automatic version update by autodist [release 2.9.6.1-1mamba;Thu Apr 24 2014]

README.md

@@ -1,2 +1,10 @@
 # snort
 
+Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
+It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
+Snort uses a flexible rules language to describe traffic that it should collect or pass, as well as a detection engine that utilizes a modular plugin architecture.
+Snort has a real-time alerting capability as well, incorporating alerting mechanisms for syslog, a user specified file, a UNIX socket, or WinPopup messages to Windows clients using Samba's smbclient.
+
+Snort has three primary uses.
+It can be used as a straight packet sniffer like tcpdump(1), a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion  detection system.
+

snort-conf

@@ -0,0 +1,974 @@
+#--------------------------------------------------
+#   http://www.snort.org     Snort 2.8.2.1 Ruleset
+#     Contact: snort-sigs@lists.sourceforge.net
+#--------------------------------------------------
+# $Id$
+#
+###################################################
+# This file contains a sample snort configuration. 
+# You can take the following steps to create your own custom configuration:
+#
+#  1) Set the variables for your network
+#  2) Configure dynamic loaded libraries
+#  3) Configure preprocessors
+#  4) Configure output plugins
+#  5) Add any runtime config directives
+#  6) Customize your rule set
+#
+###################################################
+# Step #1: Set the network variables:
+#
+# You must change the following variables to reflect your local network. The
+# variable is currently setup for an RFC 1918 address space.
+#
+# You can specify it explicitly as: 
+#
+# var HOME_NET 10.1.1.0/24
+#
+# or use global variable $<interfacename>_ADDRESS which will be always
+# initialized to IP address and netmask of the network interface which you run
+# snort at.  Under Windows, this must be specified as
+# $(<interfacename>_ADDRESS), such as:
+# $(\Device\Packet_{12345678-90AB-CDEF-1234567890AB}_ADDRESS)
+#
+# var HOME_NET $eth0_ADDRESS
+#
+# You can specify lists of IP addresses for HOME_NET
+# by separating the IPs with commas like this:
+#
+# var HOME_NET [10.1.1.0/24,192.168.1.0/24]
+#
+# MAKE SURE YOU DON'T PLACE ANY SPACES IN YOUR LIST!
+#
+# or you can specify the variable to be any IP address
+# like this:
+
+var HOME_NET 127.0.0.1
+
+# Set up the external network addresses as well.  A good start may be "any"
+var EXTERNAL_NET any
+
+# Configure your server lists.  This allows snort to only look for attacks to
+# systems that have a service up.  Why look for HTTP attacks if you are not
+# running a web server?  This allows quick filtering based on IP addresses
+# These configurations MUST follow the same configuration scheme as defined
+# above for $HOME_NET.  
+
+# List of DNS servers on your network 
+var DNS_SERVERS $HOME_NET
+
+# List of SMTP servers on your network
+var SMTP_SERVERS $HOME_NET
+
+# List of web servers on your network
+var HTTP_SERVERS $HOME_NET
+
+# List of sql servers on your network 
+var SQL_SERVERS $HOME_NET
+
+# List of telnet servers on your network
+var TELNET_SERVERS $HOME_NET
+
+# List of snmp servers on your network
+var SNMP_SERVERS $HOME_NET
+
+# Configure your service ports.  This allows snort to look for attacks destined
+# to a specific application only on the ports that application runs on.  For
+# example, if you run a web server on port 8081, set your HTTP_PORTS variable
+# like this:
+#
+# portvar HTTP_PORTS 8081
+#
+# Ports you run web servers on
+portvar HTTP_PORTS 80
+
+# NOTE:  If you wish to define multiple HTTP ports, use the portvar
+# syntax to represent lists of ports and port ranges.  Examples:
+## portvar HTTP_PORTS [80,8080]
+## portvar HTTP_PORTS [80,8000:8080]
+# And only include the rule that uses $HTTP_PORTS once.
+#
+# The pre-2.8.0 approach of redefining the variable to a different port and
+# including the rules file twice is obsolete.  See README.variables for more
+# details.
+
+# Ports you want to look for SHELLCODE on.
+portvar SHELLCODE_PORTS !80
+
+# Ports you might see oracle attacks on
+portvar ORACLE_PORTS 1521
+
+# other variables
+# 
+# AIM servers.  AOL has a habit of adding new AIM servers, so instead of
+# modifying the signatures when they do, we add them to this list of servers.
+var AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]
+
+# Path to your rules files (this can be a relative path)
+# Note for Windows users:  You are advised to make this an absolute path,
+# such as:  c:\snort\rules
+var RULE_PATH ./rules
+var PREPROC_RULE_PATH ./preproc_rules
+
+# Configure the snort decoder
+# ============================
+#
+# Snort's decoder will alert on lots of things such as header
+# truncation or options of unusual length or infrequently used tcp options
+#
+#
+# Stop generic decode events:
+#
+# config disable_decode_alerts
+#
+# Stop Alerts on experimental TCP options
+#
+# config disable_tcpopt_experimental_alerts
+#
+# Stop Alerts on obsolete TCP options
+#
+# config disable_tcpopt_obsolete_alerts
+#
+# Stop Alerts on T/TCP alerts
+#
+# In snort 2.0.1 and above, this only alerts when a TCP option is detected
+# that shows T/TCP being actively used on the network.  If this is normal
+# behavior for your network, disable the next option.
+#
+# config disable_tcpopt_ttcp_alerts
+#
+# Stop Alerts on all other TCPOption type events:
+#
+# config disable_tcpopt_alerts
+#
+# Stop Alerts on invalid ip options
+#
+# config disable_ipopt_alerts
+#
+# Alert if value in length field (IP, TCP, UDP) is greater than the
+# actual length of the captured portion of the packet that the length
+# is supposed to represent:
+#
+# config enable_decode_oversized_alerts
+#
+# Same as above, but drop packet if in Inline mode -
+# enable_decode_oversized_alerts must be enabled for this to work:
+#
+# config enable_decode_oversized_drops
+#
+
+# Configure the detection engine
+# ===============================
+#
+# Use a different pattern matcher in case you have a machine with very limited
+# resources:
+#
+# config detection: search-method lowmem
+
+# Configure Inline Resets
+# ========================
+# 
+# If running an iptables firewall with snort in InlineMode() we can now
+# perform resets via a physical device. We grab the indev from iptables
+# and use this for the interface on which to send resets. This config
+# option takes an argument for the src mac address you want to use in the
+# reset packet.  This way the bridge can remain stealthy. If the src mac
+# option is not set we use the mac address of the indev device. If we
+# don't set this option we will default to sending resets via raw socket,
+# which needs an ipaddress to be assigned to the int.
+#
+# config layer2resets: 00:06:76:DD:5F:E3
+
+###################################################
+# Step #2: Configure dynamic loaded libraries
+#
+# If snort was configured to use dynamically loaded libraries,
+# those libraries can be loaded here.
+#
+# Each of the following configuration options can be done via
+# the command line as well.
+#
+# Load all dynamic preprocessors from the install path
+# (same as command line option --dynamic-preprocessor-lib-dir)
+#
+dynamicpreprocessor directory /usr/lib/snort_dynamicpreprocessor/
+#
+# Load a specific dynamic preprocessor library from the install path
+# (same as command line option --dynamic-preprocessor-lib)
+#
+# dynamicpreprocessor file /usr/lib/snort_dynamicpreprocessor/libdynamicexample.so
+#
+# Load a dynamic engine from the install path
+# (same as command line option --dynamic-engine-lib)
+#
+dynamicengine /usr/lib/snort_dynamicengine/libsf_engine.so
+#
+# Load all dynamic rules libraries from the install path
+# (same as command line option --dynamic-detection-lib-dir)
+#
+# dynamicdetection directory /usr/lib/snort_dynamicrule/
+#
+# Load a specific dynamic rule library from the install path
+# (same as command line option --dynamic-detection-lib)
+#
+# dynamicdetection file /usr/lib/snort_dynamicrule/libdynamicexamplerule.so
+#
+
+###################################################
+# Step #3: Configure preprocessors
+#
+# General configuration for preprocessors is of 
+# the form
+# preprocessor <name_of_processor>: <configuration_options>
+
+# Configure Flow tracking module
+# -------------------------------
+#
+# The Flow tracking module is meant to start unifying the state keeping
+# mechanisms of snort into a single place. Right now, only a portscan detector
+# is implemented but in the long term,  many of the stateful subsystems of
+# snort will be migrated over to becoming flow plugins. This must be enabled
+# for flow-portscan to work correctly.
+#
+# See README.flow for additional information
+#
+#preprocessor flow: stats_interval 0 hash 2
+
+# frag3: Target-based IP defragmentation 
+# --------------------------------------
+#
+# Frag3 is a brand new IP defragmentation preprocessor that is capable of
+# performing "target-based" processing of IP fragments.  Check out the
+# README.frag3 file in the doc directory for more background and configuration
+# information.
+# 
+# Frag3 configuration is a two step process, a global initialization phase 
+# followed by the definition of a set of defragmentation engines.  
+# 
+# Global configuration defines the number of fragmented packets that Snort can
+# track at the same time and gives you options regarding the memory cap for the
+# subsystem or, optionally, allows you to preallocate all the memory for the 
+# entire frag3 system.
+#
+# frag3_global options:
+#   max_frags: Maximum number of frag trackers that may be active at once.  
+#              Default value is 8192.
+#   memcap: Maximum amount of memory that frag3 may access at any given time.
+#           Default value is 4MB.
+#   prealloc_frags: Maximum number of individual fragments that may be processed
+#                   at once.  This is instead of the memcap system, uses static 
+#                   allocation to increase performance.  No default value.  Each
+#                   preallocated fragment typically eats ~1550 bytes.  However,
+#                   the exact amount is determined by the snaplen, and this can
+#                   go as high as 64K so beware!
+#
+# Target-based behavior is attached to an engine as a "policy" for handling 
+# overlaps and retransmissions as enumerated in the Paxson paper.  There are
+# currently five policy types available: "BSD", "BSD-right", "First", "Linux" 
+# and "Last".  Engines can be bound to standard Snort CIDR blocks or
+# IP lists.
+#
+# frag3_engine options:
+#   timeout: Amount of time a fragmented packet may be active before expiring.
+#            Default value is 60 seconds.
+#   ttl_limit: Limit of delta allowable for TTLs of packets in the fragments. 
+#              Based on the initial received fragment TTL.
+#   min_ttl: Minimum acceptable TTL for a fragment, frags with TTLs below this
+#            value will be discarded.  Default value is 0.
+#   detect_anomalies: Activates frag3's anomaly detection mechanisms.
+#   policy: Target-based policy to assign to this engine.  Default is BSD.
+#   bind_to: IP address set to bind this engine to.  Default is all hosts.
+#
+# Frag3 configuration example:
+#preprocessor frag3_global: max_frags 65536, prealloc_frags 65536
+#preprocessor frag3_engine: policy linux \
+#                           bind_to [10.1.1.12/32,10.1.1.13/32] \
+#                           detect_anomalies
+#preprocessor frag3_engine: policy first \
+#                           bind_to 10.2.1.0/24 \
+#                           detect_anomalies
+#preprocessor frag3_engine: policy last \
+#                           bind_to 10.3.1.0/24
+#preprocessor frag3_engine: policy bsd
+
+preprocessor frag3_global: max_frags 65536
+preprocessor frag3_engine: policy first detect_anomalies
+
+
+# stream4: stateful inspection/stream reassembly for Snort
+#----------------------------------------------------------------------
+# Use in concert with the -z [all|est] command line switch to defeat stick/snot
+# against TCP rules.  Also performs full TCP stream reassembly, stateful
+# inspection of TCP streams, etc.  Can statefully detect various portscan
+# types, fingerprinting, ECN, etc.
+
+# stateful inspection directive
+# no arguments loads the defaults (timeout 30, memcap 8388608)
+# options (options are comma delimited):
+#   detect_scans - stream4 will detect stealth portscans and generate alerts
+#                  when it sees them when this option is set
+#   detect_state_problems - detect TCP state problems, this tends to be very
+#                           noisy because there are a lot of crappy ip stack
+#                           implementations out there
+#
+#   disable_evasion_alerts - turn off the possibly noisy mitigation of
+#                            overlapping sequences.
+#
+#   ttl_limit [number]     - differential of the initial ttl on a session versus
+#                             the normal that someone may be playing games.
+#                             Routing flap may cause lots of false positives.
+# 
+#   keepstats [machine|binary] - keep session statistics, add "machine" to 
+#                         get them in a flat format for machine reading, add
+#                         "binary" to get them in a unified binary output 
+#                         format
+#   noinspect - turn off stateful inspection only
+#   timeout [number] - set the session timeout counter to [number] seconds,
+#                      default is 30 seconds
+#   max_sessions [number] - limit the number of sessions stream4 keeps
+#                         track of
+#   memcap [number] - limit stream4 memory usage to [number] bytes (does
+#                     not include session tracking, which is set by the
+#                     max_sessions option)
+#   log_flushed_streams - if an event is detected on a stream this option will
+#                         cause all packets that are stored in the stream4
+#                         packet buffers to be flushed to disk.  This only 
+#                         works when logging in pcap mode!
+#   server_inspect_limit [bytes] - Byte limit on server side inspection.
+#   enable_udp_sessions - turn on tracking of "sessions" over UDP.  Requires
+#                         configure --enable-stream4udp.  UDP sessions are
+#                         only created when there is a rule for the sender or
+#                         responder that has a flow or flowbits keyword.
+#   max_udp_sessions [number] - limit the number of simultaneous UDP sessions
+#                               to track
+#   udp_ignore_any - Do not inspect UDP packets unless there is a port specific
+#                    rule for a given port.  This is a performance improvement
+#                    and turns off inspection for udp xxx any -> xxx any rules
+#   cache_clean_sessions [number] - Cleanup the session cache by number sessions
+#                                   at a time.  The larger the value, the
+#                                   more sessions are purged from the cache when
+#                                   the session limit or memcap is reached.
+#                                   Defaults to 5.
+#   
+#   
+#
+# Stream4 uses Generator ID 111 and uses the following SIDS 
+# for that GID:
+#  SID     Event description
+# -----   -------------------
+#   1       Stealth activity
+#   2       Evasive RST packet
+#   3       Evasive TCP packet retransmission
+#   4       TCP Window violation
+#   5       Data on SYN packet
+#   6       Stealth scan: full XMAS
+#   7       Stealth scan: SYN-ACK-PSH-URG
+#   8       Stealth scan: FIN scan
+#   9       Stealth scan: NULL scan
+#   10      Stealth scan: NMAP XMAS scan
+#   11      Stealth scan: Vecna scan
+#   12      Stealth scan: NMAP fingerprint scan stateful detect
+#   13      Stealth scan: SYN-FIN scan
+#   14      TCP forward overlap
+
+#preprocessor stream4: disable_evasion_alerts
+
+# tcp stream reassembly directive
+# no arguments loads the default configuration 
+#   Only reassemble the client,
+#   Only reassemble the default list of ports (See below),  
+#   Give alerts for "bad" streams
+#
+# Available options (comma delimited):
+#   clientonly - reassemble traffic for the client side of a connection only
+#   serveronly - reassemble traffic for the server side of a connection only
+#   both - reassemble both sides of a session
+#   noalerts - turn off alerts from the stream reassembly stage of stream4
+#   ports [list] - use the space separated list of ports in [list], "all" 
+#                  will turn on reassembly for all ports, "default" will turn
+#                  on reassembly for ports 21, 23, 25, 42, 53, 80, 110,
+#                  111, 135, 136, 137, 139, 143, 445, 513, 514, 1433, 1521,
+#                  2401, and 3306
+#   favor_old - favor an old segment (based on sequence number) over a new one.
+#               This is the default.
+#   favor_new - favor an new segment (based on sequence number) over an old one.
+#   overlap_limit [number] - limit on overlaping segments for a session.
+#   flush_on_alert - flushes stream when an alert is generated for a session.
+#   flush_behavior [mode] -
+#           default      - use old static flushpoints (default)
+#           large_window - use new larger static flushpoints
+#           random       - use random flushpoints defined by flush_base, 
+#                          flush_seed and flush_range
+#   flush_base [number] - lowest allowed random flushpoint (512 by default)
+#   flush_range [number] - number is the space within which random flushpoints
+#                          are generated (default 1213)
+#   flush_seed [number] - seed for the random number generator, defaults to 
+#                         Snort PID + time
+#
+# Using the default random flushpoints, the smallest flushpoint is 512,
+# and the largest is 1725 bytes.
+#preprocessor stream4_reassemble
+
+# stream5: Target Based stateful inspection/stream reassembly for Snort
+# ---------------------------------------------------------------------
+# Stream5 is a target-based stream engine for Snort.  Its functionality
+# replaces that of Stream4.  Consequently, BOTH Stream4 and Stream5
+# cannot be used simultaneously.  Comment out the stream4 configurations
+# above to use Stream5.
+# 
+# See README.stream5 for details on the configuration options.
+#
+# Example config (that emulates Stream4 with UDP support compiled in)
+preprocessor stream5_global: max_tcp 8192, track_tcp yes, \
+                              track_udp no
+preprocessor stream5_tcp: policy first, use_static_footprint_sizes
+# preprocessor stream5_udp: ignore_any_rules
+
+
+# Performance Statistics
+# ----------------------
+# Documentation for this is provided in the Snort Manual.  You should read it.
+# It is included in the release distribution as doc/snort_manual.pdf
+# 
+# preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000
+
+# http_inspect: normalize and detect HTTP traffic and protocol anomalies
+#
+# lots of options available here. See doc/README.http_inspect.
+# unicode.map should be wherever your snort.conf lives, or given
+# a full path to where snort can find it.
+preprocessor http_inspect: global \
+    iis_unicode_map unicode.map 1252 
+
+preprocessor http_inspect_server: server default \
+    profile all ports { 80 8080 8180 } oversize_dir_length 500
+
+#
+#  Example unique server configuration
+#
+#preprocessor http_inspect_server: server 1.1.1.1 \
+#    ports { 80 3128 8080 } \
+#    flow_depth 0 \
+#    ascii no \
+#    double_decode yes \
+#    non_rfc_char { 0x00 } \
+#    chunk_length 500000 \
+#    non_strict \
+#    oversize_dir_length 300 \
+#    no_alerts
+
+
+# rpc_decode: normalize RPC traffic
+# ---------------------------------
+# RPC may be sent in alternate encodings besides the usual 4-byte encoding
+# that is used by default. This plugin takes the port numbers that RPC
+# services are running on as arguments - it is assumed that the given ports
+# are actually running this type of service. If not, change the ports or turn
+# it off.
+# The RPC decode preprocessor uses generator ID 106
+#
+# arguments: space separated list
+# alert_fragments - alert on any rpc fragmented TCP data
+# no_alert_multiple_requests - don't alert when >1 rpc query is in a packet
+# no_alert_large_fragments - don't alert when the fragmented
+#                            sizes exceed the current packet size
+# no_alert_incomplete - don't alert when a single segment
+#                       exceeds the current packet size
+
+preprocessor rpc_decode: 111 32771
+
+# bo: Back Orifice detector
+# -------------------------
+# Detects Back Orifice traffic on the network.
+#
+# arguments:  
+#   syntax:
+#     preprocessor bo: noalert { client | server | general | snort_attack } \
+#                      drop    { client | server | general | snort_attack }
+#   example:
+#     preprocessor bo: noalert { general server } drop { snort_attack }
+#
+# 
+# The Back Orifice detector uses Generator ID 105 and uses the 
+# following SIDS for that GID:
+#  SID     Event description
+# -----   -------------------
+#   1       Back Orifice traffic detected
+#   2       Back Orifice Client Traffic Detected
+#   3       Back Orifice Server Traffic Detected
+#   4       Back Orifice Snort Buffer Attack
+
+preprocessor bo
+
+# telnet_decode: Telnet negotiation string normalizer
+# ---------------------------------------------------
+# This preprocessor "normalizes" telnet negotiation strings from telnet and ftp
+# traffic.  It works in much the same way as the http_decode preprocessor,
+# searching for traffic that breaks up the normal data stream of a protocol and
+# replacing it with a normalized representation of that traffic so that the
+# "content" pattern matching keyword can work without requiring modifications.
+# This preprocessor requires no arguments.
+#
+# DEPRECATED in favor of ftp_telnet dynamic preprocessor
+#preprocessor telnet_decode
+#
+# ftp_telnet: FTP & Telnet normalizer, protocol enforcement and buff overflow
+# ---------------------------------------------------------------------------
+# This preprocessor normalizes telnet negotiation strings from telnet and
+# ftp traffic.  It looks for traffic that breaks the normal data stream
+# of the protocol, replacing it with a normalized representation of that
+# traffic so that the "content" pattern matching keyword can work without
+# requiring modifications.
+#
+# It also performs protocol correctness checks for the FTP command channel,
+# and identifies open FTP data transfers.
+#
+# FTPTelnet has numerous options available, please read
+# README.ftptelnet for help configuring the options for the global
+# telnet, ftp server, and ftp client sections for the protocol.
+
+#####
+# Per Step #2, set the following to load the ftptelnet preprocessor
+# dynamicpreprocessor file <full path to libsf_ftptelnet_preproc.so>
+# or use commandline option
+# --dynamic-preprocessor-lib <full path to libsf_ftptelnet_preproc.so>
+
+preprocessor ftp_telnet: global \
+   encrypted_traffic yes \
+   inspection_type stateful
+
+preprocessor ftp_telnet_protocol: telnet \
+   normalize \
+   ayt_attack_thresh 200
+
+# This is consistent with the FTP rules as of 18 Sept 2004.
+# CWD can have param length of 200
+# MODE has an additional mode of Z (compressed)
+# Check for string formats in USER & PASS commands
+# Check nDTM commands that set modification time on the file.
+preprocessor ftp_telnet_protocol: ftp server default \
+   def_max_param_len 100 \
+   alt_max_param_len 200 { CWD } \
+   cmd_validity MODE < char ASBCZ > \
+   cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
+   chk_str_fmt { USER PASS RNFR RNTO SITE MKD } \
+   telnet_cmds yes \
+   data_chan
+
+preprocessor ftp_telnet_protocol: ftp client default \
+   max_resp_len 256 \
+   bounce yes \
+   telnet_cmds yes
+
+# smtp: SMTP normalizer, protocol enforcement and buffer overflow
+# ---------------------------------------------------------------------------
+# This preprocessor normalizes SMTP commands by removing extraneous spaces.
+# It looks for overly long command lines, response lines, and data header lines.
+# It can alert on invalid commands, or specific valid commands.  It can optionally
+# ignore mail data, and can ignore TLS encrypted data.
+#
+# SMTP has numerous options available, please read README.SMTP for help
+# configuring options.
+
+#####
+# Per Step #2, set the following to load the smtp preprocessor
+# dynamicpreprocessor file <full path to libsf_smtp_preproc.so>
+# or use commandline option
+# --dynamic-preprocessor-lib <full path to libsf_smtp_preproc.so>
+
+preprocessor smtp: \
+  ports { 25 587 691 } \
+  inspection_type stateful \
+  normalize cmds \
+  normalize_cmds { EXPN VRFY RCPT } \
+  alt_max_command_line_len 260 { MAIL } \
+  alt_max_command_line_len 300 { RCPT } \
+  alt_max_command_line_len 500 { HELP HELO ETRN } \
+  alt_max_command_line_len 255 { EXPN VRFY }
+
+# sfPortscan
+# ----------
+# Portscan detection module.  Detects various types of portscans and
+# portsweeps.  For more information on detection philosophy, alert types,
+# and detailed portscan information, please refer to the README.sfportscan.
+#
+# -configuration options-
+#     proto { tcp udp icmp ip all }
+#       The arguments to the proto option are the types of protocol scans that
+#       the user wants to detect.  Arguments should be separated by spaces and
+#       not commas.
+#     scan_type { portscan portsweep decoy_portscan distributed_portscan all }
+#       The arguments to the scan_type option are the scan types that the
+#       user wants to detect.  Arguments should be separated by spaces and not
+#       commas.
+#     sense_level { low|medium|high }
+#       There is only one argument to this option and it is the level of
+#       sensitivity in which to detect portscans.  The 'low' sensitivity
+#       detects scans by the common method of looking for response errors, such
+#       as TCP RSTs or ICMP unreachables.  This level requires the least
+#       tuning.  The 'medium' sensitivity level detects portscans and 
+#       filtered portscans (portscans that receive no response).  This
+#       sensitivity level usually requires tuning out scan events from NATed
+#       IPs, DNS cache servers, etc.  The 'high' sensitivity level has
+#       lower thresholds for portscan detection and a longer time window than
+#       the 'medium' sensitivity level.  Requires more tuning and may be noisy
+#       on very active networks.  However, this sensitivity levels catches the
+#       most scans.
+#     memcap { positive integer }
+#       The maximum number of bytes to allocate for portscan detection.  The
+#       higher this number the more nodes that can be tracked.
+#     logfile { filename }
+#       This option specifies the file to log portscan and detailed portscan
+#       values to.  If there is not a leading /, then snort logs to the
+#       configured log directory.  Refer to README.sfportscan for details on
+#       the logged values in the logfile.
+#     watch_ip { Snort IP List }
+#     ignore_scanners { Snort IP List }
+#     ignore_scanned { Snort IP List }
+#       These options take a snort IP list as the argument.  The 'watch_ip'
+#       option specifies the IP(s) to watch for portscan.  The 
+#       'ignore_scanners' option specifies the IP(s) to ignore as scanners.
+#       Note that these hosts are still watched as scanned hosts.  The
+#       'ignore_scanners' option is used to tune alerts from very active
+#       hosts such as NAT, nessus hosts, etc.  The 'ignore_scanned' option 
+#       specifies the IP(s) to ignore as scanned hosts.  Note that these hosts
+#       are still watched as scanner hosts.  The 'ignore_scanned' option is
+#       used to tune alerts from very active hosts such as syslog servers, etc.
+#     detect_ack_scans
+#       This option will include sessions picked up in midstream by the stream
+#       module, which is necessary to detect ACK scans.  However, this can lead to
+#       false alerts, especially under heavy load with dropped packets; which is why
+#       the option is off by default.
+#
+preprocessor sfportscan: proto  { all } \
+                         memcap { 10000000 } \
+                         sense_level { low }
+
+# arpspoof
+#----------------------------------------
+# Experimental ARP detection code from Jeff Nathan, detects ARP attacks,
+# unicast ARP requests, and specific ARP mapping monitoring.  To make use of
+# this preprocessor you must specify the IP and hardware address of hosts on
+# the same layer 2 segment as you.  Specify one host IP MAC combo per line.
+# Also takes a "-unicast" option to turn on unicast ARP request detection. 
+# Arpspoof uses Generator ID 112 and uses the following SIDS for that GID:
+
+#  SID     Event description
+# -----   -------------------
+#   1       Unicast ARP request
+#   2       Etherframe ARP mismatch (src)
+#   3       Etherframe ARP mismatch (dst)
+#   4       ARP cache overwrite attack
+
+#preprocessor arpspoof
+#preprocessor arpspoof_detect_host: 192.168.40.1 f0:0f:00:f0:0f:00
+
+# ssh
+#----------------------------------------
+# EXPERIMENTAL CODE!!!
+#
+# THIS CODE IS STILL EXPERIMENTAL AND MAY OR MAY NOT BE STABLE!
+# USE AT YOUR OWN RISK!  DO NOT USE IN PRODUCTION ENVIRONMENTS.
+# YOU HAVE BEEN WARNED.
+#
+# The SSH preprocessor detects the following exploits: Gobbles, CRC 32,
+# Secure CRT, and the Protocol Mismatch exploit.
+#
+# Both Gobbles and CRC 32 attacks occur after the key exchange, and are
+# therefore encrypted.  Both attacks involve sending a large payload
+# (20kb+) to the server immediately after the authentication challenge.
+# To detect the attacks, the SSH preprocessor counts the number of bytes
+# transmitted to the server.  If those bytes exceed a pre-defined limit
+# within a pre-define number of packets, an alert is generated.  Since
+# Gobbles only effects SSHv2 and CRC 32 only effects SSHv1, the SSH
+# version string exchange is used to distinguish the attacks.
+#
+# The Secure CRT and protocol mismatch exploits are observable before
+# the key exchange.
+#
+# SSH has numerous options available, please read README.ssh for help
+# configuring options.
+
+#####
+# Per Step #2, set the following to load the ssh preprocessor
+# dynamicpreprocessor file <full path to libsf_ssh_preproc.so>
+# or use commandline option
+# --dynamic-preprocessor-lib <full path to libsf_ssh_preproc.so>
+#
+#preprocessor ssh: server_ports { 22 } \
+#                  max_client_bytes 19600 \
+#                  max_encrypted_packets 20
+
+# DCE/RPC
+#----------------------------------------
+#
+# The dcerpc preprocessor detects and decodes SMB and DCE/RPC traffic.
+# It is primarily interested in DCE/RPC data, and only decodes SMB
+# to get at the DCE/RPC data carried by the SMB layer.
+# 
+# Currently, the preprocessor only handles reassembly of fragmentation
+# at both the SMB and DCE/RPC layer.  Snort rules can be evaded by
+# using both types of fragmentation; with the preprocessor enabled
+# the rules are given a buffer with a reassembled SMB or DCE/RPC
+# packet to examine.
+# 
+# At the SMB layer, only fragmentation using WriteAndX is currently
+# reassembled.  Other methods will be handled in future versions of
+# the preprocessor.
+# 
+# Autodetection of SMB is done by looking for "\xFFSMB" at the start of
+# the SMB data, as well as checking the NetBIOS header (which is always
+# present for SMB) for the type "SMB Session".
+# 
+# Autodetection of DCE/RPC is not as reliable.  Currently, two bytes are
+# checked in the packet.  Assuming that the data is a DCE/RPC header,
+# one byte is checked for DCE/RPC version (5) and another for the type
+# "DCE/RPC Request".  If both match, the preprocessor proceeds with that
+# assumption that it is looking at DCE/RPC data.  If subsequent checks
+# are nonsensical, it ends processing.
+#
+# DCERPC has numerous options available, please read README.dcerpc for help
+# configuring options.
+
+#####
+# Per Step #2, set the following to load the dcerpc preprocessor
+# dynamicpreprocessor file <full path to libsf_dcerpc_preproc.so>
+# or use commandline option
+# --dynamic-preprocessor-lib <full path to libsf_dcerpc_preproc.so>
+
+preprocessor dcerpc: \
+    autodetect \
+    max_frag_size 3000 \
+    memcap 100000
+
+# DNS
+#----------------------------------------
+# The dns preprocessor (currently) decodes DNS Response traffic
+# and detects a few vulnerabilities.
+#
+# DNS has a few options available, please read README.dns for
+# help configuring options.
+
+#####
+# Per Step #2, set the following to load the dns preprocessor
+# dynamicpreprocessor file <full path to libsf_dns_preproc.so>
+# or use commandline option
+# --dynamic-preprocessor-lib <full path to libsf_dns_preproc.so>
+
+preprocessor dns: \
+    ports { 53 } \
+    enable_rdata_overflow
+
+# SSL
+#----------------------------------------
+# Encrypted traffic should be ignored by Snort for both performance reasons
+# and to reduce false positives.  The SSL Dynamic Preprocessor (SSLPP) 
+# inspects SSL traffic and optionally determines if and when to stop 
+# inspection of it.
+#
+# Typically, SSL is used over port 443 as HTTPS.  By enabling the SSLPP to
+# inspect port 443, only the SSL handshake of each connection will be
+# inspected.  Once the traffic is determined to be encrypted, no further
+# inspection of the data on the connection is made.
+#
+#   Important note: Stream4 or Stream5 should be explicitly told to reassemble
+#                   traffic on the ports that you intend to inspect SSL
+#                   encrypted traffic on.
+#
+#   To add reassembly on port 443 to Stream5, use 'port both 443' in the 
+#   Stream5 configuration.
+
+preprocessor ssl: noinspect_encrypted
+
+
+####################################################################
+# Step #4: Configure output plugins
+#
+# Uncomment and configure the output plugins you decide to use.  General
+# configuration for output plugins is of the form:
+#
+# output <name_of_plugin>: <configuration_options>
+#
+# alert_syslog: log alerts to syslog
+# ----------------------------------
+# Use one or more syslog facilities as arguments.  Win32 can also optionally
+# specify a particular hostname/port.  Under Win32, the default hostname is
+# '127.0.0.1', and the default port is 514.
+#
+# [Unix flavours should use this format...]
+# output alert_syslog: LOG_AUTH LOG_ALERT
+#
+# [Win32 can use any of these formats...]
+# output alert_syslog: LOG_AUTH LOG_ALERT
+# output alert_syslog: host=hostname, LOG_AUTH LOG_ALERT
+# output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT
+
+# log_tcpdump: log packets in binary tcpdump format
+# -------------------------------------------------
+# The only argument is the output file name.
+#
+# output log_tcpdump: tcpdump.log
+
+# database: log to a variety of databases
+# ---------------------------------------
+# See the README.database file for more information about configuring
+# and using this plugin.
+#
+# output database: log, mysql, user=root password=test dbname=db host=localhost
+# output database: alert, postgresql, user=snort dbname=snort
+# output database: log, odbc, user=snort dbname=snort
+# output database: log, mssql, dbname=snort user=snort password=test
+# output database: log, oracle, dbname=snort user=snort password=test
+
+# unified: Snort unified binary format alerting and logging
+# -------------------------------------------------------------
+# The unified output plugin provides two new formats for logging and generating
+# alerts from Snort, the "unified" format.  The unified format is a straight
+# binary format for logging data out of Snort that is designed to be fast and
+# efficient.  Used with barnyard (the new alert/log processor), most of the
+# overhead for logging and alerting to various slow storage mechanisms such as
+# databases or the network can now be avoided.  
+#
+# Check out the spo_unified.h file for the data formats.
+#
+# Two arguments are supported.
+#    filename - base filename to write to (current time_t is appended)
+#    limit    - maximum size of spool file in MB (default: 128)
+#
+# output alert_unified: filename snort.alert, limit 128
+# output log_unified: filename snort.log, limit 128
+
+
+# prelude: log to the Prelude Hybrid IDS system
+# ---------------------------------------------
+#
+# profile = Name of the Prelude profile to use (default is snort).
+#
+# Snort priority to IDMEF severity mappings:
+# high < medium < low < info
+#
+# These are the default mapped from classification.config:
+# info   = 4
+# low    = 3
+# medium = 2
+# high   = anything below medium
+#
+# output alert_prelude
+# output alert_prelude: profile=snort-profile-name
+
+
+# You can optionally define new rule types and associate one or more output
+# plugins specifically to that type.
+#
+# This example will create a type that will log to just tcpdump.
+# ruletype suspicious
+# {
+#   type log
+#   output log_tcpdump: suspicious.log
+# }
+#
+# EXAMPLE RULE FOR SUSPICIOUS RULETYPE:
+# suspicious tcp $HOME_NET any -> $HOME_NET 6667 (msg:"Internal IRC Server";)
+#
+# This example will create a rule type that will log to syslog and a mysql
+# database:
+# ruletype redalert
+# {
+#   type alert
+#   output alert_syslog: LOG_AUTH LOG_ALERT
+#   output database: log, mysql, user=snort dbname=snort host=localhost
+# }
+#
+# EXAMPLE RULE FOR REDALERT RULETYPE:
+# redalert tcp $HOME_NET any -> $EXTERNAL_NET 31337 \
+#   (msg:"Someone is being LEET"; flags:A+;)
+
+#
+# Include classification & priority settings
+# Note for Windows users:  You are advised to make this an absolute path,
+# such as:  c:\snort\etc\classification.config
+#
+
+include classification.config
+
+#
+# Include reference systems
+# Note for Windows users:  You are advised to make this an absolute path,
+# such as:  c:\snort\etc\reference.config
+#
+
+include reference.config
+
+####################################################################
+# Step #5: Configure snort with config statements
+#
+# See the snort manual for a full set of configuration references
+#
+# config flowbits_size: 64
+#
+# New global ignore_ports config option from Andy Mullican
+#
+# config ignore_ports: <tcp|udp> <list of ports separated by whitespace>
+# config ignore_ports: tcp 21 6667:6671 1356
+# config ignore_ports: udp 1:17 53
+
+
+####################################################################
+# Step #6: Customize your rule set
+#
+# Up to date snort rules are available at http://www.snort.org
+#
+# The snort web site has documentation about how to write your own custom snort
+# rules.
+
+#=========================================
+# Include all relevant rulesets here 
+# 
+# The following rulesets are disabled by default:
+#
+#   web-attacks, backdoor, shellcode, policy, porn, info, icmp-info, virus,
+#   chat, multimedia, and p2p
+#            
+# These rules are either site policy specific or require tuning in order to not
+# generate false positive alerts in most enviornments.
+# 
+# Please read the specific include file for more information and
+# README.alert_order for how rule ordering affects how alerts are triggered.
+#=========================================
+
+include $RULE_PATH/community-bot.rules           
+include $RULE_PATH/community-deleted.rules       
+include $RULE_PATH/community-dos.rules           
+include $RULE_PATH/community-exploit.rules       
+include $RULE_PATH/community-ftp.rules           
+include $RULE_PATH/community-game.rules          
+include $RULE_PATH/community-icmp.rules          
+include $RULE_PATH/community-imap.rules          
+include $RULE_PATH/community-inappropriate.rules 
+include $RULE_PATH/community-mail-client.rules   
+include $RULE_PATH/community-misc.rules          
+include $RULE_PATH/community-nntp.rules          
+include $RULE_PATH/community-oracle.rules
+include $RULE_PATH/community-policy.rules
+include $RULE_PATH/community-sip.rules
+include $RULE_PATH/community-smtp.rules
+include $RULE_PATH/community-sql-injection.rules
+include $RULE_PATH/community-virus.rules
+include $RULE_PATH/community-web-attacks.rules
+include $RULE_PATH/community-web-cgi.rules
+include $RULE_PATH/community-web-client.rules
+include $RULE_PATH/community-web-dos.rules
+include $RULE_PATH/community-web-iis.rules
+include $RULE_PATH/community-web-misc.rules
+include $RULE_PATH/community-web-php.rules       
+         
+# include $PREPROC_RULE_PATH/preprocessor.rules
+# include $PREPROC_RULE_PATH/decoder.rules
+
+# Include any thresholding or suppression commands. See threshold.conf in the
+# <snort src>/etc directory for details. Commands don't necessarily need to be
+# contained in this conf, but a separate conf makes it easier to maintain them. 
+# Note for Windows users:  You are advised to make this an absolute path,
+# such as:  c:\snort\etc\threshold.conf
+# Uncomment if needed.
+# include threshold.conf

snort-createmysql

@@ -0,0 +1,11 @@
+#!/bin/bash
+mysqladmin create snort
+cat << EOF | mysql -u root snort 
+grant INSERT,SELECT on root.* to snort@localhost;
+SET PASSWORD FOR snort@localhost=PASSWORD('$1');
+grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort@localhost;
+grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort;
+exit
+EOF
+mysql -u root < /usr/share/snort/contrib/create_mysql snort
+bzcat /usr/share/snort/contrib/snortdb-extra.bz2 | mysql -u snort --password="$1" snort 

snort-createmysql-archive

@@ -0,0 +1,11 @@
+#!/bin/bash
+mysqladmin create snort_archive
+cat << EOF | mysql -u root snort_archive
+grant INSERT,SELECT on root.* to snort@localhost;
+SET PASSWORD FOR snort@localhost=PASSWORD('$1');
+grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort_archive.* to snort@localhost;
+grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort_archive.* to snort;
+exit
+EOF
+mysql -u root < /usr/share/snort/contrib/create_mysql snort_archive
+bzcat /usr/share/snort/contrib/snortdb-extra.bz2 | mysql -u snort --password="$1" snort_archive 

snort-initscript

@@ -0,0 +1,59 @@
+#! /bin/bash
+#
+# snort - Snort intrusion detection system loader
+#         This starts and stops the snort service
+#
+# Copyright (c) 2003 by Silvan Calarco <silvan.calarco@qilinux.it>
+# Copyright (c) 2003 by Davide Madrisan <davide.madrisan@qilinux.it>
+#
+# description: snort loader
+# chkconfig: 2345 60 80
+
+source /etc/sysconfig/rc
+source $rc_functions
+source /etc/sysconfig/network
+[ -f /etc/sysconfig/snort ] && source /etc/sysconfig/snort
+
+case "$1" in
+   start)
+      intstring=""
+      [ -z "$SNORT_INTERFACES" ] && SNORT_INTERFACES=`grep -il "ONBOOT=yes" $network_devices/ifconfig.* 2>/dev/null`
+      for file in $SNORT_INTERFACES; do
+         interface="`echo $file | sed s/.*ifconfig\.// 2>/dev/null`"
+         intstring="-i $interface"
+         echo -n "Starting snort on interface $interface: "
+         daemon snort -u snort -b -D -c /etc/snort/snort.conf $intstring
+         evaluate_retval
+         echo
+      done
+      ;;
+
+   stop)
+      echo -n "Stopping snort: "
+      killproc snort
+      evaluate_retval
+      echo
+      ;;
+
+   reload)
+      echo -n "Reloading snort config file: "
+      reloadproc snort 1
+      evaluate_retval
+      echo
+      ;;
+
+   restart)
+      $0 stop
+      sleep 1
+      $0 start
+      ;;
+
+   status)
+      statusproc snort
+      ;;
+
+   *)
+      echo "Usage: $0 {start|stop|reload|restart|status}"
+      exit 1
+      ;;
+esac

snort-sysconfig

@@ -0,0 +1,6 @@
+# snort service configuration
+#
+# Snort is started by deafult on all active interfaces
+# use SNORT_INTERFACES to specify the interfaces you want snort to bind on
+
+#SNORT_INTERFACES="eth1 eth3"

snort.spec

@@ -0,0 +1,386 @@
+%define enable_mysql 1
+%define enable_odbc 0
+%define enable_postgresql 0
+%define groupid 65023
+%define userid 65023
+
+Name:          snort
+Version:       2.9.6.1
+Release:       1mamba
+Summary:       The Open Source Intrusion Detection System
+Group:         Network/Monitoring
+Vendor:        openmamba
+Distribution:  openmamba
+Packager:      Silvan Calarco <silvan.calarco@mambasoft.it>
+URL:           http://www.snort.org
+# 2.8.6.1: no direct link working; downloaded by hand
+Source0:       http://www.snort.org/dl/snort-current/%{name}-%{version}.tar.gz
+Source1:       snort-initscript
+Source2:       snort-sysconfig
+Source3:       snort-createmysql
+Source4:       snort-createmysql-archive
+#Source5:       http://www.snort.org/dl/contrib/...
+Source5:       snortdb-extra.bz2
+Source6:       http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-CURRENT.tar.gz
+Source7:       snort-conf
+License:       GPL
+%if %enable_mysql
+BuildRequires: libmysql5-devel
+%endif
+%if %enable_odbc
+Requires:      libodbc >= 2.2.6
+BuildRequires: libodbc-devel >= 2.2.6
+%endif
+%if %enable_postgresql
+Requires:      postgresql >= 7.3.3
+BuildRequires: postgresql-devel >= 7.4-2
+%endif
+## AUTOBUILDREQ-BEGIN
+BuildRequires: glibc-devel
+BuildRequires: libmysql5-devel
+BuildRequires: libopenssl-devel
+BuildRequires: libpcap-devel
+BuildRequires: libpcre-devel
+BuildRequires: libz-devel
+BuildRequires: mysql
+BuildRequires: mysql-client
+## AUTOBUILDREQ-END
+BuildRequires: libdnet-devel
+BuildRequires: libdaq-devel
+BuildRoot:     %{_tmppath}/%{name}-%{version}-build
+Provides:      %{_datadir}/snort/contrib/createmysql
+Provides:      %{_datadir}/snort/contrib/createmysql-archive
+
+%description
+Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
+It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
+Snort uses a flexible rules language to describe traffic that it should collect or pass, as well as a detection engine that utilizes a modular plugin architecture.
+Snort has a real-time alerting capability as well, incorporating alerting mechanisms for syslog, a user specified file, a UNIX socket, or WinPopup messages to Windows clients using Samba's smbclient.
+
+Snort has three primary uses. 
+It can be used as a straight packet sniffer like tcpdump(1), a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion  detection system.
+
+%package devel
+Summary:       Static libraries, headers and source files for development with %{name}
+Group:         Development/Applications
+Requires:      %{name} = %{version}-%{release}
+
+%description devel
+Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
+It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
+Snort uses a flexible rules language to describe traffic that it should collect or pass, as well as a detection engine that utilizes a modular plugin architecture.
+Snort has a real-time alerting capability as well, incorporating alerting mechanisms for syslog, a user specified file, a UNIX socket, or WinPopup messages to Windows clients using Samba's smbclient.
+
+Snort has three primary uses. 
+It can be used as a straight packet sniffer like tcpdump(1), a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion  detection system.
+
+This package contains the static libraries, headers and source files for development.
+
+%prep
+%setup -q -a6
+sed -i "s|/usr/local|/usr|" etc/snort.conf
+
+%build
+%configure \
+   -sysconfdir=%{_sysconfdir}/snort \
+   --enable-linux-smp-stat \
+   --enable-smbalerts \
+%if %enable_mysql
+   --with-mysql \
+%else
+   --without-mysql --disable-mysql \
+%endif
+%if %enable_odbc
+   --with-odbc \
+%endif
+%if %enable_postgresql
+   --with-postgresql \
+%endif
+#  --enable-sourcefire
+#  --enable-perfmonitor
+#  --enable-flexresp
+
+%make -j1
+
+%install
+[ "%{buildroot}" != / ] && rm -rf %{buildroot}
+%makeinstall
+
+install -d %{buildroot}%{_sysconfdir}/snort/{rules,preproc_rules}
+cp rules/*.rules %{buildroot}%{_sysconfdir}/snort/rules/
+cp preproc_rules/*.rules %{buildroot}%{_sysconfdir}/snort/preproc_rules/
+
+cp etc/*.conf etc/*.config etc/*.map %{buildroot}%{_sysconfdir}/snort
+
+install -D -m 755 %{SOURCE1} %{buildroot}%{_initrddir}/snort
+install -D -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/snort
+
+install -d %{buildroot}/var/log/snort
+
+install -D %{SOURCE3} %{buildroot}%{_datadir}/snort/contrib/createmysql
+install -D %{SOURCE4} %{buildroot}%{_datadir}/snort/contrib/createmysql-archive
+
+install -D %{SOURCE7} %{buildroot}%{_sysconfdir}/snort/snort.conf
+
+#cp contrib/create* contrib/snortdb-extra.bz2 %{buildroot}%{_datadir}/snort/contrib/
+cp %{SOURCE5} %{buildroot}%{_datadir}/snort/contrib/
+#cp schemas/create_* %{buildroot}%{_datadir}/snort/contrib/
+
+%pre
+/usr/sbin/groupadd snort -g %{groupid} 2>/dev/null
+/usr/sbin/useradd -u %{userid} -c 'Snort user' -d /dev/null -g snort \
+   -s /bin/false snort 2>/dev/null
+exit 0
+
+%post
+# new install
+if [ $1 -eq 1 ]; then
+   RANDOM_PASSWD=`/usr/bin/mkpasswd -l 10 -s 0`
+   sed -i "s|# output database: log, mysql.*|output database: log, mysql, user=snort password=$RANDOM_PASSWD dbname=snort host=localhost|" \
+      %{_sysconfdir}/snort/snort.conf
+   %{_datadir}/snort/contrib/createmysql $RANDOM_PASSWD
+   %{_datadir}/snort/contrib/createmysql-archive $RANDOM_PASSWD
+fi
+exit 0
+
+%preun
+# erase
+if [ $1 -eq 0 ]; then
+   service snort stop 2>/dev/null
+   /sbin/chkconfig --del snort
+   /usr/sbin/userdel snort 2>/dev/null
+fi
+exit 0
+
+%postun
+# update
+if [ $1 -eq 1 ]; then
+   groupadd snort -g %{groupid} 2>/dev/null
+   /usr/sbin/useradd -u %{userid} -c 'Snort user' -d /dev/null -g snort \
+      -s /bin/false snort 2>/dev/null
+   /sbin/chkconfig snort
+   [ $? -eq 0 ] && service snort restart
+fi
+exit 0
+
+%clean
+[ "%{buildroot}" != / ] && rm -rf %{buildroot}
+
+%files
+%defattr(-,root,root)
+%config(noreplace) %{_sysconfdir}/snort/snort.conf
+%config %{_sysconfdir}/snort/file_magic.conf
+%config(noreplace) %{_sysconfdir}/snort/threshold.conf
+%config(noreplace) %{_sysconfdir}/snort/classification.config
+%config(noreplace) %{_sysconfdir}/snort/reference.config
+%config(noreplace) %{_sysconfdir}/sysconfig/snort
+%{_sysconfdir}/snort/rules/*
+%{_sysconfdir}/snort/preproc_rules/*
+%{_sysconfdir}/snort/*.map
+%{_bindir}/u2boat
+%{_bindir}/u2spewfoo
+%{_bindir}/snort
+%dir %{_prefix}/lib/snort_dynamicengine
+%{_prefix}/lib/snort_dynamicengine/libsf_engine.a
+%{_prefix}/lib/snort_dynamicengine/libsf_engine.la
+%{_prefix}/lib/snort_dynamicengine/libsf_engine.so
+%{_prefix}/lib/snort_dynamicengine/libsf_engine.so.*
+%dir %{_prefix}/lib/snort_dynamicpreprocessor
+%{_prefix}/lib/snort_dynamicpreprocessor/*.a
+%{_prefix}/lib/snort_dynamicpreprocessor/*.la
+%{_prefix}/lib/snort_dynamicpreprocessor/*.so*
+%dir %{_libdir}/snort/dynamic_output/
+%{_libdir}/snort/dynamic_output/libsf_dynamic_output.a
+%{_libdir}/snort/dynamic_output/libsf_dynamic_output.la
+%dir %{_libdir}/snort/dynamic_preproc
+%{_libdir}/snort/dynamic_preproc/libsf_dynamic_preproc.a
+%{_libdir}/snort/dynamic_preproc/libsf_dynamic_preproc.la
+%dir %{_datadir}/snort
+%dir %{_datadir}/snort/contrib
+%{_datadir}/snort/contrib/*
+%attr(755,root,root) %{_initrddir}/snort
+%dir %attr(755,snort,snort) /var/log/snort
+%{_datadir}/doc/snort/*
+%{_mandir}/man8/*
+%doc ChangeLog doc/AUTHORS doc/CREDITS
+%doc doc/snort_manual.*
+
+%files devel
+%defattr(-,root,root)
+%{_prefix}/src/snort_dynamicsrc/*.h
+%{_prefix}/src/snort_dynamicsrc/*.c
+%dir %{_includedir}/snort
+%{_includedir}/snort/*
+%{_libdir}/pkgconfig/snort.pc
+%{_libdir}/pkgconfig/snort_preproc.pc
+%{_libdir}/pkgconfig/snort_output.pc
+%doc doc/{BUGS,CREDITS,NEWS,README*,TODO,USAGE}
+
+%changelog
+* Thu Apr 24 2014 Automatic Build System <autodist@mambasoft.it> 2.9.6.1-1mamba
+- automatic version update by autodist
+
+* Sun Feb 02 2014 Automatic Build System <autodist@mambasoft.it> 2.9.6.0-1mamba
+- automatic version update by autodist
+
+* Tue Nov 19 2013 Automatic Build System <autodist@mambasoft.it> 2.9.5.6-1mamba
+- automatic version update by autodist
+
+* Tue Sep 17 2013 Automatic Build System <autodist@mambasoft.it> 2.9.5.5-1mamba
+- automatic version update by autodist
+
+* Wed Jul 31 2013 Automatic Build System <autodist@mambasoft.it> 2.9.5.3-1mamba
+- automatic version update by autodist
+
+* Tue Jul 02 2013 Automatic Build System <autodist@mambasoft.it> 2.9.5-1mamba
+- automatic version update by autodist
+
+* Thu Apr 25 2013 Automatic Build System <autodist@mambasoft.it> 2.9.4.6-1mamba
+- automatic version update by autodist
+
+* Thu Apr 04 2013 Automatic Build System <autodist@mambasoft.it> 2.9.4.5-1mamba
+- automatic version update by autodist
+
+* Wed Mar 06 2013 Automatic Build System <autodist@mambasoft.it> 2.9.4.1-1mamba
+- automatic version update by autodist
+
+* Tue Dec 04 2012 Automatic Build System <autodist@mambasoft.it> 2.9.4-1mamba
+- automatic version update by autodist
+
+* Thu Aug 09 2012 Automatic Build System <autodist@mambasoft.it> 2.9.3.1-1mamba
+- automatic version update by autodist
+
+* Sun Jul 22 2012 Automatic Build System <autodist@mambasoft.it> 2.9.3-1mamba
+- automatic version update by autodist
+
+* Wed May 16 2012 Automatic Build System <autodist@mambasoft.it> 2.9.2.3-1mamba
+- automatic version update by autodist
+
+* Wed Mar 28 2012 Automatic Build System <autodist@mambasoft.it> 2.9.2.2-1mamba
+- automatic version update by autodist
+
+* Fri Jan 20 2012 Automatic Build System <autodist@mambasoft.it> 2.9.2.1-1mamba
+- automatic version update by autodist
+
+* Thu Dec 22 2011 Automatic Build System <autodist@mambasoft.it> 2.9.2-1mamba
+- automatic version update by autodist
+
+* Thu Oct 20 2011 Automatic Build System <autodist@mambasoft.it> 2.9.1.2-1mamba
+- automatic version update by autodist
+
+* Fri Oct 07 2011 Automatic Build System <autodist@mambasoft.it> 2.9.1.1-1mamba
+- automatic version update by autodist
+
+* Thu Aug 25 2011 Automatic Build System <autodist@mambasoft.it> 2.9.1-1mamba
+- automatic version update by autodist
+
+* Thu Apr 07 2011 Automatic Build System <autodist@mambasoft.it> 2.9.0.5-1mamba
+- automatic update by autodist
+
+* Sat Feb 19 2011 Automatic Build System <autodist@mambasoft.it> 2.9.0.4-1mamba
+- update to 2.9.0.4
+
+* Mon Jul 26 2010 Automatic Build System <autodist@mambasoft.it> 2.8.6.1-1mamba
+- update to 2.8.6.1
+
+* Sat May 08 2010 Automatic Build System <autodist@mambasoft.it> 2.8.6-1mamba
+- automatic update to 2.8.6 by autodist
+
+* Thu Feb 18 2010 Automatic Build System <autodist@mambasoft.it> 2.8.5.3-1mamba
+- automatic update to 2.8.5.3 by autodist
+
+* Thu Dec 31 2009 Automatic Build System <autodist@mambasoft.it> 2.8.5.2-1mamba
+- automatic update to 2.8.5.2 by autodist
+
+* Sun Oct 25 2009 Automatic Build System <autodist@mambasoft.it> 2.8.5.1-1mamba
+- automatic update to 2.8.5.1 by autodist
+
+* Tue Sep 29 2009 Automatic Build System <autodist@mambasoft.it> 2.8.5-1mamba
+- update to 2.8.5
+
+* Tue Apr 28 2009 Automatic Build System <autodist@mambasoft.it> 2.8.4.1-1mamba
+- automatic update to 2.8.4.1 by autodist
+
+* Wed Apr 08 2009 Silvan Calarco <silvan.calarco@mambasoft.it> 2.8.4-1mamba
+- automatic update to 2.8.4 by autodist
+
+* Sat Jan 17 2009 Silvan Calarco <silvan.calarco@mambasoft.it> 2.8.3.2-1mamba
+- automatic update to 2.8.3.2 by autodist
+
+* Thu Oct 02 2008 Silvan Calarco <silvan.calarco@mambasoft.it> 2.8.3.1-1mamba
+- automatic update to 2.8.3.1 by autodist
+
+* Sat Sep 06 2008 Silvan Calarco <silvan.calarco@mambasoft.it> 2.8.3-1mamba
+- update to 2.8.3
+
+* Sun Aug 31 2008 Silvan Calarco <silvan.calarco@mambasoft.it> 2.8.2.2-2mamba
+- fix requirements in post script
+
+* Sun Aug 24 2008 gil <puntogil@libero.it> 2.8.2.2-1mamba
+- update to 2.8.2.2
+
+* Wed Jun 18 2008 Silvan Calarco <silvan.calarco@mambasoft.it> 2.8.2.1-1mamba
+- update to 2.8.2.1
+
+* Fri Jul 08 2005 Davide Madrisan <davide.madrisan@qilinux.it> 2.3.3-3qilnx
+- rebuilt with new libpcap libraries
+
+* Thu Jul 07 2005 Davide Madrisan <davide.madrisan@qilinux.it> 2.3.3-2qilnx
+- fixed %%pre script
+
+* Mon May 02 2005 Davide Madrisan <davide.madrisan@qilinux.it> 2.3.3-1qilnx
+- update to version 2.3.3 by autospec
+- new source `snortdb-extra.bz2'
+  see http://cvs.snort.org/viewcvs.cgi/snort/contrib/Attic/snortdb-extra.gz
+- fixed group for used snort
+
+* Fri Dec 31 2004 Silvan Calarco <silvan.calarco@mambasoft.it> 2.2.0-1qilnx
+- update to version 2.2.0 by autospec
+
+* Tue Oct 05 2004 Silvan Calarco <silvan.calarco@mambasoft.it> 2.1.3-5qilnx
+- added creation of snort-archive database
+
+* Sat Jun 05 2004 Silvan Calarco <silvan.calarco@mambasoft.it> 2.1.3-4qilnx
+- start daemon without "-A fast" otherwise it won't log to database
+
+* Tue Jun 04 2004 Silvan Calarco <silvan.calarco@mambasoft.it> 2.1.3-3qilnx
+- completed db creation with snortdb-extra.gz
+
+* Tue Jun 04 2004 Silvan Calarco <silvan.calarco@mambasoft.it> 2.1.3-2qilnx
+- reconfigured with mysql database creation on install
+- now runs with its own user and group (snort)
+
+* Thu Jun 03 2004 Silvan Calarco <silvan.calarco@mambasoft.it> 2.1.3-1qilnx
+- new version build
+
+* Thu Apr 01 2004 Davide Madrisan <davide.madrisan@qilinux.it> 2.1.2-1qilnx
+- new version rebuild
+
+* Tue Mar 02 2004 Davide Madrisan <davide.madrisan@qilinux.it> 2.1.1-2qilnx
+- RPM group modified; postun scriptlet fixed
+
+* Mon Mar 01 2004 Davide Madrisan <davide.madrisan@qilinux.it> 2.1.1-1qilnx
+- rebuilt with version 2.1.1
+- minor specfile cleanups
+
+* Tue Dec 30 2003 Davide Madrisan <davide.madrisan@qilinux.it> 2.1.0-1qilnx
+- rebuilt with version 2.1.0
+  enabled support for mysql, postgresql, odbc
+
+* Fri Nov 21 2003 Davide Madrisan <davide.madrisan@qilinux.it> 2.0.5-1qilnx
+- rebuilt with version 2.0.5
+
+* Fri Nov 07 2003 Davide Madrisan <davide.madrisan@qilinux.it> 2.0.4-1qilnx
+- rebuilt with version 2.0.4
+
+* Wed Nov 05 2003 Davide Madrisan <davide.madrisan@qilinux.it> 2.0.3-1qilnx
+- rebuilt with version 2.0.3
+
+* Fri Sep 19 2003 Davide Madrisan <davide.madrisan@qilinux.it> 2.0.2-1qilnx
+- rebuid using snort 2.0.2
+- some interesting optional features enabled (via configure options):
+  SMB alerting via Samba, statistics reporting through proc.
+  flexible responses on hostile connection attempts not yet enabled.
+
+* Tue Jun 18 2003 Silvan Calarco <silvan.calarco@qinet.it> 2.0.0-1qilnx
+- first build for snort