Bug 191347 - [NEW PORT] security/sguil: Sguil is a network security monitoring program
Summary: [NEW PORT] security/sguil: Sguil is a network security monitoring program
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: John Marino
URL:
Keywords:
: 183112 (view as bug list)
Depends on:
Blocks:
 
Reported: 2014-06-24 20:37 UTC by Muhammad Moinur Rahman
Modified: 2014-08-16 19:01 UTC (History)
1 user (show)

See Also:


Attachments
Shar File for sguil-0.9.0 (49.65 KB, text/plain)
2014-06-24 20:37 UTC, Muhammad Moinur Rahman
no flags Details
UIDs for Sguil (566 bytes, patch)
2014-06-24 20:38 UTC, Muhammad Moinur Rahman
no flags Details | Diff
GIDs for Sguil (218 bytes, patch)
2014-06-24 20:39 UTC, Muhammad Moinur Rahman
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Muhammad Moinur Rahman freebsd_committer freebsd_triage 2014-06-24 20:37:02 UTC
Created attachment 144107 [details]
Shar File for sguil-0.9.0

Sguil (pronounced sgweel) is built by network security analysts for network
security analysts. Sguil's main component is an intuitive GUI that provides
access to realtime events, session data, and raw packet captures. Sguil
facilitates the practice of Network Security Monitoring and event driven
analysis. The Sguil client is written in tcl/tk and can be run on any operating
system that supports tcl/tk (including Linux, *BSD, Solaris, MacOS, and Win32).

WWW: https://bammv.github.io/sguil/

For Committer's reference:
http://pdr.s.ubze.ro/bulk/latest-per-pkg/sguil/0.9.0/
Comment 1 Muhammad Moinur Rahman freebsd_committer freebsd_triage 2014-06-24 20:38:04 UTC
Created attachment 144108 [details]
UIDs for Sguil
Comment 2 Muhammad Moinur Rahman freebsd_committer freebsd_triage 2014-06-24 20:39:50 UTC
Created attachment 144109 [details]
GIDs for Sguil
Comment 3 John Marino freebsd_committer freebsd_triage 2014-07-31 16:04:09 UTC
How does this differ from security/sguil-client and security/sguil-server which already exist and have upgrade PRs?
Comment 4 Muhammad Moinur Rahman freebsd_committer freebsd_triage 2014-08-11 07:31:05 UTC
Those are version 0.80 and the maintainer requested someone to take over and upgrade in the mailing list. I have accumulated all the security/sguil-server, security/sguil-client and security/sguil-sensor in a single port and upgraded to 0.9.0.

(In reply to John Marino from comment #3)
> How does this differ from security/sguil-client and security/sguil-server
> which already exist and have upgrade PRs?
Comment 5 John Marino freebsd_committer freebsd_triage 2014-08-11 07:33:44 UTC
okay, the key is "single port"
bug 183112 is related to this discussion
Comment 6 John Marino freebsd_committer freebsd_triage 2014-08-11 07:35:09 UTC
Form letter:

Do you have any verification available?  In order of preference, examples of what I'm looking for are:

1) "poudriere testport" or "poudriere bulk -t" logs
2) Redports or tinderbox logs
3) "make check-plist" followed by "make stage-qa" output  (https://www.freebsd.org/doc/en/books/porters-handbook/porting-testing.html)

Also, please run "portlint" and paste the output.
Comment 7 Muhammad Moinur Rahman freebsd_committer freebsd_triage 2014-08-11 07:41:39 UTC
http://pdr.s.ubze.ro/bulk/latest-per-pkg/sguil/0.9.0/

(In reply to John Marino from comment #6)
> Form letter:
> 
> Do you have any verification available?  In order of preference, examples of
> what I'm looking for are:
> 
> 1) "poudriere testport" or "poudriere bulk -t" logs
> 2) Redports or tinderbox logs
> 3) "make check-plist" followed by "make stage-qa" output 
> (https://www.freebsd.org/doc/en/books/porters-handbook/porting-testing.html)
> 
> Also, please run "portlint" and paste the output.
Comment 8 John Marino freebsd_committer freebsd_triage 2014-08-11 07:44:16 UTC
ah, you provided it in comment 1.

It would have been clearer to mark it "poudriere logs" instead of "committer reference" but that oversight is still on me. :)

Moving to patch-ready.
Comment 9 John Marino freebsd_committer freebsd_triage 2014-08-16 12:17:26 UTC
I have an side interest in getting this into ports.  (to kill the other sguil ports)
Comment 10 John Marino freebsd_committer freebsd_triage 2014-08-16 12:57:23 UTC
*** Bug 183112 has been marked as a duplicate of this bug. ***
Comment 11 John Marino freebsd_committer freebsd_triage 2014-08-16 13:04:50 UTC
FYI I reserved UID 978 to match GID of 978
Comment 12 John Marino freebsd_committer freebsd_triage 2014-08-16 13:50:51 UTC
okay, with this 3-in-1 approach, that means the server, client, and sensors are mutually exclusive.  If you install one, you can't install the other two.  Is that intended?  Normal use case?
Comment 13 John Marino freebsd_committer freebsd_triage 2014-08-16 14:09:44 UTC
okay, I see you can choose 1, 2, or 3 components.  They aren't mutually exclusive.
Comment 14 John Marino freebsd_committer freebsd_triage 2014-08-16 14:15:32 UTC
Remove Stan Gammons from CC per his request.
Comment 15 Muhammad Moinur Rahman freebsd_committer freebsd_triage 2014-08-16 16:27:04 UTC
Sorry for late response. But any UIDs/GIDs are good enough. Options are MULTI hence you can chose whichever you wish.
Comment 16 commit-hook freebsd_committer freebsd_triage 2014-08-16 18:38:45 UTC
A commit references this bug:

Author: marino
Date: Sat Aug 16 18:38:30 UTC 2014
New revision: 365120
URL: http://svnweb.freebsd.org/changeset/ports/365120

Log:
  Add new port security/sguil (version 0.9.0)

  This port replaces security/sguil-client, security/sguild-server and
  security/sguil-sensor which are at version 0.8.0.  They will be removed
  shortly as a result.

  PR:		191347
  Submitted by:	Muhammad Rahman

  Sguil (pronounced sgweel) is built by network security analysts for network
  security analysts. Sguil's main component is an intuitive GUI that provides
  access to realtime events, session data, and raw packet captures. Sguil
  facilitates the practice of Network Security Monitoring and event driven
  analysis. The Sguil client is written in tcl/tk and can be run on any operating
  system that supports tcl/tk (including Linux, *BSD, Solaris, MacOS, and Win32).

Changes:
  head/security/Makefile
  head/security/sguil/
  head/security/sguil/Makefile
  head/security/sguil/distinfo
  head/security/sguil/files/
  head/security/sguil/files/example_agent.in
  head/security/sguil/files/pads_agent.in
  head/security/sguil/files/patch-client__sguil.conf
  head/security/sguil/files/patch-client__sguil.tk
  head/security/sguil/files/patch-sensor__contrib__ossec_agent__ossec_agent.tcl
  head/security/sguil/files/patch-sensor__pads_agent.tcl
  head/security/sguil/files/patch-sensor__pcap_agent-sancp.tcl
  head/security/sguil/files/patch-sensor__pcap_agent.tcl
  head/security/sguil/files/patch-sensor__sancp_agent.tcl
  head/security/sguil/files/patch-server__lib__SguildLoaderd.tcl
  head/security/sguil/files/patch-server__lib__SguildMysqlMerge.tcl
  head/security/sguil/files/patch-server__sguild
  head/security/sguil/files/patch-server__sguild.access
  head/security/sguil/files/patch-server__sguild.conf
  head/security/sguil/files/patch-server__snort_agent
  head/security/sguil/files/patch-server__sql_scripts__sancp_cleanup.tcl
  head/security/sguil/files/pcap_agent-sancp.in
  head/security/sguil/files/pcap_agent.in
  head/security/sguil/files/pkg-message-client.in
  head/security/sguil/files/pkg-message-sensor.in
  head/security/sguil/files/pkg-message-server.in
  head/security/sguil/files/sancp_agent.in
  head/security/sguil/files/sguild.in
  head/security/sguil/files/snort_agent.in
  head/security/sguil/pkg-descr
  head/security/sguil/pkg-plist
Comment 17 John Marino freebsd_committer freebsd_triage 2014-08-16 18:41:19 UTC
(In reply to Muhammad Moinur Rahman from comment #15)
> Sorry for late response. But any UIDs/GIDs are good enough. Options are
> MULTI hence you can chose whichever you wish.

I was actually done with this a few hours ago.
I found a couple of minor bugs, but I did a lot of wrapping to 80 column and eliminating loops where ever I could.  I also combined mkdir commands.  I also indent nested .if etc.

you might want to check over the port but it's building fine.  I tried a lot of different option combinations.
Comment 18 Muhammad Moinur Rahman freebsd_committer freebsd_triage 2014-08-16 18:44:44 UTC
(In reply to John Marino from comment #17)
> (In reply to Muhammad Moinur Rahman from comment #15)
> > Sorry for late response. But any UIDs/GIDs are good enough. Options are
> > MULTI hence you can chose whichever you wish.
> 
> I was actually done with this a few hours ago.
> I found a couple of minor bugs, but I did a lot of wrapping to 80 column and
> eliminating loops where ever I could.  I also combined mkdir commands.  I
> also indent nested .if etc.
> 
Really sorry for those. As I try to be cautious over those.
> you might want to check over the port but it's building fine.  I tried a lot
> of different option combinations.
I have already tested all the possible combinations before submitting. But despite you have to check yours before committing.
Comment 19 John Marino freebsd_committer freebsd_triage 2014-08-16 19:01:08 UTC
(In reply to Muhammad Moinur Rahman from comment #18)
> (In reply to John Marino from comment #17)
> > you might want to check over the port but it's building fine.  I tried a lot
> > of different option combinations.
> I have already tested all the possible combinations before submitting. But
> despite you have to check yours before committing.

I meant in case I introduced a bug of my own.  I was sure that yours was tested.

Oh, I removed the post-install cat pkg-message stuff which is redundant in a couple of weeks when pkg_install is removed.