45f8acb24a
Poll-based host intrusion-detection daemon modeled on freeze-watcher's sample→trigger→snapshot→classify loop, with security signatures instead of performance ones: - reverse_shell (interpreter with a network socket on stdio) - ld_preload (/etc/ld.so.preload or LD_PRELOAD in writable dirs) - deleted_exe (process running from a deleted/memfd binary) - new_listener (listening port absent from startup baseline) - new_suid (new SUID/SGID binary; critical in writable dirs) - persistence (cron/systemd/authorized_keys/rc-file changes) - suspicious_egress (interpreter holding an outbound public connection) Each capture writes a forensic snapshot with per-signature incident- response guidance. Includes a safe, self-cleaning red-team harness (sentinel-redteam), hardened systemd unit, config, Makefile, and Arch packaging. Tested on Arch: detectors fire on drills, no false positives on a clean sweep, sweep cost optimized from ~15s to ~1s via batched syscalls and a gated filesystem-wide SUID scan. This bash implementation is retained as the regression oracle for the forthcoming Python rewrite. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
50 lines
2.8 KiB
Text
50 lines
2.8 KiB
Text
# Enodia Sentinel configuration
|
|
# Sourced by /usr/local/bin/sentinel.sh at startup (bash variable assignments).
|
|
# Restart after editing: sudo systemctl restart enodia-sentinel.service
|
|
|
|
# --- timing --------------------------------------------------------------
|
|
SAMPLE_INTERVAL=4 # seconds between detector sweeps
|
|
COOLDOWN=60 # min seconds before re-alerting the same signature
|
|
BASELINE_GRACE=10 # seconds after start before new-listener/suid arm
|
|
SUID_REFRESH=3600 # seconds between SUID baseline refreshes
|
|
SUID_SCAN_INTERVAL=60 # seconds between filesystem-wide SUID scans (expensive)
|
|
|
|
# --- detector toggles (1 = on, 0 = off) ----------------------------------
|
|
DET_REVERSE_SHELL=1 # shell/interpreter with a socket on stdio
|
|
DET_LD_PRELOAD=1 # ld.so.preload rootkit / LD_PRELOAD in temp dirs
|
|
DET_DELETED_EXE=1 # process running from deleted/memfd binary
|
|
DET_NEW_LISTENER=1 # listening port not present at baseline
|
|
DET_NEW_SUID=1 # new SUID/SGID binary
|
|
DET_PERSISTENCE=1 # cron/systemd/authorized_keys/rc file changes
|
|
DET_EGRESS=1 # interpreter with outbound conn to public IP
|
|
|
|
# --- tuning --------------------------------------------------------------
|
|
# Process names treated as "interpreters" for reverse-shell / egress checks.
|
|
INTERPRETERS="bash sh dash zsh ksh ash nc ncat netcat socat telnet python python2 python3 perl ruby php lua awk"
|
|
|
|
# Trusted public CIDRs that should NOT trip the egress detector (your VPS,
|
|
# your VPN exit, monitoring endpoints, etc.). Space separated.
|
|
EGRESS_ALLOW_CIDRS=""
|
|
|
|
# Listener ports that never alert even if they appear after baseline.
|
|
LISTENER_ALLOW_PORTS=""
|
|
|
|
# Dirs where any SUID binary is treated as CRITICAL (attacker-writable).
|
|
SUID_HOT_DIRS="/tmp /dev/shm /var/tmp /home /run/user"
|
|
|
|
# Persistence files/dirs to watch for modification (globs ok).
|
|
# Append the red-team sandbox here to test the persistence drill safely.
|
|
WATCH_PERSISTENCE="/etc/cron.d /etc/crontab /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /var/spool/cron /etc/systemd/system /etc/ld.so.preload /etc/passwd /etc/sudoers /etc/sudoers.d /root/.ssh/authorized_keys /root/.bashrc /root/.profile"
|
|
|
|
# --- eBPF on-ramp --------------------------------------------------------
|
|
# Run a 3s bpftrace execve trace inside each snapshot to catch short-lived
|
|
# processes that polling misses. Requires the 'bpftrace' package.
|
|
CAPTURE_EXECVE_BPFTRACE=0
|
|
|
|
# --- retention -----------------------------------------------------------
|
|
MAX_SNAPSHOTS=300 # auto-delete oldest beyond this (0 = no cap)
|
|
MAX_SNAPSHOT_AGE_DAYS=60 # auto-delete older than this (0 = no age cap)
|
|
|
|
# --- notifications -------------------------------------------------------
|
|
NOTIFY_USERS="" # e.g. "luna" — desktop notify-send on alert
|
|
NOTIFY_URGENCY=critical # low / normal / critical
|