ossec-hids-2.6-16.fc16.art$>mu3DApEJ-g>@d?dd   R04PTim W\W  W W W W W`W%W,W  !!("6)">*"}+","-"8"s9$Xs:9s=RDRGRWHTWIUtWXUYU\VW]WlW^\b]d^l^t^4Wu_Wv` waWxc$WyddedfdCossec-hids2.616.fc16.artAn Open Source Host-based Intrusion Detection SystemOSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection System (HIDS). It has a powerful correlation and analysis engine, integrating log analysis, file integrity checking, Windows registry monitoring, centralized policy enforcement, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows. This package contains common files required for all packages.Pnministry.whq.atomicorp.com=http://www.ossec.netGPLAtomicorp Applications/Systemhttp://www.ossec.net/linuxx86_64if ! id -g ossec > /dev/null 2>&1; then groupadd -r ossec fi if ! id -u ossec > /dev/null 2>&1; then useradd -g ossec -G ossec \ -d /var/ossec \ -r -s /sbin/nologin ossec fi if ! id -u ossecr > /dev/null 2>&1; then useradd -g ossec -G ossec \ -d /var/ossec \ -r -s /sbin/nologin ossecr fi86<_=- R ; s 1 <, c ? v;|<4U' AO {d((<(A큤A큤A큤A큤AhAhAhhhhhhhhhAhhhhhhhhhhhhhAhAhAA聠AAhAAAhAPjPmNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPlPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPjPj65bec1e837d94dff7f8db551208d73aeb0dc2fef6a6407ea7c91c4ee6f430528b697413cf6e55da97ca296ebd72cd8db53eef2c007869d389075d5d2391e14a0e9c1d327b2e97725bbcb54f63bec73a12ec07b8d44ad17020238e84970a2d2cf484df679efd5a5a186c40942cd2fcac511c8d3742d6a7896b4b90f59f7f581bf92612a256f5ba0a382513b2cd6b6259e3565dccf5d91adfee1967803de50e5c49fe9080ce777f1a6ae7b30897d0fb608ae624bfb348ecf0c0c860ddbdf86e5f00ec9577297c751ff97badc51306be8111040caa25081fd2e30c0fe38e44c7f681e0f3d6deb94ce7081fae364891cac7758754639e4b88acccc54671eab510266c988f19452b5542572cae3fff4f0fac802562acc315e5173aa4e083d9e3698429d9ec8875aec0ac6117dae038f4e015d811720fe4a64b93c15d3583b1340dcf020cf243734164073841e9ca712d34f54db876fb5d7ebafdbdb71a9fd5c91fc92dc0b9539ba19d3b5ddca245f8cf1e3f89a9fd345a6f6fb5dc86f7087acdb45cd1e0f3d6deb94ce7081fae364891cac7758754639e4b88acccc54671eab510266098c461918330df3a040ae8b3fdf06ba15ef234deeb7c8da37d9a8cc21d3af8ba81c47faa02a7cddf8962e1301f71a013cdea018cdb0975758487de252499d34f2271e2698e78b45b32149e10600d4fd15262cbdf44e43a5a4b0d51c9f7f2e8fbe8502642e5a5251a50cf8274747caa2b3aae9b819e172e5def48dd3e33e9443ecce3956f6c2defb4033e497cf965a81ddf825964637324920d58566f6933dc83fa00600644e8add5af583ae9f16b64e72ae13bdf65dd5c2cbafa9cbab3e63f9a76d2a0929c5508ddfd00a8a246c549e4d3855fd5277453d9b61c7f660e8fb4870f89134f79532f6f642f47a2d0bdf63861d20f4b76f190711bc4e2d3dfcb8929dfb9bdf2df6d1948877696ffb6ff8f08dbda8a3c3e1fcdead588fc44ce462ca8ab9eb4987d590c7d1e5e7a62358c957d9d5a5c6e528f835eb2529eb751edd1ca5924d7f5fa4ecfa24bee05187fa22f432069720a914374892e9bd8d2a807d8a4f73cb6caba37b1f399cb8e835608aa1e41dbb4ccee16ba23f6e878dd8f588991e1f01db9177108f64c5e561822f0a259bdfad59aebcf0fe24d0c0e9df5f97561e0f3d6deb94ce7081fae364891cac7758754639e4b88acccc54671eab510266ef970afaee6fc7fa4168b1a3ccdf9808edf5df98b30c195597317e7d59c0bae1065ae034ecc96615757d45a4af1c9f1770295131a1ead862073eb78329522d4e1d1e66839dd778872fe2aa7275713c2ffc64486f2b2157b51d044cbfcf5ea9eecee8fd0b3cee63ba465cf8d4d58de2e155602f678efcc54bb6a6d5a43f496a423668a2dd9f579512554f17443a71530e8ac867bf8c9115c53f79b301f05e78360458d564b9d237a720b126230bd78175da49c5a19e4e9324dcb0384302654282785514a76800f7faf6865ba06fe6eea63cf17c2c04bd2dc65c2af5697c808070810475207bab7ce35d0ca1f3fb2174dbad95ab50f9873a3879889674bcad9b80c4c02e402256dfdcd58357750535ca49e191e13328eb43b5e746999153958ff1f9a813e4e53823fc8d43a8ec1a91df67524308156eabdf63c8440086f23942607b870cbb4655022c0f68f97a737942d2f26b32644f43d7c38b2d8e3e74b6389ca92731e8b8ef0e0e6ac663e2ab01d92b5809a94f46858f4cbcf7dc01aa92aec15781e4c355eee177f8789ce242a75dde4b27f1f313e6eb4b1641227ab2767848e736dde6929e32461fe51db100d4bff0d80ac2d316e7011aa4ac8294bb94a0a97b180716a51e2910f2e2595675e087bb173ba962aa61c0835990f186818704c2a8a4b349fff82b0c8ab42a00c19289e437f0cdebbeb6b6b5c1cf575e53cbfba9b3466df217762f4fc91bb1df77aea83c957cf0b43bce3651837700d172ad78511cbb5e45f98a4b872a9fe533186676ae110bb4dff25e6418589597590467e39a44bb5b1b51a13614052f25b721cfaaee094b1a23f2048680c28dac2748c77017d551c086b902c9192089460ab6ffe03daf15b6841119f65a22a8922e4b6d453353203388c00aedefb59511c4e482c0f76cb8cb22f01085d9c1d96278c232bd3db6deef2fb3eeca969e8c4f491dedec38c80965fc7ed0caa108e48fdeedd344f8df410bebad94ad7c3b72246240c178727a538b13afbcfd207524a34c2c9617f202d696911e55bf3a427f7f010d105b4d47710b2c367c94dbc93f9b5dbc340af124fbc3719bff6f041002db8857af4f903f82abcb5d29484b68380db178fe0dace502a2943a7d783954f784e46dde4b90261ae6a726608c90140221b061ec56085df7cc5b85f2d85a5b99e98f0d25e5bd20dae24c6eede74067e0845840f4ca5e452993375423d3d27cb78247052759d5f9fa2af425fbf239f13b4c13b2ba6713076f8fe539b132fc462ec518ab3740c9e4e21231dce7dcb6237daa4d3de5e9ab484b465d99d05f755034d15ed5519bf9738fbd794d8fbaf588a29e0823a6d9299fb3b973248c76d14a814ba558235f520640d26e9f2fafac03fa2432b16e40f925a7f364c19adf32a092b97aa4609675237da4b5f47d17516d5068b18e033b4caee022646c6b78507bd02bd632efc1d46e65c82589c8823190e83e4c006846d600897a8ee5c0159709c28c622ad5e4de85d0e596f770ea8c80be97893f85f67543ba95564730b7265e456120cef81905316d877cc532344993987b38f1b1e0081c87cd21a1b8e5e4fca27a2fc19868d161f15635514513586adddbdb196cec6cf97d988840ce05868f7e8eb40582354bb44f1d0e1614241d088a8c440f0fc4ba4d4d92afaa567f36f7b7e159ea245b23873688c662380971b3f38868637fc9bd6885d148c45a37180b3a8ee40236fc0519b87a467409e5e9167b9f4fe599054e58d925aab330df06db3418f50d3f57c2f1f5c892f142c3d59cb9db2de1380a8d3952a2669d9788a52c0f54d54db7954dd74129e9a34953bcf4864248fbfa5107b8f7994193cc5fcc7a75988740e117b64462ee62a7d40cff17f72e5d39fb2736rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecrootossecossecrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecrootossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossecossec-hids-2.6-16.fc16.art.src.rpmconfig(ossec-hids)ossecossec-hidsossec-hids(x86-64)@@@@@@    /bin/sh/bin/sh/bin/sh/usr/bin/env/usr/bin/perl/usr/sbin/groupadd/usr/sbin/useraddconfig(ossec-hids)inotify-toolsperl(DBI)perl(Fcntl)perl(strict)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)2.6-16.fc16.art3.0.4-14.6.0-14.0-15.2-14.9.1.3[ -r /etc/localtime ] && cp -fpL /etc/localtime /var/ossec/etcglibcP!@P@OiO@OЗOЗO O OpZ@NNS@NK@N;@N;@N6@N-ZNMMM@M@M@M?MM>MUM@M PL~L8LΫLΫLʷ@LeL@L{LL@LA@LLLzL~@@L|LvW@LmLa?@LRL4l@LT@KtK͗@KKK@K[K@K8@K@K@K@J@JJJ@JJJn@JL@JI@J2C@J2C@J/@J&eI@Io@I)@I4IܑIII@I@I&@III~@H@H|@HcHM@H2@H)GJ@GAzGV@G m@Fޚ@F@F@FF@Fr@Fq-FIF-@EWEEySEIE E DDY@D@DLSupport - 2.6-16Support - 2.6-15Support - 2.6-14Support - 2.6-13Support - 2.6-12Support - 2.6-11Support - 2.6-10Support - 2.6-9Support - 2.6-8Support - 2.6-7Support - 2.6-6Support - 2.6-5Support - 2.6-4Support - 2.6-3Support - 2.6-2Support - 2.6-1Support - 2.6.0-0.10Support - 2.6.0-0.9Support - 2.6.0-0.8Support - 2.6.0-0.7Support - 2.6.0-0.6Support - 2.6.0-0.5Support - 2.6.0-0.4Support - 2.6.0-0.3Support - 2.6.0-0.1Support - 2.5.1-10Support - 2.5.1-9Support - 2.5.1-8Support - 2.5.1-7Support - 2.5.1-6Support - 2.5.1-5Support - 2.5.1-4Support - 2.5.1-3Support - 2.5.1-2Support - 2.5.1-1Support - 2.5-1Support - 2.5-0.9Support - 2.5-0.8Support - 2.5-0.7Support - 2.5-0.6Support - 2.5-0.1Support - 2.4.1-11.2Support - 2.4.1-11.1Support - 2.4.1-10Support - 2.4.1-9Support - 2.4.1-8Support - 2.4.1-7Support - 2.4.1-6Support - 2.4.1-5Support - 2.4.1-4Scott R. Shinn - 2.4.1-1Scott R. Shinn - 2.4-5Scott R. Shinn - 2.4-4Scott R. Shinn - 2.4-1Scott R. Shinn - 2.4-0.2Scott R. Shinn - 2.4-0.1Scott R. Shinn - 2.3-8Scott R. Shinn - 2.3-7Scott R. Shinn - 2.3-6Scott R. Shinn - 2.3-1Scott R. Shinn - 2.2-5Scott R. Shinn - 2.2-4Scott R. Shinn - 2.2-3Scott R. Shinn - 2.2.0.beta2.1Scott R. Shinn - 2.2.0.beta1.1Scott R. Shinn - 2.1.1-5Scott R. Shinn - 2.1.1-3Scott R. Shinn - 2.1.1-1Scott R. Shinn - 2.1-3Scott R. Shinn - 2.1-1Scott R. Shinn - 2.0-11Scott R. Shinn - 2.0-10Scott R. Shinn - 2.0-9Scott R. Shinn - 2.0-8Scott R. Shinn - 2.0-7Scott R. Shinn - 2.0-6Scott R. Shinn - 2.0-5Scott R. Shinn - 2.0-4Scott R. Shinn - 2.0-2Scott R. Shinn - 2.0-1Scott R. Shinn - 2.0.0-0.090225.1Scott R. Shinn - 2.0.0-0.090220.1Scott R. Shinn - 2.0.0-0.090206.1Scott R. Shinn - 2.0.0-0.090205.1Scott R. Shinn - 1.99-2Scott R. Shinn - 1.99-1Scott R. Shinn - 1.6.1-1Scott R. Shinn - 1.6-1Scott R. Shinn - 1.5.1-1Scott R. Shinn - 1.5-3Scott R. Shinn - 1.5-2Scott R. Shinn - 1.5-1Scott R. Shinn - 1.4-2Scott R. Shinn - 1.4-1Scott R. Shinn - 1.3-4Scott R. Shinn - 1.3-3Scott R. Shinn - 1.3-2Scott R. Shinn - 1.3-1Scott R. Shinn - 1.2-8Scott R. Shinn - 1.2-7Scott R. Shinn - 1.2-5Scott R. Shinn - 1.2-4Scott R. Shinn - 1.2-3Scott R. Shinn - 1.2-1Scott R. Shinn - 1.1-1Scott R. Shinn - 1.0-2Scott R. Shinn - 1.0Scott R. Shinn peter.pramberger@member.fsf.orgpeter.pramberger@member.fsf.orgpeter.pramberger@member.fsf.orgpeter.pramberger@member.fsf.orgpeter.pramberger@member.fsf.orgpeter.pramberger@member.fsf.orgpeter.pramberger@member.fsf.org- Update to pam decoder (Case #20742)- Move active response components under the common package- bugfix #xxx, correct ownership permissions on fts dir- Update to init script to suppress spurious execd output - Add alerts queue to server package with ossec/ossec permissions- Bugfix #XXX, correct any/agentd condition- Moved agentless packages under server- Drop timeid and cat_id indexes from schema- Add new index, timeid to alerts table.- Add cmoraes patch, Adds config options for enabling/disabling rootkit/syscheck options, and agent config profiles - Add ossec-memleaks patch - Add agentless directories, and agent.conf - Bugfix #XXX, ossec-hids.init will now return an exit code on status- Add prelink_cmd support- Bugfix #XXX, display multi-line events in data table correcty- Update to asl-shun.pl purge event to default to 24 hours.- Update to asl-shun.pl to change ordering of block rules - Revert from 0805 snapshot- Update to 0805 snapshot- Update to 0801 snapshot - Update asl-shun.pl to log to active-responses.log, blocks now go to the named chain ASL-ACTIVE-RESPONSE, and delete events are more redundant.- Update to OSSEC 2.6 Final- Update to snapshot 110711- Update to snapshot 110613- Update to snapshot 110609- Update to snapshot 110606 - Moved ossecr user creation event to the ossec-hids core package- Update to snapshot 110531- Update to snapshot 110526- Update to snapshot 110504- Bugfix #536, Increase the default sleep time for syscheck- Renamed to 2.6 branch- Add support for the rules/decoders dir system- Update to snapsot 110405 - Update asl-shun to support ossec alert ids- Changed asl-shun sqlite database to /var/ossec/var/blocklist3.sqlite - asl-shun database format now stores the full alertid- Update to snapshot 101203- Update to snapshot 101125- Added alertid support to os_dbd, this involves a schema update- Added dst ip, src prt, and dst prt capture support to os_dbd- Bugfix #XXX, manage_agents was built in client mode for the server package.- Add clamav decoder & ruleset- Update to 2.5.1 final- Update to 2.5 final- Update to 0928 snapshot- Extended no_ar into ossec-dbd- Add no_ar option to disable active response per rule- Update to snapshot 100920- Update snapshot to 100907- Snapshot 100901- Added test fix for os_dbd- Bugfix #376, ossec-control will now properly stop and reload- Update to 0809 snapshot- Relink against native mysql- Add minicon decoder from les fenison- Update to 100707 snapshot - Feature Request #371, add ossec.log to logrotate- Updated to 100615 snapshot- Updated init and ossec-server scripts to support the new reload feature.- Update to 2.4.1- Added zabbix reporting active response- Update to 2.4 final - Lowered courier rule 3910 (failures) from 6 over 240 to 10 over 10 - Lowered courier rule 3911 (success) from 10 over 60 to 30 over 20- Rebuilt for atomic repo- Update to CVS 100317- Update to CVS 100311 - Add decoder for denyhosts - Update asl_rules.xml to include denyhosts rules- Update to CVS 100309- Added new decoder for smtp_auth - Added rules to detect smtp_auth brute force attempts - Added rules to detect imap/pop brute force attempts- Updated ossec-server.conf to be in parity with the ASL config - Added templates dir for generating configs- Update to 2.3 release- Update to snapshot 091109- Update to snapshot 091008- Update to snapshot 090925 - Added timestamp field to the mysql schema - Bugfix #XXX, for the ossec-client.init script to call the correct (renamed) ossec syscheckd/logcollector daemons - Appologies for not updating the previous changelogs. Missed a few updates!- Update to snapshot 090827 - Feature Request #225, Added logrotate event to active-response log - Updated system_audit_rcl.txt to look for the correct php.ini file- Update to 090824, beta 1 release- Update to 090812 snapshot- Rebuild agent daemons with -DCLIENT, added symlink trickery- update to 2.1.1- update to 090630 snapshot, this has fixes for CentOS/RHEL 4 64-bit environments- update to 2.1 final- update to snapshot 090612- update to snapshot 090610- update to snapshot 090603- Disable postgresql support, to get around an undesirable dependency on EL4- Update to snapshot 090417- Update to snapshot 090413 (this adds in inotify support)- Update to snapshot 090410 (this adds in inotify support)- Update to snapshot 090408- Added authpsa rules back in, this is used to detect brute force attacks - Added conditional building support for ASL modifications- Update to 2.0 official release- update to snapshot 090225- update to snapshot 090220- update to snapshot 090206- update to snapshot 090205- update to CVS code 090129, this is not an offical release. Its for testing only- update to CVS code 090126, this is not an offical release. Its for testing only- update to 1.6.1- update to 1.6- update to 1.5.1- added mysql support- Added Stanislaw Polak's excellent ban-hackers script to manage shunning more intelligently.- update to 1.5- fix on active-response locking bug that prevented some rules from expiring.- update to ossec 1.4- update snapshot to ossec-hids-071011.tar.gz - relinked C4, FC4, FC5 against mysql4- update to snapshot ossec-hids-071006.tar.gz- update to shun blocklist tracking used by ASL - added authpsa rules + decoder- update to 1.3- minor adjustment in %post, to check for config file before overwriting it- v6 was first version of the patch. - added in logging in active-response for better ASL support - Disabled conf event in %post, to keep from overwriting config files.- changed permissions on queue/syscheck so it can be read by the ossec group (tweak for web gui)- removed the noreplace settings from decoder and the rules - patch for a more ASL friendly client config- release -2 had a bug. - added ASL rules (asl_rules.xml) - added decoder for the asl style modsecurity logging - adjusted syslog_rules for qmail-scanner issue (BUG #ASL-18) - Added http index in asl_rules.xml (BUG #ASL-7)- update to 1.2- update to 1.1- configuration change for ASL- updated to 1.0- import into ART - changed their naming conventions a bit, 0.9-3 to 0.9.3. Please dont be cross with me.- new version (0.9-3)- new version (0.9-2)- new version (0.9-1a)- new version (0.9-1)- new version (0.9)- some bugfixes- created/bin/sh/bin/sh#######################################################################################t1w`wawbwcwdwewwwywvw{www~wwwww|w}wwzwxwiwuwjwpwrwmwswqwtwowkwlwnwfwgwhsgshsit0ttttttt2sjttttttttttttskt3sst4ssssssssssssssqsusys{ss2.6-16.fc16.art2.6-16.fc16.art2.6-16.fc16.art    ossec-hidsossec-hids-2.6BUGSCONFIGINSTALLREADMEdocREADME.configactive-response-internal.txtactive-response.txtbrINSTALL.brREADME.configTRANSLATIONactive-response-internal.txtactive-response.txtlogs.txtmanager.txtrootcheck.txtrule_ids.txtrules.txtlogs.txtmanage_agents.txtmanager.txtnmap.txtplINSTALL.plREADME.configTRANSLATIONactive-response-internal.txtactive-response.txtlogs.txtmanager.txtrootcheck.txtrule_ids.txtrules.txtrootcheck.txtrule_ids.txtrules.txtossecactive-responsebinasl-shun.pldisable-account.shfirewall-drop.shhost-deny.shossec-tweeter.shrestart-ossec.shroute-null.shzabbix-alert.shagentlessmain.expregister_host.shssh.expssh_asa-fwsmconfig_diffssh_foundry_diffssh_generic_diffssh_integrity_check_bsdssh_integrity_check_linuxssh_nopass.expssh_pixconfig_diffsshlogin.expsu.expbinossec-configureetcsharedagent.conftemplatesactive-response.templateapache-logs.templatear-disable-account.templatear-firewall-drop.templatear-host-deny.templatear-routenull.templatepgsql-logs.templaterootcheck.templaterules.templatesnort-logs.templatesyscheck.templatesyslog-logs.templatelogsqueuediffossecvarrun/etc/logrotate.d//usr/share/doc//usr/share/doc/ossec-hids-2.6//usr/share/doc/ossec-hids-2.6/doc//usr/share/doc/ossec-hids-2.6/doc/br//usr/share/doc/ossec-hids-2.6/doc/pl//var//var/ossec//var/ossec/active-response//var/ossec/active-response/bin//var/ossec/agentless//var/ossec/bin//var/ossec/etc//var/ossec/etc/shared//var/ossec/etc/templates//var/ossec/queue//var/ossec/var/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=genericdrpmx86_64-redhat-linux-gnuASCII textISO-8859 textPOSIX shell script, ASCII text executableUTF-8 Unicode texta /usr/bin/perl -w script, ASCII text executablea expect script, ASCII text executabledirectoryexported SGML document, ASCII text RR R R RRRRRRRRRRRRRRRRRRRRxz2?7zXZ !#,*]"k%w!q{"}A Hگ,XMXS雥9bj,"_P$GP¯ _ 3k}D;Ts4!& _1*ZYCn"SHKg`FE ,toDqp_>|úހ! Ց}wVi"ciNfUD}D0I z^] q֕vsQ- ZS؆rRUeZdݕ ?%"jw62{FQc`C_M-CARܥ?Wv#fȇ8 @C2*aM 3r{SFf޴SD@^2#qLU K҃t"t8HOx La#򺯆0iqN@zGB&vH Σ?4쳅ɪy d;Ryp/D˫Gna ӡܯfd*'XK/?hs?Ff9RY( mYGPr/YUM8%J1Y #(WK#.K_Ess#~UHuN 6@RCƢrjOmfvl$-kRs 9 <ݪB<E Mp;ą$!`VsI ])/EלC ؤ͟oב| R H]Rؒ9ޔ>( %|A۱@-)^rOrMzG~&z@%_pS&<=cSHt"9:9 % YZ