File scanlogd.spec of Package scanlogd

Overview Repositories Revisions Requests Users Attributes Meta

File scanlogd.spec of Package scanlogd (Revision aa3081f39a8e0d03f4b60b1a76f4b755)

Currently displaying revision aa3081f39a8e0d03f4b60b1a76f4b755 , Show latest

Name:		scanlogd
Summary:	A tool to detect and log TCP port scans.
Version:	2.2.7
Release:	1%{?dist}
License:	BSD-compatible
Group:		Productivity/Networking/Security
URL:		http://www.openwall.com/scanlogd/
PreReq:		/sbin/chkconfig, grep, shadow-utils
BuildRoot:	%{_tmppath}/%{name}-%{version}-root
BuildRequires:  libpcap-devel

Source0:	%{name}-%{version}.tar.gz
Source1:	scanlogd.init.suse
Source2:	scanlogd.logrotate
Source3:	readme-syslog.txt
Patch1:		scanlogd-2.2.7_params_chroot.patch
Patch2:     scanlogd-2.2.7_Makefile_static_pcap.patch

%define _unpackaged_files_terminate_build 0

%description
scanlogd detects port scans and writes one line per scan via the syslog(3)
mechanism.  If a source address sends multiple packets to different ports
in a short time, the event will be logged.
This version is staticly linked against to libpcap, because the recommended 
raw sockets does NOT work with iptables firewalls!
(See ftp://ftp.openwall.com/pub/projects/scanlogd/scanlogd-%version.tar.gz)

%prep
%setup -q
%patch1
%patch2

%build
%__make libpcap CFLAGS="-Wall %optflags"

%install
rm -rf %buildroot
mkdir -p %buildroot{%_sbindir,%_mandir/man8,/etc/init.d,/etc/logrotate.d,/usr/share/doc/packages,/var/lib/scanlogd}

install -m 700 scanlogd %buildroot%_sbindir/
install -m 644 scanlogd.8 %buildroot%_mandir/man8/
install -m 700 %{SOURCE1} %buildroot/etc/init.d/scanlogd
install -m 644 %{SOURCE2} %buildroot/etc/logrotate.d/scanlogd
install -m 644 %{SOURCE3} %buildroot/usr/share/doc/packages/

ln -sf ../../etc/init.d/scanlogd %buildroot%_sbindir/rcscanlogd

%pre
grep -q ^scanlogd: /etc/group || groupadd -g 199 scanlogd
grep -q ^scanlogd: /etc/passwd ||
useradd -g scanlogd -u 199 -d / -s /bin/false -M scanlogd
rm -f /var/run/scanlogd.restart
if [ $1 -ge 2 ]; then
	/etc/init.d/scanlogd status && touch /var/run/scanlogd.restart || :
	/etc/init.d/scanlogd stop || :
fi

%post
#/sbin/chkconfig --add scanlogd
test -f /var/run/scanlogd.restart && /etc/init.d/scanlogd start || :
rm -f /var/run/scanlogd.restart
cat /usr/share/doc/packages/readme-syslog.txt

%preun
if [ $1 -eq 0 ]; then
	/etc/init.d/scanlogd stop || :
	/sbin/chkconfig --del scanlogd
fi

%files
%defattr(-,root,root)
%doc LICENSE
%doc /usr/share/doc/packages/readme-syslog.txt
%_sbindir/scanlogd
%_sbindir/rcscanlogd
%_mandir/man8/scanlogd.8*
%config /etc/init.d/scanlogd
%config /etc/logrotate.d/scanlogd
%dir /var/lib/scanlogd
%attr(0570,scanlogd,root) /var/lib/scanlogd

%changelog
* Tue Jul 05 2017Meike Stone meike.stone@googlemail.com 2.2.7-1%{?dist}
- changed to libpcap instead of raw sockets. With raw sockets, the
  scanlogd ist not usable with iptables. Staticly linked, so that
  no libpcap must installed of the system (e.g. in DMZ)!

* Mon Jun 12 2017 Meike Stone meike.stone@googlemail.com 2.2.7-1%{?dist}
- Made small changes for SUSE distibution.

* Wed Aug 15 2012 Solar Designer <solar-at-owl.openwall.com> 2.2.7-owl1
- Fixed an off-by-one bug in the safety check against SCAN_MAX_COUNT.  In
properly configured builds of scanlogd, SCAN_WEIGHT_THRESHOLD is such that it's
always hit before SCAN_MAX_COUNT would be hit, so this bug did not matter for
those.  However, other projects reusing this code could make these settings
runtime (mis)configurable, thereby exposing the bug.  Luckily, in scanlogd
itself, if it is misconfigured like this, a port number written right beyond
the array limit would overwrite relatively unimportant data only (part of the
same struct), which could be directly provided/spoofed by the remote system
anyway.  However, in other projects reusing code from scanlogd this could be
different.  Thanks to Florian Westphal for reporting this bug.
- Switched to heavily cut-down BSD license.

* Sun Mar 05 2006 Solar Designer <solar-at-owl.openwall.com> 2.2.6-owl1
- Use sysconf(_SC_CLK_TCK) instead of CLK_TCK when _SC_CLK_TCK is known to be
available or CLK_TCK is not.

* Thu Jun 10 2004 Solar Designer <solar-at-owl.openwall.com> 2.2.5-owl1
- Dropped the cleanup() stuff because it was not async-signal-safe and
to implement it properly would depend on pcap_breakloop() and on a
non-existent(?) equivalent for it with libnids; this code was only used
when running as root which is something to not do anyway.

* Thu Jun 03 2004 Solar Designer <solar-at-owl.openwall.com> 2.2.4-owl1
- Detach from the tty by opening /dev/null on fd 0, 1, 2.

* Wed Jun 02 2004 Solar Designer <solar-at-owl.openwall.com> 2.2.3-owl1
- When built with libnids or direct libpcap support, use Pavel Kankovsky's
smart pcap expression, with a minor enhancement.
- Explained "any" and "all" magic device names in a comment in params.h.
- Dropped the rlog stuff; librlog was never released.
- chroot to /var/empty.
- Do register scanlogd with chkconfig, but don't enable it for any runlevels
by default.
- Moved this spec file and the init script to under scanlogd/ to include
them in the non-Owl-specific distribution of scanlogd.

* Sun May 23 2004 Solar Designer <solar-at-owl.openwall.com> 2.2.2-owl1
- #include <stdlib.h> for exit(3) (apparently this is actually needed on
FreeBSD).
- Obfuscated e-mail addresses in the man page and sources.

* Wed May 08 2002 Solar Designer <solar-at-owl.openwall.com> 2.2.1-owl1
- Start after syslogd.
- Don't abuse glibc-internal __feature macros.

* Wed Feb 06 2002 Solar Designer <solar-at-owl.openwall.com>
- Enforce our new spec file conventions.

* Thu Jul 12 2001 Solar Designer <solar-at-owl.openwall.com>
- Packaged scanlogd for Owl.

Places

File scanlogd.spec of Package scanlogd (Revision aa3081f39a8e0d03f4b60b1a76f4b755)

Places