Bug#361954: ITP: ossec-hids -- Host-based intrusion detection system

[Matej Vela <vela@debian.org>]

owner 361954 !
unmerge 407121
close 407121
thanks

On Tue, Jun 12, 2007 at 11:42:33 +0200, Alberto Furia wrote:
> Ciao Yaroslav,
> i can't fornish ossec for debian in this moment: for me it's ok if
> you want to package it.

Since no one jumped in, I guess I'm taking over the ITP.  Of course,
co-maintainers are more than welcome.  I'm also closing #407121 so that
we don't have two bugs to keep track of.

Here's my to-do list so far:

  * Make sure there's no licensing conflict between GPL and the bundled
    OpenSSL code.  Upstream has graciously agreed to add the usual
    exception [1], so this should be a non-issue in short order.

  * Map to an FHS layout, using symlinks if necessary.  Tentatively:

    /var/ossec/bin        -> /usr/bin
    /var/ossec/etc        -> /etc/ossec
    /var/ossec/logs       -> /var/log/ossec
    /var/ossec/queue      -> /var/spool/ossec
    /var/ossec/var/run    -> /var/run/ossec
    /var/ossec (the rest) -> /var/lib/ossec

  * Debconf-iscate as much of install.sh as possible.

  * Link against zlib1g rather than an embedded copy, to avoid giving
    more headaches to the Security Team [2].

I'll keep this bug posted.

[1] <http://marc.info/?t=119567120200010>
[2] <http://wiki.debian.org/EmbeddedCodeCopies>

Cheers,

Matej