45f8acb24a
Poll-based host intrusion-detection daemon modeled on freeze-watcher's sample→trigger→snapshot→classify loop, with security signatures instead of performance ones: - reverse_shell (interpreter with a network socket on stdio) - ld_preload (/etc/ld.so.preload or LD_PRELOAD in writable dirs) - deleted_exe (process running from a deleted/memfd binary) - new_listener (listening port absent from startup baseline) - new_suid (new SUID/SGID binary; critical in writable dirs) - persistence (cron/systemd/authorized_keys/rc-file changes) - suspicious_egress (interpreter holding an outbound public connection) Each capture writes a forensic snapshot with per-signature incident- response guidance. Includes a safe, self-cleaning red-team harness (sentinel-redteam), hardened systemd unit, config, Makefile, and Arch packaging. Tested on Arch: detectors fire on drills, no false positives on a clean sweep, sweep cost optimized from ~15s to ~1s via batched syscalls and a gated filesystem-wide SUID scan. This bash implementation is retained as the regression oracle for the forthcoming Python rewrite. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
53 lines
1.6 KiB
Makefile
53 lines
1.6 KiB
Makefile
PREFIX ?= /usr/local
|
|
BINDIR := $(PREFIX)/bin
|
|
SYSTEMDDIR := /etc/systemd/system
|
|
CONFDIR := /etc
|
|
LOGDIR := /var/log/enodia-sentinel
|
|
|
|
.PHONY: install uninstall enable disable status logs check baseline drill clean
|
|
|
|
install:
|
|
install -Dm755 src/sentinel.sh $(DESTDIR)$(BINDIR)/sentinel.sh
|
|
install -Dm755 src/sentinel-redteam $(DESTDIR)$(BINDIR)/sentinel-redteam
|
|
install -Dm644 systemd/enodia-sentinel.service $(DESTDIR)$(SYSTEMDDIR)/enodia-sentinel.service
|
|
@if [ ! -e "$(DESTDIR)$(CONFDIR)/enodia-sentinel.conf" ]; then \
|
|
install -Dm644 config/enodia-sentinel.conf $(DESTDIR)$(CONFDIR)/enodia-sentinel.conf; \
|
|
echo "Installed default config at $(CONFDIR)/enodia-sentinel.conf"; \
|
|
else \
|
|
install -Dm644 config/enodia-sentinel.conf $(DESTDIR)$(CONFDIR)/enodia-sentinel.conf.new; \
|
|
echo "Existing config preserved; new template at $(CONFDIR)/enodia-sentinel.conf.new"; \
|
|
fi
|
|
install -dm750 $(DESTDIR)$(LOGDIR)
|
|
@echo "Installed. Run 'sudo make enable' to start the service."
|
|
|
|
uninstall:
|
|
rm -f $(DESTDIR)$(BINDIR)/sentinel.sh
|
|
rm -f $(DESTDIR)$(BINDIR)/sentinel-redteam
|
|
rm -f $(DESTDIR)$(SYSTEMDDIR)/enodia-sentinel.service
|
|
rm -f $(DESTDIR)$(CONFDIR)/enodia-sentinel.conf.new
|
|
@echo "Uninstalled. Config and logs preserved."
|
|
|
|
enable:
|
|
systemctl daemon-reload
|
|
systemctl enable --now enodia-sentinel.service
|
|
|
|
disable:
|
|
systemctl disable --now enodia-sentinel.service
|
|
|
|
status:
|
|
systemctl status enodia-sentinel.service --no-pager
|
|
|
|
logs:
|
|
journalctl -u enodia-sentinel.service -f
|
|
|
|
check:
|
|
sentinel.sh --check
|
|
|
|
baseline:
|
|
sentinel.sh --baseline
|
|
|
|
drill:
|
|
sentinel-redteam
|
|
|
|
clean:
|
|
@echo "Nothing to clean (no build artifacts)."
|