summaryrefslogtreecommitdiff
path: root/security/prelude-lml/Makefile
AgeCommit message (Collapse)AuthorFilesLines
2012-07-05revbump for libpreluse requirement bumpdrochner1-2/+2
2012-03-03Recursive bump for pcre-8.30* (shlib major change)wiz1-2/+2
2011-11-11Remove patch-aa, it's a nop. Remove MAKE_DIRS for an entry that also hasjoerg1-4/+4
MAKE_DIRS_PERMS. Add user-destdir support.
2011-04-22recursive bump from gettext-lib shlib bump.obache1-2/+2
2009-12-15Recursive bump for libltdljoerg1-1/+2
2009-08-23Update to 0.9.15. Changes since 0.9.14:hasso1-6/+35
- Make the Prelude-LML UDP server IPv6 compatible. - Implement 'idmef-alter' and 'idmef-alter-force' option, alloing to include static values into IDMEF events generated using a given format. - New PPP/PPTPD/L2TP ruleset, by Alexander Afonyashin <firm <at> iname.com>, with slight modification from Pierre Chifflier <p.chifflier <at> inl.fr>. Close #340. - Fix CISCO VPN ruleset so that the 'Authentication rejected' rule will trigger even if the 'server' field does not contain a word (fix #328). - Remove dos-style end-of-lines (Closes #338) - Fixes possible off by one when parsing variable reference number, and remove un-needed check that would always evaluate to TRUE.Thanks Steve Grubb <sgrubb <at> redhat.com> for reporting this problem (and running flexelint on the Prelude sources)! - Update for libtool 2.x compatibility. - This simplify the whole regular expression handling a lot, making the code much easier to read, and fixing potential problem with ovector assignement. This code should also improve performance by a small factor. - Change CISCO references urls to their new location, add CISCO ASA rule to handle discarded tcp or udp packets. - Various fixes and update.
2008-10-18Update to 0.9.14. Changes:shannonjr1-2/+2
- Fix log file permission error, that could happen thought the user Prelude-LML was running as could access the file (#291). - ModSecurity ruleset update, by Dan Kopecek <dkopecek@redhat.com>: provides much more descriptive classification.text, add regexps for [file ..], [line ...], [tag ...] fields and fine tune targets/types (#321). - Deprecate Gamin/FAM support in favor of libev: the previous implementation had problem on SELinux enabled system due to Gamin server startup being triggered by other program, and thus using improper role for Prelude-LML. (#326). - Improved polling architecture by using Operating System specific backend when possible. - We now monitor files that are not immediately available for reading on startup: once the file can be monitored, libev provide us with a notification.
2008-08-26Update to 0.9.13. Changes:shannonjr1-5/+4
ModSecurity ruleset rewrite, by Peter Vrabec <pvrabec@redhat.com> and Dan Kopecek <dkopecek@redhat.com>. This ruleset handle ModSecurity 2.0 output. (Fix #216). - New rulesets for FreeBSD su attempts, by Alexander Afonyashin <firm@iname.com> (Fix #304). - Add additional format to the default configuration to deal with apache error_log file format, by Alexander Afonyashin <firm@iname.com> (Fix #307). - Normalize some classification: introduce Remote Login, and Credentials Change. Cleanup SSH ruleset, and remove duplicated rules.
2008-06-16Add missing directory.joerg1-1/+3
2008-04-28Update to 0.9.12.2. Changes:shannonjr1-3/+2
- [rulesets]: Remove successful/failure keyword from classification (use IDMEF completion). Analyzer class sanitization. - [nagios] Handle Nagios V2 log entry (fix #283). - [spamassassin] Fix incorrect AdditionalData assignement. - New Suhosin ruleset, by Sebastien Tricaud <toady@inl.fr> - Fix invalid logfile inconsistency alert that could be triggered in a rare case, after a renaming detection. Alert improvement. - On logfile inconsistency alert, do not re-analyze the whole file. - Remove the 1024 bytes per PCRE reference limit. - Minor bug fixes, build system cleanup.
2008-03-06Recursive PKGREVISION bump for gnutls-2.2.2 update with shlib major bump.wiz1-2/+2
2007-10-29PLIST correctionshannonjr1-2/+2
2007-09-05Corrected my misunderstanding of CONF_FILESshannonjr1-15/+70
infrastrure. Fixed several configuration file installation problems.
2007-09-03Update to 0.9.10.1. Changes:shannonjr1-3/+4
- Make SSH rules IPv6 compliants, allowing to merge old IPv6 only rules with IPv4 rules. Some additional minor bug fixes (fix #232). - Fix incorrect target user assignment, as well as incorrect PCRE reference in assessment.impact.description (Paul Robert Marino <prmarino1@gmail.com>) (fix #232). - CISCO router acl lists can now use names instead of numbers. This made rule id=500 in cisco-router.rules fail to alert on packet denys on newer cisco devices (Paul Robert Marino <prmarino1@gmail.com>). - Fix Apache formating when Apache logname or user is set (Robin Gruyters <r.gruyters@yirdis.nl> and <andre@vandervlies.xs4all.nl>) (fix #229). - Invalid user.user_id(0).name assignement in SSH rule 1913 (Scott Olihovik <skippylou@gmail.com>) (fix #243). - Various bug fixes and minor improvements.
2007-08-04Update to 0.9.10. Changes:shannonjr1-3/+2
- Ability to use regular expressions in plugins.rules to define monitored sources, this can be very useful when combined to file globing. - [SPEEDUP] When the "*" keyword is used, the data is passed to the upper layer without trying to match anything. - Fix NULL pointer dereference when a rule reference an existing, but empty context (fix #226). - Remove deprecated use of prelude_client_print_setup_error(), directly handled via prelude_perror(). - Make the log parser more robust.
2007-07-04Make it easier to build and install packages "unprivileged", wherejlam1-1/+4
the owner of all installed files is a non-root user. This change affects most packages that require special users or groups by making them use the specified unprivileged user and group instead. (1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to unprivileged.mk. These two variables are lists of other bmake variables that define package-specific users and groups. Packages that have user-settable variables for users and groups, e.g. apache and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP}, etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER} and ${UNPRIVILEGED_GROUP}. (2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS.
2007-06-05opencdk shlib major changed; bump ABI depends and PKGREVISIONs ofwiz1-1/+2
affected packages.
2007-05-12Update to 0.9.9. Changes:shannonjr1-2/+2
- Pattern can now be used to specify file to be monitored. - Fix an issue in the detection of buggy writev() FAM notification. - Add bonding.rules, by Paul Robert Marino <prmarino1@gmail.com>. - ModSecurity ruleset update: remove unnecessary fields + ModSecurity 2.0 compatibility. - New Cisco IOS common ruleset, by Alexandre Racine. - Avoid duplicating information in node name and node address. - Add rule ID and revision to the generated alert for each matched rule. Fix #206. - Handle "last" keyword even if the rule does not contain any IDMEF assignment. Fix #218. - Various bug fixes.
2007-02-23Update to 0.9.8.1. Changes:shannonjr1-2/+2
- Various portability fixes. - Introduce Cisco ASA IPS module support. - Introduce yum support. - Introduce Cacti thold plugin support. - Introduce Microsoft Cluster Service support. - Honeyd rules update and improvement. - Updated NAVCE rules; modified ClamAV rules for consistency. - Improve NTSyslog ruleset. - Added rule to ignore LML's "could not match prefix" log entries. - Fix format problem with Apache logs from western hemisphere (- versus + TZ). - Fix Squid process exited rule (#185).
2006-08-23Add master site entry for times when pkgsrc doesn't have the completelywiz1-2/+3
latest version.
2006-07-11Update to prelude-lml 0.9.6. Changes:shannonjr1-3/+2
- Fix a bug where some rules marked silent would trigger an alert. - Load Sonicwall and Spamassassin ruleset by default. - Fix rule syntax problem in Sonicwall ruleset. - Fix rule indexing problem in Squid ruleset. - Postfix rule consistency fix.
2006-05-26Modify run-prelude-lml to properly start prelude-lml as daemon. This worksshannonjr1-1/+2
around a problem where prelude-lml is not connecting to prelude-manager when passed the -d command line argument.
2006-05-221) Update to 0.9.5shannonjr1-5/+4
2) Changed permissions on plugins.rules and prelude-lml.conf so that prelude-lml can run unpriviledged 3) Changed confdir in configure so that plugins.rules and prelude-lml.conf are found. Changes in 0.9.5: - Experimental context support (ala SEC): we now handle multiline log matching. - Update PAX rules so that it use the new context feature. - Don't exit on statistics signal, improve statistics precision, make them easier to read. - Fix some problem with user & group options. - text-output argument is optional. - New experimental ruleset: Sonicwall and Spamassassin. These need to be manually hooked to pcre.rules if you plan to use them. - Fix FAM activation switches.
2006-05-21Fixed pkglint warnings.rillig1-10/+10
2006-05-21It is spelled CONF_FILES_PERMS, USE_GNU_TOOLS is dead and remove somejoerg1-6/+6
bogus :Q.
2006-05-20Use config file framework.joerg1-2/+22
2006-04-23Modify packages that set PKG_USERS and PKG_GROUPS to follow the newjlam1-2/+7
syntax as specified in pkgsrc/mk/install/bsd.pkginstall.mk:1.47.
2006-03-10Update to 0.9.4shannonjr1-3/+2
Changes: - Remove trailing space from regex we get from plugins.rules (this fix a match problem on log entry that didn't contain any space). - Add --user / --group option to drop privilege. However, make sure it is not allowed to open file that the target user can not read, because it would lead to failure when trying to re-open the logfile after a rotation. - Signal handling improvement. - Fix priority for --quiet option. - Use newer libprelude IDMEF_LIST_APPEND/IDMEF_LIST_PREPEND addition. - Add unhandled arguments warning.
2006-03-06Belatedly bump PKGREVISION for all libtasn1 dependencies, sincewiz1-2/+2
libtasn1 had a shlib major bump. Also update dependencies in bl3.mk files. Addresses PR 32998 by Robert Elz.
2006-02-05Recursive revision bump / recommended bump for gettext ABI change.joerg1-1/+2
2006-01-31Update to 0.9.2. Changes:shannonjr1-2/+4
- Get rid of the 1024 characters per line limitation (defined as per the syslog RFC), since LML is not limited to parsing input from syslog anymore. - Handle events in Clamav logging format as well as syslog. - Abstracted Squid chain regex to allow parsing of data directly from Squid log files. - Introduced support for openhostapd. - Began expanding rulesets with additional_data and vendor-specific classification data. - Various ruleset updates and bug fixes. Prelude-LML is a signature based log analyzer monitoring logfile and received syslog messages for suspicious activity. It handle events generated by a large set of components, including but not limited to: BigIP, Grsecurity, Honeyd, ipchains, Netfilter, ipfw, Nokia ipso, Nagios, Norton Antivirus Corporate Edition, NTsyslog, PAM, Portsentry, Postfix, Proftpd, ssh, etc.
2006-01-29Prelude is a hybrid IDS consisting of multipleshannonjr1-0/+53
sensors, managers, and a display console. Prelude-lml is the log file analyzer. It scans system log files and generates IDMEF alerts to the prelude-manager based on signature rulesets. This is one of sever new Prelude packages.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-20 00:57:26 +0000