<?xml version="1.0" encoding="ISO-8859-1"?>

<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/">
	<channel>
		<title>LinuxQuestions.org - Blogs - unSpawn</title>
		<link>http://www.linuxquestions.org/questions/blog.php?u=2450</link>
		<description>LinuxQuestions.org offers a free Linux forum where Linux newbies can ask questions and Linux experts can offer advice. Topics include security, installation, networking and much more.</description>
		<language>en</language>
		<lastBuildDate>Mon, 23 Nov 2009 10:23:40 GMT</lastBuildDate>
		<generator>vBulletin</generator>
		<ttl>60</ttl>
		<image>
			<url>http://e1h7.simplecdn.net/lqcdn/images/questions/images/misc/rss.jpg</url>
			<title>LinuxQuestions.org - Blogs - unSpawn</title>
			<link>http://www.linuxquestions.org/questions/blog.php?u=2450</link>
		</image>
		<item>
			<title>Logwatch, webserver logs, PHP malarky</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=2308</link>
			<pubDate>Sat, 03 Oct 2009 09:52:02 GMT</pubDate>
			<description><![CDATA[As I'm seeing more questions about (badly coded) web applications spawning rogue processes I wonder why people don't read their logs. Attacks require...]]></description>
			<content:encoded><![CDATA[<div>As I'm seeing more questions about (badly coded) web applications spawning rogue processes I wonder why people don't read their logs. Attacks require reconnaissance so keeping an eye on anything that looks like a prelude enables you to take measures. And please spend time updating when updates are released, installing apps properly (like not leaving the installation files around when docs remind you not to), hardening (any IDS, <a href="http://www.modsecurity.org" target="_blank">mod_security</a>, <a href="http://www.gotroot.com" target="_blank">Gotroot</a> rulesets, mod_evasive or equivalent, PHPIDS, Suhosin, GreenSQL). <br />
If you have any questions regarding this please ask them in the LQ Linux Security forum. We'd be happy to help you along.<br />
<br />
Finding preludes to attacks by visual inspection of logfiles is cumbersome and tedious and that's why there is <a href="http://www.logwatch.org/" target="_blank">Logwatch</a> to help you as it creates reports you can actually read. Logwatch unfortunately doesn't by default include rules to filter common crack signs like gotroot's mod_security/rootkits.conf but that's easily alleviated. <br />
<br />
Locate your scripts/services/http file (might be &quot;/usr/share/logwatch/scripts/services/http&quot; if it's a default installation) and patch it with this:<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<pre class="bbcodeblock" dir="ltr" style="
		margin: 0px;
		margin-right: -99999px;
		padding: 3px;
		border: 1px inset;
		width: 98%;
		height: 498px;
		text-align: left;
		overflow: auto">--- http     2008-06-30 22:47:20.000000000
+++ http     2009-10-02 00:00:00.000000000
@@ -334,6 +334,45 @@
    'shtml\.exe',
    'win\.ini',
    'xxxxxxxxxxxxxxxxxxxxxx',
+   'wget%20',
+   'perl%20',
+   'nc%20',
+   'cd%20',
+   'python%20',
+   'rpm%20',
+   'yum%20',
+   'apt-get%20',
+   'emerge%20',
+   'lynx%20',
+   'links%20',
+   'mkdir%20',
+   'elinks%20',
+   'cmd%20',
+   'wget%20',
+   'lwp-download%20',
+   'lwp-request%20',
+   'lwp-mirror%20',
+   'lwp-rget%20',   
+   'uname',
+   'cvs%20',
+   'svn%20',
+   'sh%20',
+   'netstat',
+   'netcat%20',
+   'rexec%20',
+   'smbclient%20',
+   'tftp%20',   
+   'ftp%20',
+   'ncftp%20',
+   'curl%20',
+   'telnet%20',
+   'gcc%20',
+   'cc%20',
+   'whoami',
+   'killall',
+   'kill%20',
+   'rm%20',
+   'tar%20',
 );
 
 #</pre>
</div>If there's lines in your webservers logs your Logwatch report will show:<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<pre class="bbcodeblock" dir="ltr" style="
		margin: 0px;
		margin-right: -99999px;
		padding: 3px;
		border: 1px inset;
		width: 98%;
		height: 226px;
		text-align: left;
		overflow: auto"> Attempts to use known hacks by 5 hosts were logged 35 time(s) from:
    000.0.0.0: 16 Time(s)
       uname 7 Time(s) 
       tar%20 1 Time(s) 
       cd%20 2 Time(s) 
       perl%20 1 Time(s) 
       wget%20 4 Time(s) 
       rm%20 1 Time(s) 
    000.0.0.0: 10 Time(s)
       cd%20 2 Time(s) 
       perl%20 2 Time(s) 
       wget%20 4 Time(s) 
       rm%20 2 Time(s)</pre>
</div>which should be your cue to investigate things <i>immediately</i>.<br />
<br />
Note this is a patch against a checkout of the Logwatch CVS. If patching fails (always try testing with <i>--dry-run</i> and the appropriate amount of <i>--fuzz</i>) then check the code at around line 300 between the line starting with &quot;my @exploits = (&quot; and &quot;#  Define some useful RE paterns&quot;.<br />
<br />
Also note that Logwatch takes the <i>--service</i> arg so you could run Logwatch as a daily cronjob on all logs (which will be slow if you've got lots of logs) and something like 'logwatch --detail High --service http --range Today' as a hourly cronjob.</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=2308</guid>
		</item>
		<item>
			<title>Rootkit Hunter 1.3.5-dev progress</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=2169</link>
			<pubDate>Wed, 05 Aug 2009 14:47:13 GMT</pubDate>
			<description><![CDATA[Take a peak at RKH's SF CVS stats and you will see that activity picked up again. Currently the RKH 1.3.5(-dev) Changelog...]]></description>
			<content:encoded><![CDATA[<div>Take a peak at RKH's SF CVS stats and you will see that activity picked up again. Currently the RKH 1.3.5(-dev) <a href="http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/CHANGELOG?revision=1.119&amp;view=markup" target="_blank">Changelog</a> (rev1.119) lists 16 bugfixes, 13 new items, 14 changes and counting.<br />
<br />
It was a bit sad to notice some of the existing signatures were incomplete though. And while everyone knows breaches of security &quot;the old school rootkit way&quot; have dropped to nil, RKH aims to be complete. So I'll be replaying rootkit installs again and working on improving rootkit checks until it's release time (RSN). <br />
<br />
You are invited to test the CVS tarball. Just get it with 'wget <a href="http://rkhunter.sourceforge.net/rkhunter-CVS.tar.gz" target="_blank">http://rkhunter.sourceforge.net/rkhunter-CVS.tar.gz</a>' (if you already installed RKH please install in a different location) and please post problems/questions in <a href="https://lists.sourceforge.net/lists/listinfo/rkhunter-users" target="_blank">the rkhunter-users mailing list</a>. <br />
<br />
If you choose to <i>tangibly support</i> RKH development: my gratitude!</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=2169</guid>
		</item>
		<item>
			<title>Eiciel .spec</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=2097</link>
			<pubDate>Thu, 09 Jul 2009 11:46:38 GMT</pubDate>
			<description>Eiciel allows you to visually edit file ACL entries. You can add and remove users and groups who will be granted permissions through the graphical...</description>
			<content:encoded><![CDATA[<div>Eiciel allows you to visually edit file ACL entries. You can add and remove users and groups who will be granted permissions through the graphical interface. Eiciel can be used as stand-alone application and as Nautilus extension.<br />
<br />
ACL: <a href="http://bestbits.at" target="_blank">http://bestbits.at</a><br />
Eiciel: <a href="http://rofi.roger-ferrer.org/eiciel/" target="_blank">http://rofi.roger-ferrer.org/eiciel/</a><br />
Also-see: <a href="http://www.cs.bham.ac.uk/~nrs/jfacl/" target="_blank">http://www.cs.bham.ac.uk/~nrs/jfacl/</a> (Java-based UI)<br />
<br />
I didn't see no package but I know it is in Fedora-extras, I just didn't want to rebuild it.<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<pre class="bbcodeblock" dir="ltr" style="
		margin: 0px;
		margin-right: -99999px;
		padding: 3px;
		border: 1px inset;
		width: 98%;
		height: 498px;
		text-align: left;
		overflow: auto"># No debuginfo:
%define debug_packages	%{nil}
%define debug_package %{nil}
#
%define name eiciel
# Version
%define ver 0.9.6.1
# Release
%define rel 1

Name: %{name}
Summary: %{name} allows you to visually edit file ACL entries.
Version: %{ver}
Release: %{rel}
License: GPL
Group: Utilities/System
Source: %{name}-%{ver}.tar.bz2
Provides: %{name}
Vendor: rofi.roger-ferrer.org
URL: http://rofi.roger-ferrer.org/eiciel/
BuildRoot: %{_tmppath}/%{name}-%{version}
Prefix: /usr

%description 
Eiciel allows you to visually edit file ACL entries. You can add and remove users and groups 
who will be granted permissions through the graphical interface. Eiciel can be used as 
stand-alone application and as Nautilus extension.

%prep
%setup -n %{name}-%{version}

%build

%configure

make

%install
if [ &quot;$RPM_BUILD_ROOT&quot; = &quot;%{_tmppath}/%{name}-%{version}&quot; ]; then
	rm -rf $RPM_BUILD_ROOT

	make DESTDIR=$RPM_BUILD_ROOT install
else
	echo &quot;Invalid Build root &quot;${RPM_BUILD_ROOT}&quot;.&quot;
	exit 1
fi

find $RPM_BUILD_ROOT -not -type d | sed -e &quot;s|$RPM_BUILD_ROOT||g&quot; -e &quot;s|man[A-Z0-9]/.*$|\0.gz|g&quot; &gt; autofillfiles


%clean
if [ &quot;$RPM_BUILD_ROOT&quot; = &quot;%{_tmppath}/%{name}-%{version}&quot; ]; then
	rm -rf $RPM_BUILD_ROOT
else
	echo &quot;Invalid Build root &quot;${RPM_BUILD_ROOT}&quot;.&quot;
	exit 1
fi

# Auto-fill files
%files -f autofillfiles


%changelog
* Thu Jul 09 2009 unSpawn -
- Init .spec file.</pre>
</div>* Note: as this is GNOME territory the buildreqs (+deps) include: &quot;<i>alsa-lib-devel atk-devel audiofile-devel cairo-devel cairomm-devel dbus-devel dbus-glib-devel esound-devel fontconfig-devel freetype-devel GConf2-devel glibmm24-devel gnome-keyring-devel gnome-vfs2-devel gtk2-devel gtkmm24-devel hal-devel libart_lgpl-devel libbonobo-devel libbonoboui-devel libgcrypt-devel libglade2-devel libgnomecanvas-devel libgnome-devel libgnomeui-devel libgpg-error-devel libICE-devel libIDL-devel libpng-devel libsigc++20-devel libSM-devel libX11-devel libXau-devel libXcursor-devel libXdmcp-devel libXext-devel libXfixes-devel libXft-devel libXi-devel libXinerama-devel libxml2-devel libXrandr-devel libXrender-devel libxslt-devel mesa-libGL-devel nautilus-devel ORBit2-devel pango-devel xorg-x11-proto-devel</i>&quot; on Centos 5.3 that is. Having a list makes it less bothersome to add/remove I hope. Also note that if you find a bug in or need help with eiciel you should <i>contact the developer</i>, not me.</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=2097</guid>
		</item>
		<item>
			<title>Torsocks .spec</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=2082</link>
			<pubDate>Fri, 03 Jul 2009 10:07:46 GMT</pubDate>
			<description>Torsocks: http://code.google.com/p/torsocks/ 
 
 
Code: 
--------- 
# No debuginfo: 
%define debug_packages	%{nil} 
%define debug_package %{nil} 
#...</description>
			<content:encoded><![CDATA[<div>Torsocks: <a href="http://code.google.com/p/torsocks/" target="_blank">http://code.google.com/p/torsocks/</a><br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<pre class="bbcodeblock" dir="ltr" style="
		margin: 0px;
		margin-right: -99999px;
		padding: 3px;
		border: 1px inset;
		width: 98%;
		height: 498px;
		text-align: left;
		overflow: auto"># No debuginfo:
%define debug_packages	%{nil}
%define debug_package %{nil}
#
%define name torsocks
%define ver 1.0
%define rel 1
%define buildver %{ver}-gamma
#
# Configuration switches for rebuilding (1=yes 0=no).
# Force dns lookups to use tcp? (config switch --enable-socksdns)
%define enablesocksdns 0
%{?build_enablesocksdns:%define enablesocksdns 1}
# Don't override name lookup calls to use SOCKS? (config switch --disable-tordns)
%define disabletordns 0
%{?build_disabletordns:%define disabletordns 1}
# Use the old method to override connect? (config switch --enable-oldmethod)
%define enableoldmethod 0
%{?build_enableoldmethod:%define enableoldmethod 1}
# Enable hostname lookups for socks servers? (config switch --enable-hostnames)
%define enablehostnames 0
%{?build_enablehostnames:%define build_enablehostnames 1}
# Do not allow TSOCKS_CONF_FILE to specify configuration file? (config switch --disable-envconf)
%define disableenvconf 0
%{?build_disableenvconf:%define 1}
#
# Be standards compliant, don't break relocation and avoid necessity for configure switches.
%define _prefix /usr/local
%define _sysconfdir /usr/local/etc
%define _libdir /usr/local/lib
%define _docdir /usr/local/share/doc
%define _mandir /usr/local/share/man
%define _bindir /usr/local/bin
%define _sbindir /usr/local/sbin
#
Name: %{name}
Summary: %{name}, use applications with Tor.
Version: %{ver}
Release: %{rel}
License: GPL
Group: Utilities/System
Source: %{name}-%{buildver}.tar.gz
Prereq: tor
Provides: %{name}
Buildarch: noarch
Vendor: Robert Hogan and Ruben Garcia
URL: http://code.google.com/p/torsocks
BuildRoot: %{_tmppath}/%{name}-%{version}
Prefix: /usr/local

%description
%{name} allows you to use most socks-friendly applications in a safe way with Tor.

This is a fork of the tsocks project (http://sourceforge.net/project/
showfiles.php?group_id=17338). The purpose of this fork is to maintain a
working implementation of tsocks that is primarily useful for Tor.

%prep
%setup -n %{name}-%{buildver}

%build
%configure \
%if %{enablesocksdns}
 --enable-socksdns \
%endif
%if %{disabletordns}
 --disable-tordns \
%endif
%if %{enableoldmethod}
 --enable-oldmethod \
%endif
%if %{enablehostnames}
 --enable-hostnames \
%endif
%if %{disableenvconf}
 --disable-envconf \
%endif
make

%install
if [ &quot;$RPM_BUILD_ROOT&quot; = &quot;%{_tmppath}/%{name}-%{ver}&quot; ]; then
	rm -rf $RPM_BUILD_ROOT
	make DESTDIR=$RPM_BUILD_ROOT install
else
	echo &quot;Invalid Build root &quot;${RPM_BUILD_ROOT}&quot;.&quot;
	exit 1
fi
find $RPM_BUILD_ROOT -not -type d | sed -e &quot;s|$RPM_BUILD_ROOT||g&quot; &gt; autofillfiles
						
%clean
if [ &quot;$RPM_BUILD_ROOT&quot; = &quot;%{_tmppath}/%{name}-%{ver}&quot; ]; then
	rm -rf $RPM_BUILD_ROOT
else
	echo &quot;Invalid Build root &quot;${RPM_BUILD_ROOT}&quot;.&quot;
	exit 1
fi

%files -f autofillfiles

%changelog
* Thu Jul 03 2009 unSpawn -
- Init .spec file.
- Build version with &quot;--define='build_enablesocksdns=1'&quot;.</pre>
</div>* To work the compile-time switches just use --define like: 'rpmbuild -bb --define='build_enablesocksdns=1' --define='build_enablehostnames=0' torsocks.spec'.</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=2082</guid>
		</item>
		<item>
			<title>Non-authoritative scan results of BitDefender, ClamAV and F-prot</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=2078</link>
			<pubDate>Thu, 02 Jul 2009 00:35:54 GMT</pubDate>
			<description><![CDATA[Like before here's some results of running BitDefender, ClamAV and F-prot on over 11K of files containing Rootkits, LKM's and other goodies. Because...]]></description>
			<content:encoded><![CDATA[<div>Like before here's some results of running BitDefender, ClamAV and F-prot on over 11K of files containing Rootkits, LKM's and other goodies. Because of what I do most of the files are GNU/Linux related. (I run AV like a pentester would run metasploit against a networked entity.) I'm well aware of the AV-on-GNU/Linux-yes-or-no debate and this is not the place to go into that: search LQ or open up a thread if you need to discuss validity. <br />
<br />
The commercial AV market is kind of an odd place (to put it politely), and products that don't (have the inclination, licensing or resources to) play along, well, <i>show</i> it. That doesn't mean I don't respect ClamAV developers for what they've brought us in terms of OSS. The only thing I hope these results emphasise is that you should make your own informed decision. This goes especially for those that choose to promote just one product without realising the effects of doing so. <br />
<br />
Files scanned: <br />
BDC:    65525<br />
F-prot: 65253<br />
ClamAV: 220<br />
<br />
Infected found: <br />
BDC:    1641 (0 suspects)<br />
F-prot: 1158 (19 files with errors)<br />
ClamAV: 19<br />
<br />
Old rootkit material:<br />
sauber (T0rnkit), modhide.o (Knark), relink (Adore)<br />
BDC:    Y Y Y<br />
F-prot: Y Y Y<br />
ClamAV: N N N<br />
<br />
2.6 LKMs: Override, Intoxonia-NG, EnyeLKM, Mood-NT: <br />
BDC:    N N N N<br />
F-prot: N N N N<br />
ClamAV: N N N N<br />
<br />
Misc: boxer (obfuscated ELF), OSXrk (Mac), Fbrk (BSD), Vlogger (keylogger):<br />
BDC:    N Y Y Y<br />
F-prot: N Y Y Y<br />
ClamAV: N N N N<br />
<br />
Malware: PHP mass mailer, r57shell, C99Shell, C99Shell other version, I-Frame Trojan:<br />
BDC:    Y Y Y Y Y Y <br />
F-prot: Y Y Y Y Y Y<br />
ClamAV: N N N N N Y<br />
<br />
App/engine version info:<br />
BDC:    v7.90123 Linux-i586<br />
F-prot: version 6.2.1.4252, engine version: 4.4.4.56<br />
ClamAV: 0.95.2/9532<br />
<br />
Commandline:<br />
BDC:    --action=ignore --recursive-level=100 --archive-level=100 --no-list<br />
F-prot: --boot --follow --mount --maxdepth=60 --heurlevel=3 --archive=10 --adware --applications --verbose=2<br />
ClamAV: --verbose --remove=no --tempdir=/dev/shm --detect-pua=yes --detect-structured=yes --scan-mail=yes --phishing-scan-urls=yes --heuristic-scan-precedence=yes --algorithmic-detection=yes --scan-pe=yes --scan-elf=yes --scan-ole2=yes --scan-pdf=yes --scan-html=yes --scan-archive=yes --detect-broken=yes --block-encrypted=no --mail-follow-urls=no<br />
<br />
Scan time (MM:SS):<br />
BDC:    05:56<br />
F-prot: 01:52<br />
ClamAV: 40.85</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=2078</guid>
		</item>
		<item>
			<title>Rootkit Hunter announces release 1.3.4</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=1484</link>
			<pubDate>Tue, 30 Dec 2008 23:23:52 GMT</pubDate>
			<description>Finally Rootkit Hunter release 1.3.4 (http://sourceforge.net/projects/rkhunter/) is here listing 4 additions, 8 changes and 9 bugfixes. Thanks to all...</description>
			<content:encoded><![CDATA[<div>Finally <a href="http://sourceforge.net/projects/rkhunter/" target="_blank">Rootkit Hunter release 1.3.4</a> is here listing 4 additions, 8 changes and 9 bugfixes. Thanks to all contributors who made this release possible by providing code, submitting ideas, bugs, fixes, documentation, testing from CVS, helping out on the rkhunter-users mailing list and promoting Rootkit Hunter.<br />
Even though it's a given by now, the project wouldn't be going anywhere without John Horne...</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=1484</guid>
		</item>
		<item>
			<title>Sjeng xboard / eboard compatible chess engine .spec</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=868</link>
			<pubDate>Wed, 26 Mar 2008 02:27:13 GMT</pubDate>
			<description>Sjeng: http://www.sjeng.org/ 
Xboard: http://www.tim-mann.org/xboard.html 
Eboard: http://eboard.sourceforge.net/ 
 
 
Code: 
--------- 
%define...</description>
			<content:encoded><![CDATA[<div>Sjeng: http://www.sjeng.org/<br />
Xboard: http://www.tim-mann.org/xboard.html<br />
Eboard: http://eboard.sourceforge.net/<br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<pre class="bbcodeblock" dir="ltr" style="
		margin: 0px;
		margin-right: -99999px;
		padding: 3px;
		border: 1px inset;
		width: 98%;
		height: 498px;
		text-align: left;
		overflow: auto">%define origname Sjeng-Free-11.2
%define name sjeng
%define ver 11.2
%define rel 1
%define debug_packages	%{nil}
%define debug_package %{nil}

Name: %{name}
Summary: %{name}, a xboard compatible chess engine
Version: %{ver}
Release: %{rel}
License: GPL
Group: Amusements/Games
Source0: %{origname}.tar.gz
Prereq: xboard
Provides: %{name}
Buildarch: noarch
Vendor: Gian-Carlo Pascutto
URL: http://www.sjeng.org/
BuildRoot: %{_tmppath}/%{name}-%{version}

%description
Sjeng is a xboard compatible chess engine. Sjeng currently plays
standard chess, crazyhouse, bughouse, suicide (aka giveaway or 
anti-chess) and losers. It can also play variants which have the 
same rules as normal chess, but a different starting position. 

Technically, Sjeng is a highly advanced alpha-beta searcher, 
using modern techniques like history and killer moves, 
transposition tables, SEE move ordering and pruning, and 
search enhancements like selective extensions, Aspiration 
Principal Variation Search, Adaptive nullmove pruning, 
Extended Futility Pruning and Limited Razoring. Sjeng can 
use an opening book and learns from the games it plays. 

On 14th of October 2000, Sjeng won it's first title
by becoming the World Computer Crazyhouse Chess Champion.

On December 31th 2000, Sjeng became the first computer
program to reach the #1 spot on the crazyhouse rating list
on the Free Internet Chess Server. It had been #1 on the
Internet Chess Club before.

Early 2001 Sjeng became the #1 losers/giveaway player
on the Internet Chess Club.

%prep
%setup -n %{origname}

%build
./configure --prefix=$RPM_BUILD_ROOT/usr/local
make

%install
if [ &quot;$RPM_BUILD_ROOT&quot; = &quot;%{_tmppath}/%{name}-%{version}&quot; ]; then
	rm -rf $RPM_BUILD_ROOT
install -d $RPM_BUILD_ROOT/usr/local/bin
make install
install %{name} -m 0755 $RPM_BUILD_ROOT/usr/local/bin/%{name}
# Yes, I should make a .desktop file...
cat &lt;&lt; EOC &gt; $RPM_BUILD_ROOT/usr/local/bin/%{name}.sh
#!/bin/sh
exec xboard -fcp /usr/local/bin/%{name}
exit 0
EOC
else
	echo &quot;Invalid Build root \'&quot;$RPM_BUILD_ROOT&quot;\'&quot;
	exit 1
fi
						
%clean
if [ &quot;$RPM_BUILD_ROOT&quot; = &quot;%{_tmppath}/%{name}-%{version}&quot; ]; then
	rm -rf $RPM_BUILD_ROOT
else
	echo &quot;Invalid Build root \'&quot;$RPM_BUILD_ROOT&quot;\'&quot;
	exit 1
fi

%define _docdir /usr/local/share/doc

%files
%defattr(-,root,root)
%doc AUTHORS BUGS ChangeLog COPYING INSTALL NEWS README THANKS TODO 
%attr(755,root,root) /usr/local/bin/%{name}
%attr(755,root,root) /usr/local/bin/%{name}.sh

%changelog
* Wed Mar 26 2008 unSpawn -
- initial .spec.
- patch Makefile.</pre>
</div></div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=868</guid>
		</item>
		<item>
			<title>FUSE CopyFS .spec</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=863</link>
			<pubDate>Sun, 23 Mar 2008 23:32:44 GMT</pubDate>
			<description>FUSE: http://fuse.sourceforge.net 
CopyFS: http://n0x.org/copyfs/ 
  
 
Code: 
--------- 
%define origname copyfs 
%define name fuse-copyfs 
%define...</description>
			<content:encoded><![CDATA[<div>FUSE: http://fuse.sourceforge.net<br />
CopyFS: http://n0x.org/copyfs/<br />
 <br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<pre class="bbcodeblock" dir="ltr" style="
		margin: 0px;
		margin-right: -99999px;
		padding: 3px;
		border: 1px inset;
		width: 98%;
		height: 498px;
		text-align: left;
		overflow: auto">%define origname copyfs
%define name fuse-copyfs
%define ver 1.0.1
%define rel 1
%define debug_packages	%{nil}
%define debug_package %{nil}

Name: %{name}
Summary: %{name}, a copy-on-write, versioned filesystem using FUSE 
Version: %{ver}
Release: %{rel}
License: GPL
Group: Utilities/System
Source0: %{origname}-%{ver}.tar.bz2
# &quot;copyfs.html&quot; is a copy of the sites HTML.
Source1: %{origname}.html
Prereq: kernel &gt;= 2.6.14, fuse &gt;= 2.7.3, libattr &gt;= 2.4.32
Provides: %{name}
Buildarch: noarch
Vendor: Nicolas Vigier / Thomas Joubert
URL: http://n0x.org/copyfs/
BuildRoot: %{_tmppath}/%{name}-%{version}
BuildRequires: fuse-devel &gt;= 2.7.3, libattr-devel &gt;= 2.4.32

%description
CopyFS aims to solve a common problem : given a directory, especially
one full of configuration files, or other files that one can modify,
and which can affect the functionning of a system, or of programs, 
that may be important to other users (or to the user himself), how
to be sure that a person modifying the files will do a backup of the
working version first? Based on FUSE, the userspace filesystem frame-
work for Linux, see http://fuse.sourceforge.net.

%prep
%setup -n %{origname}-%{ver}
cp $RPM_SOURCE_DIR/%{origname}.html .

%build
%configure --prefix=/usr/local
make

%install
if [ &quot;$RPM_BUILD_ROOT&quot; = &quot;%{_tmppath}/%{name}-%{version}&quot; ]; then
	rm -rf $RPM_BUILD_ROOT
	#make install
	install -d $RPM_BUILD_ROOT/usr/local/bin
	install -d $RPM_BUILD_ROOT/usr/local/share/man/man1
	install -m 755 copyfs-daemon $RPM_BUILD_ROOT/usr/local/bin
	install -m 755 copyfs-mount copyfs-fversion $RPM_BUILD_ROOT/usr/local/bin
	install -m 644 copyfs.1 copyfs-daemon.1 copyfs-mount.1 copyfs-fversion.1 $RPM_BUILD_ROOT/usr/local/share/man/man1
else
	echo &quot;Invalid Build root \'&quot;$RPM_BUILD_ROOT&quot;\'&quot;
	exit 1
fi
						
%clean
if [ &quot;$RPM_BUILD_ROOT&quot; = &quot;%{_tmppath}/%{name}-%{version}&quot; ]; then
	rm -rf $RPM_BUILD_ROOT
else
	echo &quot;Invalid Build root \'&quot;$RPM_BUILD_ROOT&quot;\'&quot;
	exit 1
fi

%files
%defattr(-,root,root)
%doc README TODO COPYING %{origname}.html
%attr(755,root,root) /usr/local/bin/copyfs-daemon
%attr(755,root,root) /usr/local/bin/copyfs-mount
%attr(755,root,root) /usr/local/bin/copyfs-fversion
%attr(644,root,root) /usr/local/share/man/man1/copyfs.1
%attr(644,root,root) /usr/local/share/man/man1/copyfs-daemon.1
%attr(644,root,root) /usr/local/share/man/man1/copyfs-mount.1
%attr(644,root,root) /usr/local/share/man/man1/copyfs-fversion.1

%changelog
* Sun Mar 23 2008 unSpawn -
- Initial .spec file.</pre>
</div></div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=863</guid>
		</item>
		<item>
			<title>Rootkit Hunter 1.3.2 release imminent...</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=808</link>
			<pubDate>Tue, 26 Feb 2008 02:38:00 GMT</pubDate>
			<description>The team will be releasing RKH-1.3.2, which will fix aprox 10-ish bugs, RSN. 
 
I thank all the contributors on our rkhunter-users mailing list and...</description>
			<content:encoded><![CDATA[<div>The team will be releasing RKH-1.3.2, which will fix aprox 10-ish bugs, RSN.<br />
<br />
I thank all the contributors on our rkhunter-users mailing list and all who submitted bugs and patches to our bug tracker. I thank John again for his dedication and work on RKH and Aus9 for his work on the RKH Wiki page at LQ, documentation and persistence in general. I also like to thank the anonymous crowd that managed to D/L RKH from SF over the months. (I still find it weird that if you look below the varnish that is OSS' mantra's of &quot;freedom&quot; and &quot;many eyeballs&quot; you'll find only a few people ever manage to contribute. Oh well.)<br />
<br />
Anyway. <br />
<br />
Here's to those that did *make* a difference.</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=808</guid>
		</item>
		<item>
			<title>Ext3cow implements secure deletion, authenticated encryption, and incremental authentication.</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=771</link>
			<pubDate>Fri, 08 Feb 2008 13:06:26 GMT</pubDate>
			<description><![CDATA["Ext3cow is an open-source, versioning file system based on ext3. It provides a time-shifting interface that allows a real-time and continuous view...]]></description>
			<content:encoded><![CDATA[<div>&quot;Ext3cow is an open-source, versioning file system based on ext3. It provides a time-shifting interface that allows a real-time and continuous view of the past. This allows users to access their file system as it appeared at any point in time. Ext3cow was designed as a platform for regulatory compliance, and has been used to implement secure deletion, authenticated encryption, and incremental authentication.&quot;<br />
 <br />
Some advantages of ext3cow:<br />
- It does not pollute the name space with named versions<br />
- It has low storage and performance overhead<br />
- <i>It is totally modular, requiring no changes to kernel or VFS interfaces</i><br />
<br />
<br />
http://www.ext3cow.com/</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=771</guid>
		</item>
		<item>
			<title>The Problem With PHP Application Security</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=486</link>
			<pubDate>Tue, 23 Jan 2007 00:35:12 GMT</pubDate>
			<description>One of the topics sadly not exhausted. Please chip in if you want to discuss this in a meaningful way:...</description>
			<content:encoded><![CDATA[<div>One of the topics sadly not exhausted. Please chip in if you want to discuss this in a meaningful way: <a href="http://The Problem With PHP Application Security" target="_blank">http://www.linuxquestions.org/questions/showthread.php?p=2598001</a>.</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=486</guid>
		</item>
		<item>
			<title>...in other security-related news today</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=472</link>
			<pubDate>Mon, 08 Jan 2007 20:38:23 GMT</pubDate>
			<description>1168038000, death (http://news.bbc.co.uk/2/hi/asia-pacific/6237013.stm) of Momofuku Ando (http://www.nissinfoods.com/his2.htm), famous for inventing...</description>
			<content:encoded><![CDATA[<div>1168038000, <a href="http://news.bbc.co.uk/2/hi/asia-pacific/6237013.stm" target="_blank">death</a> of <a href="http://www.nissinfoods.com/his2.htm" target="_blank">Momofuku Ando</a>, famous for inventing Instant <a href="http://en.wikipedia.org/wiki/Ramen" target="_blank">Ramen</a> which lead to <a href="http://www.ciac.org/ciac/bulletins/l-040.shtml" target="_blank">Ramen</a>.</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=472</guid>
		</item>
		<item>
			<title>The Rootkit Hunter is looking for C/C++ developers</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=427</link>
			<pubDate>Wed, 22 Nov 2006 18:40:12 GMT</pubDate>
			<description><![CDATA[We're looking for developers who have C/C++, experience developing applications on POSIX-based systems and an understanding of shell scripts, work...]]></description>
			<content:encoded><![CDATA[<div>We're looking for developers who have C/C++, experience developing applications on POSIX-based systems and an understanding of shell scripts, work together as a team and who can dedicate time on a more or less regular basis. <br />
<br />
If you want to help develop Rootkit Hunter or like more information please contact me.</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=427</guid>
		</item>
		<item>
			<title>YAWLINRFTWA</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=416</link>
			<pubDate>Sun, 05 Nov 2006 15:26:11 GMT</pubDate>
			<description><![CDATA["yet another why Linux is not ready for the world article" (http://www.linuxquestions.org/questions/showthread.php?t=498352) 
 
Ask not what...]]></description>
			<content:encoded><![CDATA[<div><a href="http://www.linuxquestions.org/questions/showthread.php?t=498352">&quot;yet another why Linux is not ready for the world article&quot;</a><br />
<br />
<i>Ask not what GNU/Linux can do for you, but what you can do for GNU/Linux.</i> <br />
GNU/Linux users have an obligation because of using FOSS: active and constructive participation in the FOSS ecology. Not doing so means consumerism, which in essence is egotistical and a shallow and destructive movement. Anyone who says GNU/Linux should do &quot;better&quot; and does not put in any substantial and constructive effort to make it &quot;better&quot; does not understand FOSS.<br />
</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=416</guid>
		</item>
		<item>
			<title>Non-authoritative scan results of BitDefender, ClamAV, F-prot and NOD32</title>
			<link>http://www.linuxquestions.org/questions/blog.php?b=410</link>
			<pubDate>Sat, 14 Oct 2006 09:41:04 GMT</pubDate>
			<description><![CDATA[Here's some scan results of running BitDefender, ClamAV, F-prot and NOD32 on a stash of aproximately 10K files containing a mixed set of Root kits,...]]></description>
			<content:encoded><![CDATA[<div>Here's some scan results of running BitDefender, ClamAV, F-prot and NOD32 on a stash of aproximately 10K files containing a mixed set of Root kits, LKM's, tools and w32 goodies:<br />
Files scanned: BDC: 12113, NOD32: 11000, F-prot: 9375, ClamAV: 9280.<br />
Threats / infected + suspected files found: BDC: 537, NOD32: 421, F-prot: 366, ClamAV: 150.<br />
<br />
More details here: http://www.linuxquestions.org/questions/showthread.php?t=491870</div>

]]></content:encoded>
			<dc:creator>unSpawn</dc:creator>
			<guid isPermaLink="true">http://www.linuxquestions.org/questions/blog.php?b=410</guid>
		</item>
	</channel>
</rss>
