search

ossec / ossec-hids

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
http://www.ossec.net
Other
4.49k stars 1.04k forks source link

Gentoo ebuild. #978

Closed hackers-terabit closed 8 years ago

hackers-terabit commented 8 years ago

Hi,

There is a large community of users who use hardened-gentoo (and normal gentoo) as their choice of operating system, me being one of them, I couldn't find a package (ebuild) for OSSEC.

Can you support Gentoo please? It would make life for folks like me much easier, I'd rather use a package manager than use my script that downloads/verifies/installs OSSEC.

Best regards, -Terabit

ddpbsd commented 8 years ago

Gentoo doesn't maintain their own packages?

hackers-terabit commented 8 years ago

I have asked them to do so. I thought ossec maintained rpm and deb packages,that's why I created this issue.

ddpbsd commented 8 years ago

Not really. AtomiCorp maintains the rpm stuff, and wazuh has debs for their own OSSEC. I don't even have access to a gentoo system to try and figure out their packaging.

thinrope commented 8 years ago

I guess using Gentoo bugzilla is the right way. There is an old bug here https://bugs.gentoo.org/show_bug.cgi?id=545788

I can look into it, although I need some time to understand how to package various parts of ossec. At first glance it does not look trivial, esp. the windows agent with mingw cross-compile.

I am just starting with ossec (found about it today), I'll have a look and use this issue to track progress. How is packaging handled for other distros? Do you want PR or keep them separate? Gentoo is a source-based distro, so providing an ebuild (=install script) is all it is needed.

Don't see anything in the https://github.com/ossec/ossec-hids/wiki Any other sources for devs/package managers?

ddpbsd commented 8 years ago

https://ossec.github.io/docs/#development is pretty much all we have. There is some packaging stuff in https://github.com/ossec/ossec-hids/tree/master/contrib but I haven't paid any attention to it. An "ebuild" or "gentoo-ebuild" or something similar directory would be fine if you want to submit a pull request.