# # Specfile for SEC, the simple event correlator # # https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345 # Name: sec Version: 2.4.1 Release: 1%{?dist} Summary: SEC (simple event correlator) Group: System Environment/Daemons License: GPL URL: http://www.estpak.ee/~risto/sec/ ################################################################################ Source0: http://dl.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.sysconfig Source2: sec.init Source3: sec.logrotate # Example files and configuration info Source100: conf.README Source101: http://www.estpak.ee/~risto/sec/examples/syslog-ng.txt Source102: 001_init.sec Source103: http://www.bleedingsnort.com/sec/amavisd.sec Source104: http://www.bleedingsnort.com/sec/bsd-MONITOR.sec Source105: http://www.bleedingsnort.com/sec/bsd-PHYSMOD.sec Source106: http://www.bleedingsnort.com/sec/bsd-USERACT.sec Source107: http://www.bleedingsnort.com/sec/clamav.sec Source108: http://www.bleedingsnort.com/sec/cvs.sec Source109: http://www.bleedingsnort.com/sec/dameware.sec Source110: http://www.bleedingsnort.com/sec/dbi-example.sec Source111: http://www.bleedingsnort.com/sec/general.sec Source112: http://www.bleedingsnort.com/sec/hp-openview.sec Source113: http://www.bleedingsnort.com/sec/labrea.sec Source114: http://www.bleedingsnort.com/sec/mpd.sec Source115: http://www.bleedingsnort.com/sec/pix-security.sec Source116: http://www.bleedingsnort.com/sec/pix-url.sec Source117: http://www.bleedingsnort.com/sec/portscan.sec Source118: http://www.bleedingsnort.com/sec/snort.sec Source119: http://www.bleedingsnort.com/sec/snortsam.sec Source120: http://www.bleedingsnort.com/sec/ssh-brute.sec Source121: http://www.bleedingsnort.com/sec/ssh.sec Source122: http://www.bleedingsnort.com/sec/vtund.sec Source123: http://www.bleedingsnort.com/sec/windows.sec BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildArch: noarch ################################################################################ Requires(post): chkconfig Requires(postun): initscripts Requires(preun): initscripts, chkconfig # The init script uses arrays, so we need bash Requires: bash # Not required specifically by SEC, but our examples use it so we might as well # create a requirement for logrotate. Requires: logrotate # Some alternate names for the package that users might search for Provides: simple-evcorr Provides: sec.pl ################################################################################ %description SEC is an open source and platform independent event correlation tool that was designed to fill the gap between commercial event correlation systems and homegrown solutions that usually comprise a few simple shell scripts. SEC accepts input from regular files, named pipes, and standard input, and can thus be employed as an event correlator for any application that is able to write its output events to a file stream. ################################################################################ %prep %setup -q # Replace some tags in the config files sed -i -e 's/@@NAME@@/%{name}/' \ %{SOURCE1} \ %{SOURCE2} \ %{SOURCE3} # Fix the bindir in case a user wants it put in a different location sed -i -e 's#/usr/bin/sec#%{_bindir}/sec#' \ %{SOURCE2} ################################################################################ %install rm -rf $RPM_BUILD_ROOT # Create the directories we'll need install -d -m 755 $RPM_BUILD_ROOT%{_initrddir} install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/log install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/run install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples # Install SEC and its associated files install -D -p -m 755 sec.pl $RPM_BUILD_ROOT%{_bindir}/sec install -D -p -m 644 sec.pl.man $RPM_BUILD_ROOT%{_mandir}/man1/sec.1 install -p -m 644 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/sec install -p -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/sec install -p -m 755 %{SOURCE2} $RPM_BUILD_ROOT%{_initrddir}/sec # Install the example config files and readme install -p -m 644 %{SOURCE100} \ $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/README install -p -m 644 %{SOURCE101} \ $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/syslog-ng.sec install -p -m 644 %{SOURCE102} \ %{SOURCE103} \ %{SOURCE104} \ %{SOURCE105} \ %{SOURCE106} \ %{SOURCE107} \ %{SOURCE108} \ %{SOURCE109} \ %{SOURCE110} \ %{SOURCE111} \ %{SOURCE112} \ %{SOURCE113} \ %{SOURCE114} \ %{SOURCE115} \ %{SOURCE116} \ %{SOURCE117} \ %{SOURCE118} \ %{SOURCE119} \ %{SOURCE120} \ %{SOURCE121} \ %{SOURCE122} \ %{SOURCE123} \ $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/ # Replace all "email.com" in sample scripts with an actual fake domain: example.com grep -rl 'email.com' $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/ \ | xargs sed -i -e 's/email.com/example.com/g' # Create ghost files so rpm doesn't complain about them being gone touch $RPM_BUILD_ROOT%{_localstatedir}/log/sec touch $RPM_BUILD_ROOT%{_localstatedir}/run/sec.pid ################################################################################ %post if [ $1 = 1 ]; then /sbin/chkconfig --add sec fi %preun if [ $1 = 0 ]; then /sbin/service sec stop > /dev/null 2>&1 || : /sbin/chkconfig --del sec fi %postun if [ $1 = 1 ]; then /sbin/service sec condrestart fi %clean rm -rf $RPM_BUILD_ROOT ################################################################################ %files %defattr(-,root,root,-) %doc ChangeLog COPYING README %config(noreplace) %{_sysconfdir}/sysconfig/sec %config(noreplace) %verify (not md5 size mtime) %{_sysconfdir}/logrotate.d/sec %{_sysconfdir}/%{name} %{_bindir}/sec %{_initrddir}/sec %{_mandir}/man1/* %ghost %verify (not md5 size mtime) %{_localstatedir}/log/sec %ghost %verify (not md5 size mtime) %{_localstatedir}/run/sec.pid ################################################################################ %changelog * Mon May 28 2007 Chris Petersen 2.4.1-1 - Update to 2.4.1 * Wed Dec 06 2006 Chris Petersen 2.4.0-1 - Update to 2.4.0 * Mon Jun 12 2006 Chris Petersen 2.3.3-4 - Change group to keep rpmlint happy - Fix permissions on the logrotate script * Thu Jun 08 2006 Chris Petersen 2.3.3-3 - Clean up spec - Add ghost file entries for the default logfile and pid - Add logrotate script - Add more bleedingsnort examples - Add pid to sec.sysconfig and completely rewrite to handle multiple instances - Fix download URL - Fix echo log command in 001_init.sec - Rewrite sysV init script to handle multiple instances (based loosely on vsftpd) * Mon May 01 2006 Didier Moens 2.3.3-2 - Change init script to not start by default in any runlevel * Fri Apr 28 2006 Didier Moens 2.3.3-1 - Upgrade to upstream 2.3.3 - Add status to init script * Thu Sep 22 2005 Didier Moens 2.3.2-4 - Update Source locations * Thu Sep 22 2005 Didier Moens 2.3.2-3 - Change permissions on /usr/bin/sec * Thu Sep 22 2005 Didier Moens 2.3.2-2 - Create initial startup rulesets - Add examples - Refine init script * Wed Sep 21 2005 Didier Moens 2.3.2-1 - First build