rpms/sec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
sec/sec.spec
Chris Petersen d21467118d Upgrade to 2.4.1
2007-05-28 20:06:22 +00:00

236 lines
8.3 KiB
RPMSpec
Raw Permalink Blame History

#
# Specfile for SEC, the simple event correlator
#
# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345
#
Name: sec
Version: 2.4.1
Release: 1%{?dist}
Summary: SEC (simple event correlator)
Group: System Environment/Daemons
License: GPL
URL: http://www.estpak.ee/~risto/sec/
################################################################################
Source0: http://dl.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz
Source1: sec.sysconfig
Source2: sec.init
Source3: sec.logrotate
# Example files and configuration info
Source100: conf.README
Source101: http://www.estpak.ee/~risto/sec/examples/syslog-ng.txt
Source102: 001_init.sec
Source103: http://www.bleedingsnort.com/sec/amavisd.sec
Source104: http://www.bleedingsnort.com/sec/bsd-MONITOR.sec
Source105: http://www.bleedingsnort.com/sec/bsd-PHYSMOD.sec
Source106: http://www.bleedingsnort.com/sec/bsd-USERACT.sec
Source107: http://www.bleedingsnort.com/sec/clamav.sec
Source108: http://www.bleedingsnort.com/sec/cvs.sec
Source109: http://www.bleedingsnort.com/sec/dameware.sec
Source110: http://www.bleedingsnort.com/sec/dbi-example.sec
Source111: http://www.bleedingsnort.com/sec/general.sec
Source112: http://www.bleedingsnort.com/sec/hp-openview.sec
Source113: http://www.bleedingsnort.com/sec/labrea.sec
Source114: http://www.bleedingsnort.com/sec/mpd.sec
Source115: http://www.bleedingsnort.com/sec/pix-security.sec
Source116: http://www.bleedingsnort.com/sec/pix-url.sec
Source117: http://www.bleedingsnort.com/sec/portscan.sec
Source118: http://www.bleedingsnort.com/sec/snort.sec
Source119: http://www.bleedingsnort.com/sec/snortsam.sec
Source120: http://www.bleedingsnort.com/sec/ssh-brute.sec
Source121: http://www.bleedingsnort.com/sec/ssh.sec
Source122: http://www.bleedingsnort.com/sec/vtund.sec
Source123: http://www.bleedingsnort.com/sec/windows.sec
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildArch: noarch
################################################################################
Requires(post): chkconfig
Requires(postun): initscripts
Requires(preun): initscripts, chkconfig
# The init script uses arrays, so we need bash
Requires: bash
# Not required specifically by SEC, but our examples use it so we might as well
# create a requirement for logrotate.
Requires: logrotate
# Some alternate names for the package that users might search for
Provides: simple-evcorr
Provides: sec.pl
################################################################################
%description
SEC is an open source and platform independent event correlation tool that
was designed to fill the gap between commercial event correlation systems and
homegrown solutions that usually comprise a few simple shell scripts.
SEC accepts input from regular files, named pipes, and standard input, and can
thus be employed as an event correlator for any application that is able to
write its output events to a file stream.
################################################################################
%prep
%setup -q
# Replace some tags in the config files
sed -i -e 's/@@NAME@@/%{name}/' \
%{SOURCE1} \
%{SOURCE2} \
%{SOURCE3}
# Fix the bindir in case a user wants it put in a different location
sed -i -e 's#/usr/bin/sec#%{_bindir}/sec#' \
%{SOURCE2}
################################################################################
%install
rm -rf $RPM_BUILD_ROOT
# Create the directories we'll need
install -d -m 755 $RPM_BUILD_ROOT%{_initrddir}
install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/log
install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/run
install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d
install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig
install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples
# Install SEC and its associated files
install -D -p -m 755 sec.pl $RPM_BUILD_ROOT%{_bindir}/sec
install -D -p -m 644 sec.pl.man $RPM_BUILD_ROOT%{_mandir}/man1/sec.1
install -p -m 644 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/sec
install -p -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/sec
install -p -m 755 %{SOURCE2} $RPM_BUILD_ROOT%{_initrddir}/sec
# Install the example config files and readme
install -p -m 644 %{SOURCE100} \
$RPM_BUILD_ROOT%{_sysconfdir}/%{name}/README
install -p -m 644 %{SOURCE101} \
$RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/syslog-ng.sec
install -p -m 644 %{SOURCE102} \
%{SOURCE103} \
%{SOURCE104} \
%{SOURCE105} \
%{SOURCE106} \
%{SOURCE107} \
%{SOURCE108} \
%{SOURCE109} \
%{SOURCE110} \
%{SOURCE111} \
%{SOURCE112} \
%{SOURCE113} \
%{SOURCE114} \
%{SOURCE115} \
%{SOURCE116} \
%{SOURCE117} \
%{SOURCE118} \
%{SOURCE119} \
%{SOURCE120} \
%{SOURCE121} \
%{SOURCE122} \
%{SOURCE123} \
$RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/
# Replace all "email.com" in sample scripts with an actual fake domain: example.com
grep -rl 'email.com' $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/ \
| xargs sed -i -e 's/email.com/example.com/g'
# Create ghost files so rpm doesn't complain about them being gone
touch $RPM_BUILD_ROOT%{_localstatedir}/log/sec
touch $RPM_BUILD_ROOT%{_localstatedir}/run/sec.pid
################################################################################
%post
if [ $1 = 1 ]; then
/sbin/chkconfig --add sec
fi
%preun
if [ $1 = 0 ]; then
/sbin/service sec stop > /dev/null 2>&1 || :
/sbin/chkconfig --del sec
fi
%postun
if [ $1 = 1 ]; then
/sbin/service sec condrestart
fi
%clean
rm -rf $RPM_BUILD_ROOT
################################################################################
%files
%defattr(-,root,root,-)
%doc ChangeLog COPYING README
%config(noreplace) %{_sysconfdir}/sysconfig/sec
%config(noreplace) %verify (not md5 size mtime) %{_sysconfdir}/logrotate.d/sec
%{_sysconfdir}/%{name}
%{_bindir}/sec
%{_initrddir}/sec
%{_mandir}/man1/*
%ghost %verify (not md5 size mtime) %{_localstatedir}/log/sec
%ghost %verify (not md5 size mtime) %{_localstatedir}/run/sec.pid
################################################################################
%changelog
* Mon May 28 2007 Chris Petersen <rpm@forevermore.net> 2.4.1-1
- Update to 2.4.1
* Wed Dec 06 2006 Chris Petersen <rpm@forevermore.net> 2.4.0-1
- Update to 2.4.0
* Mon Jun 12 2006 Chris Petersen <rpm@forevermore.net> 2.3.3-4
- Change group to keep rpmlint happy
- Fix permissions on the logrotate script
* Thu Jun 08 2006 Chris Petersen <rpm@forevermore.net> 2.3.3-3
- Clean up spec
- Add ghost file entries for the default logfile and pid
- Add logrotate script
- Add more bleedingsnort examples
- Add pid to sec.sysconfig and completely rewrite to handle multiple instances
- Fix download URL
- Fix echo log command in 001_init.sec
- Rewrite sysV init script to handle multiple instances (based loosely on vsftpd)
* Mon May 01 2006 Didier Moens <Didier.Moens@dmbr.UGent.be> 2.3.3-2
- Change init script to not start by default in any runlevel
* Fri Apr 28 2006 Didier Moens <Didier.Moens@dmbr.UGent.be> 2.3.3-1
- Upgrade to upstream 2.3.3
- Add status to init script
* Thu Sep 22 2005 Didier Moens <Didier.Moens@dmbr.UGent.be> 2.3.2-4
- Update Source locations
* Thu Sep 22 2005 Didier Moens <Didier.Moens@dmbr.UGent.be> 2.3.2-3
- Change permissions on /usr/bin/sec
* Thu Sep 22 2005 Didier Moens <Didier.Moens@dmbr.UGent.be> 2.3.2-2
- Create initial startup rulesets
- Add examples
- Refine init script
* Wed Sep 21 2005 Didier Moens <Didier.Moens@dmbr.UGent.be> 2.3.2-1
- First build
Reference in a new issue View git blame Copy permalink