diff options
Diffstat (limited to 'security/ossec-hids-local-config')
7 files changed, 61 insertions, 50 deletions
diff --git a/security/ossec-hids-local-config/Makefile b/security/ossec-hids-local-config/Makefile index 44edf99..7b8390d 100644 --- a/security/ossec-hids-local-config/Makefile +++ b/security/ossec-hids-local-config/Makefile @@ -1,8 +1,8 @@ # $FreeBSD: head/security/ossec-hids-local-config/Makefile 485977 2018-11-27 01:58:02Z swills $ PORTNAME= ossec-hids -PORTVERSION= 3.1.0 -PORTREVISION= 1 +PORTVERSION= 3.2.0 +PORTREVISION= CATEGORIES= security PKGNAMESUFFIX= -${OSSEC_TYPE}-config @@ -47,14 +47,15 @@ NO_ARCH= yes OPTIONS_SUB= yes OPTIONS_SINGLE= FIREWALL -OPTIONS_SINGLE_FIREWALL= IPF IPFW PF +OPTIONS_SINGLE_FIREWALL= NOFW IPF IPFW PF -OPTIONS_DEFAULT+= IPF +OPTIONS_DEFAULT+= NOFW FIREWALL_DESC= Active Response Firewall PF_DESC= Packet Filter IPFW_DESC= ipfirewall IPF_DESC= ipfilter +NOFW_DESC= Custom or no firewall TEMPL_ENABLED_HEADER= template-header-enabled.xml TEMPL_DISABLED_HEADER= template-header-disabled.xml @@ -68,6 +69,7 @@ TEMPL_SAMPLE_DB= template-sample-database.xml PF_VARS= FW_DROP=pf.sh PKGMSG_FILES+=message-pf IPFW_VARS= FW_DROP=ipfw.sh IPF_VARS= FW_DROP=ipfilter.sh +NOFW_VARS= FW_DROP= .if defined(MAINTAINER_MODE) OSSEC_HOME= ${PREFIX}/${PORTNAME} diff --git a/security/ossec-hids-local-config/distinfo b/security/ossec-hids-local-config/distinfo index 38a6c3c..78bdadd 100644 --- a/security/ossec-hids-local-config/distinfo +++ b/security/ossec-hids-local-config/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1539459620 -SHA256 (ossec-ossec-hids-3.1.0_GH0.tar.gz) = e0e2987751badb95c2bf618531c7853b2289c910f796da85ff394c0faea43f50 -SIZE (ossec-ossec-hids-3.1.0_GH0.tar.gz) = 1886469 +TIMESTAMP = 1553010491 +SHA256 (ossec-ossec-hids-3.2.0_GH0.tar.gz) = b36cc4db73c265f5fd65f2b5450d69e332316612b5602a3e310ae8907e9d2548 +SIZE (ossec-ossec-hids-3.2.0_GH0.tar.gz) = 1896977 diff --git a/security/ossec-hids-local-config/files/pkg-deinstall.in b/security/ossec-hids-local-config/files/pkg-deinstall.in index 0de19bf..f9f3e7e 100644 --- a/security/ossec-hids-local-config/files/pkg-deinstall.in +++ b/security/ossec-hids-local-config/files/pkg-deinstall.in @@ -1,10 +1,19 @@ #!/bin/sh ossec_home="%%OSSEC_HOME%%" +fw_drop="%%FW_DROP%%" + +ar_bin_dir="${ossec_home}/active-response/bin" ossec_conf="${ossec_home}/etc/ossec.conf" agent_conf="${ossec_home}/etc/shared/agent.conf" if [ "$2" == "DEINSTALL" ]; then rm -f "${ossec_conf}" rm -f "${agent_conf}" + + if [ -n "${fw_drop}" ]; then + if [ "${ar_bin_dir}/${fw_drop}" -ef "${ar_bin_dir}/firewall-drop.sh" ]; then + rm -f "${ar_bin_dir}/firewall-drop.sh" + fi + fi fi diff --git a/security/ossec-hids-local-config/files/pkg-install.in b/security/ossec-hids-local-config/files/pkg-install.in index f164b9c..b8af2c8 100644 --- a/security/ossec-hids-local-config/files/pkg-install.in +++ b/security/ossec-hids-local-config/files/pkg-install.in @@ -1,6 +1,8 @@ #!/bin/sh ossec_home="%%OSSEC_HOME%%" +fw_drop="%%FW_DROP%%" + ar_bin_dir="${ossec_home}/active-response/bin" ossec_conf="${ossec_home}/etc/ossec.conf" ossec_conf_bak="${ossec_conf}.bak" @@ -8,7 +10,9 @@ agent_conf="${ossec_home}/etc/shared/agent.conf" agent_conf_bak="${ossec_home}/etc/agent.conf.bak" if [ "$2" == "POST-INSTALL" ]; then - ln -f "${ar_bin_dir}/%%FW_DROP%%" "${ar_bin_dir}/firewall-drop.sh" + if [ -n "${fw_drop}" ]; then + ln -f "${ar_bin_dir}/${fw_drop}" "${ar_bin_dir}/firewall-drop.sh" + fi if [ -e "${ossec_conf}" ]; then mv -f "${ossec_conf}" "${ossec_conf_bak}" diff --git a/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in b/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in index 37c2166..6591f57 100644 --- a/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in +++ b/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in @@ -15,6 +15,7 @@ <rootcheck> <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files> <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans> + <system_audit>/var/ossec/etc/shared/system_audit_pw.txt</system_audit> <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit> <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit> </rootcheck> diff --git a/security/ossec-hids-local-config/files/template-rules-default.xml.in b/security/ossec-hids-local-config/files/template-rules-default.xml.in index 5f34a6a..511d551 100644 --- a/security/ossec-hids-local-config/files/template-rules-default.xml.in +++ b/security/ossec-hids-local-config/files/template-rules-default.xml.in @@ -51,6 +51,7 @@ <include>ms_ipsec_rules.xml</include> <include>vmware_rules.xml</include> <include>ids_rules.xml</include> + <include>ms_powershell_rules.xml</include> <include>apache_rules.xml</include> <include>web_rules.xml</include> <include>zeus_rules.xml</include> @@ -78,6 +79,9 @@ <include>ms_firewall_rules.xml</include> <include>psad_rules.xml</include> <include>unbound_rules.xml</include> + <include>kesl_rules.xml</include> + <include>mhn_dionaea_rules.xml</include> + <include>mhn_cowrie_rules.xml</include> <include>local_rules.xml</include> <!-- Files not included by default --> diff --git a/security/ossec-hids-local-config/scripts/plist.sh b/security/ossec-hids-local-config/scripts/plist.sh index 6d61787..a58b25a 100644 --- a/security/ossec-hids-local-config/scripts/plist.sh +++ b/security/ossec-hids-local-config/scripts/plist.sh @@ -11,11 +11,17 @@ PLIST=$3 WORKDIR=$4 STAGEDIR=$5 -staged_plist="${WORKDIR}/.staged-plist" fixed_lines="" skip_lines="" skip_paths="" -sample_paths="/etc/command.conf.sample /etc/ossec.conf.d/900.local.conf.sample /etc/agent.conf.d/900.local.conf.sample" + +sample_paths=" +/etc/command.conf.sample +/etc/ossec.conf.d/900.local.conf.sample +/etc/agent.conf.d/900.local.conf.sample" + +NL=$'\n' +IFS=${NL} print_path() { local path="$1" @@ -28,15 +34,28 @@ print_path() { fi fi local user=`stat -f "%Su" "${full_path}"` - if [ "${user}" == "${USER}" ]; then + if [ "${user}" = "${USER}" ]; then user="" fi local group=`stat -f "%Sg" "${full_path}"` - if [ "${group}" == "${GROUP}" ]; then + if [ "${group}" = "${GROUP}" ]; then group="" fi local mode=`stat -f "%p" "${full_path}" | tail -c 5` - echo -e "${command}(${user},${group},${mode}) %%OSSEC_HOME%%${path}" >> "${PLIST}" + echo "${command}(${user},${group},${mode}) %%OSSEC_HOME%%${path}" >> "${PLIST}" +} + +contains() { + local list="$1" + local word="$2" + + for e in ${list}; do + if [ "${e}" = "${word}" ]; then + return 0 + fi + done + + return 1 } echo -n > "${PLIST}" @@ -45,16 +64,9 @@ print_path done_paths="" while read line; do - skip_line="" - for e in ${skip_lines}; do - if [ "${e}" == "${line}" ]; then - skip_line="${e}" - break - fi - done - if [ -z "${skip_line}" ]; then + if ! contains "${skip_lines}" "${line}"; then path="" - case $line in + case ${line} in "@dir %%OSSEC_HOME%%"*) path=`echo "${line}" | sed -e "s|@dir %%OSSEC_HOME%%||g"` ;; @@ -62,7 +74,7 @@ while read line; do path=`echo "${line}" | sed -e "s|%%OSSEC_HOME%%||g"` ;; "%%"*) - unchanged_lines="${unchanged_lines} ${line}" + unchanged_lines="${unchanged_lines}${NL}${line}" ;; esac if [ -n "${path}" ]; then @@ -70,33 +82,12 @@ while read line; do path="" for segment in ${segments}; do path="${path}/${segment}" - skip_path="" - for e in ${skip_paths}; do - if [ "${e}" == "${path}" ]; then - skip_path="${e}" - break - fi - done - if [ -n "${skip_path}" ]; then + if contains "${skip_paths}" "${path}"; then break fi - done_path="" - for e in ${done_paths}; do - if [ "${e}" == "${path}" ]; then - done_path="${e}" - break - fi - done - if [ -z "${done_path}" ]; then - done_paths="${done_paths} ${path}" - sample_path="" - for e in ${sample_paths}; do - if [ "${e}" == "${path}" ]; then - sample_path="${e}" - break - fi - done - if [ -n "${sample_path}" ]; then + if ! contains "${done_paths}" "${path}"; then + done_paths="${done_paths}${NL}${path}" + if contains "${sample_paths}" "${path}"; then print_path "${path}" @sample else print_path "${path}" @@ -105,9 +96,9 @@ while read line; do done fi fi -done < "${staged_plist}" +done < "${WORKDIR}/.staged-plist" -unchanged_lines="${unchanged_lines} ${fixed_lines}" +unchanged_lines="${unchanged_lines}${NL}${fixed_lines}" for line in ${unchanged_lines}; do echo "${line}" >> "${PLIST}" done |