contrib/specs/local/ossec-hids-local.spec

   1 #
   2 # OSSEC 1.3 .spec file - LOCAL
   3 # Fri Aug 17 15:13:04 EDT 2007
   4 #
   5 #
   6 # TODO:
   7 #
   8 # o Safety checks for %clean
   9 #
  10 # o Remove script
  11 #
  12 # o create an RPM_README.txt and put it in the source tree
  13 #
  14 #
  15
  16 Summary: Open Source Host-based Intrusion Detection System (Server)
  17 Name: ossec-hids-local-FC7
  18 Version: 1.3
  19 Release: 1
  20 License: GPLv2
  21 Group: Applications/Security
  22 URL: http://www.ossec.net
  23 Packager: Michael Williams (maverick@maverick.org)
  24 Source: http://www.ossec.net/files/ossec-hids-1.3.tar.gz
  25 Requires: /usr/sbin/useradd, /usr/sbin/groupadd, /usr/sbin/groupdel, /usr/sbin/userdel, /sbin/service, /sbin/chkconfig
  26
  27 %description
  28 OSSEC is an Open Source Host-based Intrusion
  29 Detection System. It performs log analysis,
  30 integrity checking, Windows registry monitoring,
  31 rootkit detection, real-time alerting and active
  32 response.
  33
  34
  35 %prep
  36
  37 %setup -n ossec-hids-1.3
  38
  39 %build
  40 /bin/cp /usr/local/src/OSSEC-RPM/1.3/local/preloaded-vars.conf ${RPM_BUILD_DIR}/ossec-hids-1.3/etc/
  41
  42 ./install.sh
  43
  44 %clean
  45 rm -rf $RPM_BUILD_ROOT
  46
  47 %pre
  48 ################################################################################
  49 # Create OSSEC group
  50 #
  51 if ! grep "^ossec" /etc/group > /dev/null ; then
  52   /usr/sbin/groupadd --system ossec
  53 fi
  54
  55
  56 ################################################################################
  57 # Create OSSEC users
  58 #
  59 for USER in ossec ossecm ossecr ; do
  60   if ! grep "^${USER}" /etc/passwd > /dev/null ; then
  61     /usr/sbin/useradd --system -d /var/ossec -s /bin/false -g ossec ${USER}
  62   fi
  63 done
  64
  65 %post
  66
  67
  68
  69 ################################################################################
  70 # Create OSSEC /etc/init.d/ossec file
  71 #
  72 cat <<EOF >> /etc/init.d/ossec
  73 #!/bin/bash
  74 #
  75 # ossec Starts ossec
  76 #
  77 #
  78 # chkconfig: 2345 12 88
  79 # description: OSSEC is an open source host based IDS
  80 ### BEGIN INIT INFO
  81 # Provides: $ossec
  82 ### END INIT INFO
  83
  84 # Source function library.
  85 . /etc/init.d/functions
  86
  87 [ -f /var/ossec/bin/ossec-control ] || exit 0
  88
  89 RETVAL=0
  90
  91 umask 077
  92
  93 case "\$1" in
  94   start)
  95         /var/ossec/bin/ossec-control start
  96         ;;
  97   stop)
  98         /var/ossec/bin/ossec-control stop
  99         ;;
 100   status)
 101         /var/ossec/bin/ossec-control status
 102         ;;
 103   restart|reload)
 104         /var/ossec/bin/ossec-control restart
 105         ;;
 106   *)
 107         echo "Usage: /var/ossec/bin/ossec-control {start|stop|status|restart}"
 108         exit 1
 109 esac
 110
 111 EOF
 112
 113 /bin/chown root.root /etc/init.d/ossec
 114 /bin/chmod 755 /etc/init.d/ossec
 115
 116 ################################################################################
 117 # Set configuration so OSSEC starts on reboot
 118 #
 119 /sbin/chkconfig --add ossec
 120 /sbin/chkconfig ossec on
 121
 122 %postun
 123 # Run service command, make sure OSSEC is stopped
 124 /sbin/service ossec stop
 125
 126 # Run chkconfig, stop ossec from starting on boot
 127 /sbin/chkconfig ossec off
 128 /sbin/chkconfig --del ossec
 129
 130 # Remove init.d file
 131 [ -f /etc/init.d/ossec ] && rm /etc/init.d/ossec
 132
 133 # Remove ossec users
 134 for USER in ossec ossecm ossecr ; do
 135   if grep "^${USER}" /etc/passwd > /dev/null ; then
 136     /usr/sbin/userdel -r ${USER}
 137   fi
 138 done
 139
 140 # Remove ossec group
 141 if grep "^ossec" /etc/group > /dev/null ; then
 142   /usr/sbin/groupdel ossec
 143 fi
 144
 145
 146 %files
 147 %doc README BUGS CONFIG CONTRIB INSTALL LICENSE
 148
 149 %dir /var/ossec/
 150 %attr(550, root, ossec) /var/ossec/
 151 %dir /var/ossec/stats
 152 %attr(750, ossec, ossec) /var/ossec/stats
 153 %dir /var/ossec/var
 154 %attr(550, root, ossec) /var/ossec/var
 155 %dir /var/ossec/var/run
 156 %attr(770, root, ossec) /var/ossec/var/run
 157 %dir /var/ossec/active-response
 158 %attr(550, root, ossec) /var/ossec/active-response
 159 %dir /var/ossec/active-response/bin
 160 %attr(550, root, ossec) /var/ossec/active-response/bin
 161 /var/ossec/active-response/bin/route-null.sh
 162 %attr(755, root, ossec) /var/ossec/active-response/bin/route-null.sh
 163 /var/ossec/active-response/bin/host-deny.sh
 164 %attr(755, root, ossec) /var/ossec/active-response/bin/host-deny.sh
 165 /var/ossec/active-response/bin/firewall-drop.sh
 166 %attr(755, root, ossec) /var/ossec/active-response/bin/firewall-drop.sh
 167 /var/ossec/active-response/bin/disable-account.sh
 168 %attr(755, root, ossec) /var/ossec/active-response/bin/disable-account.sh
 169 %dir /var/ossec/tmp
 170 %attr(550, root, ossec) /var/ossec/tmp
 171 %dir /var/ossec/bin
 172 %attr(550, root, ossec) /var/ossec/bin
 173 /var/ossec/bin/ossec-agentd
 174 %attr(550, root, ossec) /var/ossec/bin/ossec-agentd
 175 /var/ossec/bin/ossec-logcollector
 176 %attr(550, root, ossec) /var/ossec/bin/ossec-logcollector
 177 /var/ossec/bin/ossec-control
 178 %attr(550, root, ossec) /var/ossec/bin/ossec-control
 179 /var/ossec/bin/ossec-syscheckd
 180 %attr(550, root, ossec) /var/ossec/bin/ossec-syscheckd
 181 /var/ossec/bin/manage_agents
 182 %attr(550, root, ossec) /var/ossec/bin/manage_agents
 183 /var/ossec/bin/ossec-remoted
 184 %attr(550, root, ossec) /var/ossec/bin/ossec-remoted
 185 /var/ossec/bin/ossec-monitord
 186 %attr(550, root, ossec) /var/ossec/bin/ossec-monitord
 187 /var/ossec/bin/list_agents
 188 %attr(550, root, ossec) /var/ossec/bin/list_agents
 189 /var/ossec/bin/clear_stats
 190 %attr(550, root, ossec) /var/ossec/bin/clear_stats
 191 /var/ossec/bin/ossec-execd
 192 %attr(550, root, ossec) /var/ossec/bin/ossec-execd
 193 /var/ossec/bin/ossec-maild
 194 %attr(550, root, ossec) /var/ossec/bin/ossec-maild
 195 /var/ossec/bin/ossec-analysisd
 196 %attr(550, root, ossec) /var/ossec/bin/ossec-analysisd
 197 /var/ossec/bin/syscheck_update
 198 %attr(550, root, ossec) /var/ossec/bin/syscheck_update
 199 %dir /var/ossec/etc
 200 %attr(550, root, ossec) /var/ossec/etc
 201 /var/ossec/etc/internal_options.conf
 202 %attr(440, root, ossec) /var/ossec/etc/internal_options.conf
 203 /var/ossec/etc/localtime
 204 %attr(555, root, ossec) /var/ossec/etc/localtime
 205 %dir /var/ossec/etc/shared
 206 %attr(550, root, ossec) /var/ossec/etc/shared
 207 /var/ossec/etc/shared/win_malware_rcl.txt
 208 %attr(440, root, ossec) /var/ossec/etc/shared/win_malware_rcl.txt
 209 /var/ossec/etc/shared/win_applications_rcl.txt
 210 %attr(440, root, ossec) /var/ossec/etc/shared/win_applications_rcl.txt
 211 /var/ossec/etc/shared/win_audit_rcl.txt
 212 %attr(440, root, ossec) /var/ossec/etc/shared/win_audit_rcl.txt
 213 /var/ossec/etc/shared/rootkit_files.txt
 214 %attr(440, root, ossec) /var/ossec/etc/shared/rootkit_files.txt
 215 /var/ossec/etc/shared/rootkit_trojans.txt
 216 %attr(440, root, ossec) /var/ossec/etc/shared/rootkit_trojans.txt
 217 /var/ossec/etc/ossec.conf
 218 %attr(440, root, ossec) /var/ossec/etc/ossec.conf
 219 /var/ossec/etc/decoder.xml
 220 %attr(440, root, ossec) /var/ossec/etc/decoder.xml
 221 %dir /var/ossec/rules
 222 %attr(550, root, ossec) /var/ossec/rules
 223 /var/ossec/rules/ms_ftpd_rules.xml
 224 %attr(550, root, ossec) /var/ossec/rules/ms_ftpd_rules.xml
 225 /var/ossec/rules/zeus_rules.xml
 226 %attr(550, root, ossec) /var/ossec/rules/zeus_rules.xml
 227 /var/ossec/rules/squid_rules.xml
 228 %attr(550, root, ossec) /var/ossec/rules/squid_rules.xml
 229 /var/ossec/rules/racoon_rules.xml
 230 %attr(550, root, ossec) /var/ossec/rules/racoon_rules.xml
 231 /var/ossec/rules/smbd_rules.xml
 232 %attr(550, root, ossec) /var/ossec/rules/smbd_rules.xml
 233 /var/ossec/rules/proftpd_rules.xml
 234 %attr(550, root, ossec) /var/ossec/rules/proftpd_rules.xml
 235 /var/ossec/rules/msauth_rules.xml
 236 %attr(550, root, ossec) /var/ossec/rules/msauth_rules.xml
 237 /var/ossec/rules/ms-exchange_rules.xml
 238 %attr(550, root, ossec) /var/ossec/rules/ms-exchange_rules.xml
 239 /var/ossec/rules/symantec-ws_rules.xml
 240 %attr(550, root, ossec) /var/ossec/rules/symantec-ws_rules.xml
 241 /var/ossec/rules/sendmail_rules.xml
 242 %attr(550, root, ossec) /var/ossec/rules/sendmail_rules.xml
 243 /var/ossec/rules/web_rules.xml
 244 %attr(550, root, ossec) /var/ossec/rules/web_rules.xml
 245 /var/ossec/rules/netscreenfw_rules.xml
 246 %attr(550, root, ossec) /var/ossec/rules/netscreenfw_rules.xml
 247 /var/ossec/rules/attack_rules.xml
 248 %attr(550, root, ossec) /var/ossec/rules/attack_rules.xml
 249 /var/ossec/rules/hordeimp_rules.xml
 250 %attr(550, root, ossec) /var/ossec/rules/hordeimp_rules.xml
 251 /var/ossec/rules/postfix_rules.xml
 252 %attr(550, root, ossec) /var/ossec/rules/postfix_rules.xml
 253 /var/ossec/rules/rules_config.xml
 254 %attr(550, root, ossec) /var/ossec/rules/rules_config.xml
 255 /var/ossec/rules/spamd_rules.xml
 256 %attr(550, root, ossec) /var/ossec/rules/spamd_rules.xml
 257 /var/ossec/rules/cisco-ios_rules.xml
 258 %attr(550, root, ossec) /var/ossec/rules/cisco-ios_rules.xml
 259 /var/ossec/rules/local_rules.xml
 260 %attr(550, root, ossec) /var/ossec/rules/local_rules.xml
 261 /var/ossec/rules/apache_rules.xml
 262 %attr(550, root, ossec) /var/ossec/rules/apache_rules.xml
 263 /var/ossec/rules/mailscanner_rules.xml
 264 %attr(550, root, ossec) /var/ossec/rules/mailscanner_rules.xml
 265 /var/ossec/rules/vpn_concentrator_rules.xml
 266 %attr(550, root, ossec) /var/ossec/rules/vpn_concentrator_rules.xml
 267 /var/ossec/rules/firewall_rules.xml
 268 %attr(550, root, ossec) /var/ossec/rules/firewall_rules.xml
 269 /var/ossec/rules/named_rules.xml
 270 %attr(550, root, ossec) /var/ossec/rules/named_rules.xml
 271 /var/ossec/rules/ossec_rules.xml
 272 %attr(550, root, ossec) /var/ossec/rules/ossec_rules.xml
 273 /var/ossec/rules/courier_rules.xml
 274 %attr(550, root, ossec) /var/ossec/rules/courier_rules.xml
 275 /var/ossec/rules/vsftpd_rules.xml
 276 %attr(550, root, ossec) /var/ossec/rules/vsftpd_rules.xml
 277 /var/ossec/rules/vpopmail_rules.xml
 278 %attr(550, root, ossec) /var/ossec/rules/vpopmail_rules.xml
 279 /var/ossec/rules/pure-ftpd_rules.xml
 280 %attr(550, root, ossec) /var/ossec/rules/pure-ftpd_rules.xml
 281 /var/ossec/rules/telnetd_rules.xml
 282 %attr(550, root, ossec) /var/ossec/rules/telnetd_rules.xml
 283 /var/ossec/rules/pix_rules.xml
 284 %attr(550, root, ossec) /var/ossec/rules/pix_rules.xml
 285 /var/ossec/rules/ftpd_rules.xml
 286 %attr(550, root, ossec) /var/ossec/rules/ftpd_rules.xml
 287 /var/ossec/rules/ids_rules.xml
 288 %attr(550, root, ossec) /var/ossec/rules/ids_rules.xml
 289 /var/ossec/rules/symantec-av_rules.xml
 290 %attr(550, root, ossec) /var/ossec/rules/symantec-av_rules.xml
 291 /var/ossec/rules/arpwatch_rules.xml
 292 %attr(550, root, ossec) /var/ossec/rules/arpwatch_rules.xml
 293 /var/ossec/rules/policy_rules.xml
 294 %attr(550, root, ossec) /var/ossec/rules/policy_rules.xml
 295 /var/ossec/rules/sshd_rules.xml
 296 %attr(550, root, ossec) /var/ossec/rules/sshd_rules.xml
 297 /var/ossec/rules/syslog_rules.xml
 298 %attr(550, root, ossec) /var/ossec/rules/syslog_rules.xml
 299 /var/ossec/rules/pam_rules.xml
 300 %attr(550, root, ossec) /var/ossec/rules/pam_rules.xml
 301 /var/ossec/rules/imapd_rules.xml
 302 %attr(550, root, ossec) /var/ossec/rules/imapd_rules.xml
 303 %dir /var/ossec/logs
 304 %attr(750, ossec, ossec) /var/ossec/logs
 305 %dir /var/ossec/logs/alerts
 306 %attr(750, ossec, ossec) /var/ossec/logs/alerts
 307 %dir /var/ossec/logs/firewall
 308 %attr(750, ossec, ossec) /var/ossec/logs/firewall
 309 %dir /var/ossec/logs/archives
 310 %attr(750, ossec, ossec) /var/ossec/logs/archives
 311 /var/ossec/logs/ossec.log
 312 %attr(664, ossec, ossec) /var/ossec/logs/ossec.log
 313 %dir /var/ossec/queue
 314 %attr(550, root, ossec) /var/ossec/queue
 315 %dir /var/ossec/queue/fts
 316 %attr(750, ossec, ossec) /var/ossec/queue/fts
 317 %dir /var/ossec/queue/rids
 318 %attr(755, ossecr, ossec) /var/ossec/queue/rids
 319 %dir /var/ossec/queue/alerts
 320 %attr(770, ossec, ossec) /var/ossec/queue/alerts
 321 %dir /var/ossec/queue/rootcheck
 322 %attr(750, ossec, ossec) /var/ossec/queue/rootcheck
 323 %dir /var/ossec/queue/agent-info
 324 %attr(755, ossecr, ossec) /var/ossec/queue/agent-info
 325 %dir /var/ossec/queue/syscheck
 326 %attr(750, ossec, ossec) /var/ossec/queue/syscheck
 327 %dir /var/ossec/queue/ossec
 328 %attr(770, ossec, ossec) /var/ossec/queue/ossec
 329
 330
 331