17:47 fernape 

security/samhain: Update to 4.4.3

ChangeLog: https://www.la-samhna.de/samhain/index.html

PR:	251735
Submitted by:	freebsd@gregv.net (maintainer)

 

17:23 swills 

security/samhain: update to 4.4.2

PR:		249113
Submitted by:	Greg Veldman <freebsd@gregv.net> (maintainer)

 

16:35 lwhsu 

Update to 4.4.1

PR:		244648
Submitted by:	Greg Veldman <freebsd@gregv.net> (maintainer)
Reported by:	Nikola Kolev <koue@chaosophia.net>

 

15:25 swills 

security/samhain: update to 4.3.3

PR:		241044
Submitted by:	Nikola Kolev <koue@chaosophia.net> (maintainer)

 

12:30 joneum 

Update to 4.3.2

Changelog:
 * fix compile failure on OpenBSD (reported by Mithrond)

PR:		234933
Submitted by:	Nikola Kolev <koue@chaosophia.net> (maintainer)
Sponsored by:	Netzkommune GmbH

 

04:57 swills 

security/samhain: update to 4.3.1

PR:		231941
Submitted by:	Nikola Kolev <koue@chaosophia.net> (maintainer)

 

13:56 wen 

- Update to 4.2.4

PR:		224991
Submitted by:	koue@chaosophia.net(maintainer)

 

14:32 robak 

security/samhain: update 4.2.1 -> 4.2.3

PR:		223444
Submitted by:	Nikola Kolev <koue@chaosophia.net> (maintainer)

 

13:55 miwi 

- Update to 4.2.1

PR:		218537
Submitted by:	Nikola Kolev
Approved by:	maintainer timeout

 

17:07 lifanov 

add ports for Samhain Intrusion Detection System

Samhain is an open source file integrity and host-based intrusion
detection system for Linux and Unix. It can run as a daemon process,
and and thus can remember file changes - contrary to a tool that runs
from cron, if a file is modified you will get only one report, while
subsequent checks of that file will ignore the modification as it is
already reported (unless the file is modified again).

Samhain can optionally be used as client/server system to provide
centralized monitoring for multiple host. Logging to a (MySQL or
PostgreSQL) database is supported.

PR:		214623
Submitted by:	Nikola Kolev <koue@chaosophia.net>

 

19:04 lx 

Update to 3.0.13. Fixes a regression in the GrowingLogFiles policy.

 

18:36 lx 

Update to 3.0.12. Changes:

- A bug has been fixed that could cause a slow and steady increase of memory
  usage

- Negated conditionals in the config file are handled correctly now

 

23:52 lx 

Update to 3.0.11. Changes:

 -  Log rotation is handled more gracefully now under favourable
    conditions (logfile is moved so inode is kept, and it does not get
    compressed immediately).

 -  An option IgnoreModified has been added to cover transient files that
    not only get added/deleted but also modified during their lifetime.

 -  An option KernelCheckProc has been added to suppress the kernel /proc test.

 -  Large groups are handled better now.

 -  Reconnecting to a temporarily unavailable Oracle database has been fixed.

Feature safe: yes

 

21:14 lx 

Update to 3.0.9.

 

20:36 lx 

Update to 3.0.8, unbreak with utmpx.

Feature safe: Yes

 

20:34 lx 

Update to 3.0.3, a bugfix release.

Feature safe:   yes

22:05 lx 

Update to 3.0.2 - minor bugfixes.

18:58 lx 

Update to 3.0.1.

Feature safe:   yes

04:46 lx 

Update to 3.0.0a.

00:17 lx 

Update to 2.8.6.

20:56 lx 

Update to 2.8.5.

20:05 lx 

Update to 2.8.4.

02:01 lx 

Update to 2.8.3a.

23:24 lx 

Update to 2.8.1. Bugfixes, IPv6.

20:17 lx 

Update to 2.7.2.

23:49 lx 

Update to 2.7.1.

Feature safe:   yes

18:16 lx 

Update to 2.7.0.

20:55 lx 

Update to 2.6.4.

05:13 lx 

Update to 2.6.1. From changelog:

 -  Logfile monitoring has been enhanced with three new features:
    (1) reporting on bursts of very similar/repeated messages
    (2) reporting on expected yet missing messages (e.g. heartbeat messages)
    (3) reporting on correlated events (e.g. event A is followed by event B
        within X seconds)

 -  Better caching of UIDs/GIDs to reduce lookups

 -  Hostnames of clients are matched case-insensitively now

09:41 lx 

Update to 2.6.0.

23:41 lx 

Update to 2.5.10, a bugfix release.

Feature safe:   yes

21:21 lx 

Update to 2.5.9.

Feature safe: yes

02:47 lx 

Update to 2.5.7, a bugfix release.

22:47 lx 

Update to 2.5.4, a security bugfix release. This resolves a problem
where an unauthorized client could download configuration and database
files from the server.

Full changes since 2.5.2:

 - email logging has been rewritten for enhanced functionality. It's
   now possible to filter messages different for each recipient, and
   regular expressions can be used now for filtering

 - new option SetMailPort allows to set a custom SMTP port

 - in the configuration file, option values can now be set by evaluating
   shell commands: Key = $( command )

 - PortCheckInterface now allows a list as value

 - new option SetConnectionTimeout allows to configure the client/server
   connection timeout

 - new option SetThrottle allows to configure throughput throttling for
   the database download to the client

01:52 lx 

Update to 2.5.2.

Changes:

 -  On request, there is now a global option LooseDirCheck ([false]/true) to
    drop reports on directories with changes of size/mtime/ctime (resulting
    from changes within the directory)

 -  An option to improve hidden process detection from within an OpenVZ
    container has been added

 -  Port check now reports process pid, reporting to prelude is more
    complete now

 -  A bug has been fixed whereby for files larger than 2GB, a filesize of
    exactly 2GB could be inserted into the RDBMS (if logging to one)

04:38 lx 

Update to 2.5.1, which should really fix the amd64 build problems.

00:20 lx 

Update to 2.5.0. Includes a new module for log file analysis, and should fix
build issues on 64 bit platforms.

21:55 lx 

Update to 2.4.5. Only notable change on fbsd is the introduction of
the dnmalloc allocator.

00:00 lx 

Update to 2.4.4. Fixes some bugs, and adds the ability to store full
file content for small files in the signature database itself.

01:45 lx 

Update to 2.4.2. This fixes a security issue where checksumming of the gpg
binary before execution did not function correctly.

20:10 lx 

Update to 2.4.1. Also fix a rather silly uninstall message, reported
by brd@.

21:29 lx 

Upgrade to 2.3.7, which fixes a Prelude integration bug.

20:24 lx 

Update to 2.3.6.

21:27 lx 

Update to 2.3.5.

23:04 lx 

Update to 2.3.4. This fixes a reliablility problem in the process check
module. If you are a user of this module, upgrading is recommended.

Approved by:    edwin (mentor)

12:33 lx 

Updating to 2.3.3.

Approved by:    edwin (mentor)

21:03 lx 

Update to 2.3.2, which fixes a regression in "stealth mode".

Approved by:    edwin (mentor)

02:30 lx 

Updating to 2.3.1.

Approved by:    edwin (mentor)

10:11 rafan 

- Update to 2.3.0

PR:             ports/105159
Submitted by:   David Thiel (maintainer)

07:03 rafan 

- Update to 2.2.4

PR:             ports/102915
Submitted by:   David Thiel <lx at redundancy.redundancy.org> (maintainer)

20:14 itetcu 

Updating the Samhain HIDS to 2.2.1. This is a minor release which fixes
some issues with the Prelude IDS system and compilation on x86_64.

PR:             ports/99114
Submitted by:   maintainer

07:58 clsung 

Updating the Samhain HIDS to 2.2.0. Changes since last version:
-  For files under the 'GrowingLogfiles' policy, the checksum is now
   verified up to the previous size.
-  Server-to-server relay is possible.
-  More user policies are available now.

PR:             ports/96643
Submitted by:   maintainer (David Thiel)

19:17 mnag 

- Update to 2.1.2
- Add PRELUDE option

PR:             94406
Submitted by:   Robin Gruyters <r.gruyters@yirdis.nl>
Approved by:    maintainer

01:03 edwin 

SHA256ify

Approved by: krion@

07:56 edwin 

Update: security/samhain 2.0.10 -> 2.1.0

        Updating the Samhain integrity checking system to 2.1.0, a
        bugfix release.

        It's been requested by several people to break Samhain out
        into separate client and server ports. This PR does that,
        with a samhain-client and samhain-server port, as slave
        ports off of samhain. I'm not sure the best way to submit
        a PR to do this kind of action, but here is a shar of all
        three ports. If another format is desired, please let me
        know.  I'm also interested in feedback on the approach used
        for splitting these out.

PR:             ports/90305
Submitted by:   David Thiel <lx@redundancy.redundancy.org>

22:56 vsevolod 

Update to 2.0.10 [1]
Feed portlint

PR:             86426 [1]
Submitted by:   David Thiel (maintainer) [1]

22:04 pav 

- Update to 2.0.9
- samhainrc.sample file is chgrp'd to wheel
- RUNAS_USER now defaults to "yule" properly
- XML logging is now on by default and tunable

PR:             ports/85448
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

19:53 thierry 

Update to 2.0.8.

PR:             83960
Submitted by:   Babak Farrokhi <babak (at) farrokhi.net>
Approved by:    maintainer

09:21 pav 

- Update to 2.0.6

PR:             ports/80622
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

22:20 pav 

- Update to 2.0.2

PR:             ports/73699
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

12:36 pav 

- Update to 2.0.1

PR:             ports/73501
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

18:12 pav 

- Update to 2.0.0

PR:             ports/73393
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

11:56 pav 

- Update to 1.8.12 and unbreak on 5.x

PR:             ports/72750
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

02:04 edwin 

Update: security/samhain 1.8.10b -> 1.8.11

        Updating the Samhain integrity checking system from 1.8.10b to 1.8.11.

        Code changes include:

        o for files in the IgnoreAll policy, there are no warnings
          (anymore) about 'no such user/group' and/or non-printable filenames
        o there is a new option HardlinkOffset=... to specify an
          offset from the canonical hardlink count for a directory
        o ... and a new option AddOKChars=... to modify the set of
          characters in a filename for which a warning (about
          obscure/non-printable) filename is issued.

        Port changes:

        Turn off kernel integrity checking by default - building
        this into packages wouldn't work anyhow, since it would
        only work with an identical kernel as on the build cluster.

PR:             ports/71169
Submitted by:   David Thiel <lx@redundancy.redundancy.org>

23:00 pav 

- Update to 1.8.10b

PR:             ports/69387
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

19:09 pav 

- Update to 1.8.9

PR:             ports/68173
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

14:18 pav 

- Update to 1.8.7
- Fix WITH_LOGSERVER knob

PR:             ports/66578
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

19:41 krion 

- Update to version 1.8.6

PR:             ports/65778
Submitted by:   maintainer

13:01 krion 

- Update to version 1.8.5

PR:             ports/65226
Submitted by:   maintainer

21:26 krion 

- Update to version 1.8.4

PR:             ports/64480
Submitted by:   maintainer

18:01 trevor 

Add size data, approved by maintainers.

05:09 linimon 

Update to 1.8.3.  See docs/Changelog for full details.  Notable:

 new option SetBindAddress (--bind-address=...) to force
   interface for outgoing connections on multi-interface box
 use persistent connection to database by default

PR:             ports/62290
Submitted by:   David Thiel <lx@redundancy.redundancy.org>

21:46 pav 

- Update to 1.8.2

PR:             ports/61588
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

09:50 linimon 

Update to 1.8.1, mostly minor bugfixes.  See docs/Changelog for details.

PR:             ports/59935
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

14:05 krion 

- Update to version 1.8.0

PR:             58790
Submitted by:   maintainer

07:11 daichi 

update security/samhain: 1.7.11 -> 1.7.12
  - Updating Samhain to 1.7.12, which contains fixes for a heap overflow
    in e-mail parsing.

PR:             57965
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

11:25 edwin 

Update port: security/samhain

        Update to 1.7.11.

PR:             ports/56754
Submitted by:   David Thiel <lx@redundancy.redundancy.org>

05:45 daichi 

update security/samhain: 1.7.9 -> 1.7.10

PR:             54997
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

06:08 daichi 

update security/samhain: 1.7.8 -> 1.7.9

PR:             54481
Submitted by:   David Thiel <lx@redundancy.redundancy.org> (maintainer)

09:20 edwin 

iUpdate of Samhain to 1.7.8

        Update to version 1.7.8
        Fix build when MySQL logging is enabled
        Add LOG_SERVER and ALT_LOG_SERVER tunables
        Require LOG_SERVER be defined for clients
        Have clients request config and signatures from server by default
        Change TRUSTED_USER to a more accurate name (RUNAS_USER)
        Fix sample config file install/deinstall
        Add documentation on tunables

PR:             ports/52912
Submitted by:   David Thiel <lx@redundancy.redundancy.org>

00:42 naddy 

Update to 1.7.5, fix packing list bugs, and add a more reliable
MASTER_SITE.

PR:             51044
Submitted by:   David Thiel <lx@redundancy.redundancy.org>

13:17 edwin 

The Samhain Intrusion Detection System

        Samhain is a host-based Intrusion Detection System and
        integrity checker with advanced features such as centralized
        logging, MySQL/PostgreSQL support, and rootkit detection.

PR:             ports/46982
Submitted by:   David Thiel <lx@redundancy.redundancy.org>