Enodia Sentinel v0.1 — bash host-IDS prototype

Poll-based host intrusion-detection daemon modeled on freeze-watcher's
sample→trigger→snapshot→classify loop, with security signatures instead
of performance ones:

- reverse_shell  (interpreter with a network socket on stdio)
- ld_preload     (/etc/ld.so.preload or LD_PRELOAD in writable dirs)
- deleted_exe    (process running from a deleted/memfd binary)
- new_listener   (listening port absent from startup baseline)
- new_suid       (new SUID/SGID binary; critical in writable dirs)
- persistence    (cron/systemd/authorized_keys/rc-file changes)
- suspicious_egress (interpreter holding an outbound public connection)

Each capture writes a forensic snapshot with per-signature incident-
response guidance. Includes a safe, self-cleaning red-team harness
(sentinel-redteam), hardened systemd unit, config, Makefile, and Arch
packaging.

Tested on Arch: detectors fire on drills, no false positives on a clean
sweep, sweep cost optimized from ~15s to ~1s via batched syscalls and a
gated filesystem-wide SUID scan.

This bash implementation is retained as the regression oracle for the
forthcoming Python rewrite.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/enodia-sentinel.conf

@@ -0,0 +1,50 @@
+# Enodia Sentinel configuration
+# Sourced by /usr/local/bin/sentinel.sh at startup (bash variable assignments).
+# Restart after editing:  sudo systemctl restart enodia-sentinel.service
+
+# --- timing --------------------------------------------------------------
+SAMPLE_INTERVAL=4          # seconds between detector sweeps
+COOLDOWN=60                # min seconds before re-alerting the same signature
+BASELINE_GRACE=10          # seconds after start before new-listener/suid arm
+SUID_REFRESH=3600          # seconds between SUID baseline refreshes
+SUID_SCAN_INTERVAL=60      # seconds between filesystem-wide SUID scans (expensive)
+
+# --- detector toggles (1 = on, 0 = off) ----------------------------------
+DET_REVERSE_SHELL=1        # shell/interpreter with a socket on stdio
+DET_LD_PRELOAD=1           # ld.so.preload rootkit / LD_PRELOAD in temp dirs
+DET_DELETED_EXE=1          # process running from deleted/memfd binary
+DET_NEW_LISTENER=1         # listening port not present at baseline
+DET_NEW_SUID=1             # new SUID/SGID binary
+DET_PERSISTENCE=1          # cron/systemd/authorized_keys/rc file changes
+DET_EGRESS=1               # interpreter with outbound conn to public IP
+
+# --- tuning --------------------------------------------------------------
+# Process names treated as "interpreters" for reverse-shell / egress checks.
+INTERPRETERS="bash sh dash zsh ksh ash nc ncat netcat socat telnet python python2 python3 perl ruby php lua awk"
+
+# Trusted public CIDRs that should NOT trip the egress detector (your VPS,
+# your VPN exit, monitoring endpoints, etc.). Space separated.
+EGRESS_ALLOW_CIDRS=""
+
+# Listener ports that never alert even if they appear after baseline.
+LISTENER_ALLOW_PORTS=""
+
+# Dirs where any SUID binary is treated as CRITICAL (attacker-writable).
+SUID_HOT_DIRS="/tmp /dev/shm /var/tmp /home /run/user"
+
+# Persistence files/dirs to watch for modification (globs ok).
+# Append the red-team sandbox here to test the persistence drill safely.
+WATCH_PERSISTENCE="/etc/cron.d /etc/crontab /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /var/spool/cron /etc/systemd/system /etc/ld.so.preload /etc/passwd /etc/sudoers /etc/sudoers.d /root/.ssh/authorized_keys /root/.bashrc /root/.profile"
+
+# --- eBPF on-ramp --------------------------------------------------------
+# Run a 3s bpftrace execve trace inside each snapshot to catch short-lived
+# processes that polling misses. Requires the 'bpftrace' package.
+CAPTURE_EXECVE_BPFTRACE=0
+
+# --- retention -----------------------------------------------------------
+MAX_SNAPSHOTS=300          # auto-delete oldest beyond this (0 = no cap)
+MAX_SNAPSHOT_AGE_DAYS=60   # auto-delete older than this (0 = no age cap)
+
+# --- notifications -------------------------------------------------------
+NOTIFY_USERS=""            # e.g. "luna" — desktop notify-send on alert
+NOTIFY_URGENCY=critical    # low / normal / critical