsd openmaintainer |
|---|
| 12 | |
|---|
| 13 | license BSD |
|---|
| 14 | |
|---|
| 15 | description help you keep your Snort signatures current |
|---|
| 16 | long_description ${description} |
|---|
| 17 | |
|---|
| 18 | homepage http://oinkmaster.sourceforge.net/ |
|---|
| 19 | |
|---|
| 20 | master_sites sourceforge |
|---|
| 21 | |
|---|
| 22 | checksums md5 d2a1b56f51cf40e919c63206ca4ec8f8 \ |
|---|
| 23 | rmd160 a3292cfc2e6b175008a7172be5809ca6e2fc85b7 \ |
|---|
| 24 | sha256 3d52f0426aa7c81b122cef22b80d708d8bb8337537e48754a065804f46c46162 |
|---|
| 25 | |
|---|
| 26 | depends_run port:perl5.16 port:snort |
|---|
| 27 | |
|---|
| 28 | use_configure no |
|---|
| 29 | build {} |
|---|
| 30 | |
|---|
| 31 | post-configure { |
|---|
| 32 | addgroup oinkmaster |
|---|
| 33 | add_users oinkmaster gid=[existsgroup oinkmaster] home=/var/empty shell=/sbin/nologin realname=oinkmaster\ user |
|---|
| 34 | } |
|---|
| 35 | |
|---|
| 36 | ### trying to do without install.sh: OK |
|---|
| 37 | destroot { |
|---|
| 38 | xinstall -m 755 ${worksrcpath}/oinkmaster.pl ${destroot}${prefix}/bin/ |
|---|
| 39 | ## FIXME! "Error: reinplace: sed: RE error: illegal byte sequence" |
|---|
| 40 | #reinplace "s|/usr/bin/perl -w|${prefix}/bin/perl5.16 -w|g" ${destroot}${prefix}/bin/oinkmaster.pl |
|---|
| 41 | |
|---|
| 42 | xinstall -d ${destroot}${prefix}/share/examples/${name} |
|---|
| 43 | xinstall ${worksrcpath}/oinkmaster.conf ${destroot}${prefix}/share/examples/${name}/ |
|---|
| 44 | reinplace "s|path = /bin:/usr/bin:/usr/local/bin|path = /bin:/usr/bin:/usr/local/bin:${prefix}/bin|g" \ |
|---|
| 45 | ${destroot}${prefix}/share/examples/${name}/oinkmaster.conf |
|---|
| 46 | xinstall -d -m 755 ${destroot}${prefix}/share/examples/${name}/contrib |
|---|
| 47 | xinstall ${worksrcpath}/contrib/README.contrib ${destroot}${prefix}/share/examples/${name}/contrib/ |
|---|
| 48 | foreach f { addmsg.pl addsid.pl create-sidmap.pl makesidex.pl oinkgui.pl } { |
|---|
| 49 | xinstall -m 755 ${worksrcpath}/contrib/${f} ${destroot}${prefix}/share/examples/${name}/contrib/ |
|---|
| 50 | } |
|---|
| 51 | xinstall -d ${destroot}${prefix}/share/doc/${name} |
|---|
| 52 | copy ${worksrcpath}/README ${destroot}${prefix}/share/doc/${name}/ |
|---|
| 53 | copy ${worksrcpath}/FAQ ${destroot}${prefix}/share/doc/${name}/ |
|---|
| 54 | xinstall -d ${destroot}${prefix}/share/man/man1 |
|---|
| 55 | xinstall ${worksrcpath}/oinkmaster.1 ${destroot}${prefix}/share/man/man1/ |
|---|
| 56 | |
|---|
| 57 | xinstall -d ${destroot}${prefix}/libexec/${name} |
|---|
| 58 | xinstall -m 0755 ${filespath}/oinkmaster-run.sh ${destroot}${prefix}/libexec/${name}/ |
|---|
| 59 | reinplace "s|%%PREFIX%%|${prefix}|g" ${destroot}${prefix}/libexec/${name}/oinkmaster-run.sh |
|---|
| 60 | xinstall -d ${destroot}${prefix}/Library/LaunchDaemons/ |
|---|
| 61 | copy ${filespath}/org.macports.oinkmaster.plist ${destroot}${prefix}/Library/LaunchDaemons/ |
|---|
| 62 | reinplace "s|%%PREFIX%%|${prefix}|g" ${destroot}${prefix}/Library/LaunchDaemons/org.macports.oinkmaster.plist |
|---|
| 63 | |
|---|
| 64 | xinstall -d -u oinkmaster ${destroot}${prefix}/var/log/${name} |
|---|
| 65 | destroot.keepdirs ${destroot}${prefix}/var/log/${name} |
|---|
| 66 | } |
|---|
| 67 | |
|---|
| 68 | post-activate { |
|---|
| 69 | if ![file exists ${prefix}/etc/oinkmaster.conf ] { |
|---|
| 70 | copy ${prefix}/share/examples/${name}/oinkmaster.conf ${prefix}/etc/ |
|---|
| 71 | } |
|---|
| 72 | } |
|---|
| 73 | |
|---|
| 74 | notes " |
|---|
| 75 | *** To finish oinkmaster install *** |
|---|
| 76 | |
|---|
| 77 | 1) If not existing, a default config has been copied in |
|---|
| 78 | ${prefix}/etc/oinkmaster.conf |
|---|
| 79 | Edit and adapt to your setup |
|---|
| 80 | You need to register on snort to get latest rules |
|---|
| 81 | http://www.snort.org/snort-rules/ |
|---|
| 82 | and get the corresponding oinkcode to report in oinkmaster.conf |
|---|
| 83 | |
|---|
| 84 | Some free sets: |
|---|
| 85 | url = http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz |
|---|
| 86 | url = http://www.bleedingsnort.com/downloads/bleeding.rules.tar.gz |
|---|
| 87 | and also: |
|---|
| 88 | http://rules.emergingthreats.net/blockrules/emerging-rbn.rules |
|---|
| 89 | http://mtc.sri.com/live_data/signatures/ |
|---|
| 90 | |
|---|
| 91 | 2) A user oinkmaster has been created to run the script. In order to modify snort rules |
|---|
| 92 | # chown -R oinkmaster ${prefix}/etc/snort/rules |
|---|
| 93 | # install -d -o oinkmaster -m 755 ${prefix}/etc/snort/backup |
|---|
| 94 | If you are using the joined oinkmaster-run.sh script, you also need those |
|---|
| 95 | # install -d -o oinkmaster -m 755 ${prefix}/etc/snort/community |
|---|
| 96 | # install -d -o oinkmaster -m 755 ${prefix}/etc/snort/backup.community |
|---|
| 97 | # install -d -o oinkmaster -m 755 ${prefix}/etc/snort/ET |
|---|
| 98 | # install -d -o oinkmaster -m 755 ${prefix}/etc/snort/backup.ET |
|---|
| 99 | |
|---|
| 100 | 3) Test script |
|---|
| 101 | $ sudo -u oinkmaster ${prefix}/bin/oinkmaster.pl -o ${prefix}/etc/snort/rules -C ${prefix}/etc/oinkmaster.conf |
|---|
| 102 | |
|---|
| 103 | 4) Scheduled task: a default file has been created as |
|---|
| 104 | ${prefix}/libexec/${name}/oinkmaster-run.sh |
|---|
| 105 | ${prefix}/Library/LaunchDaemons/org.macports.${name}.plist |
|---|
| 106 | Check if it fit you and start it like |
|---|
| 107 | # ln -s ${prefix}/Library/LaunchDaemons/org.macports.${name}.plist /Library/LaunchDaemons/ |
|---|
| 108 | # launchctl load -w /Library/LaunchDaemons/org.macports.${name}.plist |
|---|
| 109 | |
|---|
| 110 | The provided task is using rules from oinkmaster.conf (most probably VRT registered) |
|---|
| 111 | and additional free community rules and emergingthreats. |
|---|
| 112 | |
|---|
| 113 | " |
|---|
| 114 | |
|---|
| 115 | livecheck.type regex |
|---|
| 116 | livecheck.url ${homepage}/download.shtml |
|---|
| 117 | livecheck.regex "<b>Latest release is (\\d+(?:\\.\\d+)*)</b>" |
|---|
| 118 | |
|---|
