Added changelog data since psad-2.2.1 2.2.2
authorMichael Rash <mbr@cipherdyne.org>
Fri, 17 Jan 2014 03:12:46 +0000 (22:12 -0500)
committerMichael Rash <mbr@cipherdyne.org>
Thu, 16 Jan 2014 21:09:05 +0000 (16:09 -0500)
ChangeLog.git

index f8bfb92..4b7e7e8 100644 (file)
-commit e7d4d477372e52bbf69fdd395b9d370ec131f6b8 (HEAD, refs/heads/master)
+commit dcbfd2034d2e8c1f8fc8ccfab3e4bcade22e9c43 (HEAD, refs/heads/master)
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Wed Jan 2 23:23:17 2013 -0500
+Date:   Mon Jan 13 18:38:31 2014 -0500
 
-    added auto_min_dl5_blocking.conf file
+    copyright date update
 
- test/conf/auto_min_dl5_blocking.conf |  596 ++++++++++++++++++++++++++++++++++
- 1 file changed, 596 insertions(+)
+ psad | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
-commit 0c59ffd1917d72ec81c8074eedfd8b9d624959e2
+commit 679d49d24957ee6f56269990c8d8980a737101a5
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Wed Jan 2 23:16:50 2013 -0500
+Date:   Mon Jan 13 18:37:24 2014 -0500
 
-    changes since psad-2.2
+    bumped version to 2.2.2
 
- ChangeLog.git |  368 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 368 insertions(+)
+ ChangeLog                             | 2 +-
+ VERSION                               | 2 +-
+ nf2csv                                | 2 +-
+ packaging/psad-nodeps.spec            | 5 ++++-
+ packaging/psad-require-makemaker.spec | 5 ++++-
+ packaging/psad.spec                   | 5 ++++-
+ psad                                  | 4 ++--
+ 7 files changed, 17 insertions(+), 8 deletions(-)
 
-commit 98debf7924cfaae1541e7684f7ec3ac30e3eaaf7
+commit a91f73529e6e799068af6cad68ddd0c2f5cab92d
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Wed Jan 2 23:12:43 2013 -0500
+Date:   Mon Jan 13 18:27:53 2014 -0500
 
-    minor date update for psad-2.2.1 release
+    minor bug fix to auto-generate iptables logs in benchmark mode
 
- ChangeLog |    2 +-
+ psad | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-commit da758cc9fffdc49bbf4ccf2236761e0f85da1f25
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Tue Jan 1 22:23:18 2013 -0500
-
-    bumped version to 2.2.1
-
- VERSION                               |    2 +-
- nf2csv                                |    2 +-
- packaging/psad-nodeps.spec            |    5 ++++-
- packaging/psad-require-makemaker.spec |    5 ++++-
- packaging/psad.spec                   |    5 ++++-
- psad                                  |    4 ++--
- 6 files changed, 16 insertions(+), 7 deletions(-)
-
-commit 996ef41711b48643029c31c7d5c7e7cd9a9d035b
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Tue Jan 1 22:20:00 2013 -0500
-
-    Added EMAIL_THROTTLE for email throttling
-    
-    Added the ability to throttle emails generated by psad via a new
-    EMAIL_THROTTLE variable which is implemented as a per-IP threshold.  That
-    is, if EMAIL_THROTTLE is set to "10", then psad will only send 1/10th as
-    many emails for each scanning IP as it would have normally.  This feature
-    was suggested by Naji Mouawad.
-
- CREDITS                                          |    4 ++++
- ChangeLog                                        |   10 +++++++++-
- psad                                             |   10 +++++++++-
- psad.conf                                        |    8 ++++++++
- test/conf/auto_blocking.conf                     |    8 ++++++++
- test/conf/default_psad.conf                      |    8 ++++++++
- test/conf/disable_ipv6_detection.conf            |    8 ++++++++
- test/conf/enable_ack_detection.conf              |    8 ++++++++
- test/conf/ignore_tcp.conf                        |    8 ++++++++
- test/conf/ignore_udp.conf                        |    8 ++++++++
- test/conf/require_DROP_syslog_prefix_str.conf    |    8 ++++++++
- test/conf/require_missing_syslog_prefix_str.conf |    8 ++++++++
- 12 files changed, 94 insertions(+), 2 deletions(-)
-
-commit b39dc01133d7b0e981c58622b5f0a9c48c979b81
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Tue Jan 1 20:56:00 2013 -0500
-
-    Configurable auto-blocking timeout values.
-    
-    Oscar Marley suggested configurable auto-blocking timeout values depending on
-    the danger level that a scan or attack achieves.  This resulted in the
-    implementation of the AUTO_BLOCK_DL*_TIMEOUT variables.
-
- CREDITS                                          |    5 ++
- psad                                             |   73 +++++++++++++++-------
- psad.conf                                        |    9 +++
- test/conf/auto_blocking.conf                     |   11 +++-
- test/conf/default_psad.conf                      |    9 +++
- test/conf/disable_ipv6_detection.conf            |    9 +++
- test/conf/enable_ack_detection.conf              |    9 +++
- test/conf/ignore_tcp.conf                        |    9 +++
- test/conf/ignore_udp.conf                        |    9 +++
- test/conf/require_DROP_syslog_prefix_str.conf    |    9 +++
- test/conf/require_missing_syslog_prefix_str.conf |    9 +++
- test/test-psad.pl                                |   26 +++++++-
- 12 files changed, 162 insertions(+), 25 deletions(-)
-
-commit d78f288f0577e59e1b36447604ea040dc302caea
+commit d69cbdfc21dfd9db42efee4fc47fc0999de5c3df
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sat Dec 22 22:19:19 2012 -0500
+Date:   Mon Jan 13 18:11:14 2014 -0500
 
-    added --analysis-auto-block mode to allow auto-responses to be testing in -A mode
+    [test suite] added EXPECT_TCP_OPTIONS to config files
 
- psad   |   36 +++++++++++++++++++++++-------------
- psad.8 |    8 +++++++-
- 2 files changed, 30 insertions(+), 14 deletions(-)
+ test/conf/auto_blocking.conf                     | 1 +
+ test/conf/auto_min_dl5_blocking.conf             | 1 +
+ test/conf/default_psad.conf                      | 1 +
+ test/conf/disable_ipv6_detection.conf            | 1 +
+ test/conf/enable_ack_detection.conf              | 1 +
+ test/conf/ignore_tcp.conf                        | 1 +
+ test/conf/ignore_udp.conf                        | 1 +
+ test/conf/require_DROP_syslog_prefix_str.conf    | 1 +
+ test/conf/require_missing_syslog_prefix_str.conf | 1 +
+ 9 files changed, 9 insertions(+)
 
-commit 1d2602e6ba83f27042c6e59fa39d2320e0477ef3
+commit db91ca09cf5079b821fe8a10f3a2dfe6afaef2cc
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sat Dec 22 22:15:14 2012 -0500
-
-    Added --enable-auto-block-tests for testing the auto-blocking functionality in psad
+Date:   Mon Jan 13 18:07:36 2014 -0500
 
- test/conf/auto_blocking.conf |  579 ++++++++++++++++++++++++++++++++++++++++++
- test/test-psad.pl            |   72 ++++--
- 2 files changed, 633 insertions(+), 18 deletions(-)
+    [test suite] removed comments and blank lines for config files
 
-commit 574d31aff2702412d78016d509beedf8e866b7db (refs/remotes/web/master, refs/remotes/origin/master)
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Thu Dec 20 21:06:46 2012 -0500
+ test/conf/auto_blocking.conf                     | 410 -----------------------
+ test/conf/auto_min_dl5_blocking.conf             | 410 -----------------------
+ test/conf/default_psad.conf                      | 410 -----------------------
+ test/conf/disable_ipv6_detection.conf            | 410 -----------------------
+ test/conf/enable_ack_detection.conf              | 410 -----------------------
+ test/conf/ignore_tcp.conf                        | 410 -----------------------
+ test/conf/ignore_udp.conf                        | 410 -----------------------
+ test/conf/require_DROP_syslog_prefix_str.conf    | 410 -----------------------
+ test/conf/require_missing_syslog_prefix_str.conf | 410 -----------------------
+ 9 files changed, 3690 deletions(-)
 
-    Detect Topera IPv6 scans when IP options are logged
-    
-    Added detection for Topera IPv6 scans when --log-ip-options is used in
-    the ip6tables logging rule.  When this option is not used, the previous                                                                                                                        psad-2.2 release detected Topera scans.  An example TCP SYN packet
-    generated by Topera when --log-ip-options is used looks like this (note                                                                                                                        the series of empty IP options strings "OPT ( )":
-    
-        Dec 20 20:10:40 rohan kernel: [  488.495776] DROP IN=eth0 OUT=                                                                                                                                 MAC=00:1b:b9:76:9c:e4:00:13:46:3a:41:36:86:dd
-        SRC=2012:1234:1234:0000:0000:0000:0000:0001                                                                                                                                                    DST=2012:1234:1234:0000:0000:0000:0000:0002 LEN=132 TC=0 HOPLIMIT=64
-        FLOWLBL=0 OPT ( ) OPT ( ) OPT ( ) OPT ( ) OPT ( ) OPT ( ) OPT ( )                                                                                                                              OPT ( ) OPT ( ) PROTO=TCP SPT=61287 DPT=1 WINDOW=8192 RES=0x00 SYN
-        URGP=0
-
- ChangeLog                                          |   14 +
- psad                                               |   62 +-
- .../scans/iptables/topera_ipv6_syn_scan_no_ip_opts | 1058 ++++++++++++++++++++
- .../iptables/topera_ipv6_syn_scan_with_ip_opts     | 1046 +++++++++++++++++++
- test/test-psad.pl                                  |   36 +
- 5 files changed, 2200 insertions(+), 16 deletions(-)
-
-commit bd89cfbad0cdc4540f1b983811e40803b8fa29b9
+commit b19a03fd59ab60a1a8811ee506b82905fbe00542 (refs/remotes/origin/master, refs/remotes/origin/HEAD)
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Mon Dec 17 23:05:56 2012 -0500
+Date:   Sun Sep 29 22:01:53 2013 -0400
 
-    Parse fwsnort rules for 'msg' fields
+    Added detection for Errata Security's "Masscan" port scanner
     
-    Added the ability to acquire Snort rule 'msg' fields from fwsnort if
-    it's also installed.  A new variable FWSNORT_RULES_DIR tells psad where
-    to look for the fwsnort rule set.  This fixes a problem reported by Pui
-    Edylie to the psad mailing list where fwsnort logged an attack that psad
-    could not map back to a descriptive 'msg' field.
-
- CREDITS                                          |    6 ++
- ChangeLog                                        |    6 ++
- psad                                             |  106 ++++++++++++----------
- psad.conf                                        |    1 +
- test/conf/default_psad.conf                      |    1 +
- test/conf/disable_ipv6_detection.conf            |    1 +
- test/conf/enable_ack_detection.conf              |    1 +
- test/conf/ignore_tcp.conf                        |    1 +
- test/conf/ignore_udp.conf                        |    1 +
- test/conf/require_DROP_syslog_prefix_str.conf    |    1 +
- test/conf/require_missing_syslog_prefix_str.conf |    1 +
- 11 files changed, 77 insertions(+), 49 deletions(-)
-
-commit 361281e7d38c68b8e8c201ca31ea9be0bc7ec858
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sat Dec 15 22:12:22 2012 -0500
-
-    added nmap scan style details to syslog output
-
- psad |    7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-commit 9659621061cd1a8032e736294cedcb3d79b7ae72
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sat Dec 15 22:06:31 2012 -0500
+    Added detection for Errata Security's "Masscan" port scanner that was
+    used in an Internet-wide scan for port 22 on Sept. 12, 2013 (see:
+    http://blog.erratasec.com/2013/09/we-scanned-internet-for-port-22.html).
+    The detection strategy used by psad relies on the fact that masscan does
+    not appear to set the options portion of the TCP header, and if the
+    iptables LOG rules that generate log data for psad are built with the
+    --log-tcp-options switch, then no options in a SYN scan can be seen.
+    This is not to say that other scanning software always sets TCP options -
+    Scapy seems to not set options by default when issuing a SYN scan like
+    this either: http://www.secdev.org/projects/scapy/doc/usage.html#syn-scans
+    There is a new psad.conf variable "EXPECT_TCP_OPTIONS" to assist with
+    Masscan detection as well.  When looking for Masscan SYN scans, psad
+    requires at least one TCP options field to be populated within a LOG
+    message (so that it knows --log-tcp-options has been set for at least
+    some logged traffic), and after seeing this then SYN packets with no
+    options are attributed to Masscan traffic.  All usual psad threshold
+    variables continue to apply however, so (by default) a single Masscan
+    SYN packet will not trigger a psad alert.  Masscan detection can be
+    disabled altogether by setting EXPECT_TCP_OPTIONS to "N", and this will
+    not affect any other psad detection techniques such as passive OS
+    fingerprinting, etc.
 
-    completed IP protocol scan detection task
+ ChangeLog | 21 +++++++++++++++++++++
+ psad      | 29 +++++++++++++++++++++++++----
+ psad.conf |  9 +++++++++
+ 3 files changed, 55 insertions(+), 4 deletions(-)
 
- todo.org |    4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-commit 19bee218741a725a8085a937046164fea47ec310
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sat Dec 15 22:03:26 2012 -0500
-
-    added IP protocol scan output to psad emails
-
- psad |   69 +++++++++++++++++++++++++++++++++---------------------------------
- 1 file changed, 35 insertions(+), 34 deletions(-)
-
-commit 6383941e87c5cadbc6f34eed99adcf26e2264818
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sat Dec 15 22:02:42 2012 -0500
-
-    additional regex's to look for perl warnings
-
- test/test-psad.pl |    4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-commit 8018338cd7668da7447fc5e106f4ae2285a972bf
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Fri Dec 14 21:04:31 2012 -0500
-
-    [test suite] added --analysis-write-data to psad test command line
-
- test/test-psad.pl |   34 +++++++++++++++++-----------------
- 1 file changed, 17 insertions(+), 17 deletions(-)
-
-commit 668453375e2256c6a7e182b211ac2acce0cb4764
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sun Dec 9 21:31:22 2012 -0500
-
-    added 'Other' protocols to per-IP 'Global stats' output for protocol scans
-
- psad |   35 +++++++++++++++++++++++++++++------
- 1 file changed, 29 insertions(+), 6 deletions(-)
-
-commit 1e9afc6f82328f16ca415524484b0fc3b354fe9e
+commit cb891a8cfae9acdbbac67a68d92f26e07d6d0d70
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sun Dec 9 21:22:50 2012 -0500
+Date:   Sun Sep 29 20:54:32 2013 -0400
 
-    remove 'multiproto' hash key in favor of new 'tot_protocols' hash key (used in -sO protocol scan detection)
+    minor auto_dl spacing update
 
- psad |    7 +------
- 1 file changed, 1 insertion(+), 6 deletions(-)
+ auto_dl | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
 
-commit 760e02b3c2c796e4856ec1338684c84679a15580
+commit d1a25b1d011d0d64716cd73e134c11c39020328c
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sun Dec 9 21:14:46 2012 -0500
+Date:   Sun Jul 28 23:52:41 2013 -0400
 
-    minor bug fix for uninitialized variable usage in ICMP6 invalid type/code detection
+    fix uninitilized scan danger level for IP block renewals when FLUSH_IPT_AT_INIT=N, closes #6
 
- psad |   14 ++++++++++----
- 1 file changed, 10 insertions(+), 4 deletions(-)
+ CREDITS |  5 +++++
+ psad    | 18 +++++++++++++++++-
+ 2 files changed, 22 insertions(+), 1 deletion(-)
 
-commit 4e059858de6bf4d553591c83fe022c17b3904732
+commit 3b7d73b87f21abef746a66abfeb9736258867618
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Fri Dec 7 22:34:08 2012 -0500
+Date:   Sat Jul 27 15:41:17 2013 -0400
 
-    added IP protocol scan test
+    [test suite] added --test-limit command line arg
 
- test/test-psad.pl |   17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
+ test/test-psad.pl | 3 +++
+ 1 file changed, 3 insertions(+)
 
-commit 9fd7ce6cdb2303b1d698decb9708980e4e1997ee
+commit 4f0a212eccea87abe90a8a62f23569b2f74e30fe
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Fri Dec 7 22:32:46 2012 -0500
+Date:   Fri Jul 26 21:25:52 2013 -0400
 
-    removed ununsed is_digit() function
+    minor --stdin usage text addition
 
- psad |    6 ------
- 1 file changed, 6 deletions(-)
+ psad   | 5 ++++-
+ psad.8 | 5 +++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
 
-commit 91dfe52f4a340ba52d70e03b40fb43b71774b0d5
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Fri Dec 7 21:23:22 2012 -0500
-
-    first cut at IP protocol scan detection (nmap -sO)
-
- ChangeLog                                        |   11 +-
- VERSION                                          |    2 +-
- nf2csv                                           |    2 +-
- psad                                             |  213 +++++++--
- psad.conf                                        |    6 +
- test/conf/default_psad.conf                      |    6 +
- test/conf/disable_ipv6_detection.conf            |    6 +
- test/conf/enable_ack_detection.conf              |    6 +
- test/conf/ignore_tcp.conf                        |    6 +
- test/conf/ignore_udp.conf                        |    6 +
- test/conf/require_DROP_syslog_prefix_str.conf    |    6 +
- test/conf/require_missing_syslog_prefix_str.conf |    6 +
- test/scans/iptables/proto_scan                   |  510 ++++++++++++++++++++++
- 13 files changed, 745 insertions(+), 41 deletions(-)
-
-commit 518880f270688cd903112395db97db85a89212ed
+commit 25edc093c9ca9952103c6f92b66f1f4c38a9743a
 Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Fri Dec 7 21:18:58 2012 -0500
-
-    added 'protocols' file in support of IP protocol scan detection (nmap -sO)
-
- install.pl |    6 +++---
- protocols  |   64 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 67 insertions(+), 3 deletions(-)
+Date:   Thu Jan 24 21:13:55 2013 -0500
 
-commit f20a57a6a37963ea1b27931d297f0791fbca544f
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sat Dec 1 14:36:08 2012 -0500
-
-    replaced TODO with todo.org org mode file
-
- TODO     |   91 --------------------------------------------------------------
- todo.org |   85 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 85 insertions(+), 91 deletions(-)
-
-commit eab733f4f51270116daba9eae8d221e236af9c26
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Thu Nov 22 22:17:00 2012 -0500
-
-    another hyphen fix
-
- psad.8 |    2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-commit f2c44bbd02f8db51758a3160c527245ba8879599
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Thu Nov 22 22:16:00 2012 -0500
-
-    applied hyphen fix from Franck Joncourt
-
- psad.8 |    2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-commit a3d8daabbc60da23116141fd5d899573c3bda199
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Tue Nov 20 21:00:00 2012 -0500
-
-    added Gregorio Narvaez
-
- CREDITS |    4 ++++
- 1 file changed, 4 insertions(+)
-
-commit ff46fe12b238b7f7b63b2f31345bb6a8f99f7efe
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Tue Nov 20 20:58:00 2012 -0500
-
-    Bug fix for NetAddr::IP usage in --analysis-fields IP search mode
+    psad RPM bug fix to include the protocols file
     
-    Bug fix in --Analyze mode when IP fields are to be searched with the
-    --analysis-fields argument (such as --analysis-fields "SRC:1.2.3.4").
-    The bug was reported by Gregorio Narvaez, and looked like this:
-    
-      Use of uninitialized value $_[0] in length at
-      ../../blib/lib/NetAddr/IP/UtilPP.pm (autosplit into
-      ../../blib/lib/auto/NetAddr/IP/UtilPP/hasbits.al) line 126.
-      Use of uninitialized value $_[0] in length at
-      ../../blib/lib/NetAddr/IP/UtilPP.pm (autosplit into
-      ../../blib/lib/auto/NetAddr/IP/UtilPP/hasbits.al) line 126.
-      Bad argument length for NetAddr::IP::UtilPP::hasbits, is 0, should be
-      128 at ../../blib/lib/NetAddr/IP/UtilPP.pm (autosplit into
-      ../../blib/lib/auto/NetAddr/IP/UtilPP/_deadlen.al) line 122.
-    
-    Added --stdin argument to allow psad to collect iptables log data from
-    STDIN in --Analyze mode.
-
- ChangeLog            |   18 +++++
- psad                 |   59 +++++++++++----
- psad.8               |    6 ++
- test/install.answers |   24 ++++++
- test/test-psad.pl    |  197 +++++++++++++++++++++++++++++++++++++++++++++++++-
- 5 files changed, 289 insertions(+), 15 deletions(-)
-
-commit 30120fbc5d44519aa378333c494e456e6aded331 (tag: refs/tags/psad-2.3-pre1)
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Mon Jun 11 20:58:36 2012 -0400
-
-    bumped version to psad-2.3-pre1
-
- VERSION |    2 +-
- nf2csv  |    2 +-
- psad    |    4 ++--
- 3 files changed, 4 insertions(+), 4 deletions(-)
-
-commit 99ac4ab1eed310adbe4d24bdee9b67ee6dfb7905
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Mon Jun 11 20:56:19 2012 -0400
-
-    minor comment wording update w.r.t. SYSLOG_DAEMON usage
-
- psad.conf |    4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-commit e5ada77ddf8dbec564fee5e50734460e28b5a185
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Mon Jun 11 20:55:50 2012 -0400
-
-    INSTALL_ROOT resolution bug fix (found by Kat)
-
- CREDITS  |    4 ++++
- kmsgsd.c |   20 ++++++++++++++++++++
- 2 files changed, 24 insertions(+)
-
-commit 8dedbcad794e3b539f2df202feb8a15b50e6e75a
-Author: Michael Rash <mbr@cipherdyne.org>
-Date:   Sat May 26 21:30:50 2012 -0400
-
-    removed legacy psadwatchd.conf file references
-
- packaging/psad-nodeps.spec            |    4 +---
- packaging/psad-require-makemaker.spec |    4 +---
- packaging/psad.spec                   |    4 +---
- 3 files changed, 3 insertions(+), 9 deletions(-)
+    Nicholas-Ritter reported a bug in psad-2.2.1 where the protocols file is not
+    bundled with the psad RPM's or included in the psad RPM .spec files.
+
+ CREDITS                               | 4 ++++
+ ChangeLog                             | 3 +++
+ packaging/psad-nodeps.spec            | 2 ++
+ packaging/psad-require-makemaker.spec | 2 ++
+ packaging/psad.ebuild                 | 2 +-
+ packaging/psad.spec                   | 2 ++
+ 6 files changed, 14 insertions(+), 1 deletion(-)