2 # TODO: - snort rules - fix description
3 # - clamav support - cleanup, add some docs
4 # - snort_inline - prepare separate sets of config-files, rules
5 # and startup script, adds some docs
8 %bcond_without pgsql # build without PostgreSQL storage support
9 %bcond_without mysql # build without MySQL storage support
10 %bcond_without snmp # build without SNMP support
11 %bcond_without inline # build without inline support
12 %bcond_without prelude # build without prelude support
13 %bcond_without clamav # build w/o ClamAV preprocessor support (anti-vir)
15 Summary: Network intrusion detection system (IDS/IPS)
16 Summary(pl): System wykrywania intruzów w sieciach (IDS/IPS)
17 Summary(pt_BR): Ferramenta de detecção de intrusos
18 Summary(ru): Snort - ÓÉÓÔÅÍÁ ÏÂÎÁÒÕÖÅÎÉÑ ÐÏÐÙÔÏË ×ÔÏÒÖÅÎÉÑ × ÓÅÔØ
19 Summary(uk): Snort - ÓÉÓÔÅÍÁ ×ÉÑ×ÌÅÎÎÑ ÓÐÒÏ ×ÔÏÒÇÎÅÎÎÑ × ÍÅÒÅÖÕ
25 Source0: http://www.snort.org/dl/current/%{name}-%{version}.tar.gz
26 # Source0-md5: 9dc9060d1f2e248663eceffadfc45e7e
27 Source1: http://www.snort.org/pub-bin/downloads.cgi/Download/vrt_pr/%{name}rules-pr-2.4.tar.gz
28 # Source1-md5: 35d9a2486f8c0280bb493aa03c011927
30 Source3: %{name}.logrotate
32 Patch0: %{name}-libnet1.patch
33 Patch1: %{name}-lib64.patch
34 # http://www.bleedingsnort.com/staticpages/index.php?page=snort-clamav
35 Patch2: %{name}-2.4.3-clamonly.diff
36 URL: http://www.snort.org/
37 BuildRequires: autoconf
38 BuildRequires: automake
39 %{?with_inline:BuildRequires: iptables-devel}
40 BuildRequires: libnet1-devel = 1.0.2a
41 BuildRequires: libpcap-devel
42 %{?with_prelude:BuildRequires: libprelude-devel}
43 %{?with_mysql:BuildRequires: mysql-devel}
44 %{?with_snmp:BuildRequires: net-snmp-devel >= 5.0.7}
45 BuildRequires: openssl-devel >= 0.9.7d
46 BuildRequires: pcre-devel
47 %{?with_pgsql:BuildRequires: postgresql-devel}
48 BuildRequires: rpmbuild(macros) >= 1.202
49 BuildRequires: rpmbuild(macros) >= 1.268
50 BuildRequires: zlib-devel
51 %{?with_clamav:BuildRequires: clamav-devel}
52 Requires(post,preun): /sbin/chkconfig
53 Requires(postun): /usr/sbin/groupdel
54 Requires(postun): /usr/sbin/userdel
55 Requires(pre): /bin/id
56 Requires(pre): /usr/bin/getgid
57 Requires(pre): /usr/sbin/groupadd
58 Requires(pre): /usr/sbin/useradd
59 Requires: libnet1 = 1.0.2a
60 Requires: rc-scripts >= 0.2.0
61 Provides: group(snort)
62 %{?with_mysql:Provides: snort(mysql) = %{version}}
63 %{?with_pgsql:Provides: snort(pgsql) = %{version}}
65 BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
67 %define _sysconfdir /etc/snort
68 %define _bindir %{_sbindir}
71 Snort is an open source network intrusion detection system, capable of
72 performing real-time traffic analysis and packet logging on IP
73 networks. It can perform protocol analysis and content
74 searching/matching in order to detect a variety of attacks and probes,
75 such as buffer overflows, stealth port scans, CGI attacks, SMB probes,
76 OS fingerprinting attempts, and much more. Snort uses a flexible rules
77 language to describe traffic that it should collect or pass, as well
78 as a detection engine that utilizes a modular plugin architecture.
79 Snort has a real- time alerting capability as well, incorporating
80 alerting mechanisms for syslog, user specified files, a UNIX socket,
81 or WinPopup messages to Windows clients using Samba's smbclient.
83 Sourcefire VRT Certified Rules requires registration.
84 https://www.snort.org/pub-bin/register.cgi
87 Snort to bazuj±cy na open source NIDS (network intrusion detection
88 systems) wykonuj±cy w czasie rzeczywistym analizê ruchu oraz logowanie
89 pakietów w sieciach IP. Jego mo¿liwo¶ci to analiza protoko³u oraz
90 zawarto¶ci w poszukiwaniu ró¿nego rodzaju ataków lub prób takich jak
91 przepe³nienia bufora, skanowanie portów typu stealth, ataki CGI,
92 próbkowanie SMB, OS fingerprinting i du¿o wiêcej. Snort u¿ywa
93 elastycznego jêzyka regu³ek do opisu ruchu, który nale¿y
94 przeanalizowaæ jak równie¿ silnika wykrywaj±cego, wykorzystuj±cego
95 modu³ow± architekturê. Snort umo¿liwia alarmowanie w czasie
96 rzeczywistym poprzez sysloga, osobny plik lub jako wiadomo¶æ WinPopup
97 poprzez klienta Samby: smbclient.
99 Regu³y certyfikowane poprzez Sourcefire wymagaj± rejestracji.
100 https://www.snort.org/pub-bin/register.cgi
102 %description -l pt_BR
103 Snort é um sniffer baseado em libpcap que pode ser usado como um
104 pequeno sistema de detecção de intrusos. Tem como característica o
105 registro de pacotes baseado em regras e também pode executar uma
106 análise do protocolo, pesquisa de padrões e detectar uma variedade de
107 assinaturas de ataques, como estouros de buffer, varreduras "stealth"
108 de portas, ataques CGI, pesquisas SMB, tentativas de descobrir o
109 sistema operacional e muito mais. Possui um sistema de alerta em tempo
110 real, com alertas enviados para o syslog, um arquivo de alertas em
111 separado ou como uma mensagem Winpopup.
114 Snort - ÜÔÏ ÓÎÉÆÆÅÒ ÐÁËÅÔÏ×, ËÏÔÏÒÙÊ ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ËÁË ÓÉÓÔÅÍÁ
115 ÏÂÎÁÒÕÖÅÎÉÑ ÐÏÐÙÔÏË ×ÔÏÒÖÅÎÉÑ × ÓÅÔØ. Snort ÐÏÄÄÅÒÖÉ×ÁÅÔ
116 ÐÒÏÔÏËÏÌÉÒÏ×ÁÎÉÅ ÐÁËÅÔÏ× ÎÁ ÏÓÎÏ×Å ÐÒÁ×ÉÌ, ÍÏÖÅÔ ×ÙÐÏÌÎÑÔØ ÁÎÁÌÉÚ
117 ÐÒÏÔÏËÏÌÏ×, ÐÏÉÓË × ÓÏÄÅÒÖÉÍÏÍ ÐÁËÅÔÏ×. íÏÖÅÔ ÔÁËÖÅ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÄÌÑ
118 ÏÂÎÁÒÕÖÅÎÉÑ ÁÔÁË É "ÒÁÚ×ÅÄÏË", ÔÁËÉÈ ËÁË ÐÏÐÙÔËÉ ÁÔÁË ÔÉÐÁ
119 "ÐÅÒÅÐÏÌÎÅÎÉÅ ÂÕÆÅÒÁ", ÓËÒÙÔÏÇÏ ÓËÁÎÉÒÏ×ÁÎÉÑ ÐÏÒÔÏ×, CGI ÁÔÁË, SMB
120 ÒÁÚ×ÅÄÏË, ÐÏÐÙÔÏË ÏÂÎÁÒÕÖÅÎÉÑ ÔÉÐÁ ïó É ÍÎÏÇÏ ÄÒÕÇÏÇÏ. Snort ÍÏÖÅÔ
121 ÉÎÆÏÒÍÉÒÏ×ÁÔØ Ï ÓÏÂÙÔÉÑÈ × ÒÅÁÌØÎÏÍ ×ÒÅÍÅÎÉ, ÐÏÓÙÌÁÑ ÓÏÏÂÝÅÎÉÑ ×
122 syslog, ÏÔÄÅÌØÎÙÊ ÆÁÊÌ ÉÌÉ ËÁË WinPopup ÓÏÏÂÝÅÎÉÑ ÞÅÒÅÚ smbclient.
125 Snort - ÃÅ ÓΦÆÅÒ ÐÁËÅÔ¦×, ÝÏ ÍÏÖÅ ×ÉËÏÒÉÓÔÏ×Õ×ÁÔÉÓØ ÑË ÓÉÓÔÅÍÁ
126 ×ÉÑ×ÌÅÎÎÑ ÓÐÒÏ ×ÔÏÒÇÎÅÎØ × ÍÅÒÅÖÕ. Snort ЦÄÔÒÉÍÕ¤ ÐÒÏÔÏËÏÌÀ×ÁÎÎÑ
127 ÐÁËÅÔ¦× ÎÁ ÏÓÎÏצ ÐÒÁ×ÉÌ, ÍÏÖÅ ×ÉËÏÎÕ×ÁÔÉ ÁÎÁÌ¦Ú ÐÒÏÔÏËÏ̦×, ÐÏÛÕË Õ
128 ×ͦÓÔ¦ ÐÁËÅÔ¦×. íÏÖÅ ÔÁËÏÖ ×ÉËÏÒÉÓÔÏ×Õ×ÁÔÉÓØ ÄÌÑ ×ÉÑ×ÌÅÎÎÑ ÁÔÁË ÔÁ
129 "ÒÏÚצÄÏË", ÔÁËÉÈ ÑË ÓÐÒÏÂÉ ÁÔÁË ÔÉÐÕ "ÐÅÒÅÐÏ×ÎÅÎÎÑ ÂÕÆÅÒÁ",
130 ÐÒÉÈÏ×ÁÎÏÇÏ ÓËÁÎÕ×ÁÎÎÑ ÐÏÒÔ¦×, CGI ÁÔÁË, SMB ÒÏÚצÄÏË, ÓÐÒÏ ×ÉÑ×ÌÅÎÎÑ
131 ÔÉÐÕ ïó ÔÁ ÂÁÇÁÔÏ ¦ÎÛÏÇÏ. Snort ÍÏÖÅ ¦ÎÆÏÒÍÕ×ÁÔÉ ÐÒÏ ÐÏĦ§ × ÒÅÁÌØÎÏÍÕ
132 ÞÁÓ¦, ÎÁÄÓÉÌÁÀÞÉ ÐÏצÄÏÍÌÅÎÎÑ ÄÏ syslog, ÏËÒÅÍÏÇÏ ÆÁÊÌÕ ÞÉ ÑË WinPopup
133 ÐÏצÄÏÍÌÅÎÎÑ ÞÅÒÅÚ smbclient.
137 Summary(pl): Regu³ki snorta
139 Requires: %{name} = %{version}-%{release}
144 %description rules -l pl
150 %if "%{_lib}" == "lib64"
153 %{?with_clamav:%patch2 -p1 }
159 # we don't need libnsl, so don't use it
164 %{?with_inline:--enable-inline } \
165 %{?with_inline:--with-libipq-includes=%{_includedir}/libipq } \
166 --with-libnet-includes=%{_includedir} \
167 --with%{!?with_snmp:out}-snmp \
169 --enable-perfmonitor \
170 --with%{!?with_pgsql:out}-postgresql \
171 --with%{!?with_mysql:out}-mysql \
172 %{?with_prelude:--enable-prelude } \
173 %{?with_clamav:--enable-clamav --with-clamav-defdir=/var/lib/clamav}
178 rm -rf $RPM_BUILD_ROOT
179 install -d $RPM_BUILD_ROOT/etc/{rc.d/init.d,%{name},cron.daily,logrotate.d} \
180 $RPM_BUILD_ROOT%{_var}/log/{%{name},archiv/%{name}} \
181 $RPM_BUILD_ROOT%{_datadir}/mibs/site \
182 $RPM_BUILD_ROOT%{_sysconfdir}/rules
185 DESTDIR=$RPM_BUILD_ROOT
187 install rules/*.config $RPM_BUILD_ROOT%{_sysconfdir}
188 install etc/unicode.map $RPM_BUILD_ROOT%{_sysconfdir}
189 install rules/*.rules $RPM_BUILD_ROOT%{_sysconfdir}/rules
190 install %{SOURCE2} $RPM_BUILD_ROOT/etc/rc.d/init.d/%{name}
191 install %{SOURCE3} $RPM_BUILD_ROOT/etc/logrotate.d/%{name}
192 install %{SOURCE4} $RPM_BUILD_ROOT%{_sysconfdir}
194 mv schemas/create_mysql schemas/create_mysql.sql
195 mv schemas/create_postgresql schemas/create_postgresql.sql
198 rm -rf $RPM_BUILD_ROOT
201 %groupadd -g 46 -r snort
202 %useradd -u 46 -g snort -M -r -d %{_var}/log/snort -s /bin/false -c "SNORT IDS/IPS" snort
205 /sbin/chkconfig --add snort
206 %service snort restart
207 if [ "$1" = 1 ]; then
208 %banner -e %{name} <<-EOF
209 To run snort you must download and install snort rules.
210 poldek -u snort-rules or download from http://www.snort.org/
216 if [ "$1" = "0" ] ; then
218 /sbin/chkconfig --del snort
222 if [ "$1" = "0" ] ; then
228 %defattr(644,root,root,755)
229 %doc doc/{AUTHORS,BUGS,CREDITS,NEWS,PROBLEMS,README*,RULES.todo,TODO,USAGE,WISHLIST,*.pdf}
230 %doc schemas/create_{mysql,postgresql}.sql
231 %attr(755,root,root) %{_sbindir}/*
232 %attr(770,root,snort) %dir %{_var}/log/snort
233 %attr(770,root,snort) %dir %{_var}/log/archiv/%{name}
234 %attr(750,root,snort) %dir %{_sysconfdir}
235 %attr(640,root,snort) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/unicode.map
236 %attr(640,root,snort) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/*.config
237 %attr(640,root,snort) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/snort.conf
238 %attr(750,root,snort) %dir %{_sysconfdir}/rules
239 %attr(754,root,root) /etc/rc.d/init.d/%{name}
240 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/logrotate.d/*
244 %defattr(644,root,root,755)
245 %attr(640,root,snort) %{_sysconfdir}/rules/*