diff --git a/security/scanlogd/Makefile b/security/scanlogd/Makefile index 5c1d03d886ab..550af4047b38 100644 --- a/security/scanlogd/Makefile +++ b/security/scanlogd/Makefile @@ -1,43 +1,43 @@ PORTNAME= scanlogd PORTVERSION= 2.2.8 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= security MASTER_SITES= http://openwall.com/scanlogd/ \ ftp://ftp.openwall.com/pub/projects/scanlogd/ \ ftp://rt.fm/pub/scanlogd/ MAINTAINER= novel@FreeBSD.org COMMENT= TCP port scan detection tool WWW= https://openwall.com/scanlogd/ USE_RC_SUBR= ${PORTNAME} USERS= scanlogd GROUPS= scanlogd MAKE_ARGS= CC="${CC}" CFLAGS="${CFLAGS}" LD="${CC}" LDFLAGS="${LDFLAGS}" PLIST_FILES= bin/scanlogd share/man/man8/scanlogd.8.gz \ etc/periodic/security/850.scanlogd OPTIONS_SINGLE= PCAP OPTIONS_SINGLE_PCAP= PCAP_BASE NIDS OPTIONS_DEFAULT= PCAP_BASE PCAP_BASE_DESC= Use pcap from base for packet capture NIDS_DESC= Use net/libnet for packet capture PCAP_BASE_ALL_TARGET= libpcap NIDS_ALL_TARGET= libnids NIDS_BUILD_DEPENDS= ${LOCALBASE}/lib/libnids.a:net/libnids NIDS_LIB_DEPENDS= libnet.so:net/libnet do-install: ${INSTALL_PROGRAM} ${WRKSRC}/scanlogd ${STAGEDIR}${PREFIX}/bin ${INSTALL_MAN} ${WRKSRC}/scanlogd.8 ${STAGEDIR}${PREFIX}/share/man/man8 ${MKDIR} ${STAGEDIR}${PREFIX}/etc/periodic/security ${INSTALL_SCRIPT} ${FILESDIR}/850.scanlogd \ ${STAGEDIR}${PREFIX}/etc/periodic/security .include diff --git a/security/scanlogd/files/850.scanlogd b/security/scanlogd/files/850.scanlogd index d2aec37544ff..b3f475162fa5 100644 --- a/security/scanlogd/files/850.scanlogd +++ b/security/scanlogd/files/850.scanlogd @@ -1,54 +1,51 @@ #!/bin/sh - # # Show possible port scans detected by scanlogd. # # If you want to enable this script, place the following # into /etc/periodic.conf: # # security_status_scanlogd_enable="YES" # security_status_scanlogd_period="daily" # # If there is a global system configuration file, suck it in. # if [ -r /etc/defaults/periodic.conf ]; then . /etc/defaults/periodic.conf source_periodic_confs fi : ${security_status_scanlogd_period="daily"} -security_daily_compat_var security_status_logdir -security_daily_compat_var security_status_scanlogd_enable - logdir="${security_status_logdir}" yesterday=`env LC_TIME=C date -v-1d "+%b %e "` catmsgs() { local logdir logfile mtime logdir="$1" logfile="$2" mtime="$3" find "$logdir" \( -name "$logfile" -o -name "$logfile.*" \) -mtime "$mtime" -print0 | xargs -0 ls -1tr | while read f; do case "$f" in *.gz) zcat -f "$f" ;; *.bz2) bzcat -f "$f" ;; *) cat "$f" ;; esac done } rc=0 if check_yesno_period security_status_scanlogd_enable; then echo "" echo "${host} possible port scans:" n=$(catmsgs "$logdir" messages "-2" | egrep -ia "^$yesterday.*scanlogd:" | tee /dev/stderr | wc -l) [ $n -gt 0 ] && rc=1 || rc=0 fi exit $rc