bsmtrace is a BSM based intrusion detection system, utilizing audit trails
and real-time audit event analysis through auditpipe(4). This host based
IDS operates using a finite state machine principles with a flexible
sequence driven signature system.
===> The following configuration options are available for bsmtrace-1.4_2:
EXAMPLES=on: Build and/or install examples
PCRE=off: Use Perl Compatible Regular Expressions
===> Use 'make config' to modify these settings
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/bsmtrace: backport the -fno-common fix
This port is the older version of bsmtrace and should go away in due time,
but it's easy enough to backport the fix in the meantime. This version did
need an additional fix to log.{c,h} that was no longer needed in 3.x.
PR: 248756
Approved by: csjp (maintainer, also discussed with)
MFH: 2020Q3 (-fno-common build fix)
security/bsmtrace: switch MAINTAINER over to csjp@
alm@ and csjp@ are both upstream maintainers of bsmtrace; they've decided to
transfer maintainership of bsmtrace over to csjp@. PORTREVISION bump to
reflect the new maintainer in the package.
Approved by: alm (maintainer, via e-mail)
Approved by: koobs (mentor, ports)
MFH: 2020Q2 (blanket: metadata update, MAINTAINER consistency)
MASTER_SITES cleanup.
- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.
While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.
Also, replace some EXTRACT_SUFX occurences with USES=tar:*.
Checked by: make fetch-urlall-list
With hat: portmgr
Sponsored by: Absolight
Support LIBS like LDFLAGS.
- Add LIBS="${LIBS}" to MAKE_ENV and CONFIGURE_ENV.
- Add an option helper for LIBS.
- Adjust all ports that already use LIBS. Also remove references to
PTHREAD_CFLAGS and PTHREAD_LIBS while here.
- Some ports did not support having a LIBS environment variable and
required additional patches.
Somewhat simplified a linker command line looks like:
${CC} ${src_LDFLAGS} ${LDFLAGS} ${src_LIBS} ${LIBS}
where src_LDFLAGS and src_LIBS are controlled by upstream and LDFLAGS and
LIBS can be controlled by us. If possible -L and -l flags need to be
(Only the first 15 lines of the commit message are shown above )
Update bsmtrace port to version 1.3
-Add support for larger set sizes (for group/user specifications)
-Add the ability to pass the effective uid to a trigger
-Fixed bug which resulted in "status" being ignored for single
state sequences
-Added support for logging channels.
-Added support for state triggers.
-Fixed bug where alerts were being produced for state machines
that have been expired. (Alerts have already been generated).
-Fixed two memory leaks which could really impact systems with high
volumes audit records.
Approved by: wxs
Reviewed by: alm (maintainer)
Update bsmtrace to 1.1.0.
1.1.0 fixes a pretty serious bug which resulted in BSM records without
pathname tokens being processed in some cases.
Additionally, timeout-window and timeout-probability features were added
to allow people defining sequences with timeouts to add an element of
randomness to the timeout, in theory making it more difficult for people
to attack.
timeout 60;
timeout-window 10;
timeout-probability 65;
Basically equates to:
"This sequence should timeout in a random amount of time, where the
probability of the timeout being from 60-70 is 65%"
It should be noted that there is a probability of 35% that the value will
be completely random. So naturally, the lower the timeout-probability, the
more random the timeout will be.
Approved by: tmclaugh
Add the bsmtrace port.
bsmtrace is a audit driven host based intrusion detection system which
operates on finite state machine principles. Since it's audit driven,
it requires that operating system security auditing be enabled. This
requires FreeBSD 6.2 at a minimum. By default it provides real-time
analysis through the use of an audit pipe, however it can operate on
regular audit trail files as well.
Approved by: Pav
Reviewed by: Pav (and others)
