3 %bcond_without pgsql # build without PostgreSQL storage support
4 %bcond_without mysql # build without MySQL storage support
5 %bcond_without snmp # build without SNMP support
7 Summary: Network intrusion detection system
8 Summary(pl): System wykrywania intruzów w sieciach
9 Summary(pt_BR): Ferramenta de detecção de intrusos
10 Summary(ru): Snort - ÓÉÓÔÅÍÁ ÏÂÎÁÒÕÖÅÎÉÑ ÐÏÐÙÔÏË ×ÔÏÒÖÅÎÉÑ × ÓÅÔØ
11 Summary(uk): Snort - ÓÉÓÔÅÍÁ ×ÉÑ×ÌÅÎÎÑ ÓÐÒÏ ×ÔÏÒÇÎÅÎÎÑ × ÍÅÒÅÖÕ
16 Vendor: Marty Roesch <roesch@sourcefire.com>
18 Source0: http://www.snort.org/dl/%{name}-%{version}.tar.gz
19 # Source0-md5: f01ae080f1571fd3e8d282dcae51f528
20 Source1: http://www.snort.org/dl/rules/snortrules-snapshot-2_1.tar.gz
21 # Source1-md5: 28b8011f49298ed5adf9d8e10253f5e9
23 Source3: %{name}.logrotate
25 Patch0: %{name}-libnet1.patch
26 Patch1: %{name}-lib64.patch
27 URL: http://www.snort.org/
28 BuildRequires: autoconf
29 BuildRequires: automake
30 BuildRequires: libnet1-devel = 1.0.2a
31 BuildRequires: libpcap-devel
32 %{?with_mysql:BuildRequires: mysql-devel}
33 %{?with_snmp:BuildRequires: net-snmp-devel >= 5.0.7}
34 BuildRequires: openssl-devel >= 0.9.7d
35 %{?with_pgsql:BuildRequires: postgresql-devel}
36 BuildRequires: pcre-devel
37 BuildRequires: zlib-devel
38 PreReq: rc-scripts >= 0.2.0
39 Requires(pre): /usr/bin/getgid
40 Requires(pre): /bin/id
41 Requires(pre): /usr/sbin/groupadd
42 Requires(pre): /usr/sbin/useradd
43 Requires(post,preun): /sbin/chkconfig
44 Requires(postun): /usr/sbin/userdel
45 Requires(postun): /usr/sbin/groupdel
46 Requires: libnet1 = 1.0.2a
47 %{?with_mysql:Provides: snort(mysql) = %{version}}
48 %{?with_pgsql:Provides: snort(pgsql) = %{version}}
49 BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
51 %define _sysconfdir /etc/snort
52 %define _bindir %{_sbindir}
55 Snort is an open source network intrusion detection system, capable of
56 performing real-time traffic analysis and packet logging on IP
57 networks. It can perform protocol analysis and content
58 searching/matching in order to detect a variety of attacks and probes,
59 such as buffer overflows, stealth port scans, CGI attacks, SMB probes,
60 OS fingerprinting attempts, and much more. Snort uses a flexible rules
61 language to describe traffic that it should collect or pass, as well
62 as a detection engine that utilizes a modular plugin architecture.
63 Snort has a real- time alerting capability as well, incorporating
64 alerting mechanisms for syslog, user specified files, a UNIX socket,
65 or WinPopup messages to Windows clients using Samba's smbclient.
68 Snort to bazuj±cy na open source NIDS (network intrusion detection
69 systems) wykonuj±cy w czasie rzeczywistym analizê ruchu oraz logowanie
70 pakietów w sieciach IP. Jego mo¿liwo¶ci to analiza protoko³u oraz
71 zawarto¶ci w poszukiwaniu ró¿nego rodzaju ataków lub prób takich jak
72 przepe³nienia bufora, skanowanie portów typu stealth, ataki CGI,
73 próbkowanie SMB, OS fingerprinting i du¿o wiêcej. Snort u¿ywa
74 elastycznego jêzyka regu³ek do opisu ruchu, który nale¿y
75 przeanalizowaæ jak równie¿ silnika wykrywaj±cego, wykorzystuj±cego
76 modu³ow± architekturê. Snort umo¿liwia alarmowanie w czasie
77 rzeczywistym poprzez sysloga, osobny plik lub jako wiadomo¶æ WinPopup
78 poprzez klienta Samby: smbclient.
81 Snort é um sniffer baseado em libpcap que pode ser usado como um
82 pequeno sistema de detecção de intrusos. Tem como característica o
83 registro de pacotes baseado em regras e também pode executar uma
84 análise do protocolo, pesquisa de padrões e detectar uma variedade de
85 assinaturas de ataques, como estouros de buffer, varreduras "stealth"
86 de portas, ataques CGI, pesquisas SMB, tentativas de descobrir o
87 sistema operacional e muito mais. Possui um sistema de alerta em tempo
88 real, com alertas enviados para o syslog, um arquivo de alertas em
89 separado ou como uma mensagem Winpopup.
92 Snort - ÜÔÏ ÓÎÉÆÆÅÒ ÐÁËÅÔÏ×, ËÏÔÏÒÙÊ ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ËÁË ÓÉÓÔÅÍÁ
93 ÏÂÎÁÒÕÖÅÎÉÑ ÐÏÐÙÔÏË ×ÔÏÒÖÅÎÉÑ × ÓÅÔØ. Snort ÐÏÄÄÅÒÖÉ×ÁÅÔ
94 ÐÒÏÔÏËÏÌÉÒÏ×ÁÎÉÅ ÐÁËÅÔÏ× ÎÁ ÏÓÎÏ×Å ÐÒÁ×ÉÌ, ÍÏÖÅÔ ×ÙÐÏÌÎÑÔØ ÁÎÁÌÉÚ
95 ÐÒÏÔÏËÏÌÏ×, ÐÏÉÓË × ÓÏÄÅÒÖÉÍÏÍ ÐÁËÅÔÏ×. íÏÖÅÔ ÔÁËÖÅ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÄÌÑ
96 ÏÂÎÁÒÕÖÅÎÉÑ ÁÔÁË É "ÒÁÚ×ÅÄÏË", ÔÁËÉÈ ËÁË ÐÏÐÙÔËÉ ÁÔÁË ÔÉÐÁ
97 "ÐÅÒÅÐÏÌÎÅÎÉÅ ÂÕÆÅÒÁ", ÓËÒÙÔÏÇÏ ÓËÁÎÉÒÏ×ÁÎÉÑ ÐÏÒÔÏ×, CGI ÁÔÁË, SMB
98 ÒÁÚ×ÅÄÏË, ÐÏÐÙÔÏË ÏÂÎÁÒÕÖÅÎÉÑ ÔÉÐÁ ïó É ÍÎÏÇÏ ÄÒÕÇÏÇÏ. Snort ÍÏÖÅÔ
99 ÉÎÆÏÒÍÉÒÏ×ÁÔØ Ï ÓÏÂÙÔÉÑÈ × ÒÅÁÌØÎÏÍ ×ÒÅÍÅÎÉ, ÐÏÓÙÌÁÑ ÓÏÏÂÝÅÎÉÑ ×
100 syslog, ÏÔÄÅÌØÎÙÊ ÆÁÊÌ ÉÌÉ ËÁË WinPopup ÓÏÏÂÝÅÎÉÑ ÞÅÒÅÚ smbclient.
103 Snort - ÃÅ ÓΦÆÅÒ ÐÁËÅÔ¦×, ÝÏ ÍÏÖÅ ×ÉËÏÒÉÓÔÏ×Õ×ÁÔÉÓØ ÑË ÓÉÓÔÅÍÁ
104 ×ÉÑ×ÌÅÎÎÑ ÓÐÒÏ ×ÔÏÒÇÎÅÎØ × ÍÅÒÅÖÕ. Snort ЦÄÔÒÉÍÕ¤ ÐÒÏÔÏËÏÌÀ×ÁÎÎÑ
105 ÐÁËÅÔ¦× ÎÁ ÏÓÎÏצ ÐÒÁ×ÉÌ, ÍÏÖÅ ×ÉËÏÎÕ×ÁÔÉ ÁÎÁÌ¦Ú ÐÒÏÔÏËÏ̦×, ÐÏÛÕË Õ
106 ×ͦÓÔ¦ ÐÁËÅÔ¦×. íÏÖÅ ÔÁËÏÖ ×ÉËÏÒÉÓÔÏ×Õ×ÁÔÉÓØ ÄÌÑ ×ÉÑ×ÌÅÎÎÑ ÁÔÁË ÔÁ
107 "ÒÏÚצÄÏË", ÔÁËÉÈ ÑË ÓÐÒÏÂÉ ÁÔÁË ÔÉÐÕ "ÐÅÒÅÐÏ×ÎÅÎÎÑ ÂÕÆÅÒÁ",
108 ÐÒÉÈÏ×ÁÎÏÇÏ ÓËÁÎÕ×ÁÎÎÑ ÐÏÒÔ¦×, CGI ÁÔÁË, SMB ÒÏÚצÄÏË, ÓÐÒÏ ×ÉÑ×ÌÅÎÎÑ
109 ÔÉÐÕ ïó ÔÁ ÂÁÇÁÔÏ ¦ÎÛÏÇÏ. Snort ÍÏÖÅ ¦ÎÆÏÒÍÕ×ÁÔÉ ÐÒÏ ÐÏĦ§ × ÒÅÁÌØÎÏÍÕ
110 ÞÁÓ¦, ÎÁÄÓÉÌÁÀÞÉ ÐÏצÄÏÍÌÅÎÎÑ ÄÏ syslog, ÏËÒÅÍÏÇÏ ÆÁÊÌÕ ÞÉ ÑË WinPopup
111 ÐÏצÄÏÍÌÅÎÎÑ ÞÅÒÅÚ smbclient.
116 %if "%{_libdir}" == "%{_prefix}/lib64"
124 # we don't need libnsl, so don't use it
129 --with-libnet-includes=/usr/include/libnet1 \
130 --with%{!?with_snmp:out}-snmp \
132 --with%{!?with_pgsql:out}-postgresql \
133 --with%{!?with_mysql:out}-mysql
138 rm -rf $RPM_BUILD_ROOT
139 install -d $RPM_BUILD_ROOT/etc/{rc.d/init.d,%{name},cron.daily,logrotate.d} \
140 $RPM_BUILD_ROOT%{_var}/log/{%{name},archiv/%{name}} \
141 $RPM_BUILD_ROOT%{_datadir}/mibs/site \
142 $RPM_BUILD_ROOT%{_sysconfdir}/rules
145 DESTDIR=$RPM_BUILD_ROOT
147 install rules/*.config $RPM_BUILD_ROOT%{_sysconfdir}
148 install etc/unicode.map $RPM_BUILD_ROOT%{_sysconfdir}
149 install rules/*.rules $RPM_BUILD_ROOT%{_sysconfdir}/rules
150 install %{SOURCE2} $RPM_BUILD_ROOT/etc/rc.d/init.d/%{name}
151 install %{SOURCE3} $RPM_BUILD_ROOT/etc/logrotate.d/%{name}
152 install %{SOURCE4} $RPM_BUILD_ROOT%{_sysconfdir}
155 rm -rf $RPM_BUILD_ROOT
158 if [ -z "`getgid %{name}`" ]; then
159 /usr/sbin/groupadd -g 46 -r snort 2> /dev/null || true
162 if [ -z "`id -u %{name} 2>/dev/null`" ]; then
163 /usr/sbin/useradd -u 46 -g %{name} -M -r -d %{_var}/log/%{name} -s /bin/false \
164 -c "SNORT" snort 2> /dev/null || true
168 if [ "$1" = "1" ] ; then
169 /sbin/chkconfig --add snort
171 if [ -f /var/lock/subsys/snort ]; then
172 /etc/rc.d/init.d/snort restart 1>&2
174 echo "Run \"/etc/rc.d/init.d/snort start\" to start Snort daemon."
179 if [ "$1" = "0" ] ; then
180 if [ -f /var/lock/subsys/snort ]; then
181 /etc/rc.d/init.d/snort stop 1>&2
183 /sbin/chkconfig --del snort
187 if [ "$1" = "0" ] ; then
188 /usr/sbin/userdel snort 2> /dev/null || true
189 /usr/sbin/groupdel snort 2> /dev/null || true
193 %defattr(644,root,root,755)
194 %doc doc/{AUTHORS,BUGS,CREDITS,FAQ,NEWS,README*,TODO,USAGE}
195 %doc contrib/create* doc/*.pdf
196 %attr(755,root,root) %{_sbindir}/*
197 %attr(770,root,snort) %dir %{_var}/log/%{name}
198 %attr(770,root,snort) %dir %{_var}/log/archiv/%{name}
199 %attr(750,root,snort) %dir %{_sysconfdir}
200 %attr(640,root,snort) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/unicode.map
201 %attr(640,root,snort) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/*.config
202 %attr(640,root,snort) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/snort.conf
203 %attr(750,root,snort) %dir %{_sysconfdir}/rules
204 %attr(640,root,snort) %{_sysconfdir}/rules/*
205 %attr(750,root,root) /etc/rc.d/init.d/%{name}
206 %attr(640,root,root) /etc/logrotate.d/*