Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

New upstream release
Use systemctl kill
2026-07-17 06:22:15 +00:00 · 2026-02-12 20:17:04 +01:00 · 2026-02-12 19:59:48 +01:00 · 2026-01-17 17:51:48 +00:00 · 2025-07-25 18:07:19 +00:00 · 2025-01-19 10:21:48 +00:00
29 changed files with 142 additions and 3403 deletions
--- a/.gitignore
+++ b/.gitignore
@ -13,3 +13,13 @@ sec-2.5.3.tar.gz
 /sec-2.7.9.tar.gz
 /sec-2.7.10.tar.gz
 /sec-2.7.11.tar.gz
+/sec-2.7.12.tar.gz
+/sec-2.8.0.tar.gz
+/sec-2.8.1.tar.gz
+/sec-2.8.2.tar.gz
+/sec-2.8.3.tar.gz
+/sec-2.9.0.tar.gz
+/sec-2.9.1.tar.gz
+/sec-2.9.2.tar.gz
+/sec-2.9.3.tar.gz
+/sec-2.9.4.tar.gz
--- a/amavisd.sec
+++ b/amavisd.sec
@ -1,24 +0,0 @@
-#############################################################################
-# Amavisd events
-#
-# Copyright (C) 2003-2009 Matt Jonkman
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#############################################################################
-
-#Sep  4 15:43:02 xxxxx clamd[581]: /var/amavisd/amavis-20050904T153955-46858/parts/part-00001: HTML.Phishing.Bank-1 FOUND
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+clamd\[\d+\]: .*amavis-200\d+.*: (.*) FOUND
-desc=$0
-action=add GENERAL_REPORT CLAMD: $2 on $1
-
-#Sep  4 00:02:46 xxxxx amavis[57825]: (57825-12) TROUBLE in check_mail: creating_partsdir FAILED: DBD::mysql::st execute failed: L
-ost connection to MySQL server during query at (eval 53) line 238, <GEN7> line 1789.
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+amavis\[\d+\]: .* TROUBLE .*
-desc=$0
-action=add GENERAL_REPORT AMAVISD: $1: %s
-
--- a/bsd-MONITOR.sec
+++ b/bsd-MONITOR.sec
@ -1,59 +0,0 @@
-#
-# SEC rules to pick up disruptive monitoring
-# events.
-#
-# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html
-#
-# Copyright (C) 2003-2009 Jim Brown
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#
-#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR)
-#----------------------------------------------------------------------
-#Nov 15 20:02:48 foohost syslogd: exiting on signal 15
-#Nov 22 02:00:02 foohost syslogd: restart
-#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled
-#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled
-#
-
-#
-# Syslog Exit
-# -----------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+)
-desc=$0
-action=write - MONITOR: $1 syslog exit on signal $2 at %t
-
-#
-# Syslog Restart
-# ---------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart
-desc=$0
-action=write - MONITOR: $1 syslog restart at %t
-
-#
-# Syslog Exit
-# -----------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+)
-desc=$0
-action=write - MONITOR: $1 $2 promiscuous mode $3 at %t
-
-#
-# Swapspace failure
-#
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+kernel: swap_pager_getswapspace\(\S\): .*
-desc=$0
-action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@example.com
-
--- a/bsd-PHYSMOD.sec
+++ b/bsd-PHYSMOD.sec
@ -1,50 +0,0 @@
-#
-# PHYSMOD.conf - Events concerning physical modifications
-#                to the system.
-#
-# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html
-#
-# Copyright (C) 2003-2009 Jim Brown
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#
-#Logs involving physical modifications (PHYSMOD)
-#------------------------------------------------
-#Nov 14 21:11:19 foohost /kernel: pccard: card inserted, slot 0
-#Nov 14 22:28:09 foohost /kernel: pccard: card removed, slot 0
-#Nov 12 19:46:31 foohost /kernel: de0: link down: cable problem?
-#Nov 12 19:46:42 foohost /kernel: de0: autosense failed: cable problem?
-#Oct 18 06:26:37 foohost pccardd[49]: ep0: 3Com Corporation (/3C589/) inserted.
-#Oct 18 06:26:42 foohost pccardd[49]: pccardd started
-#
-
-#
-# PCMCIA Card Insertion, Removal
-# --------------------------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pccard: card (\S+), slot (\d+)
-desc=$0
-action=write - PHYSMOD: $1 pccard: card $2 in slot $3 at %t
-
-#
-# PCMCIA Card Daemon
-# --------------------------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+pccardd\[\d+\]: (.*)
-desc=$0
-action=write - PHYSMOD: $1 pccardd: $2 at %t
-
-#
-# Cabling Problem
-# ----------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem
-desc=$0
-action=write - PHYSMOD: $1 cable problem on $2, text: $3 at %t
--- a/bsd-USERACT.sec
+++ b/bsd-USERACT.sec
@ -1,81 +0,0 @@
-#
-# Events concerning user activities.
-#
-# From http://sixshooter.v6.thrupoint.net/SEC-examples/article.html
-#
-# Copyright (C) 2003-2009 Jim Brown
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#
-#Logs involving logins, change of UID and privilege escalations (USERACT)
-#-------------------------------------------------------------------------
-#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1
-#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100
-#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for jpb from 192.168.1.1 port 1077 ssh2
-#Nov 14 12:55:29 foohost sshd[3425]: Accepted keyboard-interactive/pam for jpb from fe80::2c0:4fff:fe18:13fd%ep0 port 27492 ssh2
-#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2
-#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql
-#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0
-#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1
-#Oct 18 06:11:11 foohost login: login on ttyv0 as root
-#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0
-#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3
-#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0
-#
-
-#
-# sshd Problems
-# --------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*)
-desc=$0
-action=write - USERACT: $1 sshd $2 problem, text: $3 at %t
-
-#
-# sshd Accepted
-# --------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*)
-desc=$0
-action=write - USERACT: $1 sshd accepted login, text: $2 at %t
-
-#
-# login FAILURES
-# ---------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*)
-desc=$0
-action=write - USERACT: $1 login $2 on $4 at %t
-
-#
-# su  bad
-# -----------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+)
-desc=$0
-action=write - USERACT: $1 su: $2 $3 to $4 on $5 at %t
-
-#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0
-#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3
-#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0
-#
-#
-# su  good to root
-# -----------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+)
-desc=$0
-action=write - USERACT: $1 su: $2 to ROOT on $4  at %t
-
-
--- a/bsd-general.sec
+++ b/bsd-general.sec
@ -1,307 +0,0 @@
-# General log events, unix systems. From various sources
-#
-# Copyright (C) 2003-2009 Jim Brown
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#
-#   Bad su 
-# ----------- 
-#
-type=Single
-ptype=RegExp 
-desc=$0 
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+)
-action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com
-
-type=Single
-ptype=RegExp
-desc=$0
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+)
-action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com 
-
-
-# MONITOR.conf - SEC rules to pick up disruptive monitoring
-# events.
-#
-#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR)
-#----------------------------------------------------------------------
-#Nov 15 20:02:48 foohost syslogd: exiting on signal 15
-#Nov 22 02:00:02 foohost syslogd: restart
-#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled
-#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled
-#
-
-#
-# Syslog Exit
-# -----------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+)
-desc=$0
-action=write - MONITOR: $1 syslog exit on signal $2 at %t
-
-#
-# Syslog Restart
-# ---------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart
-desc=$0
-action=write - MONITOR: $1 syslog restart at %t
-
-#
-# Syslog Exit
-# -----------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+)
-desc=$0
-action=write - MONITOR: $1 $2 promiscuous mode $3 at %t
-
-
-#
-# sshd Problems
-# --------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*)
-desc=$0
-action=write - USERACT: $1 sshd $2 problem, text: $3 at %t
-
-#
-# sshd Accepted
-# --------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*)
-desc=$0
-action=write - USERACT: $1 sshd accepted login, text: $2 at %t
-
-#
-# login FAILURES
-# ---------------
-#
-#type=Single
-#ptype=RegExp
-#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*)
-#desc=$0
-#action=write - USERACT: $1 login $2 on $4 at %t
-
-
-#SSH Auth failure on bsd 5
-#type=Single
-#ptype=RegExp
-#pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: error: PAM: authentication error for (/S+) from (/S+)
-#desc=$0
-#action=pipe 'SSHD: 1 $1 2 $2 3 $3 to 4 $4 on 5 $5 at %t' /usr/bin/mail -s "SSHD: $1 $2 $3 to $4 on $5 at %t' alerts@example.com
-
-#
-# su  bad
-# -----------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+)
-desc=$0
-action=pipe 'USER: $1 SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com
-
-#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0
-#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3
-#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0
-#
-#
-# su  good to root
-# -----------------
-#
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+)
-desc=$0
-action=pipe 'USER: $1 GOOD SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com  
-#action=write - USERACT: $1 su: $2 to ROOT on $4  at %t
-
-#
-# Cabling Problem
-# ----------------
-#
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem
-desc=$0
-action=event 0 $1 PHYSMOD:ORANGE  cable problem on $2, text: $3 at %t
-
-
-
-# USERACT - Events concerning user activities.
-#
-# Sample BSD logs involving logins, change of UID and privilege escalations.
-#---------------------------------------------------------------------------
-#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1
-#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100
-#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for foouser from 192.168.1.1 port 1077 ssh2
-#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2
-#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql
-#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0
-#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1
-#Oct 18 06:11:11 foohost login: login on ttyv0 as root
-#Nov 10 19:40:03 foohost su: foouser to root on /dev/ttyp0
-#Nov 18 09:37:38 foohost su: BAD SU foouser to root on /dev/ttyp3
-#Nov 22 12:26:44 foohost su: BAD SU goodboy to root on /dev/ttyp0
-#
-
-#
-# sshd Problems
-# --------------
-#
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*)
-desc=$0
-action=pipe 'USER: $1 su: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com   
-#action=event 0 $1 USERACT:YELLOW  sshd $2 problem, text: $3 at %t
-
-#
-# login FAILURES
-# ---------------
-# ORANGE
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(sshd|login): (.*?FAILURE.)(.*?ON) (.*)
-desc=$0
-action=pipe 'USER: $1: Login Failure $2 on $4 at %t' /usr/bin/mail -s "USER: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com   
-#action=event 0 $1 USERACT:YELLOW  login $2 on $4 at %t
-
-
-# NETWACT - SEC rules to pick up suspicious network events.
-#
-# Sample BSD logs involving odd or suspicious network activity.
-#--------------------------------------------------------------
-#Jun  3 17:46:24 foohost named[38298]: client 10.12.127.176#3714: request has invalid signature: tsig verify failure
-#Apr 14 16:23:08 foohost /kernel: arp: 10.10.152.12 moved from 00:90:27:37:35:cf to 00:d0:59:aa:61:11 on de0
-#Apr  1 11:23:39 sixshooter /kernel: Limiting closed port RST response from 368 to 200 packets per second
-
-
-#
-# named Dynamic DNS Update rejection
-# ----------------------------------
-#
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+named\[\d+\]: client (\S+): request has invalid signature:(.*)
-desc=$0
-action=pipe 'NET: $1 dyndns attempt from $2' /usr/bin/mail -s "NET: $1 dyndns attempt from $2, text: $3 at %t" alerts@example.com
-
-#
-# MAC address moved
-# -----------------
-# ORANGE
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: arp: (\S+) moved from (\S+) to (\S+) on (\S+)
-desc=$0
-action=pipe 'NET: $1 arp moved on $2' /usr/bin/mail -s "NET: $1 arp moved on $2 from: $3 to $4 on $5 at %t" alerts@example.com
-
-#
-# DoS RST rate limit
-# ------------------
-#
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Limiting closed port RST response from (\d+) to (\d+)
-desc=$0
-action=pipe 'NET: $1 RST limit enforced: $2 to $3 at %t' /usr/bin/mail =s "NET: $1 RST limit enforced: $2 to $3" alerts@example.com
-
-
-
-# COMPROM - SEC rules to pick up potential system compromise events.
-#
-# Sample BSD logs involving potential system compromise.
-#-------------------------------------------------------
-#May 25 18:09:55 foohost ntpd[1325]: ntpd exiting on signal 11
-#Jul 21 18:33:16 foohost /kernel: pid 55454 (ftpd), uid 1001: exited on signal 8
-#Apr  9 12:57:06 foohost /kernel: pid 28039 (telnet), uid 0: exited on signal 3 (core dumped)
-
-#
-# ntpd crash
-# ------------------
-#
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+ntpd\[\d+\]: ntpd exiting on signal (\d+)
-desc=$0
-action=pipe 'CRASH: $1 ntpd crashed on signal $2 at %t' /usr/bin/mail -s "CRASH: $1 ntpd crashed" alerts@example.com
-
-#
-# Process crash
-# ------------------
-#
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pid \d+ \(\S+\), uid (\d+): exited on signal (\d+)
-desc=$0
-action=pipe 'CRASH: $1 $2 crashed on signal $4, uid $3 at %t' /usr/bin/mail -s "CRASH: $1 $2 crashed" alerts@example.com
-
-
-
-# PROCESS - SEC rules to pick up suspicious process events.
-#
-# Sample BSD logs involving unusual processes.
-#---------------------------------------------
-#Mar 23 08:05:52 foohost thttpd[126]: thttpd/2.25b 29dec2003 starting on port 8090
-
-#
-# Suspicious processes
-# --------------------
-#
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(thttpd)\[(\d+)\]:(.*) 
-desc=$0
-action=pipe 'SUSPROC: $1 suspicious process  $2 pid $3, text: $4 at %t' /usr/bin/mail -s "SUSPROC: $1 suspicious process  $2" alerts@example.com
-
-
-
-# SHUTRST - SEC rules to pick up system shutdown, restart events.
-#
-# Sample BSD logs involving system shutdown and reset.
-#-----------------------------------------------------
-#Mar  6 16:28:13 foohost reboot: rebooted by foouser 
-#Jul 15 17:35:49 foohost halt: halted by root
-#Mar  6 16:29:17 foohost /kernel: Copyright (c) 1992-2003 The FreeBSD Project.
-
-#
-# Reboot message
-# --------------
-#
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+reboot: rebooted by (\S+)
-desc=$0
-action=pipe 'REBOOT: $1 rebooted by $2' /usr/bin/mail -s "REBOOT: $1 rebooted by $2" alerts@example.com
-
-#
-# Halt message
-# --------------
-#
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+halt: halted by (\S+)
-desc=$0
-action=pipe 'HALT: $1 halted by $2' /usr/bin/mail -s "HALT: $1 halted by $2" alerts@example.com
-
-#
-# Restart message
-# --------------
-#
-type=Single
-ptype=RegExp
-pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Copyright \(c\) (\S+) The FreeBSD Project
-desc=$0
-action=pipe 'RESTART: $1 restart message at %t' /usr/bin/mail -s "RESTART: $1 restart message" alerts@example.com
-
--- a/bsd-mpd.sec
+++ b/bsd-mpd.sec
@ -1,26 +0,0 @@
-#############################################################################
-# BSD mpd events
-#
-# Copyright (C) 2003-2009 Matt Jonkman
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#############################################################################
-
-type=single
-desc = mpd connection start
-ptype=regexp
-pattern=([A-z._0-9-]*) mpd: PPTP connection from (\d+\.\d+\.\d+\.\d+):\d+
-action=add GENERAL_REPORT MPD Start from $2 on $1
-
-type=single
-ptype=regexp
-pattern=([A-z._0-9-]*) mpd:  Name: (.*)
-desc = mpd user auth
-action=add GENERAL_REPORT MPD User $2 Auth on $1
-
-type=Single
-ptype=RegExp
-pattern=([A-z._0-9-]*) mpd: pptp\d: killing connection with (\d+\.\d+\.\d+\.\d+):\d+
-desc=mpd connection end
-action=add GENERAL_REPORT MPD Connection end from $2 on $1
--- a/cisco-syslog.sec
+++ b/cisco-syslog.sec
@ -1,477 +0,0 @@
-#############################################################################
-# SEC rules for processing Cisco syslog messages
-#
-# Copyright (C) 2008-2009 Omer Ben-Shalom, Risto Vaarandi
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#############################################################################
-
-# ----- Process system configuration events -----
-
-# System configuration events
-# suppressed because we don't care about it
-#
-type=suppress
-ptype=substr
-pattern=%SYS-5-CONFIG_I:
-desc=device configuration
-
-# System configuration sync to standby router
-# suppressed because we don't care about it
-#
-type=suppress
-ptype=substr
-pattern=%PFINIT-SP-5-CONFIG_SYNC:
-desc=config sync
-
-# ----- Process reload and restart events -----
-
-# Looks for a reload 
-# 
-type=single
-continue=takeNext
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD: (.*)
-desc=(WARNING) reload requested for $1
-action=pipe '%s details:$2' mail -s 'cisco event' root@example.com
-
-# Looks for a reload followed by a restart event
-# 
-type=pairWithWindow
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD:
-desc=(CRITICAL) $1 RELOAD_PROBLEM
-action=pipe '%s' mail -s 'cisco event' root@example.com
-ptype2=regexp
-pattern2=($1).*?%SYS-5-RESTART:
-desc2=(NOTICE) $1 RELOAD_OK
-action2=pipe '%s' mail -s 'cisco event' root@example.com
-window=300
-
-# Looks for a restart without reload command
-# 
-type=single
-ptype=regexp
-pattern=(\S+) \d+:.*?%SYS-5-RESTART:
-desc=(CRITICAL) $1 restart without reload command
-action=pipe '%s' mail -s 'cisco event' root@example.com
-
-# ----- process SNMP authentication failure events -----
-
-# this rule handles the SNMP authentication failures
-# only one notification is sent for each source that is doing this per day
-#
-type=singleWithSuppress
-ptype=regexp
-pattern=(\S+) \d+:.*?%SNMP-3-AUTHFAIL: Authentication failure for SNMP req from host (\S+)
-desc=(WARNING) Auth fail coming from $2
-action=pipe '%s' mail -s 'cisco event' root@example.com
-window=86400
-
-# ----- process OSPF neighbor change events -----
-
-# This rule handles OSPF neighbor changes
-#
-type=single
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OSPF-5-ADJCHG:.*?Nbr (\S+) on (\S+) from (\S+) to (\S+), (.*)
-desc=(MINOR) OSPF adjacency change: Router $1 reports that the neighbor on $3 ($2) changed from state $4 to state $5 detail:$6
-action=event %s; pipe '%s' mail -s 'cisco event' root@example.com
-
-# This rule escalates to CRITICAL if there are more than 5 neighbor changes 
-# in 5 seconds
-# 
-type=SingleWithThreshold
-ptype=substr
-pattern=(MINOR) OSPF adjacency change
-desc=(CRITICAL) More than 5 OSPF neighbor changes in 5 seconds
-action=pipe '%s' mail -s 'cisco event' root@example.com
-thresh=5
-window=5
-
-# ----- process HSRP events -----
-
-# This rule assembles together all HSRP events
-# 
-type=single
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%STANDBY-6-STATECHANGE: (\S+).*?state (\S+) -> (\S+)
-desc=HSRP change for $1 interface $2 - changed from $3 to $4
-action=add HSRP_$1 %t: %s; set HSRP_$1 5 (report HSRP_$1 mail -s 'cisco events' root@example.com)
-
-# ----- process duplex mismatch events -----
-
-# this rule handles the duplex mismatch event
-# only one notification is sent for each port that has duplex mismatch 
-# reported per day
-#
-type=singleWithSuppress
-ptype=regexp
-pattern=(\S+) \d+:.*?%CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on (not \S+) \((.*?)\), with (\S+) (\S+) \((.*?)\)
-desc=(WARNING) Duplex mismatch between $1 port $2 ($3), other side is $4 port $5 ($6)
-action=pipe '%s' mail -s 'cisco event' root@example.com
-window=86400
-
-# ----- process link down and link up events -----
-
-# This rule deals with link down events
-# 
-type=PairWithWindow
-ptype=RegExp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINK-3-UPDOWN: Interface (\S+), changed state to down
-desc=(MINOR) $1 INTERFACE $2 DOWN and not up in one minute
-action=pipe '%s' mail -s 'cisco event' root@example.com
-ptype2=RegExp
-pattern2=($1)\s+\d+:.*?%LINK-3-UPDOWN: Interface ($2), changed state to up
-desc2=(WARNING) %1 INTERFACE %2 BOUNCE
-action2=event %s
-window=60
-
-# when the first bounce event is seen, create a reporting trigger 
-#
-type=Single
-continue=TakeNext
-ptype=regexp
-pattern=(\S+) INTERFACE \S+ BOUNCE
-context=!INTERFACE_BOUNCE_WAIT_$1
-desc=interface bounce summary event for router $1
-action=create INTERFACE_BOUNCE_WAIT_$1 10 (report INTERFACE_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete INTERFACE_BOUNCE_$1)
-
-# accumulate all interface bounce events into a context
-#
-type=Single
-ptype=regexp
-pattern=(\S+) INTERFACE (\S+) BOUNCE
-desc=interface bounce for router $1 interface $2 detected
-action=add INTERFACE_BOUNCE_$1 %t: %s
-
-# ----- process line protocol down and line protocol up events -----
-
-# This rule deals with protocol up/down events
-#
-type=PairWithWindow
-ptype=RegExp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface (\S+), changed state to down
-desc=(MINOR) $1 INTERFACE $2 line protocol DOWN and not up in one minute
-action=pipe '%s' mail -s 'cisco event' root@example.com
-ptype2=RegExp
-pattern2=($1)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface ($2), changed state to up
-desc2=(WARNING) %1 INTERFACE %2 line protocol BOUNCE
-action2=event %s
-window=60
-
-# when the first bounce event is seen, create a reporting trigger 
-#
-type=Single
-continue=TakeNext
-ptype=regexp
-pattern=(\S+) INTERFACE \S+ line protocol BOUNCE
-context=!LINE_PROTOCOL_BOUNCE_WAIT_$1
-desc=line protocol bounce for router $1
-action=create LINE_PROTOCOL_BOUNCE_WAIT_$1 10 (report LINE_PROTOCOL_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete LINE_PROTOCOL_BOUNCE_$1)
-
-# accumulate all line protocol bounce events into a context
-#
-type=Single
-ptype=regexp
-pattern=(\S+) INTERFACE (\S+) line protocol BOUNCE
-desc=line protocol bounce for router $1 interface $2 detected
-action=add LINE_PROTOCOL_BOUNCE_$1 %t: %s
-
-# ----- process late collision events -----
-
-# Late collision alerts 
-# 
-type=SingleWithThreshold
-ptype=RegExp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%PM_SCP-SP-4-LCP_FW_ABLC: Late collision message from module (\d+), port:(\d+)
-desc=(MINOR) Multiple late collision events on $1 module $2 port $3
-action=pipe '%s' mail -s 'cisco event' root@example.com
-window=3600
-thresh=5
-
-# ----- process host flap events -----
-
-# host flapping on single vlan 
-# 
-type=SingleWithThreshold
-continue=TakeNext
-ptype=RegExp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+)
-desc=(MINOR) multiple hosts flapping between ports $4 and $5 in $1 vlan $3
-action=pipe '%s' mail -s 'cisco event' root@example.com
-window=300
-thresh=5
-
-# host flapping on multiple vlans 
-# 
-type=SingleWithThreshold
-continue=TakeNext
-ptype=RegExp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+)
-desc=(MINOR) multiple hosts are flapping between ports $4 and $5 in $1 (potentially on multiple VLANs)
-action=pipe '%s' mail -s 'cisco event' root@example.com
-window=300
-thresh=20
-
-# ----- process misc hw events -----
-
-# %FILESYS-SP-STDBY-5-DEV:# flash disk removal
-#
-type=single
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%FILESYS-SP-STDBY-5-DEV:.*?PCMCIA flash card removed from (\S+)
-desc=(WARNING) Flash card removed from $1 $2
-action=pipe '%s' mail -s 'cisco event' root@example.com
-
-# %OIR-SP-STDBY-6-CONSOLE
-#
-type=suppress
-ptype=substr
-pattern=%OIR-SP-STDBY-6-CONSOLE
-desc=console access to route processor changed
-
-# %OIR-SP-6-INSCARD:  - card inserted 
-#
-type=single
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OIR-SP-6-INSCARD: Card inserted in slot (\d+), (.*)
-desc=(HARMLESS) card inserted in $1 slot $2 status:$3
-action=pipe '%s' mail -s 'cisco event' root@example.com 
-
-# ----- process module events -----
-
-# %DIAG-SP-3-TEST_FAIL - diagnostics failed on a module
-#
-type=single
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DIAG-SP-3-TEST_FAIL: Module (\d+): (.*)
-desc=(WARNING) diagnostics failed for $1 module $2 detail:$3
-action=pipe '%s' mail -s 'cisco event' root@example.com
-
-# %SNMP-5-MODULETRAP
-# Looks for a module down followed by module up event
-# 
-type=pairWithWindow
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-MODULETRAP: Module (\d+) [Down] Trap
-desc=(MINOR) $1 Module DOWN (not back up in a minute)
-action=pipe '%s' mail -s 'cisco event' root@example.com
-ptype2=regexp
-pattern2=($1) .*? %SNMP-5-MODULETRAP: Module ($2) [Up] Trap
-desc2=(WARNING) $1 Module $2 BOUNCE (down and back up within a minute)
-action2=pipe '%s' mail -s 'cisco event' root@example.com
-window=60
-
-# ----- process irrelevant events (by suppressing) -----
-
-# %SYS-SP-STDBY-5-RESTART - system restarted part of the boot - interesting?
-# 
-type=suppress
-ptype=substr
-pattern=SYS-SP-STDBY-5-RESTART
-desc=system restarted
-
-# %DIAG-SP-6-TEST_RUNNING - Running system test
-# 
-type=suppress
-ptype=substr
-pattern=%DIAG-SP-6-TEST_RUNNING
-desc=running diagnostics on a module
-
-# %FABRIC-SP-5-FABRIC_MODULE_BACKUP - module changed to backup state
-# 
-type=suppress
-ptype=substr
-pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP
-desc=module became backup
-
-# %DIAG-SP-6-RUN_MINIMUM - diagnostics are run
-# 
-type=suppress
-ptype=substr
-pattern=%DIAG-SP-6-RUN_MINIMUM
-desc=diagnostics running on switch
-
-# %DIAG-SP-6-DIAG_OK - diagnostics results are OK
-# 
-type=suppress
-ptype=substr
-pattern=%DIAG-SP-6-DIAG_OK
-desc=diagnostics results are OK
-
-# %PFREDUN-SP-STDBY-6-STANDBY - SSO events
-# 
-type=suppress
-ptype=substr
-pattern=%PFREDUN-SP-STDBY-6-STANDBY
-desc=SSO event (startup)
-
-# %PFREDUN-SP-STDBY-6-STANDBY - SSO events
-# 
-type=suppress
-ptype=substr
-pattern=%PFREDUN-SP-6-ACTIVE
-desc=SSO event (startup)
-
-# %FABRIC-SP-5-FABRIC_MODULE_BACKUP: - secondary sup is up and is secondary
-# 
-type=suppress
-ptype=substr
-pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP:
-desc=secondary sup is up and is secondary
-
-# %PFINIT-SP-5-CONFIG_SYNC - startup config on standby router sync
-# 
-type=suppress
-ptype=substr
-pattern=%PFINIT-SP-5-CONFIG_SYNC
-desc=startup config on standby router sync
-
-# %C4K_REDUNDANCY - Cayt 4K configuration/vlan database succesful sync
-# the success match is to allow fails in sync to not be suppress
-# 
-type=suppress
-ptype=regexp
-pattern=%C4K_REDUNDANCY.*?success
-desc=config sync with standby supervisor
-
-# %SCP-SP-5-ASYNC_WATERMARK: SCP long queue wait
-# the success match is to allow fails in sync to not be suppress
-# 
-type=suppress
-ptype=substr
-pattern=%SCP-SP-5-ASYNC_WATERMARK:
-desc=SCP control protocol pending queue is longer than notification threshold
-
-# %MLS_RATE-4-DISABLING: - Layer2 Rate Limiters have been disabled. Is this interesting?
-#
-type=suppress
-ptype=substr
-pattern=%MLS_RATE-4-DISABLING:
-desc=Layer2 Rate Limiters have been disabled
-
-# ----- process native VLAN mismatch events -----
-
-# %CDP-4-NATIVE_VLAN_MISMATCH: - native VLAN mismatch between switches, will repeat every minute until fixed
-#
-type=singleWithSuppress
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on (\S+) \((\d+)\), with (\S+) (\S+) \((\d+)\)
-desc=(MINOR) A native VLAN mistmatch reported between $1 interface $2 (native VLAN $3) and host $4 interface $5 (native VLAN $6)
-action=pipe '%s' mail -s 'cisco event' root@example.com
-window=60
-
-# ----- process snmp trapblock messages -----
-
-# %SNMP-3-TRAPBLOCK - A process tried to create a trap it is not entitled to create
-# See Cisco http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&counter=0&paging=5&query=SNMP-3-TRAPBLOCK
-# 
-type=suppress
-ptype=substr
-pattern=%SNMP-3-TRAPBLOCK
-desc=a process tried to create a trap it is not entitled to create
-
-# ----- process chassis alarm events -----
-
-# %SNMP-5-CHASSISALARM - this rule handles the tmpAlarm
-#
-type=pairWithWindow
-continue=takeNext
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(ON\)
-desc=(MINOR) $1 temprature alarm signaled and not cleared in five minutes
-action=pipe '%s' mail -s 'cisco event' root@example.com
-continue2=takeNext
-ptype2=regexp
-pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(OFF\)
-desc2=(WARNING) $1 temprature alarm went on and was cleared in under five minutes
-action2=pipe '%s' mail -s 'cisco event' root@example.com
-window=300
-
-# %SNMP-5-CHASSISALARM - this rule handles the minorAlarm
-#
-type=pairWithWindow
-continue=takeNext
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(ON\)
-desc=(MINOR) $1 minor alarm reported and not cleared in three minutes
-action=pipe '%s' mail -s 'cisco event' root@example.com
-continue2=takeNext
-desc2=(WARNING) $1 minor alarm went on and was cleared in under three minutes
-ptype2=regexp
-pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(OFF\)
-action2=pipe '%s' mail -s 'cisco event' root@example.com
-window=180	
-
-# %SNMP-5-CHASSISALARM - this rule handles the majorAlarm
-#
-type=pairWithWindow
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(ON\)
-desc=(MINOR) $1 major alarm signaled and not cleared in two minutes
-action=pipe '%s' mail -s 'cisco event' root@example.com
-ptype2=regexp
-pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(OFF\)
-desc2=(WARNING) $1 major alarm went on and was cleared in under two minutes
-action2=pipe '%s' mail -s 'cisco event' root@example.com
-window=120
-
-# ----- process power supply related events -----
-
-# %C4K_IOSMODPORTMAN events - this one is about power supplies only 
-#
-type=pairWithWindow
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD: Power Supply (\d+) has failed or been turned off
-desc=(MINOR) $1 power supply $2 reported bad and event not cleared in two minutes
-action=pipe '%s' mail -s 'cisco event' root@example.com
-ptype2=regexp
-pattern2=($1) .*? %C4K_IOSMODPORTMAN-6-POWERSUPPLYGOOD: Power Supply ($2) is Okay
-desc2=(WARNING) $1 power supply $2 alarm went on and was cleared in under two minutes
-action2=pipe '%s' mail -s 'cisco event' root@example.com
-window=120
-
-# ----- process neighbor down and neighbor up events -----
-
-# %DVMRP-5-NBRDOWN
-#
-type=pairWithWindow
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DVMRP-5-NBRDOWN: Neighbor (\S+) went down on (\S+)
-desc=(MINOR) $1 lost DVMRP neighbor $2 on interface $3 and it did not come up in two minutes
-action=pipe '%s' mail -s 'cisco event' root@example.com
-ptype2=regexp
-pattern2=($1) .*? %DVMRP-5-NBRUP: Neighbor ($2) is up on ($3)
-desc2=(WARNING) $1 lost DVMRP neighbor $2 on interface $3 but id come up within two minutes
-action2=pipe '%s' mail -s 'cisco event' root@example.com
-window=120
-
-# ----- process fan power supply failure/ok events -----
-
-# %C6KENV-SP-4-PSFANF events - this one is about fan failures
-#
-type=pairWithWindow
-ptype=regexp
-pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C6KENV-SP-4-PSFANFAILED: the fan in power supply (\d+) has failed
-desc=(MINOR) $1 fan in power supply $2 was reported bad and event not cleared in two minutes
-action=pipe '%s' mail -s 'cisco event' root@example.com
-ptype2=regexp
-pattern2=($1) .*? %C6KENV-SP-4-PSFANOK: the fan in power supply (\d+) is OK
-desc2=(WARNING) $1 fan in power supply $2 alarm went on and was cleared in under two minutes
-action2=pipe '%s' mail -s 'cisco event' root@example.com
-window=120
-
-# ----- process events that have not been matched by any of above rules -----
-
-# Default match
-# this rule will match anything not previously matched but allows only 
-# one notification per day for each new event class seen
-#
-type=singleWithSuppress
-ptype=regexp
-pattern=(%.*?:)
-desc=$1
-action=pipe '$0' mail -s 'cisco event' root@example.com
-window=86400
--- a/conf.README
+++ b/conf.README
@ -2,9 +2,11 @@ This is the SEC configuration directory. Because SEC usage varies so widely
 from user to user, this package is configured by default to not run.

 The commented-out default settings in /etc/sysconfig/sec will load any file in
-this directory with a .sec suffix. Please look through the example files
-included in /usr/share/doc/sec-<version>/examples/ and install the ones you
-want here (taking into account that the examples are generic and some of them
-may need to be tweaked to work with your setup). You should also read the SEC
-man page so you have at least a basic understanding of the SEC configuration
-commands.
+this directory with a .sec suffix. You can find several example rules at
+
+    https://github.com/simple-evcorr/rulesets
+
+and install the ones you want here (taking into account that the examples are
+generic and some of them may need to be tweaked to work with your setup). You
+should also read the SEC man page so you have at least a basic understanding of
+the SEC configuration commands.
--- a/cvs.sec
+++ b/cvs.sec
@ -1,44 +0,0 @@
-#############################################################################
-# CVS events
-#
-# Copyright (C) 2003-2009 Matt Jonkman
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#############################################################################
-
-#Jul 31 19:54:21 xxxx xinetd[2088]: START: cvspserver pid=16385 from=xx.xx.xx.xx
-
-type=single
-desc = cvsp server connection start
-ptype=regexp
-pattern=([A-z._0-9-]*) xinetd\[\d+\]: START: cvspserver pid=\d+ from=(\d+\.\d+\.\d+\.\d+)
-action=add GENERAL_REPORT CVS Connection from $2 on $1
-
-
-#Aug  5 10:38:29 xxxx cvs: password mismatch for username in /usr/local/cvsroot: PMOv/9hZsf6v. vs. PMMlzZLYrbthY
-
-type=single
-ptype=regexp
-pattern=([A-z._0-9-]*) cvs: password mismatch for (.*) in (.*)
-desc = cvs login failure
-action=pipe '$1 $2 CVS Login Failure: User $2 from $3' /usr/bin/mail -s '$1 $2 CVS Login Failure: $2 from $3' alerts@example.com
-
-
-#Aug  5 10:38:49 xxxx cvs: attempt to root from account: username
-
-type=single
-ptype=regexp
-pattern=([A-z._0-9-]*) cvs: attempt to root from account: (.*)
-desc = cvs login to root attempt
-action=pipe ' $1 $2 CVS Login to Root Attempt: User $2 ' /usr/bin/mail -s '$1 CVS Login to Root Failure: $2' alerts@example.com
-
-
-#Aug  5 10:42:37 xxxx cvs: login failure (for /usr/local/cvsroot)
-
-type=single
-ptype=regexp
-pattern=([A-z._0-9-]*) cvs: login failure \(for /usr/local/cvsroot\)
-desc = cvs login failure
-action=pipe '$1 $2 CVS Login Failure ' /usr/bin/mail -s '$1 CVS Login Failure' alerts@example.com
-
--- a/dameware.sec
+++ b/dameware.sec
@ -1,24 +0,0 @@
-#############################################################################
-# Dameware events
-#
-# Copyright (C) 2003-2009 Matt Jonkman
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#############################################################################
-
-#Dameware Connect
-type=single
-ptype=regexp
-pattern=([A-z._0-9-]*) DMWRCS: (.*) Connect: (.*)
-desc = Dameware Connect
-action=add WINDOWS_REPORT DAMEWARE CONNECT: %s; \
-pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@example.com
-
-
-#Dameware Disconnect
-type=single
-ptype=regexp
-pattern=([A-z._0-9-]*) DMWRCS: (.*) Disconnect: (.*)
-desc = Dameware Disconnect
-action=add WINDOWS_REPORT DAMEWARE DISCONNECT: %s
--- a/hp-openview.sec
+++ b/hp-openview.sec
@ -1,114 +0,0 @@
-################################################################
-#          Sample SEC ruleset for HP OpenView ITO
-#
-# Copyright (C) 2003-2010 Risto Vaarandi
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-################################################################
-
-# process Cisco linkDown/linkUp trap events received from 
-# HP OpenView ITO trap template through itostream plugin
-
-type=PairWithWindow
-ptype=RegExp
-pattern=node=([\w.-]+) .*msg_text=cisco linkdown trap on interface ([\w-]+)\b
-desc=CISCO $1 INTERFACE $2 DOWN
-action=event %s; 
-continue2=TakeNext
-ptype2=RegExp
-pattern2=node=$1 .*msg_text=cisco linkup trap on interface $2\b
-desc2=CISCO %1 INTERFACE %2 BOUNCE
-action2=event %s; 
-window=20
-
-type=SingleWithSuppress
-continue=TakeNext
-ptype=RegExp
-pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) DOWN
-desc=cisco $1 interface $2 down
-action=reset +1 %s
-window=60
-
-type=Pair
-ptype=RegExp
-pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) DOWN
-desc=cisco $1 interface $2 down
-action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major down
-ptype2=RegExp
-pattern2=node=$1 .*msg_text=cisco linkup trap on interface $2\b
-desc2=cisco %1 interface %2 up
-action2=shellcmd /home/opc_op/cisco_msg.sh %1 %2 normal up
-window=86400
-
-type=SingleWith2Thresholds
-ptype=RegExp
-pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) BOUNCE
-desc=cisco $1 interface $2 is unstable
-action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major unstable
-window=3600
-thresh=10
-desc2=cisco $1 interface $2 is stable again
-action2=shellcmd /home/opc_op/cisco_msg.sh $1 $2 normal stable
-window2=10800
-thresh2=0
-
-#
-# the cisco_msg.sh script:
-#
-##!/bin/sh
-#
-#NODE=$1
-#IF=$2
-#SEV=$3
-#TEXT=$4
-#
-## use snmpget utility from Net-SNMP package
-#IFNAME=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.2.1.2.2.1.2.$IF`
-#DESCR=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.4.1.9.2.2.1.1.28.$IF`
-#
-#MSG=`echo "Interface $IFNAME ($DESCR) $TEXT" | sed s/\"/\'/g`
-#
-#/opt/OV/bin/OpC/opcmsg node=$NODE app=cisco obj=if \
-#                       sev=$SEV msg_grp=Network msg_text="$MSG"
-#
-
-
-# process APC ups "not online" trap events received from 
-# HP OpenView ITO trap template through itostream plugin
-
-type=SingleWithScript
-ptype=RegExp
-pattern=node=([\w.-]+) .*msg_text=APC ups not online
-script=/home/opc_op/check_apc.sh $1
-desc=APC ups is not online!
-action=shellcmd /opt/OV/bin/OpC/opcmsg node=$1 app=APC obj=state \
-  msg_grp=UPS sev=critical msg_text='%s'
-
-#
-# the check_apc.sh script
-#
-##!/bin/sh
-# 
-## sleep for a few seconds and check if the UPS error is still present;
-## if it is, exit with 0, otherwise exit with 1
-#
-#UPS=$1
-#sleep 5
-#
-## use snmpget utility from Net-SNMP package
-#STATUS=`/usr/bin/snmpget -c public -OQve $UPS .1.3.6.1.4.1.318.1.1.1.4.1.1.0`
-#
-## According to the APC Powernet MIB the variable .1.3.6.1.4.1.318.1.1.1.4.1.1 
-## takes the the following values: unknown(1), onLine(2), onBattery(3),
-## onSmartBoost(4), timedSleeping(5), softwareBypass(6), off(7), rebooting(8),
-## switchedBypass(9), hardwareFailureBypass(10), sleepingUntilPowerReturn(11),
-## and onSmartTrim(12), where onLine(2) is the normal state for the UPS
-#
-#if [ $STATUS -eq 2 ]
-#then
-#  exit 1
-#else
-#  exit 0
-#fi 
-#
--- a/labrea.sec
+++ b/labrea.sec
@ -1,36 +0,0 @@
-#############################################################################
-# Labrea tarpit events
-#
-# Copyright (C) 2003-2009 Matt Jonkman
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#############################################################################
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Initial Connect \(tarpitting\): (\d+\.\d+\.\d+\.\d+\s\d+) \-> \d+\.\d+\.\d+\.\d+\s(.*)
-desc=$0
-action=add TARPIT_REPORT %t: $1 New Tarpitted Connect from $2 on port $3
-
-#type=Single
-#ptype=RegExp
-#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Additional Activity: (\d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+ (\d+)*
-#desc=$0
-#action=add TARPIT_REPORT %t: %s;
-#
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Responded to a PING: (d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+
-desc=$0
-action=add TARPIT_REPORT %t: PING Sweep from $@ on $3
-
-#Send hourly tarpit report
-
-type=Calendar
-time=0 8,12,20 * * *
-desc=Sending tarpit report...
-action=report TARPIT_REPORT \
-       /usr/bin/mail -s 'Tarpits: Tarpit Victim report' alerts@example.com; \
-       delete TARPIT_REPORT
--- a/pix-general.sec
+++ b/pix-general.sec
--- a/pix-security.sec
+++ b/pix-security.sec
@ -1,246 +0,0 @@
-####################################################################
-#                SEC ruleset for Cisco PIX 6.x, 7.x
-#
-# Copyright (C) 2003-2009 Chris Sawall
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-####################################################################
-
-# Process various events from PIX syslog output
-# 
-# Submitted by Chris Sawall
-# email: sawall -[at]- gmail -[dot]- com
-# Last Updated: 5/20/05
-
-# ------------------------------------------------------------------
-# Watch for weird failures - possible trojan/worm
-# ------------------------------------------------------------------
-
-# Watch for 10 denies within 10 seconds.  Especially useful to monitor
-# for certain trojans and mass mailers
-#
-type=SingleWithThreshold
-ptype=RegExp
-pattern=\s*.*Deny\s+(\w+)\s+src.*:(.*)/.*:(.*)/(\b2\d\b).*$
-desc=Unusual Failures:$1 $4/$2 -> $3
-action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
-window=10
-thresh=10
-
-# Monitor for occurrances of certain variant of PHEL trojan destined
-# for two different class C networks
-#
-type=Single
-continue=dontcont
-ptype=RegExp
-pattern=(212\.147\.14[12]\.)
-desc=Possible PHEL Trojan (1)
-action=create phel_$1; add phel_$1 Local Time = %t; add phel_$1 $0; report phel_$1 /bin/mail -s "%s" email01@example.com; delete phel_$1
-
-# ------------------------------------------------------------------
-# Watch for firewall failovers
-# ------------------------------------------------------------------
-
-# Firewall failures/failovers
-# Works for PIX 7.x
-
-# Failure of secondary (standby) firewall while primary is active
-# Works for PIX 7.x
-# 
-# $1 is the IP address of the primary firewall
-#
-type=Single
-continue=takenext
-ptype=RegExp
-pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Primary\).*$
-desc=Secondary firewall for $1 - failure/reload
-action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
-
-# Failure of secondary (standby) firewall while primary is active
-# Works for PIX 7.x
-#
-# $1 is the IP address of the primary firewall
-#
-type=Single
-continue=takenext
-ptype=RegExp
-pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Secondary\).*$
-desc=Primary firewall for $1 - failure/reload
-action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
-
-# Failure of secondary (active), primary assumes active
-# Works for PIX 7.x
-#
-# The first "desc" and "action" don't really do anything here.  But SEC requires them to be present.
-# $1 is the IP address of the primary firewall
-#
-type=Pair
-continue=dontcont
-ptype=RegExp
-pattern=PIX-1-102001:\s+\(Primary\).*$
-desc=$0
-action=logonly
-ptype2=RegExp
-pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Primary\).*Peer state Standby Ready
-desc2=Secondary (was active) firewall ($1) has failed.  Primary is now active.
-action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
-window=5
-
-# Failure of primary (active), secondary assumes active
-# Works for PIX 7.x
-#
-# The first "desc" and "action" don't really do anything here.  But SEC requires them to be present.
-# $1 is the IP address of the primary firewall
-#
-type=Pair
-continue=dontcont
-ptype=RegExp
-pattern=PIX-1-102001:\s+\(Secondary\).*$
-desc=$0
-action=logonly
-ptype2=RegExp
-pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Secondary\).*Peer state Standby Ready
-desc2=Primary firewall ($1) has failed.  Secondary is now active.
-action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
-window=5
-
-# ------------------------------------------------------------------
-# Watch for firewall reloads
-# ------------------------------------------------------------------
-
-# Manual reload of PIX
-# Works for PIX 6.x
-#
-# $1 is the IP address of the primary firewall
-#
-type=Single
-continue=dontcont
-ptype=RegExp
-pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX reload.*$
-desc=$1 has been manually rebooted
-action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com ; delete ffo_$1
-
-# Manual reload of PIX
-# Works for PIX 7.x
-#
-# $1 is the IP address of the primary firewall
-#
-type=Single
-continue=dontcont
-ptype=RegExp
-pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Orderly reload.*Reload reason:\s(\S+)
-desc=$1 has been manually rebooted, reason: $2
-action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
-
-# ------------------------------------------------------------------
-# Watch for SSH logins/failures on firewalls
-# ------------------------------------------------------------------
-
-# Suppress emails concerning pixbkup account
-# In this case, the pixbkup acct is used to backup the PIX firewalls
-# Keeping email alerts to a minimum, this skips past these alerts
-#
-type=Suppress
-continue=dontcont
-ptype=RegExp
-pattern=pixbkup
-
-# Successful Admin SSH session
-# Works for PIX 6.x
-# 
-# Monitor for successful SSH connections to the PIX firewall
-# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr
-#
-type=Single
-continue=dontcont
-ptype=RegExp
-pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'.*to\s(\d+\.\d+\.\d+\.\d+)\/0.*SSH
-desc=Admin Auth to $1.$2 -> $3 from $4
-action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
-
-# Successful Admin SSH session
-# Works for PIX 7.x
-# 
-# Monitor for successful SSH connections to the PIX firewall
-# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr
-#
-type=Single
-continue=dontcont
-ptype=RegExp
-pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'\sfrom\s(\d+\.\d+\.\d+\.\d+)\/0.*/22.*$
-desc=Admin Auth to $1.$2 -> $3 from $4
-action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
-
-# Failed Admin SSH session
-# Works for PIX 6.x
-#
-# Monitor for failed SSH attempts to the PIX firewalls
-# $1 is the user acct
-#
-type=Single
-continue=takenext
-ptype=RegExp
-pattern=Authentication failed.*\'(\S+)\'.*SSH
-desc=Admin Auth FAILED -> $1
-action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
-
-# Failed Admin SSH session
-# Works for PIX 7.x
-#
-# Monitor for failed SSH attempts to the PIX firewalls
-# $1 is the user acct
-#
-type=Single
-continue=takenext
-ptype=RegExp
-pattern=Authentication failed.*\'(\S+)\'.*/22.*$
-desc=Admin Auth FAILED -> $1
-action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
-
-# Normal SSH termination
-# Works for both PIX 6.x and 7.x
-#
-# $1 is the IP of the firewall and $2 is the user acct
-#
-type=Single
-ptype=RegExp
-pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*\"(\S+)\".*terminated normally
-desc=ADMIN END $1 -> $2
-action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
-
-# SSH session timeout or abnormal termination
-# Works for PIX 6.x
-# May work for PIX 7.x - not tested but PIX-6-315011 is the same for 6 and 7.
-#
-# $1 is the IP of the firewall
-#
-type=Single
-ptype=RegExp
-pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*disconnected by SSH server
-desc=Firewall session END - timeout $1
-action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
-
-# ------------------------------------------------------------------
-# Watch for firewall commands
-# ------------------------------------------------------------------
-
-# Admin executed "write mem"
-# Works for both PIX 6.x and 7.x
-#
-# $1 is the IP of the firewall
-type=Single
-ptype=RegExp
-pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*write\sm.*
-desc=User wrote config to memory -> $1
-action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1
-
-# Watch for HIGH CPU Utilization
-# Works for PIX 6.x
-#
-type=Single
-ptype=RegExp
-pattern=PIX-.-211003
-desc=HIGH CPU Utilization
-action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1
-
--- a/pix-url.sec
+++ b/pix-url.sec
@ -1,80 +0,0 @@
-####################################################################
-#                SEC ruleset for Monitoring Keywords
-#
-# Copyright (C) 2003-2009 Chris Sawall
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-####################################################################
-
-# This particular ruleset was designed to monitor PIX syslog traffic
-# and watch for keywords in URL traffic.  Starting SEC must include
-# the -intevents option.
-#
-# Currently tested for PIX 6.x 
-# 
-# Submitted by Chris Sawall
-# email: sawall -[at]- gmail -[dot]- com
-# Last Updated: 5/20/05
-
-# Wait for SEC to start up or be restarted and then read in two lists
-# of words.  The first being a list of words to watch for and alert on,
-# the second list being a list of exclusions for a suppression rule.
-#
-type=Single
-ptype=PerlFunc
-pattern=sub { if(($_[0] eq "SEC_STARTUP") || ($_[0] eq "SEC_RESTART")) { @words=`cat /root/watch4badwords`; chomp(@words); $list=join('|', @words); @ewords=`cat /root/watch4excludes`; chomp(@ewords); $excludes=join('|', @ewords);} }
-desc=$0
-context=SEC_INTERNAL_EVENT
-action=write - Set word list variable;
-
-# ------------------------------------------------------------------
-# Scan for certain URLs
-# ------------------------------------------------------------------
-
-# Monitor and match on keywords from the exclusions file and 
-# suppress reporting on them.
-#
-type=Suppress
-continue=dontcont
-ptype=PerlFunc
-pattern=sub {($_[0] =~ /($excludes)/) }
-
-# Monitor for keywords and send an email alert
-#
-type=Single
-ptype=PerlFunc
-pattern=sub {($_[0] =~ /($list)/) }
-desc=Inappropriate word in URL
-action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
-
-#
-# Examples of "watch4badwords" and "watch4excludes"
-# 
-# File should be a return delimited file.  The
-# script read the file in literally and creates
-# an OR statement by putting a pipe (|) between
-# all of the keywords.
-# 
-# Be careful on what words are being monitored.
-# The word virgin also finds virginia and alerts
-# on it.
-# 
-# The following are examples of things that work:
-# 
-# ----> watch4badwords
-#
-# \bvirgin\b
-# \byoung girl\b
-# \b[Pp]layboy\b
-# pr0n
-# hardcore
-#  
-# ----> watch4excludes
-# 
-# \b10\.10\.2\.4\b
-# \bcherry tree\b
-# cnn.com
-# 
-
-
--- a/portscan.sec
+++ b/portscan.sec
@ -1,45 +0,0 @@
-################################################################
-# Sample SEC ruleset for "PORTSCAN FROM ip1 TO ip2:port" events
-#
-# Copyright (C) 2003-2009 Risto Vaarandi
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-################################################################
-
-# process "PORTSCAN FROM ip1 TO ip2:port" events, and if a certain
-# source host has scanned the same destination port on more than 
-# 10 distinct destination hosts during 60 seconds, raise an alarm
-
-type=Single
-ptype=RegExp
-pattern=PORTSCAN FROM ([\d.]+) TO [\d.]+:(\d+)
-context=!HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2
-continue=TakeNext
-desc=Horizontal port sweep started from source $1 to target port $2
-action=eval %o ( $portscans{"$1:$2"} = {} ); \
-       create HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 60 \
-       eval %o ( delete $portscans{"$1:$2"} )
-
-type=Single
-ptype=RegExp
-pattern=PORTSCAN FROM ([\d.]+) TO ([\d.]+):(\d+)
-context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3
-continue=TakeNext
-desc=Scanned destination IP: $2
-action=eval %o ( $portscans{"$1:$3"}->{$2} = 1 ); \
-       add HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 %t: %s;\
-       set HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 60 \
-       eval %o ( delete $portscans{"$1:$3"} )
-
-type=Single
-ptype=RegExp
-pattern=PORTSCAN FROM ([\d.]+) TO ([\d.]+):(\d+)
-context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \
-        && =( scalar(keys(%{$portscans{"$1:$3"}})) > 10 )
-continue=DontCont
-desc=$1 has scanned more than 10 destinations
-action=report HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \
-       mail -s 'Horizontal port sweep from $1 target port $3' root@example.com; \
-       delete HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3; \
-       eval %o ( delete $portscans{"$1:$3"} )
--- a/sec.logrotate
+++ b/sec.logrotate
@ -3,6 +3,6 @@
    notifempty
    sharedscripts
    postrotate
-        [ ! -f /run/sec.pid ] || kill -USR2 `cat /run/sec.pid`
+        /usr/bin/systemctl kill --signal=USR2 --kill-whom=main sec.service 2>/dev/null || true
    endscript
 }
--- a/sec.service
+++ b/sec.service
@ -5,7 +5,8 @@ After=syslog.target
 [Service]
 Type=forking
 PIDFile=/run/sec.pid
-ExecStart=/usr/bin/sec -detach -pid=/run/sec.pid -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents
+ExecStart=/usr/bin/sec --detach --pid=/run/sec.pid $OPTIONS
+EnvironmentFile=/etc/sysconfig/sec

 [Install]
 WantedBy=multi-user.target
--- a/sec.spec
+++ b/sec.spec
@ -1,39 +1,16 @@
 Name:           sec
-Version:        2.7.11
-Release:        0%{?dist}
+Version:        2.9.4
+Release:        2%{?dist}
 Summary:        Simple Event Correlator script to filter log file entries
-Group:          System Environment/Daemons
-License:        GPLv2+
-URL:            http://simple-evcorr.github.io/
-Source0:        http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz
+# Automatically converted from old format: GPLv2+ - review is highly recommended.
+License:        GPL-2.0-or-later
+URL:            https://simple-evcorr.github.io/
+Source0:        https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz
 Source1:        sec.service
 Source2:        sec@.service
 Source3:        sec.logrotate
-# Example files and configuration info
-Source4:        conf.README
-Source5:        http://simple-evcorr.sourceforge.net/rulesets/amavisd.sec
-Source6:        http://simple-evcorr.sourceforge.net/rulesets/bsd-MONITOR.sec
-Source7:        http://simple-evcorr.sourceforge.net/rulesets/bsd-PHYSMOD.sec
-Source8:        http://simple-evcorr.sourceforge.net/rulesets/bsd-USERACT.sec
-Source9:        http://simple-evcorr.sourceforge.net/rulesets/bsd-general.sec
-Source10:       http://simple-evcorr.sourceforge.net/rulesets/bsd-mpd.sec
-Source11:       http://simple-evcorr.sourceforge.net/rulesets/cisco-syslog.sec
-Source12:       http://simple-evcorr.sourceforge.net/rulesets/cvs.sec
-Source13:       http://simple-evcorr.sourceforge.net/rulesets/dameware.sec
-Source14:       http://simple-evcorr.sourceforge.net/rulesets/hp-openview.sec
-Source15:       http://simple-evcorr.sourceforge.net/rulesets/labrea.sec
-Source16:       http://simple-evcorr.sourceforge.net/rulesets/pix-general.sec
-Source17:       http://simple-evcorr.sourceforge.net/rulesets/pix-security.sec
-Source18:       http://simple-evcorr.sourceforge.net/rulesets/pix-url.sec
-Source19:       http://simple-evcorr.sourceforge.net/rulesets/portscan.sec
-Source20:       http://simple-evcorr.sourceforge.net/rulesets/snort.sec
-Source21:       http://simple-evcorr.sourceforge.net/rulesets/snortsam.sec
-Source22:       http://simple-evcorr.sourceforge.net/rulesets/ssh-brute.sec
-Source23:       http://simple-evcorr.sourceforge.net/rulesets/ssh.sec
-Source24:       http://simple-evcorr.sourceforge.net/rulesets/vtund.sec
-Source25:       http://simple-evcorr.sourceforge.net/rulesets/windows.sec
-#
-Source26:       sec.sysconfig
+Source4:        sec.sysconfig
+Source5:        conf.README
 BuildArch:      noarch

 BuildRequires:  perl-generators
@ -63,19 +40,10 @@ writing messages to pipes or files, etc.
 install -D -m 0755 -p sec        %{buildroot}%{_bindir}/sec
 install -D -m 0644 -p sec.man    %{buildroot}%{_mandir}/man1/sec.1
 install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_unitdir}/sec.service
+install -D -m 0644 -p %{SOURCE2} %{buildroot}%{_unitdir}/sec@.service
 install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec
-
-# Install the example config files and readme
-install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/README
-install -d -m 0755  examples
-install -m 0644 -p %{SOURCE5} %{SOURCE6} %{SOURCE7} %{SOURCE8} \
-                   %{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} \
-                   %{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} \
-                   %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} \
-                   %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} \
-                   %{SOURCE25} examples/
-install -m 0644 -p %{SOURCE2}  sec@.service
-install -m 0644 -p %{SOURCE26} sec.sysconfig
+install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/sec
+install -D -m 0644 -p %{SOURCE5} %{buildroot}%{_sysconfdir}/%{name}/README

 # Remove executable bits because these files get packed as docs
 chmod 0644 contrib/convert.pl contrib/swatch2sec.pl
@ -89,19 +57,114 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl
 %postun
 %systemd_postun_with_restart sec.service

-%clean
-rm -rf %{buildroot}
-
 %files
-%defattr(-,root,root,-)
-%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples sec@.service sec.sysconfig
+%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl
 %config(noreplace) %{_sysconfdir}/%{name}
 %config(noreplace) %{_sysconfdir}/logrotate.d/sec
+%config(noreplace) %{_sysconfdir}/sysconfig/sec
 %{_bindir}/sec
 %{_mandir}/man1/sec.1*
 %{_unitdir}/sec.service
+%{_unitdir}/sec@.service

 %changelog
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Thu Feb 12 2026 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.4-1
+- New upstream release
+- Use systemctl kill
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Sat Nov 02 2024 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.3-1
+- New upstream release
+
+* Fri Jul 26 2024 Miroslav Suchý <msuchy@redhat.com> - 2.9.2-5
+- convert license to SPDX
+
+* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Mon Jun 05 2023 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.2-1
+- New upstream release
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Wed May 04 2022 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.1-1
+- New upstream release
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Thu May 13 2021 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.0-1
+- New upstream release
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.8.3-4
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Sat May 2 2020 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.3-1
+- New upstream release
+
+* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Mon Jun 3 2019 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.2-1
+- New upstream release
+- Clean up spec file
+- Added an environment file /etc/sysconfig/sec in order to specify command line options
+
+* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.1-1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Wed Oct 3 2018 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.1-0
+- New upstream release
+
+* Sun Sep 2 2018 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.0-0
+- New upstream release
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.12-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.12-1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Wed Dec 13 2017 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.12-0
+- New upstream release
+
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.11-1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
 * Sun Feb 5 2017 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.11-0
 - New upstream release

--- a/sec.sysconfig
+++ b/sec.sysconfig
@ -1,7 +1,9 @@
-# This is an example config file if multiple instances of SEC should be started.
-# This file should be located in
-#     /etc/sysconfig/sec
-# and used together with the systemd service file
+# Command line options for SEC
+
+OPTIONS="--conf=/etc/sec/*.sec --input=/var/log/messages --log=/var/log/sec --intevents"
+
+# This is an example config if multiple instances of SEC should be started.
+# These settings should be used together with the systemd service file
 #     sec@.service
 # which allows to run multiple sec instances.
 #
@ -12,6 +14,6 @@
 # For further configuration options, consult the systemd file:
 #     /lib/systemd/system/sec@.service

-OPTIONS_FOO="-input=/var/log/messages"
+#OPTIONS_FOO="--conf=/etc/sec/FOO/*.sec --input=/var/log/secure --log=/var/log/sec-FOO --intevents"

-OPTIONS_BAR="-input=/var/log/syslog"
+#OPTIONS_BAR="--conf=/etc/sec/BAR/*.sec --input=/var/log/maillog --log=/var/log/sec-BAR --intevents"
--- a/sec@.service
+++ b/sec@.service
@ -5,7 +5,7 @@ After=syslog.target
 [Service]
 Type=forking
 PIDFile=/run/sec-%I.pid
-ExecStart=/usr/bin/sec -detach -pid=/run/sec-%I.pid -conf=/etc/sec/%I/*.sec -input=/var/log/messages -log=/var/log/sec-%I -intevents $OPTIONS_%I
+ExecStart=/usr/bin/sec --detach --pid=/run/sec-%I.pid $OPTIONS_%I
 EnvironmentFile=/etc/sysconfig/sec

 [Install]
--- a/snort.sec
+++ b/snort.sec
@ -1,163 +0,0 @@
-####################################################################
-#                Sample SEC ruleset for Snort IDS
-#
-# Copyright (C) 2003-2009 Risto Vaarandi
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-####################################################################
-
-# ------------------------------------------------------------------
-# Handle portscans
-# ------------------------------------------------------------------
-
-# For every completed portscan, add an entry to the PORTSCAN_REPORT;
-# also generate a meta-event ACTIVITY_FROM for the IP 
-
-type=Single
-ptype=RegExp
-pattern=End of portscan from (([\d.]+).*)
-desc=Portscan from $1
-action=add PORTSCAN_REPORT %t: %s; event ACTIVITY_FROM_$2: %s
-
-
-# ------------------------------------------------------------------
-# Recognize snort alert message and generate corresponding SEC event
-# ------------------------------------------------------------------
-
-# recognize snort alert message; also generate 
-# a meta-event ACTIVITY_FROM for the IP
-
-type=Single
-ptype=RegExp
-pattern=snort(?:\[\d+\])?: \[[0-9:]+\] (.+|!Malware|!MALWARE) \[(.+)\] \[.*Priority: (\d+)\]: \S+ ([\d.]+):?\d* -> ([\d.]+):?\d*
-desc=PRIORITY $3 INCIDENT FROM $4 TO $5: $1 [$2]
-action=event %s; event ACTIVITY_FROM_$4: $1
-
-
-## Detect if it's an unwanted event in snort
-#type=Single
-#ptype=RegExp
-#pattern=(MALWARE|Malware)
-#desc=$0
-#action=create UNWANTED_EVENT
-
-
-# ------------------------------------------------------------------
-# Handle priority 1 incidents
-# ------------------------------------------------------------------
-
-# Detect the beginning of priority 1 attack from a certain source IP,
-# and send a warning e-mail message that a new attack has begun;
-# also create a context for storing a detailed information about the attack
-
-type=Single
-ptype=RegExp
-pattern=PRIORITY 1 INCIDENT FROM ([\d.]+) TO [\d.]+:
-context=ATTACK_FROM_$1
-continue=TakeNext
-desc=Priority 1 attack started from $1
-action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' \
-       /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1' alerts@example.com
-
-
-# For every priority 1 incident, add an entry to the context by its IP;
-# if the IP has been quiet for 5 minutes, report the whole attack
-
-type=Single
-ptype=RegExp
-pattern=PRIORITY 1 INCIDENT FROM ([\d.]+) TO ([\d.]+): (.+)
-context=ATTACK_FROM_$1
-continue=TakeNext
-desc=Priority 1 incident from $1 to $2: $3
-action=add ATTACK_FROM_$1 %t: %s; \ 
-       set ATTACK_FROM_$1 300 ( report ATTACK_FROM_$1 \
-       /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1 (report)' alerts@example.com )
-
-
-# ------------------------------------------------------------------
-# Handle incidents by thresholding
-# ------------------------------------------------------------------
-
-# Count how many _certain type_ of incidents are coming from one source
-# if the threshold has been crossed, reset the counting operation started
-# by the next rule, in order to avoid duplicate alerts for the same IP
-
-type=SingleWithThreshold
-ptype=RegExp
-pattern=PRIORITY (\d+) INCIDENT FROM ([\d.]+) TO [\d.]+: (.+)
-continue=TakeNext
-desc=Snort has seen >= 30 priority $1 incidents from $2: $3
-action=add ALERT_REPORT %t: %s; \
-       reset +1 Snort has seen >= 150 incidents from $2; \
-       create TURNOFF_$2 3600
-thresh=30
-window=3600
-
-
-# Count how many incidents come from one source
-
-type=SingleWithThreshold
-ptype=RegExp
-pattern=PRIORITY \d+ INCIDENT FROM ([\d.]+) TO [\d.]+:
-context=!TURNOFF_$1
-desc=Snort has seen >= 150 incidents from $1
-action=add ALERT_REPORT %t: %s
-thresh=150
-window=7200
-
-
-# ------------------------------------------------------------------
-# Report IPs that have been active for some time
-# ------------------------------------------------------------------
-
-# Set up activity contexts for the IP; if the IP has been active for 2 hours, 
-# and there have been no gaps longer than 30 minutes, report its activities
-
-type=Single
-ptype=RegExp
-pattern=ACTIVITY_FROM_([\d.]+):
-context=!ACTIVITY_LIST_FOR_$1
-continue=TakeNext
-desc=Create activity contexts for $1
-action=create ACTIVITY_LIST_FOR_$1_LIFETIME; \
-       create ACTIVITY_LIST_FOR_$1 7200 ( report ACTIVITY_LIST_FOR_$1 \
-       /usr/bin/mail -s 'SNORT: $1 has been active for 2 hours' alerts@example.com; \
-       delete ACTIVITY_LIST_FOR_$1_LIFETIME )
-
-
-# Add the activity event to the context of a given IP, and extend
-# the lifetime of activity contexts for 30 minutes for the IP 
-
-type=Single
-ptype=RegExp
-pattern=ACTIVITY_FROM_([\d.]+): (.*)
-context=ACTIVITY_LIST_FOR_$1
-desc=Activity from $1: $2
-action=add ACTIVITY_LIST_FOR_$1 %t: %s; \
-       set ACTIVITY_LIST_FOR_$1_LIFETIME 1800 ( delete ACTIVITY_LIST_FOR_$1 )
-
-
-# ------------------------------------------------------------------
-# Send reports every day at 9:00 am
-# ------------------------------------------------------------------
-
-# send daily report about regular alerts
-
-type=Calendar
-time=0 12 * * *
-desc=Sending alert report...
-action=report ALERT_REPORT \
-       /usr/bin/mail -s 'SNORT: Hourly alert report' alerts@example.com; \
-       delete ALERT_REPORT
-
-
-# send daily report about portscans
-
-type=Calendar
-time=0 9 * * *
-desc=Sending portscan report...
-action=report PORTSCAN_REPORT \
-       /usr/bin/mail -s 'SNORT: daily portscan report' alerts@example.com; \
-       delete PORTSCAN_REPORT
-
--- a/snortsam.sec
+++ b/snortsam.sec
@ -1,77 +0,0 @@
-#############################################################################
-# Snort SAM events
-#
-# Copyright (C) 2003-2009 Matt Jonkman
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#############################################################################
-
-type=single
-ptype=regexp
-pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Error: Could not bind socket.
-desc = $0
-action=pipe '$1 Snortsam Bind Failed -- NEEDS ATTENTION!: %s' /usr/bin/mail -s "Snortsam Bind Failure: NEEDS ATTENTION on $1" alerts@example.com
-
-
-type=single
-ptype=regexp
-pattern=([A-Za-z0-9._-]+) root: (.*), email, Error: \[email\] Did not receive a response waiting for banner on mail server at (.*)
-desc = $0
-action=add SNORTSAM_REPORT $1 Couldn't email through $3 : %s
-
-type=single
-ptype=regexp
-pattern=([A-Za-z0-9._-]+) snortsam, Extending block for host ([A-z._0-9-]*) completely for (.*)
-desc = $0
-action=add SNORTSAM_REPORT $1 Extending Block for $3 for $4
-
-
-#type=single
-#ptype=regexp
-#pattern=([A-Za-z0-9._-]+)snortsam\[([0-9]+)\]: [*], [:0-9]+, -, ipf, (.*) Failed
-#desc = Snortsam ipf error
-#action=pipe '$1 Snortsam IPF Command Failed' /usr/bin/mail -s "%s" alerts@example.com
-##action=add SNORTSAM_REPORT ERROR $1 IPF Command Failure: $2
-
-
-type=single
-ptype=regexp
-pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Starting to listen for Snort alerts.
-desc = $0
-action=add SNORTSAM_REPORT $1 Snortsam Startup: %s
-
-
-#type=single
-#ptype=regexp
-#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Removing (.*) complete block for host (.*).
-#desc = $0
-#action=add SNORTSAM_REPORT $1 Snortsam Removing Block: %s
-
-#type=single
-#ptype=regexp
-#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Blocking host (.*) completely for (.*) \((Sig_ID: \d+\))\.
-#desc = $0
-#action=add SNORTSAM_REPORT $1 Snortsam Block: %s
-
-
-type=single
-ptype=regexp
-pattern=([A-Za-z0-9._-]+) root: (.*) ipf, Error: Command (.*) Failed
-desc = $0
-action=pipe '$1 Snortsam IPF Command Failed: $1 $2 $3' /usr/bin/mail -s "Snortsam IPF Command Failed on $1" alerts@example.com
-
-type=single
-ptype=regexp
-pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Snortsam Station .* using wrong password, trying to resync.
-desc = $0
-action=pipe '$1 Snortsam Password Failure: $1' /usr/bin/mail -s "Snortsam Password Failure on $1" alerts@example.com
-
-#Send hourly snortsam report
-
-type=Calendar
-time=0 * * * *
-desc=Sending snortsam report...
-action=report SNORTSAM_REPORT \
-       /usr/bin/mail -s 'SNORTSAM report' alerts@example.com; \
-       delete SNORTSAM_REPORT
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (sec-2.7.11.tar.gz) = 2de3c131f85029a91e7db1405be236b8ef31454bdffa28d5a2f912af73a2d0b0fbfb37a2f1548f7899ae3c43248e9c20084b7cb55a6b309c00d103d8b8019e80
+SHA512 (sec-2.9.4.tar.gz) = e049ea61e52420faddc2ad3373d9ec65cc6187d59e89537d919eb0342688e494c3d9db334347dbaf9a42260930c99756d46ed3f9f015a38bd95f6959ded047d9
--- a/ssh-brute.sec
+++ b/ssh-brute.sec
@ -1,69 +0,0 @@
-################## ssh brute force attack blocker
-# Copyright (C) 2003-2009 Mark Bergman
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-##################
-#
-# This sec ruleset monitors syslog messages for indications that an ssh brute-force
-# login attack is underway. The trigger is an ssh login failure.
-#
-# If 4 additional syslog messages about ssh login failures from the same
-# source address are received within next 1 minute, an iptables firewall
-# rule is added to block access from the source IP.
-#
-# After that, the correlation operation waits until no ssh login failure
-# syslog messages from the source IP have been received from the router
-# during the last 2 hours, and then the iptables rule is removed. By
-# definition, once the IP is blocked, there will be no more connection
-# attempt failures logged by ssh (ie., packets will be dropped by the kernel
-# before they reach the syslog daemon), so the rule will be flushed after
-# 2 hours.
-#
-# Vulnerabilities of this ruleset are:
-#
-#	persistent firewall rules:
-#		if the sec daemon crashes or is restarted, any existing rules
-#		will not be removed after 2hours
-#  
-#               window=60               # sliding window (1 minute) for initial event match
-#               thresh=4                # number of events (ssh login failures from a given IP) that must
-#                                               # occur within the window period in order to trigger the action
-#
-#               window2=7200    # sliding window (2 hours) for the second event match
-#               thresh2=0
-###############
-#  RCSversion="$Header: /home/bergman/RCS/ssh_block.sec,v 1.3 2006/05/02 04:18:44 bergman Exp bergman $"
-#
-# Representative log file entries:
-#       Aug 28 04:43:03 10.1.1.18 sshd(pam_unix)[22344]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=www.ace.ne.jp
-#       Aug 28 04:43:03 host sshd[22568]: Failed password for illegal user library from 210.230.187.218 port 55019 ssh2
-#       Aug 28 04:42:28 www.somehost.net sshd[9395]: Failed password for illegal user mysql from 210.230.187.218 port 52857 ssh2
-#       Aug 28 04:42:28 host sshd[22509]: Failed password for root from 210.230.187.218 port 52960 ssh2
-#       Aug 28 04:42:32 www.somehost.net sshd[9397]: Failed password for illegal user oracle from 210.230.187.218 port 53212 ssh2
-#       Aug 28 04:42:32 host sshd[22510]: Failed password for illegal user admin from 2 10.230.187.218 port 53243 ssh2
-
-#
-type=SingleWith2Thresholds
-ptype=RegExp
-pattern=sshd.*: authentication failure[ ;].* rhost=(\S+)
-desc=Multiple failed ssh authentication attempts from $1
-action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ;  /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP )
-window=60
-thresh=4
-desc2=Pruning iptables firewall rule blocking ssh from $1
-action2=logonly ; shellcmd  ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ;  /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP )
-window2=7200
-thresh2=0
-
-type=SingleWith2Thresholds
-ptype=RegExp
-pattern=sshd.*: Failed password for.* user .* from (\S+)
-desc=Multiple ssh password failures from $1
-action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ;  /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP )
-window=60
-thresh=4
-desc2=Pruning iptables firewall rule blocking ssh from $1
-action2=logonly ; shellcmd   ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; sleep 2;  /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP  ; sleep 2)
-window2=7200
-thresh2=0
--- a/ssh.sec
+++ b/ssh.sec
@ -1,260 +0,0 @@
-###########################################################################
-# SEC ruleset to accumulate errors from a parent and child sshd process
-# into a single context. This allows reporting of the authenticated
-# user information with the error's generated by the child sshd process.
-#
-# Copyright (C) 2003-2009 John P. Rouillard
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-###########################################################################
-
-# note handling of deferred reporting until after tie events received
-# is still in flux. My old rules hanlded it by resubmitting all the
-# events, but it didn't handle the parent defered reporting
-# events. This way is cleaner, but not tested very well.
-
-type=single
-continue=dontcont
-ptype=Nregexp
-pattern=sshd|SSHD
-desc=filter out non-sshd events
-action=none
-
-type=single
-continue=dontcont
-ptype=TValue
-pattern=TRUE
-desc=guard for already handled
-action=logonly
-context = [EVENT_PROCESSED]
-
-type=single
-continue=takenext
-ptype=TValue
-pattern=TRUE
-desc=We will handle.
-action=create EVENT_PROCESSED
-
-## Recognize the start of an ssh session
-# link parent and child event contexts.
-#
-#type=PairWithWindow
-#continue=takenext
-#desc=Recognize ssh session start for $1[$2]
-#ptype=regexp
-#pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Connection from ([0-9.]+) port [0-9]+
-#action=pipe session_log_$1_$2 \
-#    /usr/bin/mail -s "ssh failed to generate tie event for $1" alerts@example.com
-#desc2=Link parent and child contexts
-#ptype2=regexp
-#pattern2=$1 [A-z0-9]+\[[0-9]+\]: \[[^]]+\] SSHD child process +([0-9]+) spawned by $2
-#action2=copy session_log_%1_$1 %b; \
-#        delete session_log_%1_$1; \
-#        alias session_log_%1_%2 session_log_%1_$1; \
-#        add session_log_%1_$1 $0; \
-#        event 0 "sshd: Report %1_$1 if needed"; \
-#        alias session_log_owner_%1_%2 session_log_owner_%1_$1 ;\
-#        create tie_event_received_%1_%2 ;\
-#        alias tie_event_received_%1_%2 tie_event_received_%1_$1 ;\
-#	delete ssh_tie_event_needed_%1
-#window=60
-
-## recognize login event and save username for later use
-type=single
-desc=Start login timer
-ptype=regexp
-pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Accepted (publickey|password) for ([A-z0-9_-]+) from [0-9.]+ port [0-9]+ (.*)
-action=add session_log_$1_$2 $0; add session_log_owner_$1_$2 $4
-
-# handle logout
-type=single
-desc=Recognize ssh session end
-ptype=regexp
-pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Closing connection to ([0-9.]+)
-action= delete session_log_$1_$2; delete session_log_owner_$1_$2; \
-        delete tie_event_received_$1_$2
-
-## ignore ssh IPV6 errors.
-#
-# Example input:
-# Nov  3 06:34:25 corphost sshd[5961]: [ID 800047 auth.error] error: \
-#     connect_to ::1 port 5910: Network is unreachable
-#
-type=suppress
-desc = ignore IPV6 errors from ssh
-ptype=regexp
-pattern=sshd\[[0-9]+\]: \[ID 800047 auth.error\] error: connect_to ::1 port [0-9]+: Network is unreachable
-
-# because the tie command can come after critical errors are reported,
-# we provide a way to generate a report on demand.
-type=single
-desc=Report immediate on request.
-ptype=regexp
-pattern=^sshd: Report (.*) if needed$
-context = session_log_report_$1
-action= report session_log_$1 /usr/bin/mailx -s "sshd error on $1" alerts@example.com ;\
-        delete session_log_report_$1
-
-type=suppress
-desc=Discard report immediate event on request.
-ptype=regexp
-pattern=^sshd: Report (.*) if needed$
-
-# INSERT IMMEDIATE REPORT RULES HERE
-# rules that should report problems immediately should go here.
-# e.g. channel_setup_fwd_listener: cannot listen to port: 1521
-# where port is < 1024, or is some other well known port indicating
-# possible hacking.
-#
-# We have five possible cases:
-#   Event is from parent process and no info from child process is needed.
-#      Report normally.
-#   Event is from parent process and info from child process is needed,
-#      and tie event received (context tie_event_received_<host>_<pid>
-#      exists). Report normally.
-#   Event is from parent process and info from child process is needed,
-#      but tie event not received (context tie_event_received_<host>_<pid>
-#      does not exist).
-#      Report using child event as trigger.
-#   Event that has to be reported is from the child process and
-#      we have received the tie event (context 
-#      tie_event_received_<host>_<pid> exists). Just report normally.
-#   Event that has to be reported is from the child process and
-#      we haven't received the tie event (context
-#      tie_event_received_<host>_<pid> does not exist). Defer reporting
-#      until after tie event by setting context
-#      session_log_report_<hostname>_<child pid>.
-#
-# We may need two rules for each event if the event can come before the tie
-# event. One rule checks to see if the context ssh_tie_event_needed_$1
-# where $1 is the reporting host. If so then it needs to set the context
-# session_log_report_<host>_<pid> if generated by the child process. 
-
-# Note we get a less specific report this way. It should be retooled
-# to generate a context that the report rule can simply obsolete.
-# These events are generated by the child.
-type=single
-continue=takenext
-desc = record ssh channel_setup_fwd_listener error for $1 port < 1025
-ptype=regexp
-pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*)
-context = $3 < 1025 && ! tie_event_received_$1_$2
-action = add session_log_$1_$2 $0 ; \
-         create session_log_report_$1_$2
-
-type=single
-continue=takenext
-desc = record ssh channel_setup_fwd_listener error for $1 port < 1025
-ptype=regexp
-pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*)
-context = $3 < 1025 && tie_event_received_$1_$2
-action = add session_log_$1_$2 $0 ; \
-         report session_log_report_$1_$2 \
-             /usr/bin/mailx -s "sshd bind < 1025 on $1" alerts@example.com
-
-# end immediate rules here
-
-##  report/record ssh bind errors.
-#  Record ssh bind errors in the session log. Don't report unless
-#  we have more than 5 of them in a 10 minute period. Then go and
-#  find out why they are occurring. Probably a frustrated user 
-#  getting the -L options wrong.
-#
-#  We record all events until a 10 minute period has passed with no
-#  events. If the threshold is exceeded, then we report all events
-#  recorded during the 10 minute rolling window.
-#
-#  We also group channel_setup_fwd_listener with this.
-#
-# Example input:
-# Nov  4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: bind: \
-#   Address already in use
-#
-type=single
-continue=takenext
-desc = record ssh bind error for $1
-ptype=regexp
-pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use
-action = add session_log_$1_$2 $0 ; \
-         set ssh_port_forward_errors_$1_$2 600
-
-type=singlewiththreshold
-ptype=regexp
-pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use
-context = ssh_port_forward_errors_$1_$2
-desc = send report on ssh forward errors if pass threshold (bind)
-action = report session_log_$1_$2 \
-            /usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com; \
-         delete ssh_port_forward_errors_$1_$2
-thresh=5
-window=600
-
-#  Similar idea to ssh bind errors except on
-#  channel_setup_fwd_listener errors. If we have more than 5 
-#  of them in a 10 minute period, go and find out why they are occurring.
-#  Probably a frustrated user getting the -L options wrong.
-#
-#  We record all events until a 10 minute period has passed with no
-#  events. If the threshold is exceeded, then we report all events
-#  recorded during the 10 minute rolling window.
-#
-# Example input:
-# Nov  4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: \
-#   channel_setup_fwd_listener: cannot listen to port: 1521
-#
-
-type=single
-continue=takenext
-desc = record ssh channel_setup_fwd_listener error for $1
-ptype=regexp
-pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port:
-action = add session_log_$1_$2 $0 ; \
-         set ssh_channel_setup_errors_$1_$2 600
-
-type=singlewiththreshold
-ptype=regexp
-pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port:
-context = ssh_channel_setup_errors_$1_$2
-desc = send report on ssh channel setup errors
-action = report session_log_$1_$2 \
-            /usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com ; \
-         delete ssh_channel_setup_errors_$1_$2
-thresh=5
-window=600
-
-# Gather random sshd errors and report after 5 minutes
-#
-# This could have been set up a number of different ways, but I have one
-# rule to create the context only when it doesn't exist, and another rule
-# that adds to the context. The create rule also sets the 5 minute timeout
-# that will cause the event store to be delivered when it is deleted.
-#
-# Example input:
-# Nov  3 09:48:56 example sshd[7871]: [ID 800047 auth.crit] fatal: \
-#      Timeout before authentication for 37.117.12.201
-#
-type=single
-continue = takenext
-ptype=regexp
-pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]:
-desc = create context to report ssh errors for host $1 pid $2 in 5 minutes
-context = ! session_log_5min_timer_$1_$2
-action = create session_log_5min_timer_$1_$2 300 report session_log_$1_$2 \
-              /usr/bin/mailx -s "ssh errors for host $1 pid $2" alerts@example.com
-
-type=single
-continue = dontcont
-ptype=regexp
-pattern=([A-Za-z0-9._-]*) sshd\[([0-9]+)\]:
-desc = gather ssh errors for host $1
-action = add session_log_$1_$2 $0
-
-# Remove the handled context if we reach this point.
-type=single
-continue=dontcont
-ptype=TValue
-pattern=TRUE
-desc=delete EVENT_PROCESSED
-action=delete EVENT_PROCESSED
-
--- a/vtund.sec
+++ b/vtund.sec
@ -1,67 +0,0 @@
-#############################################################################
-# VTUN events
-#
-# Copyright (C) 2003-2009 Matt Jonkman
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#############################################################################
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (\S+)\[\S\] opened
-desc=$0
-action=add GENERAL_REPORT %t: %s;
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: BlowFish encryption initialized
-desc=$0
-action=add GENERAL_REPORT %t: VTUN Tunnel Opened on $1
-
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: VTun client ver\s+(.*)
-desc=$0
-action=add GENERAL_REPORT %t: VTUN Server Started on $1 version $2
-
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connecting to (.*)
-desc=$0
-action=add GENERAL_REPORT VTUN %s
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Denied connection from (\d+\.\d+\.\d+\.\d+):\d+
-desc=$0
-action=add GENERAL_REPORT %t: VTUN Connection DENIED by $1 from $2
-
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connection denied by (.*)
-desc=$0
-action=add GENERAL_REPORT %t: VTUN Connection DENIED by $2 for $1 
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Exit
-desc=$0
-action=add GENERAL_REPORT %t: VTUN Exit on $1
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Can't resolv server address: (.*)
-desc=$0
-action=add GENERAL_REPORT %t: VTUN Cannot Resolve Target $2 on $1
-
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (/S+) closed
-desc=$0
-action=add GENERAL_REPORT %t: VTUN Session $2 Closed on $1
-
--- a/windows.sec
+++ b/windows.sec
@ -1,44 +0,0 @@
-#############################################################################
-# Windows events
-#
-# Copyright (C) 2003-2009 Matt Jonkman
-# This is free software. You may redistribute copies of it under the terms of 
-# the GNU General Public License version 2.
-# There is NO WARRANTY, to the extent permitted by law.
-#############################################################################
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+ESE: N/A: Information Store \(\d+\) Online defragmentation (.*)
-desc=$0
-action=add GENERAL_REPORT EXCHANGE DEFRAG%t: %s;
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Userenv: NT AUTHORITY\\SYSTEM: Windows cannot determine the user or computer name\. Return value \(1326\).
-desc=$0
-action=add GENERAL_REPORT %t: %s
-
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Locked Out: Target Account Name: (\S+) .*
-desc=$0
-action=pipe '$1 Windows Account Lockout: %s' /usr/bin/mail -s "Windows Account Locked on $1" alerts@example.com
-
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Changed: (/S+)\. .*
-desc=$0
-action=pipe '$1 Windows Account Change: %s' /usr/bin/mail -s "Windows Account Changed on $1: $2" alerts@example.com
-
-
-type=Single
-ptype=RegExp
-pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+NetBT: N\/A: A duplicate name has been detected on the TCP network\. .*
-desc=$0
-action=pipe '$1 Duplicate Netbios Name Detected: %s' /usr/bin/mail -s "Duplicate Netbios Name on $1" alerts@example.com
-
-
-
Author	SHA1	Message	Date
Fedora Release Engineering	673d78a7ee	Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild	2026-07-17 06:22:15 +00:00
Stefan Schulze Frielinghaus	a8be234577	New upstream release	2026-02-12 20:17:04 +01:00
Stefan Schulze Frielinghaus	f98d7584f2	Use systemctl kill	2026-02-12 19:59:48 +01:00
Fedora Release Engineering	6fcadc7767	Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild	2026-01-17 17:51:48 +00:00
Fedora Release Engineering	d3c773862a	Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild	2025-07-25 18:07:19 +00:00
Fedora Release Engineering	84cb4232c1	Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild	2025-01-19 10:21:48 +00:00
Stefan Schulze Frielinghaus	e70079df1c	New upstream release	2024-11-02 14:00:58 +01:00
Miroslav Suchý	aeb001a308	convert GPLv2+ license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4	2024-07-26 02:53:48 +02:00
Fedora Release Engineering	f6f4654bb3	Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild	2024-07-20 05:12:08 +00:00
Fedora Release Engineering	71f285502b	Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild	2024-01-27 02:30:13 +00:00
Fedora Release Engineering	859c94ecc9	Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2023-07-22 01:21:36 +00:00
Stefan Schulze Frielinghaus	68141661df	New upstream release	2023-06-05 21:14:35 +02:00
Fedora Release Engineering	6f5e02cee4	Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2023-01-21 02:57:20 +00:00
Fedora Release Engineering	6706d12928	Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2022-07-23 08:19:43 +00:00
Stefan Schulze Frielinghaus	b4216e8e86	New upstream release	2022-05-04 19:26:38 +02:00
Fedora Release Engineering	02d5ec1c0d	- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2022-01-22 00:38:15 +00:00
Fedora Release Engineering	c516a59378	- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2021-07-23 17:19:26 +00:00
Stefan Schulze Frielinghaus	c6313ef3ee	New upstream release	2021-05-13 11:28:32 +02:00
Zbigniew Jędrzejewski-Szmek	b455c3dca0	Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583.	2021-03-02 16:12:20 +01:00
Fedora Release Engineering	e07ca8952e	- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2021-01-27 20:10:36 +00:00
Fedora Release Engineering	3035affb40	- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2020-07-29 10:30:06 +00:00
Stefan Schulze Frielinghaus	ab73b195be	New upstream release	2020-05-02 17:01:15 +02:00
Fedora Release Engineering	b559d72f8e	- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2020-01-30 23:10:32 +00:00
Fedora Release Engineering	b944d41cb9	- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2019-07-26 23:02:09 +00:00
Stefan Schulze Frielinghaus	7d72ccb757	- New upstream release - Clean up spec file - Added an environment file /etc/sysconfig/sec in order to specify command line options	2019-06-06 19:47:55 +02:00
Fedora Release Engineering	396b86cb01	- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2019-02-02 15:09:17 +00:00
Igor Gnatenko	d46d8d5c5f	Remove obsolete Group tag References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag	2019-01-28 20:24:49 +01:00
Stefan Schulze Frielinghaus	f14e51518e	New upstream release	2018-10-03 19:52:44 +02:00
Stefan Schulze Frielinghaus	b7b7a56cfd	New upstream release sources	2018-09-02 14:07:53 +02:00
Stefan Schulze Frielinghaus	7c7145cdb7	New upstream release	2018-09-02 14:04:43 +02:00
Fedora Release Engineering	b0d5827e00	- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2018-07-14 05:55:40 +00:00
Jason Tibbitts	11f2b3f9e2	Remove needless use of %defattr	2018-07-10 01:19:51 -05:00
Igor Gnatenko	fd052c3ece	Remove %clean section None of currently supported distributions need that. Last one was EL5 which is EOL for a while. Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>	2018-02-14 07:39:09 +01:00
Fedora Release Engineering	b39775d633	- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2018-02-09 16:27:32 +00:00
Stefan Schulze Frielinghaus	e25b46f607	New upstream release	2017-12-13 18:14:18 +01:00
Fedora Release Engineering	2deab26354	- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild	2017-07-27 18:23:22 +00:00