Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Juuso Alasuutari (2f3a5f90f2e234fa3665d03e74367c2f290d1027)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Juuso Alasuutari <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Juuso Alasuutari (2f3a5f90f2e234fa3665d03e74367c2f290d1027)
  • Date: Tue, 21 Aug 2007 08:45:59 -0500

GIT changes to master grimoire by Juuso Alasuutari <iuso AT sourcemage.org>:

ChangeLog | 4 ++++
security/fwknop/BUILD | 1 +
security/fwknop/CONFIGURE | 10 ++++++++++
security/fwknop/DEPENDS | 8 ++++++++
security/fwknop/DETAILS | 28 ++++++++++++++++++++++++++++
security/fwknop/HISTORY | 4 ++++
security/fwknop/INSTALL | 1 +
security/fwknop/PRE_BUILD | 17 +++++++++++++++++
security/fwknop/fwknop.gpg |binary
security/fwknop/homedir_hack.diff | 18 ++++++++++++++++++
security/fwknop/init.d/fwknopd | 24 ++++++++++++++++++++++++
security/fwknop/init_hack.diff | 20 ++++++++++++++++++++
12 files changed, 135 insertions(+)

New commits:
commit 2f3a5f90f2e234fa3665d03e74367c2f290d1027
Author: Juuso Alasuutari <iuso AT sourcemage.org>
Commit: Juuso Alasuutari <iuso AT sourcemage.org>

New spell: fwknop, a port knocking and single packet authorization
server/client. Fwknop has its own perl install script, which makes
writing a proper spell difficult. Here are some known bugs in this first
commit:
- won't use $INSTALL_ROOT
- will attempt to kill an existing fwknopd daemon on updates (and might
fail, making the cast break)
- will do its own config file merging
Proceed with caution and please, please improve this spell if you can.

diff --git a/ChangeLog b/ChangeLog
index d5110ad..6de0b02 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2007-08-21 Juuso Alasuutari <iuso AT sourcemage.org>
+ * security/fwknop: New spell, port knocking and/or Single Packet
+ Authorization server/client.
+
2007-08-21 Mathieu Lonjaret <lejatorn AT sourcemage.org>
* video/gpac: new spell for creating/manipulating/playing mp4

diff --git a/security/fwknop/BUILD b/security/fwknop/BUILD
new file mode 100755
index 0000000..27ba77d
--- /dev/null
+++ b/security/fwknop/BUILD
@@ -0,0 +1 @@
+true
diff --git a/security/fwknop/CONFIGURE b/security/fwknop/CONFIGURE
new file mode 100755
index 0000000..9688856
--- /dev/null
+++ b/security/fwknop/CONFIGURE
@@ -0,0 +1,10 @@
+config_query_option FWKNOP_SERVER \
+ "Install server component?" y \
+ "" \
+ "--client-only" &&
+
+if [[ $FWKNOP_SERVER == '--client-only' ]]
+then
+ message "${MESSAGE_COLOR}The init script is useful only" \
+ "with the server component.$DEFAULT_COLOR"
+fi
diff --git a/security/fwknop/DEPENDS b/security/fwknop/DEPENDS
new file mode 100755
index 0000000..387478a
--- /dev/null
+++ b/security/fwknop/DEPENDS
@@ -0,0 +1,8 @@
+depends perl &&
+depends psmisc &&
+
+if [[ $FWKNOP_SERVER != '--client-only' ]]
+then
+ depends iptables &&
+ depends libcap
+fi
diff --git a/security/fwknop/DETAILS b/security/fwknop/DETAILS
new file mode 100755
index 0000000..6ed6bdc
--- /dev/null
+++ b/security/fwknop/DETAILS
@@ -0,0 +1,28 @@
+ SPELL=fwknop
+ VERSION=1.8.1
+ SOURCE=$SPELL-$VERSION.tar.bz2
+ SOURCE2=$SOURCE.asc
+ SOURCE_URL[0]=http://www.cipherdyne.org/fwknop/download/$SOURCE
+ SOURCE2_URL[0]=http://www.cipherdyne.org/fwknop/download/$SOURCE2
+ SOURCE_GPG=fwknop.gpg:$SOURCE2:UPSTREAM_KEY
+ SOURCE2_IGNORE=signature
+SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
+ WEB_SITE=http://www.cipherdyne.org/fwknop/
+ ENTERED=20070821
+ LICENSE[0]=GPL
+ KEYWORDS="security"
+ SHORT="A Single Packet Authorization (SPA) implementation."
+cat << EOF
+fwknop stands for the "FireWall KNock OPerator", and implements an
+authorization scheme called Single Packet Authorization (SPA) that is
+based around iptables and libpcap. SPA requires only a single encrypted
+packet in order to communicate various pieces of information including
+desired access through an iptables policy and/or complete commands to
+execute on the target system. By using iptables to maintain a "default
+drop" stance, the main application of this program is to protect services
+such as OpenSSH with an additional layer of security in order to make the
+exploitation of vulnerabilities (both 0-day and unpatched code) much more
+difficult. With fwknop deployed, anyone using nmap to look for sshd can't
+even tell that it is listening; it makes no difference if they have a
+0-day exploit or not.
+EOF
diff --git a/security/fwknop/HISTORY b/security/fwknop/HISTORY
new file mode 100644
index 0000000..daf2f10
--- /dev/null
+++ b/security/fwknop/HISTORY
@@ -0,0 +1,4 @@
+2007-08-21 Juuso Alasuutari <iuso AT sourcemage.org>
+ * DETAILS, CONFIGURE, DEPENDS, PRE_BUILD, BUILD, INSTALL,
+ fwknopd, fwknop.gpg, homedir_hack.diff, init_hack.diff:
+ Created spell.
diff --git a/security/fwknop/INSTALL b/security/fwknop/INSTALL
new file mode 100755
index 0000000..765d39e
--- /dev/null
+++ b/security/fwknop/INSTALL
@@ -0,0 +1 @@
+./install.pl --Defaults $FWKNOP_SERVER
diff --git a/security/fwknop/PRE_BUILD b/security/fwknop/PRE_BUILD
new file mode 100755
index 0000000..7870077
--- /dev/null
+++ b/security/fwknop/PRE_BUILD
@@ -0,0 +1,17 @@
+default_pre_build &&
+cd "$SOURCE_DIRECTORY" &&
+
+#
+# Prevent client-only installation from putting files under /root
+#
+patch -p0 < "$SCRIPT_DIRECTORY/homedir_hack.diff" &&
+
+#
+# Prevent init script installation
+#
+patch -p0 < "$SCRIPT_DIRECTORY/init_hack.diff" &&
+
+#
+# Change client-only installation's lib path from /lib to /usr/lib
+#
+sed -i "s|\$homedir/lib|\$homedir/usr/lib|g" install.pl
diff --git a/security/fwknop/fwknop.gpg b/security/fwknop/fwknop.gpg
new file mode 100644
index 0000000..94142f8
Binary files /dev/null and b/security/fwknop/fwknop.gpg differ
diff --git a/security/fwknop/homedir_hack.diff
b/security/fwknop/homedir_hack.diff
new file mode 100644
index 0000000..7abaf95
--- /dev/null
+++ b/security/fwknop/homedir_hack.diff
@@ -0,0 +1,18 @@
+--- install.pl~ 2007-06-04 02:13:34.000000000 +0000
++++ install.pl 2007-08-21 11:57:27.000000000 +0000
+@@ -224,15 +224,7 @@
+
+ if ($client_install) {
+
+- ### we are installing as a normal user instead of root, so see
+- ### if it is ok to install within the user's home directory
+ $homedir = '';
+- if ($config_homedir) {
+- $homedir = $config_homedir;
+- } else {
+- $homedir = $ENV{'HOME'} or die '[*] Could not get home ',
+- "directory, set the $config_homedir var.";
+- }
+
+ print
+ " The fwknop client will be installed at $homedir/bin/fwknop, and a
few\n",
diff --git a/security/fwknop/init.d/fwknopd b/security/fwknop/init.d/fwknopd
new file mode 100644
index 0000000..3b135ad
--- /dev/null
+++ b/security/fwknop/init.d/fwknopd
@@ -0,0 +1,24 @@
+PROGRAM=/usr/sbin/fwknopd
+RUNLEVEL=3
+NEEDS="+network"
+
+. /etc/init.d/smgl_init
+
+start()
+{
+ echo "Starting the fwknop daemons..."
+ /usr/sbin/fwknopd
+ evaluate_retval
+}
+
+stop()
+{
+ echo "Stopping the fwknop daemons..."
+ /usr/sbin/fwknopd --Kill
+ evaluate_retval
+}
+
+status()
+{
+ /usr/sbin/fwknopd --Status
+}
diff --git a/security/fwknop/init_hack.diff b/security/fwknop/init_hack.diff
new file mode 100644
index 0000000..5246cfb
--- /dev/null
+++ b/security/fwknop/init_hack.diff
@@ -0,0 +1,20 @@
+--- install.pl~ 2007-06-04 02:13:34.000000000 +0000
++++ install.pl 2007-08-21 13:27:36.000000000 +0000
+@@ -640,16 +640,12 @@
+ }
+ }
+
+- if (-d $INIT_DIR) {
+- &enable_fwknop_at_boot($distro) unless $data_method =~
/client/i;
+- }
+-
+ if ($data_method =~ /client/i) {
+ print "\n[+] fwknop has been installed!\n\n";
+ } else {
+ print
+ "\n[+] fwknop has been installed! To start in server mode, run\n\n",
+-" \"/etc/init.d/fwknop start\"\n\n",
++" \"telinit run fwknopd start\"\n\n",
+ " Note: You will need to edit $config{'FWKNOP_CONF_DIR'}/access.conf for
fwknop to\n",
+ " function properly in server mode. More information can be found in\n",
+ " the fwknop manpage.\n\n";



  • [SM-Commit] GIT changes to master grimoire by Juuso Alasuutari (2f3a5f90f2e234fa3665d03e74367c2f290d1027), Juuso Alasuutari, 08/21/2007

Archive powered by MHonArc 2.6.24.

Top of Page