summaryrefslogtreecommitdiff
path: root/security/prelude-lml
AgeCommit message (Collapse)AuthorFilesLines
2008-06-16Add missing directory.joerg1-1/+3
2008-04-28Update to 0.9.12.2. Changes:shannonjr5-26/+30
- [rulesets]: Remove successful/failure keyword from classification (use IDMEF completion). Analyzer class sanitization. - [nagios] Handle Nagios V2 log entry (fix #283). - [spamassassin] Fix incorrect AdditionalData assignement. - New Suhosin ruleset, by Sebastien Tricaud <toady@inl.fr> - Fix invalid logfile inconsistency alert that could be triggered in a rare case, after a renaming detection. Alert improvement. - On logfile inconsistency alert, do not re-analyze the whole file. - Remove the 1024 bytes per PCRE reference limit. - Minor bug fixes, build system cleanup.
2008-03-06Recursive PKGREVISION bump for gnutls-2.2.2 update with shlib major bump.wiz1-2/+2
2007-10-29PLIST correctionshannonjr2-7/+3
2007-09-05PLIST fixshannonjr1-1/+5
2007-09-05Corrected my misunderstanding of CONF_FILESshannonjr3-44/+100
infrastrure. Fixed several configuration file installation problems.
2007-09-03Update to 0.9.10.1. Changes:shannonjr2-7/+8
- Make SSH rules IPv6 compliants, allowing to merge old IPv6 only rules with IPv4 rules. Some additional minor bug fixes (fix #232). - Fix incorrect target user assignment, as well as incorrect PCRE reference in assessment.impact.description (Paul Robert Marino <prmarino1@gmail.com>) (fix #232). - CISCO router acl lists can now use names instead of numbers. This made rule id=500 in cisco-router.rules fail to alert on packet denys on newer cisco devices (Paul Robert Marino <prmarino1@gmail.com>). - Fix Apache formating when Apache logname or user is set (Robin Gruyters <r.gruyters@yirdis.nl> and <andre@vandervlies.xs4all.nl>) (fix #229). - Invalid user.user_id(0).name assignement in SSH rule 1913 (Scott Olihovik <skippylou@gmail.com>) (fix #243). - Various bug fixes and minor improvements.
2007-08-04Update to 0.9.10. Changes:shannonjr2-7/+6
- Ability to use regular expressions in plugins.rules to define monitored sources, this can be very useful when combined to file globing. - [SPEEDUP] When the "*" keyword is used, the data is passed to the upper layer without trying to match anything. - Fix NULL pointer dereference when a rule reference an existing, but empty context (fix #226). - Remove deprecated use of prelude_client_print_setup_error(), directly handled via prelude_perror(). - Make the log parser more robust.
2007-07-04Make it easier to build and install packages "unprivileged", wherejlam1-1/+4
the owner of all installed files is a non-root user. This change affects most packages that require special users or groups by making them use the specified unprivileged user and group instead. (1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to unprivileged.mk. These two variables are lists of other bmake variables that define package-specific users and groups. Packages that have user-settable variables for users and groups, e.g. apache and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP}, etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER} and ${UNPRIVILEGED_GROUP}. (2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS.
2007-06-05opencdk shlib major changed; bump ABI depends and PKGREVISIONs ofwiz1-1/+2
affected packages.
2007-05-12Update to 0.9.9. Changes:shannonjr3-7/+9
- Pattern can now be used to specify file to be monitored. - Fix an issue in the detection of buggy writev() FAM notification. - Add bonding.rules, by Paul Robert Marino <prmarino1@gmail.com>. - ModSecurity ruleset update: remove unnecessary fields + ModSecurity 2.0 compatibility. - New Cisco IOS common ruleset, by Alexandre Racine. - Avoid duplicating information in node name and node address. - Add rule ID and revision to the generated alert for each matched rule. Fix #206. - Handle "last" keyword even if the rule does not contain any IDMEF assignment. Fix #218. - Various bug fixes.
2007-02-23Update to 0.9.8.1. Changes:shannonjr3-8/+13
- Various portability fixes. - Introduce Cisco ASA IPS module support. - Introduce yum support. - Introduce Cacti thold plugin support. - Introduce Microsoft Cluster Service support. - Honeyd rules update and improvement. - Updated NAVCE rules; modified ClamAV rules for consistency. - Improve NTSyslog ruleset. - Added rule to ignore LML's "could not match prefix" log entries. - Fix format problem with Apache logs from western hemisphere (- versus + TZ). - Fix Squid process exited rule (#185).
2006-08-23Add master site entry for times when pkgsrc doesn't have the completelywiz1-2/+3
latest version.
2006-07-11Update to prelude-lml 0.9.6. Changes:shannonjr4-17/+17
- Fix a bug where some rules marked silent would trigger an alert. - Load Sonicwall and Spamassassin ruleset by default. - Fix rule syntax problem in Sonicwall ruleset. - Fix rule indexing problem in Squid ruleset. - Postfix rule consistency fix.
2006-05-26Modify run-prelude-lml to properly start prelude-lml as daemon. This worksshannonjr3-6/+22
around a problem where prelude-lml is not connecting to prelude-manager when passed the -d command line argument.
2006-05-22Added 2 missing files to PLISTshannonjr1-1/+3
2006-05-221) Update to 0.9.5shannonjr3-14/+26
2) Changed permissions on plugins.rules and prelude-lml.conf so that prelude-lml can run unpriviledged 3) Changed confdir in configure so that plugins.rules and prelude-lml.conf are found. Changes in 0.9.5: - Experimental context support (ala SEC): we now handle multiline log matching. - Update PAX rules so that it use the new context feature. - Don't exit on statistics signal, improve statistics precision, make them easier to read. - Fix some problem with user & group options. - text-output argument is optional. - New experimental ruleset: Sonicwall and Spamassassin. These need to be manually hooked to pcre.rules if you plan to use them. - Fix FAM activation switches.
2006-05-21Fixed pkglint warnings.rillig2-12/+12
2006-05-21It is spelled CONF_FILES_PERMS, USE_GNU_TOOLS is dead and remove somejoerg1-6/+6
bogus :Q.
2006-05-21Forgotten patchsums for last changes. Noticed by rillig.joerg1-2/+4
2006-05-20Forgotten patches.joerg2-0/+26
2006-05-20Use config file framework.joerg4-28/+89
2006-04-23Modify packages that set PKG_USERS and PKG_GROUPS to follow the newjlam1-2/+7
syntax as specified in pkgsrc/mk/install/bsd.pkginstall.mk:1.47.
2006-03-10Update to 0.9.4shannonjr2-7/+6
Changes: - Remove trailing space from regex we get from plugins.rules (this fix a match problem on log entry that didn't contain any space). - Add --user / --group option to drop privilege. However, make sure it is not allowed to open file that the target user can not read, because it would lead to failure when trying to re-open the logfile after a rotation. - Signal handling improvement. - Fix priority for --quiet option. - Use newer libprelude IDMEF_LIST_APPEND/IDMEF_LIST_PREPEND addition. - Add unhandled arguments warning.
2006-03-06Belatedly bump PKGREVISION for all libtasn1 dependencies, sincewiz1-2/+2
libtasn1 had a shlib major bump. Also update dependencies in bl3.mk files. Addresses PR 32998 by Robert Elz.
2006-02-05Recursive revision bump / recommended bump for gettext ABI change.joerg1-1/+2
2006-01-31Corrected problem in rc.subr script preventing PID referencing commandsshannonjr1-1/+2
from working.
2006-01-31Update to 0.9.2. Changes:shannonjr3-8/+17
- Get rid of the 1024 characters per line limitation (defined as per the syslog RFC), since LML is not limited to parsing input from syslog anymore. - Handle events in Clamav logging format as well as syslog. - Abstracted Squid chain regex to allow parsing of data directly from Squid log files. - Introduced support for openhostapd. - Began expanding rulesets with additional_data and vendor-specific classification data. - Various ruleset updates and bug fixes. Prelude-LML is a signature based log analyzer monitoring logfile and received syslog messages for suspicious activity. It handle events generated by a large set of components, including but not limited to: BigIP, Grsecurity, Honeyd, ipchains, Netfilter, ipfw, Nokia ipso, Nagios, Norton Antivirus Corporate Edition, NTsyslog, PAM, Portsentry, Postfix, Proftpd, ssh, etc.
2006-01-29Prelude is a hybrid IDS consisting of multipleshannonjr8-0/+307
sensors, managers, and a display console. Prelude-lml is the log file analyzer. It scans system log files and generates IDMEF alerts to the prelude-manager based on signature rulesets. This is one of sever new Prelude packages.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-17 03:35:43 +0000