secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
270f655d3a
secubox-deb/packages/secubox-avatar
History
CyberMind-FR e67baf4cd7 feat(secubox-core+5modules+toolbox): Phase 2c receiving modules enrichment (ref #490) 
Phase 2b (#488/#489) wired mitm addons to 5 receiving modules but events
were persisted raw. This phase implements actual enrichment in each module
via the enrich_hook param, plus aggregator merge so reports show meaningful
data (YouTube/Signal/iPhone/Safari/JA4 fingerprints) instead of raw bytes.

  - host_app.py  : 60+ host patterns -> app + category + emoji
  - cookie.py    : 40+ cookie tracker patterns -> provider + category + emoji
  - avatar.py    : UA + Client Hints -> device + browser + OS + emoji
  - ja4.py       : NEW. Deterministic JA4-style fingerprint hash from
                   cipher_suites + alpn + extensions. Lookup table for
                   known JA4 fingerprints (empty for now, Phase 3 will
                   populate). 12-char hex (SHA256 truncated).

The host_app/cookie/avatar are copies of the secubox-toolbox classifiers
moved to secubox-core so all 5 receiving modules can import them. The
secubox-toolbox-local ones stay as-is to avoid breaking changes — Phase 3
will consolidate.

  - secubox-dpi             : host/SNI -> {app, category, emoji}
  - secubox-cookies         : cookie names -> {providers{}, categories{}}
  - secubox-avatar          : UA + CH -> {device, browser, os_label}
  - secubox-threat-analyst  : ClientHello -> {ja4_fingerprint, known_client}
  - secubox-soc             : indicators -> {total_weight, band, kinds}

Each is ~25 lines, called by mount_ingest_routes BEFORE persistence.
Enriched output joins the raw event under the 'enriched' key.

_pull_mitm_module_events() now also calls _summarize_enriched(kind, events)
to consolidate per-module enrichment :

  - dpi             : top_apps[] aggregated from enriched.app counts
  - cookies         : top_providers[] from enriched.providers + tracker_total
  - avatar          : devices{} + browsers{} from enriched.{device,browser}
  - threat-analyst  : top_fingerprints[] grouped by JA4 hash
  - soc             : total_weight + max_band + indicator_kinds

These appear under mitm_modules.<kind>.enriched_summary in the /report JSON.

POST realistic payloads to all 5 sockets :
  - YouTube host -> dpi/enriched.app = 'YouTube' (streaming)
  - GA + FB Pixel cookies -> cookies/providers : GA x3, FB x1, total 4
  - iPhone Safari UA -> avatar/device='iPhone' (📱 iOS 17.4) + Safari (🧭)
  - facebook.com ClientHello -> threat-analyst/ja4 = '7175ee3a68f0'
  - 2 indicators (weight 15+25) -> soc/band='medium', total=40, kinds=[dga, suspicious]

  - secubox-dpi : call live nDPI/netifyd socket (currently pattern-match only)
  - secubox-threat-analyst : implement full FoxIO JA4 string format (currently
    deterministic SHA256 trunc which is JA4-like but not the canonical format)
  - secubox-soc : threat-intel feed lookup (currently just sums static weights)
  - secubox-avatar : screen/timing fingerprinting via WebGL hash (currently UA only)
  - Reports (PDF + HTML) : surface mitm_modules.enriched_summary in the report UI
2026-06-13 08:00:18 +02:00
..
api feat(secubox-core+5modules+toolbox): Phase 2c receiving modules enrichment (ref #490) 2026-06-13 08:00:18 +02:00
debian fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
menu.d feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
nginx fix(ci): Handle non-existent directories in build-live-usb.sh 2026-04-04 08:48:32 +02:00
www/avatar feat(avatar): add Personas tab to dashboard (ref #409) 2026-05-28 14:35:15 +02:00
README.md fix(ci): Handle non-existent directories in build-live-usb.sh 2026-04-04 08:48:32 +02:00

README.md

SecuBox Avatar - Identity Manager

Identity and avatar management module for SecuBox services.

Features

  • Unified identity management across SecuBox services
  • Avatar upload with image processing (JPG, PNG, GIF, WebP)
  • Service sync to Gitea, Nextcloud, Mail, Matrix, LDAP
  • P31 Phosphor light theme frontend
  • JWT authentication on all endpoints

API Endpoints

Public

  • GET /health - Health check

Protected (JWT required)

  • GET /identities - List all identities
  • GET /identity/{id} - Get specific identity
  • POST /identity - Create new identity
  • PUT /identity/{id} - Update identity
  • DELETE /identity/{id} - Remove identity
  • POST /avatar/upload - Upload avatar image
  • GET /avatar/{id} - Get avatar image (public)
  • DELETE /avatar/{id} - Delete avatar
  • GET /services - List connected services
  • POST /sync - Sync identity to connected services
  • GET /summary - Dashboard widget summary

Configuration

Configuration file: /etc/secubox/avatar.toml

[avatar]
max_image_size = 5242880  # 5MB

[services.gitea]
enabled = true
url = "https://git.example.com"
api_key = "secret"

[services.nextcloud]
enabled = true
url = "https://cloud.example.com"

[services.mail]
enabled = false

[services.matrix]
enabled = false

[services.ldap]
enabled = false

Data Storage

  • Identities: /var/lib/secubox/avatar/identities.json
  • Avatar images: /var/lib/secubox/avatar/images/

Dependencies

  • secubox-core (>= 1.0)
  • python3-fastapi
  • python3-pil (Pillow for image processing)

Build

cd packages/secubox-avatar
dpkg-buildpackage -us -uc -b

License

Proprietary - CyberMind ANSSI CSPN candidate