luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add platform docs; reposition as host security platform

Browse source 
Add docs/ (SPECIFICATION, ROADMAP, OPERATIONS, COMMAND_REFERENCE,
THREAT_MODEL) describing the current v0.7 agent and the phased path from
local HIDS to a host security platform. Reframe README, package metadata,
and CLI/module descriptions from "intrusion-detection daemon" to "Linux
host security platform", and surface the v0.7 signed-package verify
(pkgdb_pkgverify*) and anti-rootkit (rootcheck_*) knobs in the sample
config. Also wrap the pacman.conf read in pkgdb.siglevel_alert in a
context manager to avoid a leaked file handle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Luna 2026-06-10 04:03:06 -07:00
parent 1de5e86fed
commit 6ff2087329
11 changed files with 930 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

14
config/enodia-sentinel.toml
View file

@ -74,10 +74,24 @@ fim_pkg_verify_interval = 21600 # seconds between package verifications
pkgdb_verify = true
pkgdb_interval = 600 # seconds between DB integrity checks
heartbeat_max_age = 120 # daemon heartbeat older than this = stale/silent
# Layer 2: compare on-disk files to hashes in cached signed packages. This
# survives a rewritten local package DB, but needs a populated package cache and
# costs untar+hash work, so it samples packages on a slow cadence.
pkgdb_pkgverify = false
pkgdb_pkgverify_interval = 21600 # seconds between signed-package passes
pkgdb_pkgverify_sample = 40 # packages verified per pass (rotates)
# Sentinel's own binaries/config/units/hook are always FIM-watched (self-
# integrity). For real teeth, make them immutable: chattr +i <path>
# and run an external `enodia-sentinel watchdog` against this host's dashboard.
# --- anti-rootkit cross-view --------------------------------------------
# Ask the same question two ways and diff the answers: kill(0) vs /proc for
# hidden processes, /sys/module vs /proc/modules for hidden LKMs, /proc/net/tcp
# vs ss for hidden listeners, and interface flags for promiscuous sniffing.
rootcheck_enabled = true
rootcheck_interval = 300 # seconds between cross-view sweeps
rootcheck_pid_cap = 65536 # upper PID to brute-force via kill(0)
# --- eBPF event layer ----------------------------------------------------
# Event-driven execve monitor: catches short-lived processes the poll loop
# misses, matched against the Snort-style rule engine. Requires python-bpfcc