Samhain is an open source file integrity and host-based intrusion
detection system for Linux and Unix. It can run as a daemon process,
and thus can remember file changes - contrary to a tool that runs
from cron, if a file is modified you will get only one report, while
subsequent checks of that file will ignore the modification as it is
already reported (unless the file is modified again).
Samhain can optionally be used as client/server system to provide
centralized monitoring for multiple host. Logging to a (MySQL or
PostgreSQL) database is supported.
===> The following configuration options are available for samhain-4.4.3_1:
ASM=on: Use optimized assembly code
DB_RELOAD=off: Enable database reload on SIGHUP
DEBUG=off: Build with debugging support
DNMALLOC=on: Enable dnmalloc
DOCS=on: Build and/or install documentation
ENCRYPT=on: Enable client/server encryption
GNUPG=off: GNU Privacy Guard support
IPV6=on: IPv6 protocol support
LIBWRAP=on: TCP wrapper support
LOGFILE_MONITOR=off: Enable monitor logfiles
LOGIN_WATCH=off: Enable watch for login/logout
MAIL=on: Enable internal SMTP mailer
MOUNTS_CHECK=off: Enable check mount options on filesystems
PORT_CHECK=off: Enable check ports
POSIX_ACL=off: Enable check posix acls
PROCESS_CHECK=off: Enable check processes
PTRACE=off: Enable use anti-debugger options
SRP=on: Enable SRP for authentication
STATIC=off: Build static executables and/or libraries
SUIDCHECK=off: Enable check for suid/sgid files
UDP=off: Enable UDP server
USERFILES=off: Enable check for users config files
XML_LOGS=off: Enable XML-formatted logs
====> Database support: you can only select none or one of them
MYSQL=off: MySQL database support
ODBC=off: ODBC database backend
PGSQL=off: PostgreSQL database support
===> Use 'make config' to modify these settings
security/samhain: Remove non-default option PRELUDE
prelude has been defunct for some times and have been marked deprecated.
This removes the non-default OPTION PRELUDE.
PR: 296317
Approved by: freebsd@gregv.net (maintainer-timeout)
all: drop support for FreeBSD 13, mips and risc64sf
Reviewed by: many (*)
Differential Revision: https://reviews.freebsd.org/D55624
Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh)
many (*)
acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
nobutaka pkubaj se tagattie thj
Anton Saietskii
GenericRikka
Gert Doering
Jan Bramkamp
Oleh Hushchenkov
Oleksandr Kryvulia
Ralf van der Enden
Yamagi
desktop kde python tcltk office
security/samhain: don't use sbrk
Samhain has an internal malloc implementation that uses sbrk and malloc.
There's a fallback during initialization if sbrk fails so replace sbrk
calls with a function that return the failure value ((void *)-1).
PR: 275646
Approved by: freebsd@gregv.net (maintainer)
*/*: use USES=sbrk
Replace various BROKEN entries for missing sbrk on aarch64 and risc64
with USES=sbrk.
Fix a few missing entries (generally ports blocked by other
dependences).
Approved by: portmgr (mat in D47258 comment)
Differential Revision: https://reviews.freebsd.org/D47259
security/samhain: fix build on big-endian
x_sh_checksum.c:471:15: error: incompatible pointer to integer conversion
passing 'sha2_word32[8]' (aka 'unsigned int[8]') to parameter of type 'int'
[-Wint-conversion]
memset(d, context->state, SHA256_DIGEST_LENGTH);
^~~~~~~~~~~~~~
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
security/samhain: fix build on powerpc64
x_sh_dbIO.c:229:36: error: initializer element is not a compile-time constant
static unsigned short ooop = *iptr;
Mark ports that are BROKEN due to sbrk on aarch64, also BROKEN on riscv64
where appropriate.
While here, pet portlint (Makevar order; whitespace).
Approved by: portmgr (tier-2 blanket)
security/samhain: housekeeping
- The port comes in three flavors, standalone, -server, and -client.
All three use one or more files under /var/lib. Remove the logic
that only includes that dir in plist for some of those flavors,
and include it for all.
- Get rid of .sh extensions on rc scripts.
- Use INSTALL_SCRIPT instead of CP to ensure the rc scripts have
useful permissions.
- Patch the rc script source so they properly respect settings in rc.conf.
- Use @postunexec in plist instead of the deprecated @unexec.
PR: 249433
Submitted by: Greg Veldman <freebsd@gregv.net> (maintainer)
security/samhain: Spell *_CONFIGURE_ON correctly
While here
- Put database options in a radio group since only one can be on
at a time
- Move implied options to *_IMPLIES
- ODBC implies XML_LOGS too
Remove support for variables that have been deprecated for a while.
variables deprecation revision
WITHOUT_NLS 2013-12-13 r336337
WITH_/WITHOUT_ 2014-02-24 r345870
NOPORT(DOC|EXAMPLE)S 2014-04-19 r351587
WITH_BDB_VER 2016-05-02 r414444
OVERRIDE_LINUX_BASE_PORT 2016-09-05 r421387
WITH_OPENSSL_(BASE|PORT) 2016-06-16 r416965
While there, add an ERROR variable that works like DEV_ERROR, but for
user facing errors, and move NOPORTDOCS,
NOPORTEXAMPLES and WITHOUT_NLS to it.
Cleanup bsd.sanity.mk a bit.
Fix fallout.
PR: 224613
Submitted by: mat
Exp-run by: antoine
Sponsored by: Absolight
Differential Revision: https://reviews.freebsd.org/D13490
add ports for Samhain Intrusion Detection System
Samhain is an open source file integrity and host-based intrusion
detection system for Linux and Unix. It can run as a daemon process,
and and thus can remember file changes - contrary to a tool that runs
from cron, if a file is modified you will get only one report, while
subsequent checks of that file will ignore the modification as it is
already reported (unless the file is modified again).
Samhain can optionally be used as client/server system to provide
centralized monitoring for multiple host. Logging to a (MySQL or
PostgreSQL) database is supported.
PR: 214623
Submitted by: Nikola Kolev <koue@chaosophia.net>
security/libprelude: Take MAINTAINER'ship, STAGE & Modernize
- Take Maintainership
- Enable STAGE support
- Tweak MASTER_SITES https -> http (portlint)
- Add LICENSE and LICENSE_FILE
- Deprecate USE_AUTOTOOLS for libtool (-> USES)
- Sort USES and OPTIONS
- Use OPTIONS helpers as much as possible for now [1]
- Add --enable-static to CONFIGURE_ARGS to retain the static lib
- Assign and Use ETCDIR rather than hardcoding
- Use the install-strip install target
- Update pkg-plist, use @sample and other goodies
While I'm here, bump dependent ports since our SHLIB major version has
changed
[1] https://reviews.freebsd.org/D665
Approved by: portmgr (implicit, bump unstaged port)
Update to 3.0.12. Changes:
- A bug has been fixed that could cause a slow and steady increase of memory
usage
- Negated conditionals in the config file are handled correctly now
Update to 3.0.11. Changes:
- Log rotation is handled more gracefully now under favourable
conditions (logfile is moved so inode is kept, and it does not get
compressed immediately).
- An option IgnoreModified has been added to cover transient files that
not only get added/deleted but also modified during their lifetime.
- An option KernelCheckProc has been added to suppress the kernel /proc test.
- Large groups are handled better now.
- Reconnecting to a temporarily unavailable Oracle database has been fixed.
Feature safe: yes
Update to 2.6.1. From changelog:
- Logfile monitoring has been enhanced with three new features:
(1) reporting on bursts of very similar/repeated messages
(2) reporting on expected yet missing messages (e.g. heartbeat messages)
(3) reporting on correlated events (e.g. event A is followed by event B
within X seconds)
- Better caching of UIDs/GIDs to reduce lookups
- Hostnames of clients are matched case-insensitively now
Update to 2.5.4, a security bugfix release. This resolves a problem
where an unauthorized client could download configuration and database
files from the server.
Full changes since 2.5.2:
- email logging has been rewritten for enhanced functionality. It's
now possible to filter messages different for each recipient, and
regular expressions can be used now for filtering
- new option SetMailPort allows to set a custom SMTP port
- in the configuration file, option values can now be set by evaluating
shell commands: Key = $( command )
- PortCheckInterface now allows a list as value
- new option SetConnectionTimeout allows to configure the client/server
connection timeout
- new option SetThrottle allows to configure throughput throttling for
the database download to the client
Update to 2.5.2.
Changes:
- On request, there is now a global option LooseDirCheck ([false]/true) to
drop reports on directories with changes of size/mtime/ctime (resulting
from changes within the directory)
- An option to improve hidden process detection from within an OpenVZ
container has been added
- Port check now reports process pid, reporting to prelude is more
complete now
- A bug has been fixed whereby for files larger than 2GB, a filesize of
exactly 2GB could be inserted into the RDBMS (if logging to one)
- Set --mandir and --infodir in CONFIGURE_ARGS if the configure script
supports them. This is determined by running ``configure --help'' in
do-configure target and set the shell variable _LATE_CONFIGURE_ARGS
which is then passed to CONFIGURE_ARGS.
- Remove --mandir and --infodir in ports' Makefile where applicable
Few ports use REINPLACE_CMD to achieve the same effect, remove them too.
- Correct some manual pages location from PREFIX/man to MANPREFIX/man
- Define INFO_PATH where necessary
- Document that .info files are installed in a subdirectory relative to
PREFIX/INFO_PATH and slightly change add-plist-info to use INFO_PATH and
subdirectory detection.
PR: ports/111470
Approved by: portmgr
Discussed with: stas (Mk/*), gerald (info related stuffs)
Tested by: pointyhat exp run
Update to 2.3.4. This fixes a reliablility problem in the process check
module. If you are a user of this module, upgrading is recommended.
Approved by: edwin (mentor)
- Update to 0.9.11
- library version update of related ports
Changelog libprelude:
- Hook class comparison function. Accept NULL, equal, not equal operator.
- Introduce better error checking in the idmef-class API, which is now
considered public and might be used by external application. Rename
error code to reflect the API.
- Change to the way IDMEF listed element are handled. Specifying negative
number as the position of the element from the low level API now allow
to position the element at the specified (reversed) index. Using the
high level API a negative index permit to address a list of element
backward (replace an element).
- Build fixes for SWIG > 1.3.27.
- Modify idmef_value_match() so that it always unroll listed value
(do it for both val1 and val2. Remove assertion, and let
idmef_value_type_compare() return an error code in case there is an issue.
- Handle path using IDMEF_LIST_APPEND or IDMEF_LIST_PREPEND as
path using an undefined list index on idmef_path_get() call.
- Make criteria parser accept (*) list index.
- Implement comparison function for all IDMEF object.
PR: ports/104328
Submitted by: maintainer (Robin Gruyters)
Approved by: portmgr (pav)
Updating the Samhain HIDS to 2.2.1. This is a minor release which fixes
some issues with the Prelude IDS system and compilation on x86_64.
PR: ports/99114
Submitted by: maintainer
Number of commits found: 138 (showing only 100 on this page)
