kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
freebsd-ports/security/fwknop/Makefile

34 lines
673 B
Makefile
Raw Normal View History

Update to 2.0.3. This new version includes a migration from Perl to C and support for ipfw and pf. While here, trim the Makefile headers. PR: ports/171951 Submitted by: Sean Greven <sean.greven@gmail.com> (maintainer) Feature safe: yes
2012-11-27 22:41:29 +01:00
# Created by: Sean Greven <sean.greven@gmail.com>
New port: security/fwknop fwknop,"FireWall KNock OPerator", implements Single Packet Authorization (SPA). fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter (fwknop supports both iptables on Linux systems and ipfw on FreeBSD and Mac OS X systems) and libpcap. SPA requires only a single encrypted packet in order to communicate various pieces of information including desired access through an iptables policy and/or complete commands to execute on the target system. By using iptables to maintain a "default drop" stance, the main application of this program is to protect services such as OpenSSH with an additional layer of security in order to make the exploitation of vulnerabilities (both 0-day and unpatched code) much more difficult. With fwknop deployed, anyone using nmap to look for sshd can't even tell that it is listening; it makes no difference if they have a 0-day exploit or not. The authorization server passively monitors authorization packets via libcap and hence there is no "server" to which to connect in the traditional sense. Access to a protected service is only granted after a valid encrypted and non-replayed packet is monitored from an fwknop client (see the following network diagram; the SSH session can only take place after the SPA packet is monitored): PR: ports/118229 Submitted by: Sean Greven <sean.greven@gmail.com>
2008-06-13 05:43:51 +02:00
# $FreeBSD$
PORTNAME= fwknop
security/fwknop: update to 2.5.1 - Update to 2.5.1 [1] - Add LICENSE (GPLv2) [1] - Convert lib depends to new format PR: ports/181642 Submitted by: Kozlov Sergey <kozlov.sergey.404 gmail.com> Approved by: maintainer (timeout)
2013-09-13 14:12:49 +02:00
PORTVERSION= 2.5.1
By default libtool replaces -export-symbols <file> with -retain-symbols-file <file> on ELF systems, but this doesn't really do what -export-symbols is meant to do. On GNU ELF systems it converts <file> to a simple version script first and then uses -version-script instead of -retain-symbols-file. Let USES=libtool patch libtool scripts to do this on all systems with GNU ld(1). Bump PORTREVISION on all ports where the build log contains -export-symbols. audio/calf: This port builds a module that now exports only one function, but it also builds a number of executables that link to this module and expect to see other functions. Because it's already a bit dodgy to link to a module (libtool warns about this) let the module continue to export only one function and instead build an ordinary library from the same source that the executables can link to. Fix a number of other issues in the same Makefile.am and clean up the port Makefile. japanese/scim-honoka: Tries to hide all symbols that start with an underscore, but because this library is written in C++ all symbols start with _Z so it ends up hiding everything. Just don't hide anything at all like the textproc/scim configure script does. multimedia/schroedinger: Apply an upstream patch. textproc/scim-input-pad: Same as japanese/scim-honoka. PR: 201922 Approved by: portmgr (antoine) Exp-run by: antoine
2015-08-02 17:03:19 +02:00
PORTREVISION= 3
New port: security/fwknop fwknop,"FireWall KNock OPerator", implements Single Packet Authorization (SPA). fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter (fwknop supports both iptables on Linux systems and ipfw on FreeBSD and Mac OS X systems) and libpcap. SPA requires only a single encrypted packet in order to communicate various pieces of information including desired access through an iptables policy and/or complete commands to execute on the target system. By using iptables to maintain a "default drop" stance, the main application of this program is to protect services such as OpenSSH with an additional layer of security in order to make the exploitation of vulnerabilities (both 0-day and unpatched code) much more difficult. With fwknop deployed, anyone using nmap to look for sshd can't even tell that it is listening; it makes no difference if they have a 0-day exploit or not. The authorization server passively monitors authorization packets via libcap and hence there is no "server" to which to connect in the traditional sense. Access to a protected service is only granted after a valid encrypted and non-replayed packet is monitored from an fwknop client (see the following network diagram; the SSH session can only take place after the SPA packet is monitored): PR: ports/118229 Submitted by: Sean Greven <sean.greven@gmail.com>
2008-06-13 05:43:51 +02:00
CATEGORIES= security
MASTER_SITES= http://www.cipherdyne.org/fwknop/download/
MAINTAINER= sean.greven@gmail.com
Fix typos in COMMENT
2012-07-25 13:24:09 +02:00
COMMENT= SPA implementation for Linux and FreeBSD
New port: security/fwknop fwknop,"FireWall KNock OPerator", implements Single Packet Authorization (SPA). fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter (fwknop supports both iptables on Linux systems and ipfw on FreeBSD and Mac OS X systems) and libpcap. SPA requires only a single encrypted packet in order to communicate various pieces of information including desired access through an iptables policy and/or complete commands to execute on the target system. By using iptables to maintain a "default drop" stance, the main application of this program is to protect services such as OpenSSH with an additional layer of security in order to make the exploitation of vulnerabilities (both 0-day and unpatched code) much more difficult. With fwknop deployed, anyone using nmap to look for sshd can't even tell that it is listening; it makes no difference if they have a 0-day exploit or not. The authorization server passively monitors authorization packets via libcap and hence there is no "server" to which to connect in the traditional sense. Access to a protected service is only granted after a valid encrypted and non-replayed packet is monitored from an fwknop client (see the following network diagram; the SSH session can only take place after the SPA packet is monitored): PR: ports/118229 Submitted by: Sean Greven <sean.greven@gmail.com>
2008-06-13 05:43:51 +02:00
security/fwknop: update to 2.5.1 - Update to 2.5.1 [1] - Add LICENSE (GPLv2) [1] - Convert lib depends to new format PR: ports/181642 Submitted by: Kozlov Sergey <kozlov.sergey.404 gmail.com> Approved by: maintainer (timeout)
2013-09-13 14:12:49 +02:00
LICENSE= GPLv2
Update to 2.0.3. This new version includes a migration from Perl to C and support for ipfw and pf. While here, trim the Makefile headers. PR: ports/171951 Submitted by: Sean Greven <sean.greven@gmail.com> (maintainer) Feature safe: yes
2012-11-27 22:41:29 +01:00
OPTIONS_DEFINE= GPGME
OPTIONS_DEFAULT= GPGME
GPGME_DESC= Build support for gpgme
INFO= libfko
- Add CPE info Approved by: portmgr blanket
2015-04-24 02:55:50 +02:00
USES= cpe libtool
CPE_VENDOR= cipherdyne
Update to 2.0.3. This new version includes a migration from Perl to C and support for ipfw and pf. While here, trim the Makefile headers. PR: ports/171951 Submitted by: Sean Greven <sean.greven@gmail.com> (maintainer) Feature safe: yes
2012-11-27 22:41:29 +01:00
GNU_CONFIGURE= yes
USE_RC_SUBR= fwknopd
USE_LDCONFIG= yes
.include <bsd.port.options.mk>
.if ${PORT_OPTIONS:MGPGME}
security/fwknop: update to 2.5.1 - Update to 2.5.1 [1] - Add LICENSE (GPLv2) [1] - Convert lib depends to new format PR: ports/181642 Submitted by: Kozlov Sergey <kozlov.sergey.404 gmail.com> Approved by: maintainer (timeout)
2013-09-13 14:12:49 +02:00
LIB_DEPENDS+= libgpgme.so:${PORTSDIR}/security/gpgme
- Update to version 2.0.4 [1] - Package links to gpgme, make it LIB_DEPENDS also turn off linking to it when GPGME=off - Add empty line between description and WWW line, remove extraneous whitespace on EOL in pkg-descr PR: ports/174732 [1] Submitted by: Sean Greven <sean.greven@gmail.com> (maintainer)
2013-03-01 18:19:32 +01:00
.else
CONFIGURE_ARGS+=--without-gpgme
Update to 2.0.3. This new version includes a migration from Perl to C and support for ipfw and pf. While here, trim the Makefile headers. PR: ports/171951 Submitted by: Sean Greven <sean.greven@gmail.com> (maintainer) Feature safe: yes
2012-11-27 22:41:29 +01:00
.endif
New port: security/fwknop fwknop,"FireWall KNock OPerator", implements Single Packet Authorization (SPA). fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter (fwknop supports both iptables on Linux systems and ipfw on FreeBSD and Mac OS X systems) and libpcap. SPA requires only a single encrypted packet in order to communicate various pieces of information including desired access through an iptables policy and/or complete commands to execute on the target system. By using iptables to maintain a "default drop" stance, the main application of this program is to protect services such as OpenSSH with an additional layer of security in order to make the exploitation of vulnerabilities (both 0-day and unpatched code) much more difficult. With fwknop deployed, anyone using nmap to look for sshd can't even tell that it is listening; it makes no difference if they have a 0-day exploit or not. The authorization server passively monitors authorization packets via libcap and hence there is no "server" to which to connect in the traditional sense. Access to a protected service is only granted after a valid encrypted and non-replayed packet is monitored from an fwknop client (see the following network diagram; the SSH session can only take place after the SPA packet is monitored): PR: ports/118229 Submitted by: Sean Greven <sean.greven@gmail.com>
2008-06-13 05:43:51 +02:00
.include <bsd.port.mk>
Reference in a new issue Copy permalink