2 # TODO: - snort rules - fix description
5 %bcond_without pgsql # build without PostgreSQL storage support
6 %bcond_without mysql # build without MySQL storage support
7 %bcond_without snmp # build without SNMP support
8 %bcond_with inline # build with inline support
10 Summary: Network intrusion detection system (IDS/IPS)
11 Summary(pl): System wykrywania intruzów w sieciach (IDS/IPS)
12 Summary(pt_BR): Ferramenta de detecção de intrusos
13 Summary(ru): Snort - ÓÉÓÔÅÍÁ ÏÂÎÁÒÕÖÅÎÉÑ ÐÏÐÙÔÏË ×ÔÏÒÖÅÎÉÑ × ÓÅÔØ
14 Summary(uk): Snort - ÓÉÓÔÅÍÁ ×ÉÑ×ÌÅÎÎÑ ÓÐÒÏ ×ÔÏÒÇÎÅÎÎÑ × ÍÅÒÅÖÕ
19 Vendor: Marty Roesch <roesch@sourcefire.com>
21 Source0: http://www.snort.org/dl/current/%{name}-%{version}.tar.gz
22 # Source0-md5: 5c3c8c69f2459bbe0c1f2057966c88a7
23 Source1: http://www.snort.org/pub-bin/downloads.cgi/Download/vrt_pr/%{name}rules-pr-2.4.tar.gz
24 # Source1-md5: 35d9a2486f8c0280bb493aa03c011927
26 Source3: %{name}.logrotate
28 Patch0: %{name}-libnet1.patch
29 Patch1: %{name}-lib64.patch
30 URL: http://www.snort.org/
31 BuildRequires: autoconf
32 BuildRequires: automake
33 BuildRequires: libnet1-devel = 1.0.2a
34 BuildRequires: libpcap-devel
35 BuildRequires: libprelude-devel
36 %{?with_mysql:BuildRequires: mysql-devel}
37 %{?with_snmp:BuildRequires: net-snmp-devel >= 5.0.7}
38 BuildRequires: openssl-devel >= 0.9.7d
39 BuildRequires: pcre-devel
40 %{?with_pgsql:BuildRequires: postgresql-devel}
41 BuildRequires: rpmbuild(macros) >= 1.202
42 BuildRequires: zlib-devel
43 %{?with_inline:BuildRequires: iptables-devel}
44 PreReq: rc-scripts >= 0.2.0
45 Requires(pre): /bin/id
46 Requires(pre): /usr/bin/getgid
47 Requires(pre): /usr/sbin/groupadd
48 Requires(pre): /usr/sbin/useradd
49 Requires(post,preun): /sbin/chkconfig
50 Requires(postun): /usr/sbin/groupdel
51 Requires(postun): /usr/sbin/userdel
52 Requires: libnet1 = 1.0.2a
53 Provides: group(snort)
54 %{?with_mysql:Provides: snort(mysql) = %{version}}
55 %{?with_pgsql:Provides: snort(pgsql) = %{version}}
57 BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
59 %define _sysconfdir /etc/snort
60 %define _bindir %{_sbindir}
63 Snort is an open source network intrusion detection system, capable of
64 performing real-time traffic analysis and packet logging on IP
65 networks. It can perform protocol analysis and content
66 searching/matching in order to detect a variety of attacks and probes,
67 such as buffer overflows, stealth port scans, CGI attacks, SMB probes,
68 OS fingerprinting attempts, and much more. Snort uses a flexible rules
69 language to describe traffic that it should collect or pass, as well
70 as a detection engine that utilizes a modular plugin architecture.
71 Snort has a real- time alerting capability as well, incorporating
72 alerting mechanisms for syslog, user specified files, a UNIX socket,
73 or WinPopup messages to Windows clients using Samba's smbclient.
75 Sourcefire VRT Certified Rules requires registration.
76 https://www.snort.org/pub-bin/register.cgi
79 Snort to bazuj±cy na open source NIDS (network intrusion detection
80 systems) wykonuj±cy w czasie rzeczywistym analizê ruchu oraz logowanie
81 pakietów w sieciach IP. Jego mo¿liwo¶ci to analiza protoko³u oraz
82 zawarto¶ci w poszukiwaniu ró¿nego rodzaju ataków lub prób takich jak
83 przepe³nienia bufora, skanowanie portów typu stealth, ataki CGI,
84 próbkowanie SMB, OS fingerprinting i du¿o wiêcej. Snort u¿ywa
85 elastycznego jêzyka regu³ek do opisu ruchu, który nale¿y
86 przeanalizowaæ jak równie¿ silnika wykrywaj±cego, wykorzystuj±cego
87 modu³ow± architekturê. Snort umo¿liwia alarmowanie w czasie
88 rzeczywistym poprzez sysloga, osobny plik lub jako wiadomo¶æ WinPopup
89 poprzez klienta Samby: smbclient.
91 Regu³y certyfikowane poprzez Sourcefire wymagaj± rejestracji.
92 https://www.snort.org/pub-bin/register.cgi
95 Snort é um sniffer baseado em libpcap que pode ser usado como um
96 pequeno sistema de detecção de intrusos. Tem como característica o
97 registro de pacotes baseado em regras e também pode executar uma
98 análise do protocolo, pesquisa de padrões e detectar uma variedade de
99 assinaturas de ataques, como estouros de buffer, varreduras "stealth"
100 de portas, ataques CGI, pesquisas SMB, tentativas de descobrir o
101 sistema operacional e muito mais. Possui um sistema de alerta em tempo
102 real, com alertas enviados para o syslog, um arquivo de alertas em
103 separado ou como uma mensagem Winpopup.
106 Snort - ÜÔÏ ÓÎÉÆÆÅÒ ÐÁËÅÔÏ×, ËÏÔÏÒÙÊ ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ËÁË ÓÉÓÔÅÍÁ
107 ÏÂÎÁÒÕÖÅÎÉÑ ÐÏÐÙÔÏË ×ÔÏÒÖÅÎÉÑ × ÓÅÔØ. Snort ÐÏÄÄÅÒÖÉ×ÁÅÔ
108 ÐÒÏÔÏËÏÌÉÒÏ×ÁÎÉÅ ÐÁËÅÔÏ× ÎÁ ÏÓÎÏ×Å ÐÒÁ×ÉÌ, ÍÏÖÅÔ ×ÙÐÏÌÎÑÔØ ÁÎÁÌÉÚ
109 ÐÒÏÔÏËÏÌÏ×, ÐÏÉÓË × ÓÏÄÅÒÖÉÍÏÍ ÐÁËÅÔÏ×. íÏÖÅÔ ÔÁËÖÅ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÄÌÑ
110 ÏÂÎÁÒÕÖÅÎÉÑ ÁÔÁË É "ÒÁÚ×ÅÄÏË", ÔÁËÉÈ ËÁË ÐÏÐÙÔËÉ ÁÔÁË ÔÉÐÁ
111 "ÐÅÒÅÐÏÌÎÅÎÉÅ ÂÕÆÅÒÁ", ÓËÒÙÔÏÇÏ ÓËÁÎÉÒÏ×ÁÎÉÑ ÐÏÒÔÏ×, CGI ÁÔÁË, SMB
112 ÒÁÚ×ÅÄÏË, ÐÏÐÙÔÏË ÏÂÎÁÒÕÖÅÎÉÑ ÔÉÐÁ ïó É ÍÎÏÇÏ ÄÒÕÇÏÇÏ. Snort ÍÏÖÅÔ
113 ÉÎÆÏÒÍÉÒÏ×ÁÔØ Ï ÓÏÂÙÔÉÑÈ × ÒÅÁÌØÎÏÍ ×ÒÅÍÅÎÉ, ÐÏÓÙÌÁÑ ÓÏÏÂÝÅÎÉÑ ×
114 syslog, ÏÔÄÅÌØÎÙÊ ÆÁÊÌ ÉÌÉ ËÁË WinPopup ÓÏÏÂÝÅÎÉÑ ÞÅÒÅÚ smbclient.
117 Snort - ÃÅ ÓΦÆÅÒ ÐÁËÅÔ¦×, ÝÏ ÍÏÖÅ ×ÉËÏÒÉÓÔÏ×Õ×ÁÔÉÓØ ÑË ÓÉÓÔÅÍÁ
118 ×ÉÑ×ÌÅÎÎÑ ÓÐÒÏ ×ÔÏÒÇÎÅÎØ × ÍÅÒÅÖÕ. Snort ЦÄÔÒÉÍÕ¤ ÐÒÏÔÏËÏÌÀ×ÁÎÎÑ
119 ÐÁËÅÔ¦× ÎÁ ÏÓÎÏצ ÐÒÁ×ÉÌ, ÍÏÖÅ ×ÉËÏÎÕ×ÁÔÉ ÁÎÁÌ¦Ú ÐÒÏÔÏËÏ̦×, ÐÏÛÕË Õ
120 ×ͦÓÔ¦ ÐÁËÅÔ¦×. íÏÖÅ ÔÁËÏÖ ×ÉËÏÒÉÓÔÏ×Õ×ÁÔÉÓØ ÄÌÑ ×ÉÑ×ÌÅÎÎÑ ÁÔÁË ÔÁ
121 "ÒÏÚצÄÏË", ÔÁËÉÈ ÑË ÓÐÒÏÂÉ ÁÔÁË ÔÉÐÕ "ÐÅÒÅÐÏ×ÎÅÎÎÑ ÂÕÆÅÒÁ",
122 ÐÒÉÈÏ×ÁÎÏÇÏ ÓËÁÎÕ×ÁÎÎÑ ÐÏÒÔ¦×, CGI ÁÔÁË, SMB ÒÏÚצÄÏË, ÓÐÒÏ ×ÉÑ×ÌÅÎÎÑ
123 ÔÉÐÕ ïó ÔÁ ÂÁÇÁÔÏ ¦ÎÛÏÇÏ. Snort ÍÏÖÅ ¦ÎÆÏÒÍÕ×ÁÔÉ ÐÒÏ ÐÏĦ§ × ÒÅÁÌØÎÏÍÕ
124 ÞÁÓ¦, ÎÁÄÓÉÌÁÀÞÉ ÐÏצÄÏÍÌÅÎÎÑ ÄÏ syslog, ÏËÒÅÍÏÇÏ ÆÁÊÌÕ ÞÉ ÑË WinPopup
125 ÐÏצÄÏÍÌÅÎÎÑ ÞÅÒÅÚ smbclient.
129 Summary(pl): Regu³ki snorta
131 PreReq: %{name} = %{version}-%{release}
136 %description rules -l pl
142 %if "%{_lib}" == "lib64"
150 # we don't need libnsl, so don't use it
155 %{?with_inline:--enable-inline } \
156 %{?with_inline:--with-libipq-includes=%{_includedir}/libipq} \
157 --with-libnet-includes=%{_includedir} \
158 --with%{!?with_snmp:out}-snmp \
160 --enable-perfmonitor \
161 --with%{!?with_pgsql:out}-postgresql \
162 --with%{!?with_mysql:out}-mysql
167 rm -rf $RPM_BUILD_ROOT
168 install -d $RPM_BUILD_ROOT/etc/{rc.d/init.d,%{name},cron.daily,logrotate.d} \
169 $RPM_BUILD_ROOT%{_var}/log/{%{name},archiv/%{name}} \
170 $RPM_BUILD_ROOT%{_datadir}/mibs/site \
171 $RPM_BUILD_ROOT%{_sysconfdir}/rules
174 DESTDIR=$RPM_BUILD_ROOT
176 install rules/*.config $RPM_BUILD_ROOT%{_sysconfdir}
177 install etc/unicode.map $RPM_BUILD_ROOT%{_sysconfdir}
178 install rules/*.rules $RPM_BUILD_ROOT%{_sysconfdir}/rules
179 install %{SOURCE2} $RPM_BUILD_ROOT/etc/rc.d/init.d/%{name}
180 install %{SOURCE3} $RPM_BUILD_ROOT/etc/logrotate.d/%{name}
181 install %{SOURCE4} $RPM_BUILD_ROOT%{_sysconfdir}
183 mv schemas/create_mysql schemas/create_mysql.sql
184 mv schemas/create_postgresql schemas/create_postgresql.sql
187 rm -rf $RPM_BUILD_ROOT
190 %groupadd -g 46 -r snort
191 %useradd -u 46 -g snort -M -r -d %{_var}/log/snort -s /bin/false -c "SNORT IDS/IPS" snort
194 if [ "$1" = "1" ] ; then
195 /sbin/chkconfig --add snort
197 if [ -f /var/lock/subsys/snort ]; then
198 /etc/rc.d/init.d/snort restart 1>&2
200 echo "Run \"/etc/rc.d/init.d/snort start\" to start Snort daemon."
201 echo "To run snort you must download and install snort rules."
202 echo "poldek --install snort-rules or download from http://www.snort.org/"
207 if [ "$1" = "0" ] ; then
208 if [ -f /var/lock/subsys/snort ]; then
209 /etc/rc.d/init.d/snort stop 1>&2
211 /sbin/chkconfig --del snort
215 if [ "$1" = "0" ] ; then
221 %defattr(644,root,root,755)
222 %doc doc/{AUTHORS,BUGS,CREDITS,NEWS,PROBLEMS,README*,RULES.todo,TODO,USAGE,WISHLIST,*.pdf}
223 %doc schemas/create_{mysql,postgresql}.sql
224 %attr(755,root,root) %{_sbindir}/*
225 %attr(770,root,snort) %dir %{_var}/log/snort
226 %attr(770,root,snort) %dir %{_var}/log/archiv/%{name}
227 %attr(750,root,snort) %dir %{_sysconfdir}
228 %attr(640,root,snort) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/unicode.map
229 %attr(640,root,snort) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/*.config
230 %attr(640,root,snort) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/snort.conf
231 %attr(750,root,snort) %dir %{_sysconfdir}/rules
232 %attr(754,root,root) /etc/rc.d/init.d/%{name}
233 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/logrotate.d/*
237 %defattr(644,root,root,755)
238 %attr(640,root,snort) %{_sysconfdir}/rules/*