Subject: [alpine-devel]

From: IT Offshore <[email-masked]>
Date: Sun, 10 Nov 2013 09:58:55 +0000

All patches now use the system colours $STRONG $GREEN $RED. Post install
scripts now only give info / status messages & run unattended & do not start any services. 
Any setup is now done by /sbin/setup-$pkg

Completes patches correcting the following issues:

PSAD - now builds without stopping for user input.

dnscrypt-proxy - confd / initd now include the additional 3 variables for
the Resolvers - so /sbin/setup-dnscrypt now only updates confd & does not
touch init. 

libsodium (dnscrypt dependency) - post-install running ldconfig removed.

FWSNORT - post-install only gives an info message & does not run the included update script.
Signature updates run by /etc/periodic/daily.

inetutils-syslogd - post-install only gives an info message. Setup done by /sbin/setup-$pkg

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: IT Offshore <[email-masked]>
Date: Sun, 10 Nov 2013 09:59:00 +0000

revised complete patch for inetutils-syslogd.

post-install - just gives status / info message - configuration is
now done by /sbin/setup-inetutils-syslogd. Both scripts now use the
system colours $STRONG $RED $GREEN.

post-deinstall - just adds back busybox syslog to boot runlevel &
shows the status of syslog & cron (as cron will be stopped by removing
any syslog)
---
 testing/inetutils-syslogd/APKBUILD                 | 90 ++++++++++++++++++++++
 testing/inetutils-syslogd/inetutils-syslogd.confd  |  9 +++
 testing/inetutils-syslogd/inetutils-syslogd.initd  | 50 ++++++++++++
 .../inetutils-syslogd/inetutils-syslogd.logrotate  | 38 +++++++++
 .../inetutils-syslogd.post-deinstall               |  7 ++
 .../inetutils-syslogd.post-install                 | 13 ++++
 testing/inetutils-syslogd/inetutils-syslogd.setup  | 28 +++++++
 testing/inetutils-syslogd/syslog.conf              | 38 +++++++++
 8 files changed, 273 insertions(+)
 create mode 100644 testing/inetutils-syslogd/APKBUILD
 create mode 100644 testing/inetutils-syslogd/inetutils-syslogd.confd
 create mode 100644 testing/inetutils-syslogd/inetutils-syslogd.initd
 create mode 100644 testing/inetutils-syslogd/inetutils-syslogd.logrotate
 create mode 100644 testing/inetutils-syslogd/inetutils-syslogd.post-deinstall
 create mode 100644 testing/inetutils-syslogd/inetutils-syslogd.post-install
 create mode 100644 testing/inetutils-syslogd/inetutils-syslogd.setup
 create mode 100644 testing/inetutils-syslogd/syslog.conf

diff --git a/testing/inetutils-syslogd/APKBUILD b/testing/inetutils-syslogd/APKBUILD
new file mode 100644
index 0000000..88d5f16
--- /dev/null
+++ b/testing/inetutils-syslogd/APKBUILD
@@ -0,0 +1,90 @@
+# Contributor: IT Offshore <[email-masked]>
+# Maintainer:
+pkgname=inetutils-syslogd
+_pkgname=inetutils
+pkgver=1.9.1
+pkgrel=0
+pkgdesc="A small syslogd for logging to multiple files"
+url="http://www.gnu.org/software/inetutils/"
+arch="all"
+license="GPL3"
+depends="readline ncurses"
+depends_dev=""
+makedepends="$depends_dev"
+install="$pkgname.post-install $pkgname.post-deinstall"
+subpackages="$pkgname-doc"
+source="http://ftp.gnu.org/gnu/inetutils/${_pkgname}-${pkgver}.tar.gz
+	inetutils-syslogd.initd
+	inetutils-syslogd.confd
+	syslog.conf
+	inetutils-syslogd.logrotate
+	"
+
+_builddir="$srcdir"/$_pkgname-$pkgver
+
+build() {
+	cd "$_builddir"
+
+        ./configure \
+                --build=$CBUILD \
+                --host=$CHOST \
+                --prefix=/usr \
+		--libexec=/usr/sbin \
+                --sysconfdir=/etc \
+                --mandir=/usr/share/man \
+                --infodir=/usr/share/info \
+                --localstatedir=/var \
+		--without-wrap --without-pam \
+                --disable-ftp --disable-ftpd \
+      		--disable-telnet --disable-telnetd \
+         	--disable-talk --disable-talkd \
+         	--disable-rlogin --disable-rlogind \
+         	--disable-rsh --disable-rshd \
+	        --disable-rexec --disable-rexecd \
+        	--disable-rcp --disable-hostname \
+	        --disable-tftp --disable-tftpd \
+        	--disable-ping --disable-ping6 \
+	        --disable-logger --enable-syslogd \
+        	--disable-inetd --disable-whois \
+	        --disable-uucpd --disable-ifconfig --disable-traceroute \
+		|| return 1
+        make || return 1
+}
+
+check() {
+  cd "$srcdir/${_pkgname}-${pkgver}"
+  make check
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="${pkgdir}" install
+	#binary installed to /usr/sbin not bin
+	rm -rf $pkgdir/usr/bin
+
+	#install init script & config defaults
+        install -m755 -D "$srcdir"/$pkgname.initd \
+                "$pkgdir"/etc/init.d/$pkgname || return 1
+        install -m644 -D "$srcdir"/$pkgname.confd \
+                "$pkgdir"/etc/conf.d/$pkgname || return 1
+	install -m644 -D "$srcdir"/syslog.conf \
+                "$pkgdir"/etc/syslog.conf || return 1
+	install -m644 -D "$srcdir"/inetutils-syslogd.logrotate \
+                "$pkgdir"/etc/logrotate.d/inetutils-syslogd || return 1
+}
+
+md5sums="944f7196a2b3dba2d400e9088576000c  inetutils-1.9.1.tar.gz
+6f0deb2a07439638161d03fd887d4fad  inetutils-syslogd.initd
+edf3f502d9f2bf49c5da8cb37a927d06  inetutils-syslogd.confd
+506560780445d5a7b30e2e3c96efa19d  syslog.conf
+9980ae54a3791c7f9d1d3baa04698e2a  inetutils-syslogd.logrotate"
+sha256sums="02a9ebde8a198cb85f87545b9d88fb103a183958139864a85fe9e027ad79ff2b  inetutils-1.9.1.tar.gz
+1cf71f3656dceba3ddf0543a43a98e644a0b42999ba80b9f72318ee578c9ff53  inetutils-syslogd.initd
+86105f0a0105f50275f7381b5d7fe603b8d854a0e6753c2f06f6d0c234562948  inetutils-syslogd.confd
+a991140072f0ff1a0d3b3e593eb5935fcca0c00f93436022b9055c7450decdf9  syslog.conf
+2b3e73b1a808cabd54dd3c3b78573cdf759422fa3c7b64f15838ce0830edaa31  inetutils-syslogd.logrotate"
+sha512sums="69267bfa3cae34f6145caad668dc2e9385701fb52a144640e9893fa7f0b7694eacd1fe579de3fb7190e8485b26c00337ded136488694c399b0fc290f7eec303c  inetutils-1.9.1.tar.gz
+e70d0e244fcc30e94f846b82b4ec7318b5582f512bd715fb5bd9178d7be5ede0e5b53e29431a2db5177ce2f31fc306900b3a1297a658e84b2671f3ad5153b81c  inetutils-syslogd.initd
+82968692b4fe79706aacaeb1021b343288dc4f1d86925481796dac1f743a8269976ce86bf446cd0c16d246b918e5822e312660b201407eb7031a17cb398c9513  inetutils-syslogd.confd
+5abb2a0309c9e180d7cacf97917044a8d3573fdf4d5902d757788fb687800900b47a02c6ec4a113475931176b52a1c2ba0771452bfb301a11b5aa0230377872d  syslog.conf
+30741cf17a86a0bf39404882711d827e200a2d22cdba873e49f1a871f8d113cfe5bb1ddf3206c44be888be15aa09104656f9bd26406abb42c9b6fed0624d0bfb  inetutils-syslogd.logrotate"
diff --git a/testing/inetutils-syslogd/inetutils-syslogd.confd b/testing/inetutils-syslogd/inetutils-syslogd.confd
new file mode 100644
index 0000000..dfcc1cb
--- /dev/null
+++ b/testing/inetutils-syslogd/inetutils-syslogd.confd
@@ -0,0 +1,9 @@
+#
+# inetutils syslogd defaults
+#
+
+# Internet connections are enabled if forwarding (which is the default).
+# Example option to add a socket for chroot jailed openvpn server
+#SYSLOGD_OPTS="--no-forward -a /etc/openvpn/jail/dev/log"
+
+SYSLOGD_OPTS="--no-forward"
diff --git a/testing/inetutils-syslogd/inetutils-syslogd.initd b/testing/inetutils-syslogd/inetutils-syslogd.initd
new file mode 100644
index 0000000..6baad86
--- /dev/null
+++ b/testing/inetutils-syslogd/inetutils-syslogd.initd
@@ -0,0 +1,50 @@
+#!/sbin/runscript
+
+# This file is part of inetutils-syslogd
+# Created for Alpine Linux by IT Offshore <[email-masked]>
+
+name=syslogd
+daemon=/usr/sbin/$name
+config_file="/etc/syslog.conf"
+
+depend() {
+	need clock hostname localmount
+        provide logger
+}
+
+check_config() {
+        [ -f "$config_file" ] || error "$config_file is missing"
+}
+
+start_pre() {
+        check_config || return 1
+}
+
+start() {
+	ebegin "Starting ${name}"
+		start-stop-daemon --start --quiet \
+			--pidfile /var/run/${name}.pid \
+			--exec ${daemon} -- ${SYSLOGD_OPTS}
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping ${name}"
+		start-stop-daemon --stop --quiet \
+			--pidfile /var/run/$name.pid \
+			--exec ${daemon}
+	eend $?
+}
+
+reload() {
+        if [ ! -f "${PIDFILE}" ]; then
+                eerror "rsyslogd not running"
+                return 1
+        fi
+
+        ebegin "Re-opening intetutils-syslogd log files"
+        start-stop-daemon --stop --signal HUP \
+                --pidfile /var/run/$name.pid
+        eend $?
+}
+
diff --git a/testing/inetutils-syslogd/inetutils-syslogd.logrotate b/testing/inetutils-syslogd/inetutils-syslogd.logrotate
new file mode 100644
index 0000000..9edb145
--- /dev/null
+++ b/testing/inetutils-syslogd/inetutils-syslogd.logrotate
@@ -0,0 +1,38 @@
+/var/log/syslog
+{
+	rotate 7
+	daily
+	missingok
+	notifempty
+	delaycompress
+	compress
+	postrotate
+		/etc/init.d/inetutils-syslogd reload &>/dev/null || true
+	endscript
+}
+
+/var/log/mail.info
+/var/log/mail.warn
+/var/log/mail.err
+/var/log/mail.log
+/var/log/daemon.log
+/var/log/kern.log
+/var/log/auth.log
+/var/log/user.log
+/var/log/lpr.log
+/var/log/cron.log
+/var/log/debug
+/var/log/messages
+{
+	rotate 4
+	weekly
+	missingok
+	notifempty
+	compress
+	delaycompress
+	sharedscripts
+	postrotate
+		/etc/init.d/inetutils-syslogd reload &>/dev/null || true
+	endscript
+}
+
diff --git a/testing/inetutils-syslogd/inetutils-syslogd.post-deinstall b/testing/inetutils-syslogd/inetutils-syslogd.post-deinstall
new file mode 100644
index 0000000..28f5dde
--- /dev/null
+++ b/testing/inetutils-syslogd/inetutils-syslogd.post-deinstall
@@ -0,0 +1,7 @@
+#!/bin/sh
+rc-update add syslog boot
+# show service status - cron will be stopped due to logger dependency
+echo "Cron:"; rc-service cron status
+echo "Syslog:"; rc-service syslog status
+
+
diff --git a/testing/inetutils-syslogd/inetutils-syslogd.post-install b/testing/inetutils-syslogd/inetutils-syslogd.post-install
new file mode 100644
index 0000000..5a327cb
--- /dev/null
+++ b/testing/inetutils-syslogd/inetutils-syslogd.post-install
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+NORMAL="\033[1;0m"
+STRONG="\033[1;1m"
+GREEN="\033[1;32m"
+
+print_strong() {
+	local prompt="${STRONG}$1 ${GREEN}$2${NORMAL}"
+        printf "${prompt} %s\n"
+}
+
+print_strong "\nTo configure inetutils-syslogd / BusyBox Syslog Services & Runlevels execute:" "\n\n/sbin/setup-inetutils-syslogd\n"
+exit 0
diff --git a/testing/inetutils-syslogd/inetutils-syslogd.setup b/testing/inetutils-syslogd/inetutils-syslogd.setup
new file mode 100644
index 0000000..fd356df
--- /dev/null
+++ b/testing/inetutils-syslogd/inetutils-syslogd.setup
@@ -0,0 +1,28 @@
+#!/bin/sh
+
+NORMAL="\033[1;0m"
+STRONG="\033[1;1m"
+RED="\033[1;31m"
+GREEN="\033[1;32m"
+
+print_stop() {
+	local prompt="${STRONG}$1 ${RED}$2${NORMAL}"
+        printf "${prompt} %s"
+}
+
+print_start() {
+	local prompt="${STRONG}$1 ${GREEN}$2${NORMAL}"
+        printf "${prompt} %s"
+}
+
+print_stop "\nWould you like to STOP BusyBox Syslog & remove it from the Boot Runlevel ?" "[ Enter or Y to remove ]:"; read ans
+if [ -z "$ans" ] || [ "$ans" = "y" ] || [ "$ans" = "Y" ]; then
+        echo; rc-update del syslog boot; rc-service syslog stop
+fi
+
+print_start "\nWould you like to START inetutils-syslogd & add it to the Boot Runlevel ?" "[ Enter or Y to add ]:"; read ans
+if [ -z "$ans" ] || [ "$ans" = "y" ] || [ "$ans" = "Y" ]; then
+        echo; rc-update add inetutils-syslogd boot; rc-service inetutils-syslogd start; rc-service cron restart; echo
+fi
+
+exit 0
diff --git a/testing/inetutils-syslogd/syslog.conf b/testing/inetutils-syslogd/syslog.conf
new file mode 100644
index 0000000..27141bf
--- /dev/null
+++ b/testing/inetutils-syslogd/syslog.conf
@@ -0,0 +1,38 @@
+#
+# First some standard log files.  Log by facility.
+#
+auth,authpriv.*                 /var/log/auth.log
+*.*;auth,authpriv.none          -/var/log/syslog
+cron.*                          /var/log/cron.log
+daemon.*                        -/var/log/daemon.log
+kern.*                          -/var/log/kern.log
+lpr.*                           -/var/log/lpr.log
+mail.*                          -/var/log/mail.log
+user.*                          -/var/log/user.log
+
+#
+# Logging for the mail system.  Split it up so that
+# it is easy to write scripts to parse these files.
+#
+mail.info                       -/var/log/mail.info
+mail.warn                       -/var/log/mail.warn
+mail.err                        /var/log/mail.err
+
+#
+# Logging for INN news system.
+#
+news.crit                       /var/log/news/news.crit
+news.err                        /var/log/news/news.err
+news.notice                     -/var/log/news/news.notice
+
+#
+# Some "catch-all" log files.
+#
+*.=debug;\
+        auth,authpriv.none;\
+        news.none;mail.none     -/var/log/debug
+*.=info;*.=notice;*.=warn;\
+        auth,authpriv.none;\
+        cron,daemon.none;\
+        mail,news.none          -/var/log/messages
+
-- 
1.8.4.2

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 15 Nov 2013 17:01:48 +0100

On Sun, 10 Nov 2013 09:59:00 +0000

> revised complete patch for inetutils-syslogd.
...

> +makedepends="$depends_dev"

you should just add readline-dev and ncurses-dev to makedepends and then
let abuild detect elf dependencies.

> +         	--disable-talk --disable-talkd \

whitespace damage above.

I fixed those issues and applied whith a slightly different commit
message. thanks!

-nc

---

---

From: IT Offshore <[email-masked]>
Date: Sun, 10 Nov 2013 09:58:56 +0000

Corrected patch for PSAD - the APKBUILD now provides the answers required by install.pl
so the package will build unattended. I looked at building the package the Redhat way
but the perl install script also preserves configuration settings on upgrades.

Post-install script now only adds PSAD to the default runlevel & shows it's status as stopped.
---
 testing/psad/APKBUILD          | 106 +++++++++++++++++++++++++++++++++++++++++
 testing/psad/psad.confd        |   8 ++++
 testing/psad/psad.initd        |  55 +++++++++++++++++++++
 testing/psad/psad.post-install |   6 +++
 4 files changed, 175 insertions(+)
 create mode 100644 testing/psad/APKBUILD
 create mode 100644 testing/psad/psad.confd
 create mode 100644 testing/psad/psad.initd
 create mode 100644 testing/psad/psad.post-install

diff --git a/testing/psad/APKBUILD b/testing/psad/APKBUILD
new file mode 100644
index 0000000..0e0477b
--- /dev/null
+++ b/testing/psad/APKBUILD
@@ -0,0 +1,106 @@
+# Contributor: IT Offshore <[email-masked]>
+# Maintainer:
+pkgname=psad
+pkgver=2.2.1
+pkgrel=0
+pkgdesc="3 lightweight system daemons that analyze iptables log messages to detect port scans and other suspicious traffic"
+url="http://cipherdyne.org/psad/"
+arch="all"
+license="GPL"
+depends="perl iptables ip6tables ssmtp psmisc perl-bit-vector perl-date-calc perl-iptables-chainmgr perl-iptables-parse perl-net-ipv4addr perl-unix-syslog net-tools"
+install="$pkgname.post-install"
+subpackages="$pkgname-doc"
+source="http://cipherdyne.org/psad/download/$pkgname-nodeps-$pkgver.tar.gz
+	psad.initd
+	psad.confd
+	"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+build() {
+	cd "$_builddir"
+
+	#Set the config dirs
+  sed -e "s|'/usr/sbin'|'$pkgdir/usr/sbin'|" \
+      -e "s|'/usr/bin'|'$pkgdir/usr/bin'|" \
+      -e "s|my \$mpath = \"/usr/share/man/man\$section\";|my \$mpath = \"$pkgdir/usr/share/man/man\$section\";|" \
+          ./install.pl -i
+       #/usr/sbin/psadwatchd set with last cmd
+  sed -e "s|/var/log/psad|$pkgdir&|" \
+      -e "s|/var/run/psad|$pkgdir&|" \
+      -e "s|/var/lib/psad|$pkgdir&|" \
+      -e "s|/usr/lib/psad|$pkgdir&|" \
+      -e "s|/etc/psad|$pkgdir&|" \
+      -e "s|/usr/bin/whois_psad|$pkgdir/usr/bin/whois|" \
+      -e "s|/usr/sbin/fwcheck_psad|$pkgdir&|" \
+      -e "s|/usr/sbin/kmsgsd|$pkgdir&|" \
+      -e "s|/usr/sbin/psad|$pkgdir&|" \
+        ./psad.conf -i
+
+	#Disable install of generic init script & setting numeric run level
+	START=$(sed -n '/if ($init_dir and &is_root()) {/=' ./install.pl)
+	END=$(expr $START + 7)
+        #Busybox sed does not support +7d
+	sed -e ''$START','$END'd' ./install.pl -i
+
+	#populate install.answers so build does not wait for them
+	echo -e "Would you like to merge the config from the existing psad installation:\t n;" > ./install.answers
+        echo -e "Preserve any user modfications in etc psad signatures:\t y;" >> ./install.answers
+        echo -e "Preserve any user modfications in etc psad icmp_types:\t y;" >> ./install.answers
+        echo -e "Preserve any user modfications in etc psad icmp6_types:\t y;" >> ./install.answers
+        echo -e "Preserve any user modfications in etc psad posf:\t y;" >> ./install.answers
+        echo -e "Preserve any user modfications in etc psad auto_dl:\t y;" >> ./install.answers
+        echo -e "Preserve any user modfications in etc psad snort_rule_dl:\t y;" >> ./install.answers
+        echo -e "Preserve any user modfications in etc psad pf os:\t y;" >> ./install.answers
+        echo -e "Preserve any user modfications in etc psad ip_options:\t y;" >> ./install.answers
+        echo -e "Would you like alerts sent to a different address:\t y;" >> ./install.answers
+        echo -e "Email addresses:\t root@localhost;" >> ./install.answers
+        echo -e "Would you like psad to only parse specific strings in iptables messages:\t n;" >> ./install.answers
+        echo -e "First is it ok to leave the HOME_NET setting as any:\t y;" >> ./install.answers
+        echo -e "Would you like to enable DShield alerts:\t n;" >> ./install.answers
+        echo -e "Would you like to install the latest signatures from http www cipherdyne org psad signatures:\t n;" >> ./install.answers
+        echo -e "Enable psad at boot time:\t n;" >> ./install.answers
+}
+
+package() {
+	cd "$_builddir"
+
+	mkdir -p $pkgdir/etc/psad \
+                 $pkgdir/usr/bin \
+                 $pkgdir/usr/sbin \
+                 $pkgdir/usr/share/man/man8 \
+                 $pkgdir/var/lib/psad \
+                 $pkgdir/var/log/psad \
+                 $pkgdir/var/run/psad
+	# add dummy whois so build completes
+	ln -s /bin/busybox $pkgdir/usr/bin/whois
+	# dummy runlevel 1 / skip perl module installation
+	./install.pl --runlevel 1 --Use-answers --Skip-mod-install
+
+        #Set correct permissions
+	chmod -R o+r $pkgdir/etc/psad
+	chmod -R o+r $pkgdir/usr/sbin/*
+	chmod 0700 $pkgdir/var/lib/psad
+	#remove whois symbolic link
+	rm -rf $pkgdir/usr/bin/whois
+
+	# Fix the config
+	sed -e "s|$pkgdir||" $pkgdir/etc/psad/psad.conf -i
+	sed -e "s|$pkgdir||" $pkgdir/var/log/psad/install.log -i
+
+	#install init script & config defaults
+	install -m755 -D "$srcdir"/$pkgname.initd \
+		"$pkgdir"/etc/init.d/$pkgname || return 1
+	install -m644 -D "$srcdir"/$pkgname.confd \
+		"$pkgdir"/etc/conf.d/$pkgname || return 1
+}
+
+md5sums="d4b46544d167235a71ba5c56745927ed  psad-2.2.1.tar.bz2
+6e5ef9b0ddebf1a229da58b0f1918f89  psad.initd
+bc07efebb41cc23c4be129bbbacc874b  psad.confd"
+sha256sums="17befa8879f326d8f416c4827ec4241c6a8882656776d677f1b7ed05728e9728  psad-2.2.1.tar.bz2
+b38a3643f0b0c9ed338f1c3f1beea6114ba5b0a8cfb60097598066aa4e415c32  psad.initd
+74c72225fa37c367a458321b737050cacaf262f32b0cc13babc54468ff1988b9  psad.confd"
+sha512sums="08a4173126f3b9ea592224cd0079b41156e15366643f2347e6dbfe01a89bca112d3d94b0ec593da6c8fc9782befa74aad4a66b4117a40523d28a25bc1f1508c4  psad-2.2.1.tar.bz2
+01fbb402032f8cff9d2c6be3a032c5ea446d4708ca4f56addebba84bbd1b70e69e4c94b31a3af2680bbf8633f854f1ed8ef78ac746450ff1848fdbc4c90bf44a  psad.initd
+a80666f59356cc6157a9f5dca132991d4f1e0afda8f673d602de2557219d5521bec9ae148330e98d9483175d14d96e4cc2ccd11541d8b187b0e47f44ba4ada54  psad.confd"
diff --git a/testing/psad/psad.confd b/testing/psad/psad.confd
new file mode 100644
index 0000000..27ce228
--- /dev/null
+++ b/testing/psad/psad.confd
@@ -0,0 +1,8 @@
+# Default settings for psad.
+
+# Add any options you would like to pass to the daemon when started
+# For example if you would like to add an override file for your setup, this
+# can be achived this way:
+#
+#     command_args="--Override-config /root/psad.override.conf"
+command_args=""
diff --git a/testing/psad/psad.initd b/testing/psad/psad.initd
new file mode 100644
index 0000000..3e12cf4
--- /dev/null
+++ b/testing/psad/psad.initd
@@ -0,0 +1,55 @@
+#!/sbin/runscript
+
+# This file is part of PSAD (Port Scan Attack Detector)
+# Adapted for Alpine Linux by IT Offshore <[email-masked]>
+
+command="/usr/sbin/psad"
+pidfile="/var/run/psad/psad.pid"
+config_file="/etc/psad/psad.conf"
+
+depend() {
+	need net
+	need logger
+	after iptables
+}
+
+# allow override config_file location from conf.d
+: ${config_file:="/etc/psad/psad.conf"}
+
+check_config() {
+	[ -f "$config_file" ] || error "$config_file is missing"
+}
+
+start_pre() {
+	check_config || return 1
+	# make sure dir for pidfile exists. /var/run is tmpfs...
+	checkpath --directory ${pidfile%/*}
+}
+
+start() {
+    ebegin "Starting PSAD (Port Scan Attack Detector)"
+    start-stop-daemon --start $command --pidfile $pidfile
+    eend $?
+}
+
+stop()
+{
+	local pidfile
+	local piddir=/var/run/psad
+	local process_list="psadwatchd kmsgsd psad"
+
+	# Stop all 3 daemons with psad stopped last as it launches the other 2
+	for process in $process_list; do
+
+		pidfile="$piddir/$process.pid"
+		einfo "Stopping the $process process"
+		start-stop-daemon --stop $process --progress --pidfile $pidfile
+		eend $?
+
+	done
+}
+
+exit
+
+
+
diff --git a/testing/psad/psad.post-install b/testing/psad/psad.post-install
new file mode 100644
index 0000000..510d99b
--- /dev/null
+++ b/testing/psad/psad.post-install
@@ -0,0 +1,6 @@
+#!/bin/sh
+# add psad service to Default Runlevel
+rc-update add psad default
+echo "PSAD:";rc-service psad status
+exit 0
+
-- 
1.8.4.2

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 15 Nov 2013 15:37:36 +0100

On Sun, 10 Nov 2013 09:58:56 +0000

>  create mode 100644 testing/psad/psad.post-install

I applied with some changes:
* removed the post-install script
* copied the stop() function from the provided initscript for gentoo
  and removed the start() as i believe the default start action will
  work.

-nc

---

---

From: IT Offshore <[email-masked]>
Date: Sun, 10 Nov 2013 09:58:57 +0000

Complete patch to bump dnscrypt-proxy to version 1.33

Minor changes to APKBUILD to build with the new sources & make-depends.

confd / initd changed to include the additional configurations to set the alternative
resolver ip / public keys.

Separate patch created to build dnscrypt's dependency libsodium / libsodium-dev
(as it no longer forms part of dnscrypt's sources).

Post-install script is just status / info using the $STRONG / $RED / $GREEN
system colours.

Added /sbin/setup-dnscrypt for changing the resolver dnscrypt queries &
optionally installing unbound for dns caching. This also uses the system terminal
colours. This no longer makes any changes to init.d, it only updates conf.d
---
 testing/dnscrypt-proxy/APKBUILD                    |  51 +++--
 testing/dnscrypt-proxy/dnscrypt-proxy.confd        |   4 +
 testing/dnscrypt-proxy/dnscrypt-proxy.initd        |   2 +-
 testing/dnscrypt-proxy/dnscrypt-proxy.post-install |  14 ++
 testing/dnscrypt-proxy/dnscrypt-proxy.setup        | 227 +++++++++++++++++++++
 5 files changed, 275 insertions(+), 23 deletions(-)
 create mode 100644 testing/dnscrypt-proxy/dnscrypt-proxy.post-install
 create mode 100644 testing/dnscrypt-proxy/dnscrypt-proxy.setup

diff --git a/testing/dnscrypt-proxy/APKBUILD b/testing/dnscrypt-proxy/APKBUILD
index 9b34b39..57e10d7 100644
--- a/testing/dnscrypt-proxy/APKBUILD
+++ b/testing/dnscrypt-proxy/APKBUILD
@@ -1,33 +1,36 @@
 # Contributor: Francesco Colista <[email-masked]>
 # Maintainer: Francesco Colista <[email-masked]>
 pkgname=dnscrypt-proxy
-pkgver=1.3.0
-pkgrel=0
+pkgver=1.3.3
+pkgrel=1
 pkgdesc="A tool for securing communications between a client and a DNS resolver"
 url="http://dnscrypt.org/"
 arch="x86"
 license="custom"
-depends=""
-depends_dev=""
+depends="libsodium"
+depends_dev="libtool automake autoconf libsodium-dev"
 makedepends="$depends_dev"
-install=""
-pkguser=dnscrypt
-pkggroup=dnscrypt
-subpackages="$pkgname-dev $pkgname-doc"
-source="http://download.dnscrypt.org/$pkgname/$pkgname-$pkgver.tar.bz2
+install="$pkgname.post-install $pkgname.pre-install"
+pkgusers=dnscrypt
+pkggroups=dnscrypt
+subpackages="$pkgname-doc"
+source="saveas-https://github.com/jedisct1/$pkgname/archive/$pkgver.tar.gz/$pkgname-$pkgver.tar.gz
 	$pkgname.initd
 	$pkgname.confd
+	$pkgname.setup
 	"
+
 _builddir="$srcdir"/$pkgname-$pkgver
 
 build() {
-
-	cd "$_builddir"/src/libsodium
-	make -j1 check
-
-	cd "$_builddir"
-	CFLAGS="$CFLAGS -fPIC" ./configure --prefix=/usr
-	make -j1
+        cd "$_builddir"
+	./autogen.sh
+        CFLAGS="$CFLAGS -fPIC" ./configure \
+                --build=$CBUILD \
+                --host=$CHOST \
+                --prefix=/usr \
+                || return 1
+        make || return 1
 }
 
 package() {
@@ -38,18 +41,22 @@ package() {
 	mkdir -p $pkgdir/usr/share/licenses/$pkgname
         install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
 	install -m755 -D "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
+	install -m755 -D "$srcdir"/$pkgname.setup "$pkgdir"/sbin/setup-dnscrypt
 	install -m 644 COPYING $pkgdir/usr/share/licenses/$pkgname
 	chown dnscrypt "$pkgdir"/var/log/$pkgname
 	chown dnscrypt "$pkgdir"/var/run/$pkgname
 	rm -rf $pkgdir/usr/lib/*.la
 }
 
-md5sums="33cc94dd06d23f96b4bac3efd1b20c95  dnscrypt-proxy-1.3.0.tar.bz2
+md5sums="6a10b1d6018bfeed9a6dbc3b49cc39d8  dnscrypt-proxy-1.3.3.tar.gz
 9d4858771258a029d00197422d3888b8  dnscrypt-proxy.initd
-a7a34c94174eca5c688e7867a87cafb3  dnscrypt-proxy.confd"
-sha256sums="211ee2d75acd631b09d012229c73654c2302234d73c9f12425e1c906520dc7c5  dnscrypt-proxy-1.3.0.tar.bz2
+a7a34c94174eca5c688e7867a87cafb3  dnscrypt-proxy.confd
+57d315cafd53eefc37cd791c48d27aa8  dnscrypt-config"
+sha256sums="b797b1cc2ce6b7a01bc8a8d119367971f0cff20beea506cd0aeaa613fd5eaa24  dnscrypt-proxy-1.3.3.tar.gz
 f8b9301a8deda8413c6057788644505e622c0e12c8637f1dc7bdddf44f9cbec7  dnscrypt-proxy.initd
-e4817f9c73137bf34607df3617f3fa3075ea8cb805cff948e06901ca7259e46b  dnscrypt-proxy.confd"
-sha512sums="b6d7e6796d24bfe8ef27a16c4e6970122965f4d9fd4f3df997fc4f46e2c762efcd6fd145df7e154c2b66b358771d1ce45f676df3810b14fb6aeec0b182e354b6  dnscrypt-proxy-1.3.0.tar.bz2
+e4817f9c73137bf34607df3617f3fa3075ea8cb805cff948e06901ca7259e46b  dnscrypt-proxy.confd
+928cf063b9ab3168fe3fcc5f790ea803e344ca2d82dbfeccfffd12c177bff2e0  dnscrypt-config"
+sha512sums="e0d668446eaf65dce358b6d90fc7cf9905e49e267f0ff6c4d399c54b4ccc13d1c9f9622ac68f5fd992ce0b0c275b4e07bd98bc35404c822f521f20a244287dce  dnscrypt-proxy-1.3.3.tar.gz
 34e375faab52b381198bf50d1ce5e47be56132e7e427255782747952cf828951fec4676b523558f3f0bb46c1afa1a58b46960a3d9c550f6196f8de182a03e220  dnscrypt-proxy.initd
-544133669bb1ef1ab17992035919afccb911f7f282b71f0369f055a105efe7f6b9d61c1f281f879d684f08a095559800f57e124982dd4ea33b90a12b61352009  dnscrypt-proxy.confd"
+544133669bb1ef1ab17992035919afccb911f7f282b71f0369f055a105efe7f6b9d61c1f281f879d684f08a095559800f57e124982dd4ea33b90a12b61352009  dnscrypt-proxy.confd
+fcfd2b9bf08daeb65997f4236c46674a59e344c34d6c8724e2aa54d974b636ffd8d1b0e3ddc3267483017b3ef95deefde63db0b1d439191f1aa0b0f111deaccd  dnscrypt-config"
diff --git a/testing/dnscrypt-proxy/dnscrypt-proxy.confd b/testing/dnscrypt-proxy/dnscrypt-proxy.confd
index 9b68286..076cfde 100644
--- a/testing/dnscrypt-proxy/dnscrypt-proxy.confd
+++ b/testing/dnscrypt-proxy/dnscrypt-proxy.confd
@@ -5,3 +5,7 @@ DNSCRYPT_USER=dnscrypt
 DNSCRYPT_GROUP=dnscrypt
 # Set here the IP where DNSCRYPT listen
 DNSCRYPT_LOCALIP=127.0.0.1:53
+# Set the Resolver
+RESOLVER=208.67.220.220:443;
+PROVIDER=2.dnscrypt-cert.opendns.com
+PUBKEY=B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79;
diff --git a/testing/dnscrypt-proxy/dnscrypt-proxy.initd b/testing/dnscrypt-proxy/dnscrypt-proxy.initd
index ff63b6f..33d1a5f 100644
--- a/testing/dnscrypt-proxy/dnscrypt-proxy.initd
+++ b/testing/dnscrypt-proxy/dnscrypt-proxy.initd
@@ -8,7 +8,7 @@ depend() {
 
 start() {
 	ebegin "Starting dnscrypt-proxy"
-	start-stop-daemon --start --quiet --pidfile=${PID} --exec /usr/sbin/dnscrypt-proxy -- -p ${PID} -l ${DNSCRYPT_LOGFILE} -d -u ${DNSCRYPT_GROUP} -a ${DNSCRYPT_LOCALIP}
+	start-stop-daemon --start --quiet --pidfile=${PID} --exec /usr/sbin/dnscrypt-proxy -- -p ${PID} -l ${DNSCRYPT_LOGFILE} -d -u ${DNSCRYPT_GROUP} -a ${DNSCRYPT_LOCALIP} -r ${RESOLVER} -k ${PUBKEY} -N ${PROVIDER}
 	eend $?
 }
 
diff --git a/testing/dnscrypt-proxy/dnscrypt-proxy.post-install b/testing/dnscrypt-proxy/dnscrypt-proxy.post-install
new file mode 100644
index 0000000..7e30564
--- /dev/null
+++ b/testing/dnscrypt-proxy/dnscrypt-proxy.post-install
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+NORMAL="\033[1;0m"
+STRONG="\033[1;1m"
+GREEN="\033[1;32m"
+
+print_strong() {
+        local prompt="${STRONG}$1 ${GREEN}$2${NORMAL}"
+        printf "${prompt} %s\n"
+}
+
+print_strong "\nTo configure alternative DNS Resolvers & DNS caching please run:" "\n\n/sbin/setup-dnscrypt\n"
+exit 0
+
diff --git a/testing/dnscrypt-proxy/dnscrypt-proxy.setup b/testing/dnscrypt-proxy/dnscrypt-proxy.setup
new file mode 100644
index 0000000..8fd6d56
--- /dev/null
+++ b/testing/dnscrypt-proxy/dnscrypt-proxy.setup
@@ -0,0 +1,227 @@
+#!/bin/sh
+# Contributor: IT Offshore <[email-masked]>
+# dnscrypt-proxy setup script to choose DNS Resolver / install & configure DNS Caching
+############################################################################################
+
+NORMAL="\033[1;0m"
+STRONG="\033[1;1m"
+RED="\033[1;31m"
+GREEN="\033[1;32m"
+
+print_question() {
+        local prompt="${STRONG}$1 ${RED}$2${NORMAL}"
+        printf "${prompt} %s"
+}
+
+print_strong() {
+        local prompt="${STRONG}$1 ${RED}$2${NORMAL}"
+        printf "${prompt} %s\n"
+}
+
+
+print_green() {
+        local prompt="${GREEN}${STRONG}$1 ${NORMAL}"
+        printf "${prompt} %s\n"
+}
+
+print_table() {
+        local choice="${RED}${STRONG}$1${NORMAL}"
+	local resolver="${STRONG}$2"
+	local location="${GREEN}$3"
+	 printf "${choice} ${resolver} ${location} %s\n"
+}
+
+die() {
+    print_table "ERROR:" "$1" > /dev/null 1>&2
+    exit 1
+}
+
+choose_ip(){
+IP=none
+IPADDR=$(ifconfig |grep -B1 "inet addr" |awk '{ if ( $1 == "inet" ) { print $2 } else if ( $2 == "Link" ) { printf "%s:" ,$1 } }' |awk -F: '{ print $1 ": " $3 }')
+until echo $IPADDR | grep -e $IP 1>/dev/null
+do
+    print_question "\nChoose dnscrypt ip from the following addresses:\n"
+    print_question "\n$IPADDR\t" "[ default - 127.0.0.1 ]"
+    read IP
+    if [ ! $IP ] ;then
+        IP=127.0.0.1; print_green "\nIP: 127.0.0.1 Selected";
+    fi
+done
+}
+
+choose_port(){
+print_question "\nChoose dnscrypt port:" "[ default = 40 ]"
+until [ "$DNSPORT" -gt 0 ] 2>/dev/null
+do
+        read DNSPORT
+        if [ ! $DNSPORT ]; then
+             DNSPORT=40; print_green "\nPort: 40 Selected"
+        fi
+
+        case $DNSPORT in
+        ''|*[!0-9]*) print_question "\nChoose NUMERIC dnscrypt port:" "[ default = 40 ]" ;;
+        *) if [ "$DNSPORT" -gt 65535 ]; then
+                                print_question "\nPlease choose a valid port" "[1 - 65535]";
+                                DNSPORT=0;
+           fi;;
+        esac
+done
+}
+
+update_unbound(){
+if [ -f /etc/unbound/unbound.conf ]; then
+	if grep 'Settings from /sbin/setup-dnscrypt' /etc/unbound/unbound.conf 1>/dev/null; then
+		#replace previous setting
+		START=$(sed -n '/Settings from \/sbin\/setup-dnscrypt/=' /etc/unbound/unbound.conf)
+		LINE=$(expr $START + 5)
+		sed "$LINE c \  forward-addr: $IP@$DNSPORT" /etc/unbound/unbound.conf -i
+	else
+		echo -e '##### Settings from /sbin/setup-dnscrypt #####' >> /etc/unbound/unbound.conf
+		echo -e 'do-not-query-localhost: no' >> /etc/unbound/unbound.conf
+		echo >> /etc/unbound/unbound.conf
+		echo -e 'forward-zone:' >> /etc/unbound/unbound.conf
+		echo -e '  name: "."' >> /etc/unbound/unbound.conf
+		echo -e "  forward-addr: $IP@$DNSPORT" >> /etc/unbound/unbound.conf
+	fi
+print_strong "\n/etc/unbound/unbound.conf settings updated to:"
+print_green "--------------------------------------------------------"
+print_table 'forward-zone:'
+print_table '  name: "."'
+print_table "  forward-addr: $IP@$DNSPORT"
+print_green "--------------------------------------------------------\n"
+fi
+}
+
+# Do some sanity checking.
+if [ $(/usr/bin/id -u) != "0" ]; then
+   die 'Must be run by root user'
+fi
+
+clear;
+print_table "\n   DNSCRYPT-PROXY MANAGER"
+print_green "-----------------------------------------------------------------"
+print_table "1:" "OpenDNS"
+print_table "2:" "Cloud NS\t\t : Canberra, Australia" "(No Logs, DNSSEC)"
+print_table "3:" "Cloud NS\t\t : Canberra" "(over TOR .onion:443)"
+print_table "4:" "Cloud NS\t\t : Sydney, Australia" "(No Logs, DNSSEC)"
+print_table "5:" "Cloud NS\t\t : Sydney" "(over TOR .onion:443)"
+print_table "6:" "OpenNIC\t\t : Japan" "(No Logs)"
+print_table "7:" "DNSCrypt.eu\t\t : Holland" "(No logs, DNSSEC)"
+print_table "8:" "Soltysiak.com\t : Poland" "(No logs, DNSSEC)"
+print_green "-----------------------------------------------------------------"
+print_question "Please choose a DNS Resolver for dnscrypt-proxy to query" "[1 - 8]:"
+
+
+until [ "$DNS" -gt 0 ] 2>/dev/null
+do
+
+read DNS
+
+case $DNS in
+    1) RESOLVER=208.67.220.220:443;
+       PROVIDER=2.dnscrypt-cert.opendns.com
+       PUBKEY=B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79;;
+    2) RESOLVER=113.20.6.2:443;
+       PROVIDER=2.dnscrypt-cert.cloudns.com.au;
+       PUBKEY=1971:7C1A:C550:6C09:F09B:ACB1:1AF7:C349:6425:2676:247F:B738:1C5A:243A:C1CC:89F4;;
+    3) RESOLVER=gc2tzw6lbmeagrp3.onion:443;
+       PROVIDER=2.dnscrypt-cert.cloudns.com.au;
+       PUBKEY=1971:7C1A:C550:6C09:F09B:ACB1:1AF7:C349:6425:2676:247F:B738:1C5A:243A:C1CC:89F4;;
+    4) RESOLVER=113.20.8.17:443;
+       PROVIDER=2.dnscrypt-cert-2.cloudns.com.au;
+       PUBKEY=67A4:323E:581F:79B9:BC54:825F:54FE:1025:8B4F:37EB:0D07:0BCE:4010:6195:D94F:E330;;
+    5) RESOLVER=l65q62lf7wnfme7m.onion:443;
+       PROVIDER=2.dnscrypt-cert-2.cloudns.com.au;
+       PUBKEY=67A4:323E:581F:79B9:BC54:825F:54FE:1025:8B4F:37EB:0D07:0BCE:4010:6195:D94F:E330;;
+    6) RESOLVER=106.186.17.181:2053;
+       PROVIDER=2.dnscrypt-cert.ns2.jp.dns.opennic.glue;
+       PUBKEY=8768:C3DB:F70A:FBC6:3B64:8630:8167:2FD4:EE6F:E175:ECFD:46C9:22FC:7674:A1AC:2E2A;;
+    7) RESOLVER=176.56.237.171:443;
+       PROVIDER=2.dnscrypt-cert.dnscrypt.eu;
+       PUBKEY=67C0:0F2C:21C5:5481:45DD:7CB4:6A27:1AF2:EB96:9931:40A3:09B6:2B8D:1653:1185:9C66;;
+    8) RESOLVER=178.216.201.222:2053;
+       PROVIDER=2.dnscrypt-cert.soltysiak.com;
+       PUBKEY=25C4:E188:2915:4697:8F9C:2BBD:B6A7:AFA4:01ED:A051:0508:5D53:03E7:1928:C066:8F21;;
+       #check for numerical input
+    ''|0|*[!0-9]*) print_question "Please choose a NUMERIC option:" "[1 - 8]" ;;
+    *) if [ "$DNS" -gt 8 ]; then
+	  print_question "Please choose an option:" "[1 - 8]";
+	  DNS=0;
+       fi;;
+esac
+done
+
+# remove existing Resolver config
+if grep "RESOLVER" /etc/conf.d/dnscrypt-proxy 1> /dev/null; then
+   sed -e '/RESOLVER/d' -e '/PROVIDER/d' -e '/PUBKEY/d' /etc/conf.d/dnscrypt-proxy -i
+fi
+
+# update Resolver config
+echo "RESOLVER=$RESOLVER" >> /etc/conf.d/dnscrypt-proxy
+echo "PROVIDER=$PROVIDER" >> /etc/conf.d/dnscrypt-proxy
+echo "PUBKEY=$PUBKEY" >> /etc/conf.d/dnscrypt-proxy
+
+print_strong "\n/etc/conf.d/dnscrypt-proxy Resolver Settings updated to:"
+print_green "---------------------------------------------------------------------------------------------"
+print_table "RESOLVER\t\t:" "$RESOLVER"
+print_table "PROVIDER\t\t:" "$PROVIDER"
+print_table "PUBLIC KEY :" "$PUBKEY"
+print_green "---------------------------------------------------------------------------------------------\n"
+
+# install unbound
+if ! which unbound 1> /dev/null; then
+   print_question "Install Unbound (Caching DNS Server)" "[ Y / N ]"
+   read installsrv
+   if [ "$installsrv" = "Y" ] || [ "$installsrv" = "y" ]; then
+      apk add -q unbound
+   fi
+fi
+
+# choose dnscrypt ip address port
+print_question "Modify dnscrypt-proxy ip / port ?" "[ Y / N ]"
+read updateip
+if [ "$updateip" = "Y" ] || [ "$updateip" = "y" ]; then
+		choose_ip; choose_port
+
+		# update dnscrypt listening ip & port
+		LINE=$(sed -n '/DNSCRYPT_LOCALIP=/=' /etc/conf.d/dnscrypt-proxy)
+		sed "$LINE c DNSCRYPT_LOCALIP=$IP:$DNSPORT" /etc/conf.d/dnscrypt-proxy -i
+
+		# update dhclient.conf
+		if [ -f /etc/dhcp/dhclient.conf ]; then
+			if grep 'supersede domain-name-servers' /etc/dhcp/dhclient.conf 1>/dev/null; then
+			LINE=$(sed -n '/supersede domain-name-servers/=' /etc/dhcp/dhclient.conf)
+			sed "$LINE c supersede domain-name-servers $IP" /etc/dhcp/dhclient.conf -i
+			else
+				echo "supersede domain-name-servers $IP" >> /etc/dhcp/dhclient.conf
+			fi
+		fi
+
+		# update resolv.conf & unbound
+		LINE=$(sed -n '/nameserver/=' /etc/resolv.conf)
+                sed "$LINE c nameserver $IP" /etc/resolv.conf -i
+		update_unbound
+
+		# add / restart services
+		for srv in "unbound dnscrypt-proxy"; do
+		if which $srv 1> /dev/null; then
+			if ! rc-status | grep $srv; then
+				rc-update add $srv default
+			fi
+			rc-service $srv restart
+		fi
+		done
+
+		print_strong "/etc/conf.d/dnscrypt-proxy Listening Address updated to:"
+		print_green "--------------------------------------------------------"
+		print_table "DNSCRYPT_LOCALIP=$IP:$DNSPORT"
+		print_green "--------------------------------------------------------\n"
+fi
+
+
+
+
+
+
+
-- 
1.8.4.2

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 15 Nov 2013 16:35:06 +0100

Sorry for taking long time for this...

On Sun, 10 Nov 2013 09:58:57 +0000

> Minor changes to APKBUILD to build with the new sources & make-depends.

Applied with some changes.This is fcolista's package though so it would
be nice if fcolista could have a look at it.

> resolver ip / public keys.

I basically rewrote the init.d. I tried to use sensible defaults but
its possible to override with conf.d.
 
> (as it no longer forms part of dnscrypt's sources).

nice! thanks!

> Post-install script is just status / info using the $STRONG / $RED / $GREEN

I don't think we need any informal message at all but I'll let fcolista
decide that for this package.

> colours. This no longer makes any changes to init.d, it only updates conf.d

I didn't test it but i think this idea is pretty neat.

Thanks!

-nc

---