4
%define fwknoplibdir %_libdir/%name
5
%define fwknoplogdir /var/log/fwknop
6
%define fwknoprundir /var/run/fwknop
7
#%define fwknopvarlibdir /var/lib/fwknop
9
### get the first @INC directory that includes the string "linux".
10
### This may be 'i386-linux', or 'i686-linux-thread-multi', etc.
11
%define fwknopmoddir `perl -e '$path='i386-linux'; for (@INC) { if($_ =~ m|.*/(.*linux.*)|) {$path = $1; last; }} print $path'`
13
Summary: Fwknop implements Single Packet Authorization (SPA) around iptables
19
Url: http://www.cipherdyne.org/fwknop/
20
Source: %name-%version.tar.gz
21
BuildRoot: %_tmppath/%{name}-buildroot
25
fwknop implements an authorization scheme known as Single Packet
26
Authorization (SPA) that requires only a single encrypted packet to
27
communicate various pieces of information including desired access through an
28
iptables or ipfw policy and/or specific commands to execute on the target system.
29
The main application of this program is to protect services such as SSH with
30
an additional layer of security in order to make the exploitation of
31
vulnerabilities (both 0-day and unpatched code) much more difficult. The
32
authorization server passively monitors authorization packets via libpcap and
33
hence there is no "server" to which to connect in the traditional sense. Any
34
service protected by fwknop is inaccessible (by using iptables or ipfw to
35
intercept packets within the kernel) before authenticating; anyone scanning for
36
the service will not be able to detect that it is even listening. This
37
authorization scheme offers many advantages over port knocking, include being
38
non-replayable, much more data can be communicated, and the scheme cannot be
39
broken by simply connecting to extraneous ports on the server in an effort to
40
break knock sequences. The authorization packets can easily be spoofed as
41
well, and this makes it possible to make it appear as though, say,
42
www.yahoo.com is trying to authenticate to a target system but in reality the
43
actual connection will come from a seemingly unrelated IP. Although the
44
default data collection method is to use libpcap to sniff packets off the
45
wire, fwknop can also read packets out of a file that is written by the
46
iptables ulogd pcap writer or by a separate sniffer process.
49
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
54
cd Unix-Syslog && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
56
cd IPTables-Parse && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
58
cd IPTables-ChainMgr && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
60
cd Crypt-CBC && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
62
cd Crypt-Rijndael && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
64
cd Digest-SHA && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
66
cd Class-MethodMaker && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
68
cd GnuPG-Interface && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
70
cd Net-Ping-External && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
72
cd Net-Pcap && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
74
cd Net-RawIP && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
76
cd Net-IPv4Addr && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
78
cd TermReadKey && perl Makefile.PL PREFIX=%fwknoplibdir LIB=%fwknoplibdir
82
### build fwknop binaries (knopmd and knopwatchd)
83
make OPTS="$RPM_OPT_FLAGS"
85
### build perl modules used by fwknop
87
make OPTS="$RPM_OPT_FLAGS" -C Unix-Syslog
88
make OPTS="$RPM_OPT_FLAGS" -C IPTables-Parse
89
make OPTS="$RPM_OPT_FLAGS" -C IPTables-ChainMgr
90
make OPTS="$RPM_OPT_FLAGS" -C Crypt-CBC
91
make OPTS="$RPM_OPT_FLAGS" -C Crypt-Rijndael
92
make OPTS="$RPM_OPT_FLAGS" -C Digest-SHA
93
make OPTS="$RPM_OPT_FLAGS" -C Class-MethodMaker
94
make OPTS="$RPM_OPT_FLAGS" -C GnuPG-Interface
95
make OPTS="$RPM_OPT_FLAGS" -C Net-Ping-External
96
make OPTS="$RPM_OPT_FLAGS" -C Net-Pcap
97
make OPTS="$RPM_OPT_FLAGS" -C Net-RawIP
98
make OPTS="$RPM_OPT_FLAGS" -C Net-IPv4Addr
99
make OPTS="$RPM_OPT_FLAGS" -C TermReadKey
104
mkdir -p $RPM_BUILD_ROOT%fwknoplogdir
105
### dir for fwknopfifo
106
#mkdir -p $RPM_BUILD_ROOT%fwknopvarlibdir
108
mkdir -p $RPM_BUILD_ROOT%fwknoprundir
110
### fwknop module dirs
111
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Unix/Syslog
112
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Net/IPv4Addr
113
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Net/Pcap
114
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Net/Ping
115
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Net/RawIP
116
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Term/ReadKey
117
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/IPTables/Parse
118
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/IPTables/ChainMgr
119
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Crypt/Rijndael
120
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Digest/SHA
121
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Crypt/CBC
122
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Class/MethodMaker/array
123
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Class/MethodMaker/Engine
124
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Class/MethodMaker/hash
125
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Class/MethodMaker/scalar
126
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Unix
127
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Crypt
128
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Digest
129
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Class/MethodMaker
130
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Term
131
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/RawIP
132
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/auto/Net/IPv4Addr
133
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/auto/GnuPG/Interface
134
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/Crypt
135
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/GnuPG
136
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/Net
137
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/Net/Ping
138
mkdir -p $RPM_BUILD_ROOT%fwknoplibdir/IPTables
139
mkdir -p $RPM_BUILD_ROOT%_bindir
140
mkdir -p $RPM_BUILD_ROOT%{_mandir}/man8
141
mkdir -p $RPM_BUILD_ROOT%_sbindir
144
mkdir -p $RPM_BUILD_ROOT%_sysconfdir/%name
145
### fwknop init script
146
mkdir -p $RPM_BUILD_ROOT%_initrddir
148
install -m 755 fwknop $RPM_BUILD_ROOT%_bindir/
149
install -m 500 fwknopd $RPM_BUILD_ROOT%_sbindir/
150
install -m 500 knopmd $RPM_BUILD_ROOT%_sbindir/
151
install -m 500 fwknop_serv $RPM_BUILD_ROOT%_sbindir/
152
install -m 500 knopwatchd $RPM_BUILD_ROOT%_sbindir/
153
install -m 500 knoptm $RPM_BUILD_ROOT%_sbindir/
154
install -m 755 init-scripts/fwknop-init.redhat $RPM_BUILD_ROOT%_initrddir/fwknop
155
install -m 644 access.conf $RPM_BUILD_ROOT%_sysconfdir/%name/
156
install -m 644 fwknop.conf $RPM_BUILD_ROOT%_sysconfdir/%name/
157
install -m 644 pf.os $RPM_BUILD_ROOT%_sysconfdir/%name/
158
install -m 644 *.8 $RPM_BUILD_ROOT%{_mandir}/man8/
160
### install perl modules used by fwknop
162
install -m 555 Unix-Syslog/blib/arch/auto/Unix/Syslog/Syslog.so $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Unix/Syslog/Syslog.so
163
install -m 444 Unix-Syslog/blib/arch/auto/Unix/Syslog/Syslog.bs $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Unix/Syslog/Syslog.bs
164
install -m 444 Unix-Syslog/blib/lib/auto/Unix/Syslog/autosplit.ix $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Unix/Syslog/autosplit.ix
165
install -m 444 Unix-Syslog/blib/lib/Unix/Syslog.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Unix/Syslog.pm
166
install -m 444 IPTables-Parse/blib/lib/IPTables/Parse.pm $RPM_BUILD_ROOT%fwknoplibdir/IPTables/Parse.pm
167
install -m 444 IPTables-ChainMgr/blib/lib/IPTables/ChainMgr.pm $RPM_BUILD_ROOT%fwknoplibdir/IPTables/ChainMgr.pm
168
install -m 444 Crypt-CBC/blib/lib/Crypt/CBC.pm $RPM_BUILD_ROOT%fwknoplibdir/Crypt/CBC.pm
169
install -m 444 Class-MethodMaker/blib/lib/auto/Class/MethodMaker/array/*.* $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Class/MethodMaker/array/
170
install -m 444 Class-MethodMaker/blib/lib/auto/Class/MethodMaker/scalar/*.* $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Class/MethodMaker/scalar/
171
install -m 444 Class-MethodMaker/blib/lib/auto/Class/MethodMaker/hash/*.* $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Class/MethodMaker/hash/
172
install -m 444 Class-MethodMaker/blib/lib/auto/Class/MethodMaker/Engine/*.* $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Class/MethodMaker/Engine/
173
install -m 444 Class-MethodMaker/blib/arch/auto/Class/MethodMaker/MethodMaker.bs $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Class/MethodMaker/MethodMaker.bs
174
install -m 444 Class-MethodMaker/blib/arch/auto/Class/MethodMaker/MethodMaker.so $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Class/MethodMaker/MethodMaker.so
175
install -m 444 Class-MethodMaker/blib/lib/Class/MethodMaker.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Class/MethodMaker.pm
176
install -m 444 Class-MethodMaker/blib/lib/Class/MethodMaker/*.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Class/MethodMaker
177
install -m 444 GnuPG-Interface/blib/lib/auto/GnuPG/Interface/*.* $RPM_BUILD_ROOT%fwknoplibdir/auto/GnuPG/Interface/
178
install -m 444 GnuPG-Interface/blib/lib/GnuPG/*.pm $RPM_BUILD_ROOT%fwknoplibdir/GnuPG/
179
install -m 444 Crypt-Rijndael/blib/lib/Crypt/Rijndael.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Crypt/Rijndael.pm
180
install -m 444 Crypt-Rijndael/blib/arch/auto/Crypt/Rijndael/Rijndael.bs $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Crypt/Rijndael/Rijndael.bs
181
install -m 444 Crypt-Rijndael/blib/arch/auto/Crypt/Rijndael/Rijndael.so $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Crypt/Rijndael/Rijndael.so
182
install -m 444 Digest-SHA/blib/lib/Digest/SHA.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Digest/SHA.pm
183
install -m 444 Digest-SHA/blib/arch/auto/Digest/SHA/SHA.bs $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Digest/SHA/SHA.bs
184
install -m 444 Digest-SHA/blib/arch/auto/Digest/SHA/SHA.so $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Digest/SHA/SHA.so
185
install -m 444 Net-Ping-External/blib/lib/Net/Ping/External.pm $RPM_BUILD_ROOT%fwknoplibdir/Net/Ping/External.pm
186
install -m 444 Net-Pcap/blib/lib/Net/Pcap.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/Pcap.pm
187
install -m 444 Net-Pcap/blib/arch/auto/Net/Pcap/Pcap.bs $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Net/Pcap/Pcap.bs
188
install -m 444 Net-Pcap/blib/arch/auto/Net/Pcap/Pcap.so $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Net/Pcap/Pcap.so
189
install -m 444 Net-RawIP/blib/lib/Net/RawIP.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/RawIP.pm
190
install -m 444 Net-RawIP/blib/lib/Net/RawIP/ethhdr.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/RawIP/ethhdr.pm
191
install -m 444 Net-RawIP/blib/lib/Net/RawIP/generichdr.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/RawIP/generichdr.pm
192
install -m 444 Net-RawIP/blib/lib/Net/RawIP/icmphdr.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/RawIP/icmphdr.pm
193
install -m 444 Net-RawIP/blib/lib/Net/RawIP/iphdr.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/RawIP/iphdr.pm
194
install -m 444 Net-RawIP/blib/lib/Net/RawIP/opt.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/RawIP/opt.pm
195
install -m 444 Net-RawIP/blib/lib/Net/RawIP/tcphdr.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/RawIP/tcphdr.pm
196
install -m 444 Net-RawIP/blib/lib/Net/RawIP/udphdr.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/RawIP/udphdr.pm
197
install -m 444 Net-RawIP/blib/lib/Net/RawIP/libpcap.pod $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Net/RawIP/libpcap.pod
198
install -m 444 Net-RawIP/blib/arch/auto/Net/RawIP/RawIP.bs $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Net/RawIP/RawIP.bs
199
install -m 444 Net-RawIP/blib/arch/auto/Net/RawIP/RawIP.so $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Net/RawIP/RawIP.so
200
install -m 444 Net-RawIP/blib/lib/auto/Net/RawIP/autosplit.ix $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Net/RawIP/autosplit.ix
201
install -m 444 Net-IPv4Addr/blib/lib/auto/Net/IPv4Addr/autosplit.ix $RPM_BUILD_ROOT%fwknoplibdir/auto/Net/IPv4Addr/autosplit.ix
202
install -m 444 Net-IPv4Addr/blib/lib/Net/IPv4Addr.pm $RPM_BUILD_ROOT%fwknoplibdir/Net/IPv4Addr.pm
203
install -m 444 TermReadKey/blib/lib/Term/ReadKey.pm $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/Term/ReadKey.pm
204
install -m 444 TermReadKey/blib/lib/auto/Term/ReadKey/autosplit.ix $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Term/ReadKey/autosplit.ix
205
install -m 444 TermReadKey/blib/arch/auto/Term/ReadKey/ReadKey.bs $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Term/ReadKey/ReadKey.bs
206
install -m 444 TermReadKey/blib/arch/auto/Term/ReadKey/ReadKey.so $RPM_BUILD_ROOT%fwknoplibdir/%fwknopmoddir/auto/Term/ReadKey/ReadKey.so
210
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
213
#chmod 0600 /var/lib/fwknop/fwknopfifo
216
### put the current hostname into various config files
217
perl -p -i -e 'use Sys::Hostname; my $hostname = hostname(); s/HOSTNAME(\s+)_?CHANGE.?ME_?/HOSTNAME${1}$hostname/' %_sysconfdir/%name/fwknop.conf
219
#/bin/touch %fwknoplogdir/fwdata
220
#chown root.root %fwknoplogdir/fwdata
221
### make fwknop start at boot
222
/sbin/chkconfig --add fwknop
223
if grep -q "EMAIL.*root.*localhost" /etc/fwknop/fwknop.conf;
225
echo "[+] You can edit the EMAIL_ADDRESSES variable in /etc/fwknop/fwknop.conf"
226
echo " /etc/fwknop/fwknop.conf to have email alerts sent to an address"
227
echo " other than root\@localhost"
231
#%_preun_service fwknop
234
%defattr(-,root,root)
236
#%dir %fwknopvarlibdir
243
%dir %_sysconfdir/%name
244
%config(noreplace) %_sysconfdir/%name/*.conf
245
%config(noreplace) %_sysconfdir/%name/pf.os
250
* Tue Sep 30 2008 Michael Rash <mbr@cipherdyne.org>
251
- Release of fwknop-1.9.8
253
* Sun Aug 24 2008 Michael Rash <mbr@cipherdyne.org>
254
- Removed 'use lib' editing code
255
- Updated to use the deps/ directory for all perl module sources.
256
- Release of fwknop-1.9.7
258
* Fri Jul 18 2008 Michael Rash <mbr@cipherdyne.org>
259
- Release of fwknop-1.9.6
261
* Sun Jun 08 2008 Michael Rash <mbr@cipherdyne.org>
262
- Removed List::MoreUtils since the updated Net::RawIP module no longer
263
requires it as a dependency.
264
- Release of fwknop-1.9.5
266
* Sun Jun 01 2008 Michael Rash <mbr@cipherdyne.org>
268
- Release of fwknop-1.9.4
270
* Sat Apr 05 2008 Michael Rash <mbr@cipherdyne.org>
271
- Release of fwknop-1.9.3
273
* Wed Mar 12 2008 Michael Rash <mbr@cipherdyne.org>
274
- Release of fwknop-1.9.2
276
* Sat Jan 26 2008 Michael Rash <mbr@cipherdyne.org>
277
- Release of fwknop-1.9.1
279
* Sat Dec 15 2007 Michael Rash <mbr@cipherdyne.org>
280
- Release of fwknop-1.9.0
282
* Sat Nov 17 2007 Michael Rash <mbr@cipherdyne.org>
283
- Release of fwknop-1.8.3
285
* Sat Sep 15 2007 Michael Rash <mbr@cipherdyne.org>
286
- Updated Crypt::Rjindael module to version 1.04 to solve the issue where
287
encrypt/decrypt cycle would fail across 64 to 32-bit processors (or vice
289
- Release of fwknop-1.8.2
291
* Wed Jun 06 2007 Michael Rash <mbr@cipherdyne.org>
292
- Release of fwknop-1.8.1
294
* Sun Jun 03 2007 Michael Rash <mbr@cipherdyne.org>
295
- Release of fwknop-1.8
297
* Tue Jan 09 2007 Michael Rash <mbr@cipherdyne.org>
298
- Release of fwknop-1.0.1
300
* Sun Nov 05 2006 Michael Rash <mbr@cipherdyne.org>
301
- Release of fwknop-1.0
303
* Sun Nov 05 2006 Michael Rash <mbr@cipherdyne.org>
304
- Release of fwknop-1.0
306
* Sun Oct 15 2006 Michael Rash <mbr@cipherdyne.org>
307
- Release of fwknop-0.9.9
309
* Sun Sep 17 2006 Michael Rash <mbr@cipherdyne.org>
310
- Adapted patch that Mate Wierdl contributed to the psad project to get the
311
fwknop RPM building on x86_64 platforms.
312
- Removed iptables requirement since fwknop may be installed on a system just
313
to run the fwknop client.
314
- Release of fwknop-0.9.8
316
* Fri Aug 04 2006 Michael Rash <mbr@cipherdyne.org>
317
- Release of fwknop-0.9.7
318
- Added fwknop_serv for TCP-based SPA connections.
320
* Fri Jan 13 2006 Michael Rash <mbr@cipherdyne.org>
321
- Release of fwknop-0.9.6
322
- Added the GnuPG-Interface and Class-MethodMaker perl modules for GPG
323
encryption/decryption.
325
* Sun Oct 2 2005 Michael Rash <mbr@cipherydne.org>
326
- Release of fwknop-0.9.5
328
* Fri Sep 16 2005 Michael Rash <mbr@cipherydne.org>
329
- Initial RPM release.