Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Arjan Bouter (789c509370b27c341ac7d4e5a3c9fa93730182d9)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Arjan Bouter <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Arjan Bouter (789c509370b27c341ac7d4e5a3c9fa93730182d9)
  • Date: Mon, 27 Jul 2009 12:13:50 -0500

GIT changes to master grimoire by Arjan Bouter <abouter AT sourcemage.org>:

ChangeLog | 1 +
security/tct/BUILD | 1 +
security/tct/DEPENDS | 17 +++++++++++++++++
security/tct/DETAILS | 27 +++++++++++++++++++++++++++
security/tct/FINAL | 1 +
security/tct/HISTORY | 2 ++
security/tct/INSTALL | 2 ++
security/tct/PRE_BUILD | 3 +++
security/tct/fstools.patch | 10 ++++++++++
9 files changed, 64 insertions(+)

New commits:
commit 789c509370b27c341ac7d4e5a3c9fa93730182d9
Author: Arjan Bouter <abouter AT sourcemage.org>
Commit: Arjan Bouter <abouter AT sourcemage.org>

tct: new spell, the coroner's toolkit. forensics toolkit

diff --git a/ChangeLog b/ChangeLog
index 6cb5c11..2e20913 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,7 @@
calculator

2009-07-27 Arjan Bouter <abouter AT sourcemage.org>
+ * security/tct: new spell, the coroner's toolkit, forensics toolkit
* wm-addons/batterymon: new spell, battery applet
* wm-addons/ibam: new spell, apm battery monitor with optional
gkrellm(2) plugin
diff --git a/security/tct/BUILD b/security/tct/BUILD
new file mode 100755
index 0000000..8f58e6d
--- /dev/null
+++ b/security/tct/BUILD
@@ -0,0 +1 @@
+make
diff --git a/security/tct/DEPENDS b/security/tct/DEPENDS
new file mode 100755
index 0000000..96d70ea
--- /dev/null
+++ b/security/tct/DEPENDS
@@ -0,0 +1,17 @@
+depends gcc &&
+depends perl &&
+optional_depends lsof '' '' 'Find open files (highly recommended)' &&
+optional_depends CRON '' '' 'Inspect cron?' &&
+optional_depends rpm '' '' 'use rpm?' &&
+optional_depends yp-tools '' '' 'for ypcat and ypwhich' &&
+optional_depends uudeview '' '' 'for uudecode' &&
+optional_depends bsd-finger '' '' 'for finger' &&
+optional_depends 'nfs-utils' '' 'for nfs support' &&
+optional_depends at '' '' 'use at?' &&
+optional_depends 'netkit-ftp' '' 'for ftp support'
+optional_depends nmap '' '' 'use nmap?' &&
+optional_depends strace '' '' 'use strace?'
+
+#please help complete the list of apps:
+#acctcom, devinfo, eeprom, format, modstat, pkginfo, pstat
+#rusers, showmount, showrev, swap
diff --git a/security/tct/DETAILS b/security/tct/DETAILS
new file mode 100755
index 0000000..149c827
--- /dev/null
+++ b/security/tct/DETAILS
@@ -0,0 +1,27 @@
+ SPELL=tct
+ VERSION=1.18
+ SOURCE="${SPELL}-${VERSION}.tar.gz"
+ SOURCE_URL[0]=http://www.porcupine.org/forensics/${SOURCE}
+
SOURCE_HASH=sha512:aea6e599e4e81cc6d320c36e181ee9478899cb85d13d3ea2a2bd90c223b43b919f8c9ee25826b7aada3fe402204a94a87b7142af97d79570e22cef60f8434a26
+SOURCE_DIRECTORY="${BUILD_DIRECTORY}/${SPELL}-${VERSION}"
+ WEB_SITE="http://www.porcupine.org/forensics/tct.html";
+ LICENSE[0]=IBMPL
+ DOCS="$DOCS CHANGES Beware quick-start help-recovering-file
help-when-broken-into"
+ ENTERED=20090727
+ SHORT="The coroner's toolkit"
+cat << EOF
+TCT is a collection of programs by Dan Farmer and Wietse Venema for a
+post-mortem analysis of a UNIX system after break-in.
+The programs are all either oriented towards gathering or analyzing
+forensic data on a Unix system. There is no single task or ultimate
+goal that they are directed to, but if there was a theme it'd be an
+effort towards the reconstruction of the past - determining as much
+as possible what happened with a static snapshot of a system. Most of
+the tools are oriented towards data collection rather than analysis -
+a good use of the toolkit could be for a relative neophyte in Unix
+forensic security to send the data to someone who does know something and
+can further analyze the output.
+
+Examples of using TCT can be found in the Forensic Discovery book.
+(Last draft available for free in HTML form on the website)
+EOF
diff --git a/security/tct/FINAL b/security/tct/FINAL
new file mode 100755
index 0000000..ff53253
--- /dev/null
+++ b/security/tct/FINAL
@@ -0,0 +1 @@
+message "${PROBLEM_COLOR}Warning, ${SPELL} is installed in /opt and is
supposed to be run from there${DEFAULT_COLOR}"
diff --git a/security/tct/HISTORY b/security/tct/HISTORY
new file mode 100644
index 0000000..67eb127
--- /dev/null
+++ b/security/tct/HISTORY
@@ -0,0 +1,2 @@
+2009-07-27 Arjan Bouter <abouter AT sourcemage.org>
+ * BUILD, DETAILS, DEPENDS, INSTALL, FINAL, PRE_BUILD: spell created
diff --git a/security/tct/INSTALL b/security/tct/INSTALL
new file mode 100755
index 0000000..fe1f2d4
--- /dev/null
+++ b/security/tct/INSTALL
@@ -0,0 +1,2 @@
+mkdir -p ${INSTALL_ROOT}/opt/tct &&
+cp -a ${SOURCE_DIRECTORY}/* ${INSTALL_ROOT}/opt/tct/
diff --git a/security/tct/PRE_BUILD b/security/tct/PRE_BUILD
new file mode 100755
index 0000000..30f2e29
--- /dev/null
+++ b/security/tct/PRE_BUILD
@@ -0,0 +1,3 @@
+default_pre_build &&
+cd ${SOURCE_DIRECTORY} &&
+patch -p1 < ${SCRIPT_DIRECTORY}/fstools.patch
diff --git a/security/tct/fstools.patch b/security/tct/fstools.patch
new file mode 100644
index 0000000..758b6c8
--- /dev/null
+++ b/security/tct/fstools.patch
@@ -0,0 +1,10 @@
+--- tct-1.18-orig/src/fstools/fs_tools.h 2007-04-09 15:30:32.000000000
+0200
++++ tct-1.18-fixed/src/fstools/fs_tools.h 2009-07-27 18:31:01.934766046
+0200
+@@ -201,6 +201,7 @@
+ */
+ #if defined(LINUX2)
+ #define SUPPORTED
++#include <linux/fs.h>
+ #include <linux/ext2_fs.h>
+ #define HAVE_EXT2FS
+ #define HAVE_DTIME



  • [SM-Commit] GIT changes to master grimoire by Arjan Bouter (789c509370b27c341ac7d4e5a3c9fa93730182d9), Arjan Bouter, 07/27/2009

Archive powered by MHonArc 2.6.24.

Top of Page