barnyard2 1.9_2 security =3

An output system for Snort or Suricata that parses unified2 files
Maintained by: pauls@utdallas.edu
Port Added: 09 Sep 2009 01:43:05
License: not specified in port

---

---

Barnyard is a critical tool for the parsing of Snort's unified binary files,
processing and on-forwarding to a variety of output plugins. Unfortunately
it has not seen an updated in over 4 years and is not going to be maintained
by the original developers. With the new version of the unified format
(ie. unified2) arriving we need something to bridge this gap.

The SXL team love barnyard. So much so that we want it to stay and have been
tinkering around with the code to give it a breath of new life. Here is what
we have achieved to far for this reinvigorated code base:

    * Parsing of the new unified2 log files.
    * Maintaining majority of the command syntax of barnyard.
    * Addressed all associated bug reports and feature requests arising since
		barnyard-0.2.0.
    * Completely rewritten code based on the GPLv2 Snort making it entirely
		GPLv2.

This is an effort to fuse the awesome work of Snort and the original concept
of barnyard giving it a fresh update along the way. We've come a long way so
far and have a very stable build that we've integrated into our NSMnow
framework.  If you have any feature requests, bugs or gripes then send them
our way.

WWW: http://www.securixlive.com/barnyard2/

CVSWeb : Sources : Main Web Site : Distfiles Availability : PortsMon

---

Slave ports

security/barnyard2-sguil

---

NOTE: FreshPorts displays only required dependencies information. Optional dependencies are not covered.
Required Libraries: databases/mysql41-client
There are no ports dependent upon this port

---

To install the port: cd /usr/ports/security/barnyard2/ && make install clean
To add the package: pkg_add -r barnyard2

---

Configuration Options

===> The following configuration options are available for barnyard2-1.9_2:
     MYSQL=on (default) "Enable MySQL support"
     POSTGRESQL=off (default) "Enable PostgreSQL support"
     SNORT=off (default) "Depend on security/snort"
     SURICATA=off (default) "Depend on security/suricata"
     TCL=off (default) "Enable TCL support"
===> Use 'make config' to modify these settings

---

Master Sites:

http://www.securixlive.com/download/barnyard2/

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/

In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.

- Selectivly adds mysql/and/or postgresql to rc script 'REQUIRES:'

PR:             ports/163825
Submitted by:   scheidell
Approved by:    pauls@utdallas.edu (maintainer), gabor (mentor, implicit)

- Fix support of status and restart for multi-config rc script

PR:             ports/161168
Submitted by:   Michael Scheidell <scheidell@secnap.net>
Approved by:    Paul Schmehl <pauls@utdallas.edu> (maintainer)

- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS)
- Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead

PR:             157936
Submitted by:   myself
Exp-runs by:    pav
Approved by:    pav

Add support for running multiple instances
Adjust whitespace in Makefile

PR:             ports/159892
Submitted by:   Paul Schmehl <pauls@utdallas.edu> (maintainer)
Approved by:    tabthorpe (mentor)

- add patch to barnyard2 to allow build with postgresql and tcl
  (reported and fixed upstream)
- display option TCL only for Master port, it makes no sense if
  the slave can de-select a required option
- remove broken barnyard-sguil (master port was removed 2011-04-04)
- add new port barnyard2-sguil [1]
- add entry to MOVED

PR:             ports/156188 [1]
Submitted by:   me
Approved by:    maintainer timeout

- add OPTION tcl (default off) to allow sguil* ports build against barnyard2

PR:             ports/156341
Submitted by:   Brandon <m37a11 _at_ gmail.com>
Approved by:    maintainer timeout

 - make snort and suricata optional
 - bump portrevision

PR:             ports/156172
Submitted by:   Nikolay Denev <ndenev _at_ gmail.com>
Approved by:    Paul Schmehl <pauls _at_ utdallas.edu> (maintainer)

Bump PORTREVISION for ports linking to default libmysqlclient.

- update barnyard2 to version 2.1.9

Changes:
 2010-12-27 - Barnyard 2.1.9
   [*] Additions
      * spo_database. Support of encrypted connections to postgresql is now
        available. See README.database for the appropriate options.

      * spo_sguil. Fixed issue with duplication of alerts.

   [*] Improvements

      * spooler. Fixed issue with borking when reading unrecognised records.
        There is now sufficient information to skip and move on.

      * spooler. Fixed early termination of non-readable files, causing the
        dreaded SEGFAULT.

      * classifications. Tweaked output for classification identification if the
        appropriate node can't be found.

PR:             ports/154400
Submitted by:   Paul Schmehl <pauls _at_ utdallas.edu> (maintainer)
Feature safe:   yes

- Update to 1.8
- Do not overwrite pre-existing conf file
- Replace '/etc' with '${LOCALBASE}/etc' in sample conf

PR:             ports/148240
Submitted by:   Paul Schmehl <pauls@utdallas.edu> (maintainer)
Approved by:    wxs@ (mentor)
Feature safe:   yes

Begin the process of deprecating sysutils/rc_subr by
s#. %%RC_SUBR%%#. /etc/rc.subr#

- Fix of a previously pointyhat.

Approved by:    itetcu (mentor)

- Update to 1.7

PR:             ports/140393
Submitted by:   maintainer (Paul Schmehl <pauls@utdallas.edu>)
Approved by:    itetcu (mentor)

- Update to pkg-message

PR:             139880
Submitted by:   maintainer

Barnyard is a critical tool for the parsing of Snort's unified binary files,
processing and on-forwarding to a variety of output plugins. Unfortunately
it has not seen an updated in over 4 years and is not going to be maintained
by the original developers. With the new version of the unified format
(ie. unified2) arriving we need something to bridge this gap.

The SXL team love barnyard. So much so that we want it to stay and have been
tinkering around with the code to give it a breath of new life. Here is what
we have achieved to far for this reinvigorated code base:

    * Parsing of the new unified2 log files.
    * Maintaining majority of the command syntax of barnyard.
    * Addressed all associated bug reports and feature requests arising since
                barnyard-0.2.0.
    * Completely rewritten code based on the GPLv2 Snort making it entirely

12 vulnerabilities affecting 17 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities