Bug 122647 - security/sguil-server, port upgrade, new version
Summary: security/sguil-server, port upgrade, new version
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Marcelo Araujo
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-04-11 04:50 UTC by pauls
Modified: 2008-05-03 14:30 UTC (History)
0 users

See Also:


Attachments
patch-pkg-plist (1.37 KB, text/plain)
2008-04-11 04:50 UTC, pauls
no flags Details
patch-files-sguild (2.05 KB, text/plain)
2008-04-11 04:50 UTC, pauls
no flags Details
patch-files-sguild.conf (2.50 KB, text/plain)
2008-04-11 04:50 UTC, pauls
no flags Details
pkg-install.in (13.42 KB, text/plain)
2008-04-11 04:50 UTC, pauls
no flags Details
patch-sguil-server (14.52 KB, application/octet-stream)
2008-04-28 06:45 UTC, pauls
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description pauls 2008-04-11 04:50:04 UTC
	This PR updates the security/sguil-server port to the new version - 0.7.0
	Committer: Please note - there are three sguil port; server, sensor & client
	All three must be updated at the same time.  Please do not commit this update
	without also committing the other two.  In addition, a repocopy of security/barnyard-sguil6
	to security/barnyard-squil is required in order for the sensor port to work.  So all four
	changes must be committed at the same time.

Fix: --- distinfo.orig	2006-10-30 20:43:25.000000000 -0600
+++ distinfo	2008-04-10 21:06:48.000000000 -0500
@@ -1,3 +1,3 @@
-MD5 (sguil-server-0.6.1.tar.gz) = 27decbe3c6528bf2c86c74b35b8f7b3b
-SHA256 (sguil-server-0.6.1.tar.gz) = 22aea8f76da0530ae7ee9a68efe1de7615bec47a7702c93f8fe338d57590ce57
-SIZE (sguil-server-0.6.1.tar.gz) = 92901
+MD5 (sguil-server-0.7.0.tar.gz) = 2ba67b1a98ed92f43072ecd98d9e15eb
+SHA256 (sguil-server-0.7.0.tar.gz) = 8ed845779c516b7bcb092454d339a26bca69f52689f9f07831fb41a3efe58809
+SIZE (sguil-server-0.7.0.tar.gz) = 103440
--- patch-distinfo ends here ---

--- files/pkg-message.in.orig	2006-10-30 20:43:25.000000000 -0600
+++ files/pkg-message.in	2008-04-10 21:06:48.000000000 -0500
@@ -2,11 +2,21 @@
          * !!!!!!!!!!! WARNING !!!!!!!!!!! *
          ***********************************
 
+PLEASE NOTE: If you are upgrading from a previous version,
+read the UPGRADE doc (in %%DOCSDIR%%) before proceeding!!!
+Some noteworthy changes in version 0.7.0:
+SSL is now required for server, sensor and client.
+The sguild.conf and sguild.email files have changed.
+You MUST run the upgrade_0.7.tcl script to clean up and
+prepare the database before running the new version.  BE SURE
+TO BACK UP YOUR DATABASE BEFORE PROCEEDING!!!
+
 If you had existing config files in %%PREFIX%%/etc/%%SGUILDIR%%
 they were not overwritten.  If this is a first time install, you
 must copy the sample files to the corresponding conf file and 
 edit the various config files for your site.  See the INSTALL
-doc in %%DOCSDIR%% for details.
+doc in %%DOCSDIR%% for details.  If this is an upgrade, replace
+your existing conf file with the new one and edit accordingly.
 
 The sql scripts for creating database tables were placed in
 the %%PREFIX%%/share/%%SGUILDIR%%/ directory.  PLEASE 
@@ -23,8 +33,12 @@
 %%PREFIX%%/etc/rc.d/.  To enable it, edit /etc/rc.conf
 per the instructions in the script.
 
+NOTE:  Sguild now runs under the sguil user account not root!
+
 For general questions, see the sguil faq: 
-http://sguil.sourceforge.net/index.php?page=faq
+http://www.vorant.com/nsmwiki/Sguil_FAQ or visit the nsm wiki:
+http://www.vorant.com/nsmwiki/Main_Page
+
 For detailed install instructions see Richard Bejtlich's
 excellent guide at his blog: 
 http://taosecurity.blogspot.com/2006/03/new-sguil-scripts-and-vm-i-have-not.html
--- patch-files-pkg-message.in ends here ---

--- files/patch-sguild.access.orig	2006-10-30 20:43:25.000000000 -0600
+++ files/patch-sguild.access	2008-04-10 21:06:48.000000000 -0500
@@ -1,12 +1,12 @@
---- sguild.access.orig	Tue Mar 28 03:36:31 2006
-+++ sguild.access	Tue Mar 28 03:37:44 2006
+--- sguild.access.orig	2008-04-03 17:55:46.000000000 -0500
++++ sguild.access	2008-04-03 17:56:50.000000000 -0500
 @@ -4,7 +4,8 @@
  # This file is used by sguild for access control. It is read upon init  #
  # or when sguild receives a HUP signal.                                 #
  #                                                                       #
 -# By default, sguild will look first for /etc/sguild/sguild.access,     #
 +# By default, sguild will look first for                                #
-+# /usrlocal//etc/sguild/sguild.access,                                  #
++# /usr/local/etc/sguild/sguild.access,                                  #       
  # then ./sguild.access unless the -A /path/to/sguild.access switch      #
  # is used.                                                              #
  #                                                                       #
--- patch-files-sguild.access ends here ---

--- files/sguild.sh.in.orig	2007-02-26 17:02:04.000000000 -0600
+++ files/sguild.sh.in	2008-04-10 21:06:48.000000000 -0500
@@ -21,12 +21,13 @@
 
 command="%%PREFIX%%/bin/${name}"
 procname="%%TCLSH%%"
-pidfile="/var/run/${name}.pid"
-check_pidfile="${pidfile} ${procname} /bin/sh"
+check_process="${procname}"
+sguild_user="sguil"
+pid="/var/run/%%SGUILDIR%%/${name}.pid"
 
 sguild_enable=${sguild_enable-NO}
 sguild_conf=${sguild_conf-%%PREFIX%%/etc/%%SGUILDIR%%/sguild.conf}
-sguild_flags=${sguild_flags--D}
+sguild_flags=${sguild_flags--D -P ${pid}}
 [ -n "$sguild_conf" ] && sguild_flags="$sguild_flags -c $sguild_conf"
 
 load_rc_config ${name}
--- patch-files-sguild.sh.in ends here ---



#!/bin/sh
#
# $FreeBSD$
#

USER="sguil"

# Make sure we're in the right stage of the process
if [ "$2" = "DEINSTALL" ]; then
	echo "Stopping sguild......"
	%%PREFIX%%/etc/rc.d/sguild stop
	%%PREFIX%%/etc/rc.d/sguild poll
	echo "Would you like to remove the sguild certs?" ; read ans
	case "$ans" in
	    y*|Y*)
		if [ -f %%PREFIX%%/etc/%%SGUILDIR%%/certs/sguild.key ]; then
			rm %%PREFIX%%/etc/%%SGUILDIR%%/certs/sguild.key
		fi
		if [ -f %%PREFIX%%/etc/%%SGUILDIR%%/certs/sguild.pem ]; then
			rm %%PREFIX%%/etc/%%SGUILDIR%%/certs/sguild.pem
		fi
		;;
	    n*|N*)
		;;
	    *)
		exit 64
		;;
	esac
	cd %%PREFIX%%/etc/%%SGUILDIR%% || exit 1
# Remove the conf files *if* they have not been altered
	for f in autocat.conf sguild.access sguild.conf sguild.email \
		sguild.queries sguild.reports sguild.users; do
		cmp -s -z ${f} ${f}-sample && rm ${f}
	done
# Remove the user and group if the installer chooses to
	echo "Would you like to remove the sguil user and group?" ; read ans
	case "$ans" in
	    y*|Y*)
		if pw usershow "${USER}" 2>/dev/null 1>&2; then 
			pw userdel -n sguil
		fi
		if pw groupshow "${USER}" 2>/dev/null 1>&2; then
			pw groupdel -n sguil
		fi
		;;
	    n*|N*)
		;;
	    *)
		;;
	esac
fi
if [ "$2" = "POST-DEINSTALL" ]; then
	# If the user exists, then display a message
	if pw usershow "${USER}" 2>/dev/null 1>&2; then
		echo "To delete the '${USER}' user permanently, use 'pw userdel ${USER}'"
	fi
	# If the group exists, then display a message
	if pw groupshow "${USER}" 2>/dev/null 1>&2; then
		echo "To delete the '${USER}' group permanently, use 'pw groupdel ${USER}'"
	fi
fi

exit 0
--- pkg-deinstall.in ends here -----Q6d9VCQ9phhFNXDzfoCkNPZm18rJE3i9vVDevB3tReXXSbXC
Content-Type: text/plain; name="patch-Makefile"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="patch-Makefile"

--- Makefile.orig	2007-01-16 06:45:12.000000000 -0600
+++ Makefile	2008-04-10 21:06:48.000000000 -0500
@@ -6,8 +6,7 @@
 #
 
 PORTNAME=	sguil-server
-PORTVERSION=	0.6.1
-PORTREVISION=	1
+PORTVERSION=	0.7.0
 CATEGORIES=	security
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE}
 MASTER_SITE_SUBDIR=	sguil
@@ -18,7 +17,6 @@
 RUN_DEPENDS=	p0f:${PORTSDIR}/net-mgmt/p0f \
 		tcpflow:${PORTSDIR}/net/tcpflow \
 		dtplite:${PORTSDIR}/devel/tcllib \
-		barnyard:${PORTSDIR}/security/barnyard-sguil6 \
 		${LOCALBASE}/lib/tclx8.4/tclx.tcl:${PORTSDIR}/lang/tclX
 LIB_DEPENDS=	tls:${PORTSDIR}/devel/tcltls
 
@@ -29,24 +27,33 @@
 WRKSRC=		${WRKDIR}/sguil-${PORTVERSION}
 PATCH_WRKSRC=	${WRKSRC}/server
 PLIST_SUB=	SGUILDIR=${SGUILDIR}
-SUB_FILES=	pkg-message
-SUB_LIST=	SGUILDIR=${SGUILDIR} TCLSH=${TCLSH_CMD}
-LIBRARIES=	SguildAccess.tcl SguildEvent.tcl SguildReportBuilder.tcl \
-		SguildAutoCat.tcl SguildGenericDB.tcl SguildSendComms.tcl \
+SUB_FILES=	pkg-message pkg-install pkg-deinstall
+SUB_LIST=	SGUILDIR=${SGUILDIR} TCLSH=${TCLSH_CMD} CURDIR=${.CURDIR} \
+		WRKSRC=${WRKSRC} DOCSDIR=${DOCSDIR}
+LIBRARIES=	SguildAccess.tcl SguildGenericDB.tcl SguildReportBuilder.tcl \
+		SguildAutoCat.tcl SguildGenericEvent.tcl SguildSendComms.tcl \
 		SguildClientCmdRcvd.tcl SguildHealthChecks.tcl SguildSensorAgentComms.tcl \
 		SguildConnect.tcl SguildLoaderd.tcl SguildSensorCmdRcvd.tcl \
 		SguildCreateDB.tcl SguildMysqlMerge.tcl SguildTranscript.tcl \
-		SguildEmailEvent.tcl SguildQueryd.tcl SguildUtils.tcl
-SCRIPTS=	create_ruledb.sql update_sguildb_v10-v11.sql update_sguildb_v8-v9.sql \
-		create_sguildb.sql update_sguildb_v5-v6.sql update_sguildb_v9-v10.sql \
-		migrate_event.tcl update_sguildb_v6-v7.sql migrate_sancp.tcl update_sguildb_v7-v8.sql
+		SguildEmailEvent.tcl SguildPadsLib.tcl SguildUtils.tcl \
+		SguildEvent.tcl SguildQueryd.tcl
+SCRIPTS=	create_ruledb.sql update_0.7.tcl update_sguildb_v7-v8.sql \
+		create_sguildb.sql update_sguildb_v10-v11.sql update_sguildb_v8-v9.sql \
+		migrate_event.tcl update_sguildb_v11-v12.sql update_sguildb_v9-v10.sql \
+		migrate_sancp.tcl update_sguildb_v5-v6.sql sancp_cleanup.tcl update_sguildb_v6-v7.sql
 CONFS=		autocat.conf sguild.access sguild.conf sguild.email sguild.queries sguild.reports sguild.users
 
-PORTDOCS=	CHANGES INSTALL INSTALL.openbsd LICENSE.QPL \
-		OPENSSL.README TODO USAGE sguildb.dia
+PORTDOCS=	CHANGES FAQ INSTALL INSTALL.openbsd LICENSE.QPL \
+		OPENSSL.README TODO UPGRADE USAGE sguildb.dia
+
+OPTIONS=	MYSQL50 "Install mysql50 server" off
 
 .include <bsd.port.pre.mk>
 
+.if defined(WITH_MYSQL50)
+RUN_DEPENDS+=	${LOCALBASE}/libexec/mysqld:${PORTSDIR}/databases/mysql50-server
+.endif
+
 MYSQLTCL_VER!=	cd ${PORTSDIR}/databases/mysqltcl && ${MAKE} -V PORTVERSION
 
 RUN_DEPENDS+=	${LOCALBASE}/lib/mysqltcl-${MYSQLTCL_VER}:${PORTSDIR}/databases/mysqltcl
@@ -56,10 +63,15 @@
 	@${REINPLACE_CMD} -e 's:exec tclsh:exec ${TCLSH_CMD}:g' ${WRKSRC}/server/${f}
 .endfor
 
-do-install:
-	@${MKDIR} ${PREFIX}/etc/${SGUILDIR}
+pre-su-install:
+	@${SETENV} ${SCRIPTS_ENV} PKG_PREFIX=${PREFIX} \
+		${SH} ${PKGINSTALL} ${PKGNAME} PRE-INSTALL
+
+pre-install:
 	@${MKDIR} ${PREFIX}/lib/${SGUILDIR}
 	@${MKDIR} ${PREFIX}/share/${SGUILDIR}
+	@${MKDIR} /var/run/${SGUILDIR}
+do-install:
 .for f in archive_sguildb.tcl sguild
 	${INSTALL_SCRIPT} -m 751 ${WRKSRC}/server/${f} ${PREFIX}/bin/${f}
 .endfor
@@ -80,6 +92,9 @@
 	@${MKDIR} ${DOCSDIR}
 	cd ${WRKSRC}/doc && ${INSTALL_DATA} ${PORTDOCS} ${DOCSDIR}
 .endif
+	@${SETENV} PKG_PREFIX=${PREFIX} && PORTSDIR=${PORTSDIR} \
+		${SH} ${PKGINSTALL} ${PKGNAME} POST-INSTALL
+
 	@${CAT} ${PKGMESSAGE}
 
 .include <bsd.port.post.mk>
Comment 1 Marcelo Araujo freebsd_committer freebsd_triage 2008-04-11 12:52:13 UTC
Responsible Changed
From-To: freebsd-ports-bugs->araujo

I'll take it.
Comment 2 Marcelo Araujo freebsd_committer freebsd_triage 2008-04-27 16:37:38 UTC
State Changed
From-To: open->feedback

This patch is malformed impossible to apply this.  You should re-work 
this patch and send again.  If you have some doubts how make this, 
please see this URL. 
http://sce-tindy.tecnik93.com/FreeBSD/How-to-submit-a-diff.txt
Comment 3 pauls 2008-04-28 06:45:31 UTC
--On April 27, 2008 3:37:48 PM +0000 araujo@FreeBSD.org wrote:

> Synopsis: security/sguil-server, port upgrade, new version
>
> State-Changed-From-To: open->feedback
> State-Changed-By: araujo
> State-Changed-When: Sun Apr 27 15:37:38 UTC 2008
> State-Changed-Why:
> This patch is malformed impossible to apply this.  You should re-work
> this patch and send again.  If you have some doubts how make this,
> please see this URL.
> http://sce-tindy.tecnik93.com/FreeBSD/How-to-submit-a-diff.txt
>
>
> http://www.freebsd.org/cgi/query-pr.cgi?pr=122647

A single patch for the entire port is attached.

Paul Schmehl (pauls@utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
Comment 4 dfilter service freebsd_committer freebsd_triage 2008-05-03 14:22:21 UTC
araujo      2008-05-03 13:22:16 UTC

  FreeBSD ports repository

  Modified files:
    security/sguil-client Makefile distinfo pkg-descr 
    security/sguil-client/files patch-sguil.conf patch-sguil.tk 
    security/sguil-server Makefile distinfo pkg-plist 
    security/sguil-server/files patch-sguild patch-sguild.access 
                                patch-sguild.conf pkg-message.in 
                                sguild.sh.in 
    security/sguil-sensor Makefile distinfo pkg-descr pkg-plist 
    security/sguil-sensor/files log_packets.conf 
                                patch-log_packets.sh 
                                pkg-message.in 
  Log:
  - Update to 0.7.0.
  
  PR:             ports/122645, ports/122646, ports/122647
  Submitted by:   Paul Schmehl <pauls@utdallas.edu> (maintainer)
  
  Revision  Changes    Path
  1.5       +7 -11     ports/security/sguil-client/Makefile
  1.2       +3 -3      ports/security/sguil-client/distinfo
  1.2       +18 -13    ports/security/sguil-client/files/patch-sguil.conf
  1.2       +25 -8     ports/security/sguil-client/files/patch-sguil.tk
  1.2       +4 -4      ports/security/sguil-client/pkg-descr
  1.5       +49 -16    ports/security/sguil-sensor/Makefile
  1.2       +3 -3      ports/security/sguil-sensor/distinfo
  1.2       +5 -0      ports/security/sguil-sensor/files/log_packets.conf
  1.2       +7 -6      ports/security/sguil-sensor/files/patch-log_packets.sh
  1.2       +4 -4      ports/security/sguil-sensor/files/pkg-message.in
  1.2       +6 -5      ports/security/sguil-sensor/pkg-descr
  1.2       +12 -3     ports/security/sguil-sensor/pkg-plist
  1.5       +31 -16    ports/security/sguil-server/Makefile
  1.2       +3 -3      ports/security/sguil-server/distinfo
  1.2       +16 -16    ports/security/sguil-server/files/patch-sguild
  1.2       +3 -3      ports/security/sguil-server/files/patch-sguild.access
  1.2       +28 -41    ports/security/sguil-server/files/patch-sguild.conf
  1.2       +16 -2     ports/security/sguil-server/files/pkg-message.in
  1.4       +5 -4      ports/security/sguil-server/files/sguild.sh.in
  1.2       +8 -2      ports/security/sguil-server/pkg-plist
_______________________________________________
cvs-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/cvs-all
To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
Comment 5 Marcelo Araujo freebsd_committer freebsd_triage 2008-05-03 14:23:51 UTC
State Changed
From-To: feedback->closed

Committed. Thanks!