diff --git a/.cvsignore b/.cvsignore deleted file mode 100644 index e69de29..0000000 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e36137e --- /dev/null +++ b/.gitignore @@ -0,0 +1,15 @@ +sec-2.5.3.tar.gz +/sec-2.7.1.tar.gz +/sec-2.7.2.tar.gz +/sec-2.7.4.tar.gz +/sec-2.7.5.tar.gz +/sec-2.7.7.tar.gz +/sec-2.7.8.tar.gz +/sec-2.7.9.tar.gz +/sec-2.7.10.tar.gz +/sec-2.7.11.tar.gz +/sec-2.7.12.tar.gz +/sec-2.8.0.tar.gz +/sec-2.8.1.tar.gz +/sec-2.8.2.tar.gz +/sec-2.8.3.tar.gz diff --git a/Makefile b/Makefile deleted file mode 100644 index a45a953..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: sec -# $Id$ -NAME := sec -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/conf.README b/conf.README new file mode 100644 index 0000000..252ae6f --- /dev/null +++ b/conf.README @@ -0,0 +1,12 @@ +This is the SEC configuration directory. Because SEC usage varies so widely +from user to user, this package is configured by default to not run. + +The commented-out default settings in /etc/sysconfig/sec will load any file in +this directory with a .sec suffix. You can find several example rules at + + https://github.com/simple-evcorr/rulesets + +and install the ones you want here (taking into account that the examples are +generic and some of them may need to be tweaked to work with your setup). You +should also read the SEC man page so you have at least a basic understanding of +the SEC configuration commands. diff --git a/sec.init b/sec.init new file mode 100755 index 0000000..bf6bfb9 --- /dev/null +++ b/sec.init @@ -0,0 +1,117 @@ +#!/bin/bash +# +# sec Start and stop SEC. +# +# chkconfig: - 20 80 +# description: Simple Event Correlator script to filter log file entries + +. /etc/rc.d/init.d/functions + +prog="sec" +exec="/usr/bin/sec" +lockfile="/var/lock/subsys/sec" + +[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog + +start() { + [ -x $exec ] || exit 5 + for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do + echo -n $"Starting $prog instance "$(($n + 1))": " + daemon $exec ${SEC_ARGS[$n]} + RETVAL=$? + echo + [ $RETVAL -ne 0 ] && return $RETVAL + done + touch $lockfile + return $RETVAL +} + +stop() { + echo -n $"Stopping $prog: " + if [ -z "$SHUTDOWN_TIMELIMIT" ]; then + killproc $prog + else + killproc -d $SHUTDOWN_TIMELIMIT $prog + fi + RETVAL=$? + echo + [ $RETVAL -eq 0 ] && rm -f $lockfile + return $RETVAL +} + +restart() { + stop + start +} + +reload() { + echo -n $"Reloading $prog: " + killproc $prog -HUP + RETVAL=$? + echo + return $RETVAL +} + +rotate() { + echo -n $"Rotating $prog: " + killproc $prog -USR2 + RETVAL=$? + echo + return $RETVAL +} + +force_reload() { + restart +} + +rh_status() { + status $prog +} + +rh_status_q() { + rh_status >/dev/null 2>&1 +} + +dump() { + echo -n $"Dumping state of $prog in /tmp/sec.dump: " + killproc $prog -USR1 + RETVAL=$? + echo + return $RETVAL +} + +case "$1" in + start) + start + ;; + stop) + stop + ;; + restart) + restart + ;; + condrestart|try-restart) + rh_status_q || exit 0 + restart + ;; + reload) + reload + ;; + force-reload) + force_reload + ;; + rotate) + rotate + ;; + status) + rh_status + ;; + dump) + dump + ;; + *) + echo $"Usage: $0 {start|stop|restart|condrestart|try-restart|reload|force-reload|rotate|status|dump}" + exit 2 +esac + +exit $? diff --git a/sec.logrotate b/sec.logrotate new file mode 100644 index 0000000..5be73aa --- /dev/null +++ b/sec.logrotate @@ -0,0 +1,8 @@ +/var/log/sec { + missingok + notifempty + sharedscripts + postrotate + /sbin/service sec rotate >/dev/null 2>&1 || true + endscript +} diff --git a/sec.spec b/sec.spec new file mode 100644 index 0000000..4191272 --- /dev/null +++ b/sec.spec @@ -0,0 +1,194 @@ +Name: sec +Version: 2.8.3 +Release: 1%{?dist} +Summary: Simple Event Correlator script to filter log file entries +Group: System Environment/Daemons +License: GPLv2+ +URL: https://simple-evcorr.github.io/ +Source0: https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz +Source1: sec.sysconfig +Source2: sec.init +Source3: sec.logrotate +Source4: conf.README +BuildArch: noarch + +# The init script uses arrays, so we need bash +Requires: bash +Requires: logrotate + +Requires(post): chkconfig +Requires(postun): initscripts +Requires(preun): initscripts, chkconfig + +%description +SEC is a simple event correlation tool that reads lines from files, named +pipes, or standard input, and matches the lines with regular expressions, +Perl subroutines, and other patterns for recognizing input events. +Events are then correlated according to the rules in configuration files, +producing output events by executing user-specified shell commands, by +writing messages to pipes or files, etc. + +%prep +%setup -q + +%build + +%install +# Install SEC and its associated files +install -D -m 0755 -p sec %{buildroot}%{_bindir}/sec +install -D -m 0644 -p sec.man %{buildroot}%{_mandir}/man1/sec.1 +install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_sysconfdir}/sysconfig/sec +install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec +install -D -m 0755 -p %{SOURCE2} %{buildroot}%{_initrddir}/sec +install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/README + +# Remove executable bits because these files get packed as docs +chmod 0644 contrib/convert.pl contrib/swatch2sec.pl + +%post +if [ $1 -eq 1 ]; then + /sbin/chkconfig --add sec +fi + +%preun +if [ $1 -eq 0 ]; then + /sbin/service sec stop >/dev/null 2>&1 + /sbin/chkconfig --del sec +fi + +%postun +if [ $1 -eq 1 ]; then + /sbin/service sec condrestart >/dev/null 2>&1 +fi + +%clean +rm -rf %{buildroot} + +%files +%defattr(-,root,root,-) +%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl +%config(noreplace) %{_sysconfdir}/%{name} +%config(noreplace) %{_sysconfdir}/sysconfig/sec +%config(noreplace) %{_sysconfdir}/logrotate.d/sec +%{_initrddir}/sec +%{_bindir}/sec +%{_mandir}/man1/sec.1* + +%changelog +* Sat May 2 2020 Stefan Schulze Frielinghaus - 2.8.3-1 +- New upstream release + +* Mon Jun 3 2019 Stefan Schulze Frielinghaus - 2.8.2-1 +- New upstream release +- Clean up spec file + +* Wed Oct 3 2018 Stefan Schulze Frielinghaus - 2.8.1-0 +- New upstream release + +* Sun Sep 02 2018 Stefan Schulze Frielinghaus - 2.8.0-0 +- New upstream release + +* Wed Dec 13 2017 Stefan Schulze Frielinghaus - 2.7.12-0 +- New upstream release + +* Sun Feb 5 2017 Stefan Schulze Frielinghaus - 2.7.11-0 +- New upstream release + +* Fri Jun 24 2016 Stefan Schulze Frielinghaus - 2.7.10-0 +- New upstream release + +* Sat Apr 2 2016 Stefan Schulze Frielinghaus - 2.7.9-0 +- New upstream release + +* Wed Feb 3 2016 Stefan Schulze Frielinghaus - 2.7.8-1 +- Init script supports log rotation now + +* Sun Dec 6 2015 Stefan Schulze Frielinghaus - 2.7.8-0 +- New upstream release + +* Wed Nov 11 2015 Stefan Schulze Frielinghaus - 2.7.7-3 +- Add an optional timeout to the init script rule stop + +* Sun Oct 25 2015 Stefan Schulze Frielinghaus - 2.7.7-2 +- Update init script in order to send SIGTERM instead of SIGKILL for stop rule + +* Wed Oct 14 2015 Stefan Schulze Frielinghaus - 2.7.7-1 +- While rotating logfiles do not do a full restart of the sec instance + +* Wed Feb 18 2015 Stefan Schulze Frielinghaus - 2.7.7-0 +- New upstream release + +* Fri Jan 17 2014 Stefan Schulze Frielinghaus - 2.7.5-0 +- New upstream release + +* Sun Jun 30 2013 Stefan Schulze Frielinghaus - 2.7.4-0 +- New upstream release + +* Mon Apr 15 2013 Stefan Schulze Frielinghaus - 2.7.2-0 +- New upstream release + +* Mon Mar 18 2013 Stefan Schulze Frielinghaus - 2.7.1-0 +- New upstream release + +* Mon Dec 21 2009 Stefan Schulze Frielinghaus - 2.5.3-0 +- New upstream release + +* Tue Sep 29 2009 Stefan Schulze Frielinghaus - 2.5.2-1 +- New upstream release +- SPEC file cleanup +- Init script cleanup +- Removed some examples because of licensing issues. Upstream has clarified + and changed most of the license tags to GPLv2. Additionally, upstream + will include the examples in the next release. +- Removed a provide statement since a period was in the name and no other + package required that special name. + +* Sun Jul 26 2009 Fedora Release Engineering - 2.4.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Wed Feb 25 2009 Fedora Release Engineering - 2.4.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Thu Sep 4 2008 Tom "spot" Callaway - 2.4.1-2 +- fix license tag + +* Mon May 28 2007 Chris Petersen 2.4.1-1 +- Update to 2.4.1 + +* Wed Dec 06 2006 Chris Petersen 2.4.0-1 +- Update to 2.4.0 + +* Mon Jun 12 2006 Chris Petersen 2.3.3-4 +- Change group to keep rpmlint happy +- Fix permissions on the logrotate script + +* Thu Jun 08 2006 Chris Petersen 2.3.3-3 +- Clean up spec +- Add ghost file entries for the default logfile and pid +- Add logrotate script +- Add more bleedingsnort examples +- Add pid to sec.sysconfig and completely rewrite to handle multiple instances +- Fix download URL +- Fix echo log command in 001_init.sec +- Rewrite sysV init script to handle multiple instances (based loosely on vsftpd) + +* Mon May 01 2006 Didier Moens 2.3.3-2 +- Change init script to not start by default in any runlevel + +* Fri Apr 28 2006 Didier Moens 2.3.3-1 +- Upgrade to upstream 2.3.3 +- Add status to init script + +* Thu Sep 22 2005 Didier Moens 2.3.2-4 +- Update Source locations + +* Thu Sep 22 2005 Didier Moens 2.3.2-3 +- Change permissions on /usr/bin/sec + +* Thu Sep 22 2005 Didier Moens 2.3.2-2 +- Create initial startup rulesets +- Add examples +- Refine init script + +* Wed Sep 21 2005 Didier Moens 2.3.2-1 +- First build diff --git a/sec.sysconfig b/sec.sysconfig new file mode 100644 index 0000000..9c7ff58 --- /dev/null +++ b/sec.sysconfig @@ -0,0 +1,29 @@ +# +# Because SEC usage varies so widely from user to user, it is configured by +# default to not run. Please read `sec --help` for valid options to use in +# this configuration directive, or use the sample defaults included below. +# +# If you would like to run multiple instances of sec in order to track more +# than one log file, you can use also use $SEC_OPTIONS as an array. +# +# Also, please don't forget to read the sec man page or look at the +# configuration options for /etc/sec/. +# + +# +# Default: +# +# SEC_ARGS="-detach -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.pid" +# + +# +# For Multiple instances of SEC, use something like: +# +# SEC_ARGS[0]="-detach -conf=/etc/sec/sys/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.sys.pid" +# +# SEC_ARGS[1]="-detach -conf=/etc/sec/mail/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.mail.pid" +# +# Time limit (in seconds) to wait for SEC to shutdown. +# Default value defined in /etc/init.d/functions (usually 3 seconds) +# +# SHUTDOWN_TIMELIMIT=60 diff --git a/sources b/sources index e69de29..e30ca73 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +SHA512 (sec-2.8.3.tar.gz) = 9eba7db0dfa3661a3ef4e8aad3eeef1db710784f7a71131991a06918cc4f5634577b8bff3f00fcc1c5d998bf0c1e80efe88e1c1df3f5530b6ab4905ff00f2269