secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
270f655d3a
secubox-deb/packages/secubox-mitmproxy
History
CyberMind-FR 6efac89d49 feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496) 
Aggregate live result on gk2 :
  - journald disk    : 1.3 GB → 176 MB    (-86%)
  - Free memory      : 241 MB → 524 MB    (+283 MB)
  - Running LXCs     : 16 → 13 (yacy/horde/rustdesk stopped + autostart=0)
  - 13 LXCs with memory.max cap + swap.max=0 (5.5 GB total budget on 8 GB host)
  - mitm-wg + mitm   : RuntimeMaxSec=6h (clean restart drops ~50 MB/process)
  - mitm-wg launcher : --set http2=false (HTTP/2 multiplex state retention)

## Source artifacts

### P5 — journald rotation
  packages/secubox-mitmproxy/systemd/journald.conf.d/90-secubox-rotation.conf
    SystemMaxUse=200M, MaxRetentionSec=2week, ForwardToSyslog=no
  postinst : install file + 'journalctl --vacuum-size=200M' + restart journald

### P3 — mitm http2=false + RuntimeMaxSec drop-ins
  packages/secubox-toolbox/sbin/secubox-toolbox-mitm-wg-launch (modified)
    --set http2=false ajouté aux ARGS
  packages/secubox-toolbox/systemd/secubox-toolbox-mitm.service.d/10-runtime-max.conf (NEW)
  packages/secubox-toolbox/systemd/secubox-toolbox-mitm-wg.service.d/10-runtime-max.conf (NEW)
    [Service] RuntimeMaxSec=6h
  packages/secubox-mitmproxy/systemd/system/{...}/10-runtime-max.conf
    same drop-ins shipped via mitmproxy package (covers LXC-side WAF)
  debian/rules of both packages : install drop-ins

### P4 — per-LXC memory budget
  packages/secubox-mitmproxy/bin/secubox-apply-lxc-memory-budget (NEW, 755)
    Idempotent script : applies memory.max + swap.max=0 LIVE and persists
    in /var/lib/lxc/<name>/config. 16 LXCs covered with realistic budgets
    (5.5 GB total / 8 GB host, leaves 2.5 GB for host).
  postinst : runs it if installed (LXC-aware install).

### P6 — operator decision, not auto-applied
  Stop yacy/horde/rustdesk + autostart=0 was done LIVE on gk2 but is an
  operator preference, NOT a package decision. Documented in
  .claude/PHASE-6.P-MEMORY-OPTIMIZATION.md as 'optional stop unused LXCs'.

## What's NOT in this commit (kept for future sessions)

### P2 — secubox_toolbox FastAPI diet (~50 MB)
  Lazy-load Jinja2 templates, lazy-import dpi_class, tune uvicorn workers.
  Needs careful per-route testing.

### P1 — ASGI consolidation (~840 MB)
  New 'secubox-aggregator' package mounts 15 module FastAPIs as sub-apps
  under a single uvicorn. Biggest gain but architectural change ; do
  after Phase 7.C lands and the WAF stack is stable.

## Files

  Modified :
    packages/secubox-mitmproxy/debian/postinst
    packages/secubox-mitmproxy/debian/rules
    packages/secubox-toolbox/debian/rules
    packages/secubox-toolbox/sbin/secubox-toolbox-mitm-wg-launch
  Created :
    packages/secubox-mitmproxy/bin/secubox-apply-lxc-memory-budget
    packages/secubox-mitmproxy/systemd/journald.conf.d/90-secubox-rotation.conf
    packages/secubox-mitmproxy/systemd/system/secubox-toolbox-mitm.service.d/10-runtime-max.conf
    packages/secubox-mitmproxy/systemd/system/secubox-toolbox-mitm-wg.service.d/10-runtime-max.conf
    packages/secubox-toolbox/systemd/secubox-toolbox-mitm.service.d/10-runtime-max.conf
    packages/secubox-toolbox/systemd/secubox-toolbox-mitm-wg.service.d/10-runtime-max.conf
2026-06-06 07:37:21 +02:00
..
addons feat(secubox-mitmproxy): Phase 7.A WAF→CrowdSec bridge — alerts push → nft drop (ref #498) 2026-06-05 17:08:35 +02:00
api feat(secubox-mitmproxy): Phase 7.A.2 + 7.B — WAF backport + dashboard + rate-limit + honeypot (ref #498) 2026-06-05 17:23:00 +02:00
bin feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496) 2026-06-06 07:37:21 +02:00
crowdsec feat(secubox-mitmproxy): Phase 7.A WAF→CrowdSec bridge — alerts push → nft drop (ref #498) 2026-06-05 17:08:35 +02:00
data feat(mitmproxy): Add configuration files and WAF rules 2026-05-03 08:11:03 +02:00
debian feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496) 2026-06-06 07:37:21 +02:00
menu.d feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
nftables feat(secubox-mitmproxy): Phase 7.A.2 + 7.B — WAF backport + dashboard + rate-limit + honeypot (ref #498) 2026-06-05 17:23:00 +02:00
nginx feat(secubox-mitmproxy): Phase 7.A.2 + 7.B — WAF backport + dashboard + rate-limit + honeypot (ref #498) 2026-06-05 17:23:00 +02:00
sysctl feat(secubox-mitmproxy): Phase 6.O — kernel + memory + network perf tuning (ref #496) 2026-06-06 07:17:29 +02:00
systemd feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496) 2026-06-06 07:37:21 +02:00
tests feat: cookie audit pipeline (RGPD / ePrivacy reconciler) (#159) 2026-05-16 13:53:40 +02:00
tmpfiles.d feat(secubox-mitmproxy): Phase 6.O — kernel + memory + network perf tuning (ref #496) 2026-06-06 07:17:29 +02:00
www/mitmproxy feat(secubox-mitmproxy): Phase 7.A.2 + 7.B — WAF backport + dashboard + rate-limit + honeypot (ref #498) 2026-06-05 17:23:00 +02:00
README.md feat: cookie audit pipeline (RGPD / ePrivacy reconciler) (#159) 2026-05-16 13:53:40 +02:00

README.md

🔍 MITM Proxy

Traffic inspection and WAF proxy with auto-ban

Category: Security

Screenshot

MITM Proxy

Features

  • Traffic inspection
  • Request logging
  • Auto-ban
  • SSL interception

Installation

# Add SecuBox repository
curl -fsSL https://apt.secubox.in/install.sh | sudo bash

# Install package
sudo apt install secubox-mitmproxy

Configuration

Configuration file: /etc/secubox/mitmproxy.toml

API Endpoints

  • GET /api/v1/mitmproxy/status - Module status
  • GET /api/v1/mitmproxy/health - Health check

Addons

secubox_waf.py

Inspects every HTTP response in transit, applies the SecuBox WAF ruleset and injects the health-banner + cookie-inventory bootstrap script before </body> on text/html responses. Domain allow/exclude lists configurable via [cdn].

cookie_audit.py (issue #156)

Companion to the WAF addon. Captures every Set-Cookie header observed in transit and appends a structured JSONL record to /var/log/secubox/cookie-audit/server.jsonl. Cookie values are sha256-hashed at the addon — the raw value never leaves the process.

Register both addons together:

mitmdump -s /usr/share/secubox/addons/secubox_waf.py \
         -s /usr/share/secubox/addons/cookie_audit.py

The companion browser script shared/cookie-inventory.js (loaded via the WAF banner injection) snapshots document.cookie and posts to /api/v1/cookie-audit/ingest. The secubox-metrics CookieAuditAggregator reconciles both streams and flags RGPD/ePrivacy violations (JS-set, non-strictly-necessary cookies).

Enable via [cookie_audit] enabled = true in /etc/secubox/secubox.conf.

License

MIT License - CyberMind © 2024-2026