b21b2000d8
mitmproxyctl is SecuBox's third routing verb, parallel to:
haproxyctl vhost add/remove (routing layer)
giteactl user add/remove (identity layer)
mitmproxyctl route add/remove (interception layer) ← new
Without this verb, every WAF route change required hand-editing
/srv/mitmproxy/haproxy-routes.json + manual restart. The interception
organ existed but could not be commanded.
Changes:
* Defaults now match board reality:
CONTAINER_NAME : "mitmproxy-waf" -> "mitmproxy"
LXC_PATH : "/var/lib/lxc" -> "/data/lxc"
All overridable via [container] in /etc/secubox/mitmproxy.toml.
* Added --config flag to load any TOML.
* New `route` subcommand:
mitmproxyctl route list
mitmproxyctl route add HOST IP PORT [--no-restart]
mitmproxyctl route remove HOST [--no-restart]
Atomic writes via .tmp + replace, mirror to the LXC-rootfs copy of
haproxy-routes.json automatically, restart prefers in-LXC systemd
`mitmproxy.service` reload over full container bounce.
* `restart` is now reload-friendly when an in-LXC systemd unit exists
(the common case on the live board); falls back to stop+start otherwise.
* `logs` reads via `journalctl -u mitmproxy` in-LXC (was `tail` on a
file path that didn't exist in practice).
After this lands, the gitea WAF unbypass (done by hand today during the
#156 cascade) reduces to:
haproxyctl vhost add gitea.gk2.secubox.in mitmproxy_inspector ssl
mitmproxyctl route add gitea.gk2.secubox.in 192.168.1.200 9080
Three verbs, three layers, one operation. The grammar closes.
Out of scope (separate ticket): the package's debian/postinst still
assumes host-installed mitmproxy under /srv/mitmproxy-waf/, while the
modern board runs the LXC topology this ctl now targets. That refactor
will follow as a postinst -> LXC-bootstrap migration similar to mailctl.
Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| addons | ||
| api | ||
| bin | ||
| crowdsec | ||
| data | ||
| debian | ||
| menu.d | ||
| nginx | ||
| tests | ||
| www/mitmproxy | ||
| README.md | ||
🔍 MITM Proxy
Traffic inspection and WAF proxy with auto-ban
Category: Security
Screenshot
Features
- Traffic inspection
- Request logging
- Auto-ban
- SSL interception
Installation
# Add SecuBox repository
curl -fsSL https://apt.secubox.in/install.sh | sudo bash
# Install package
sudo apt install secubox-mitmproxy
Configuration
Configuration file: /etc/secubox/mitmproxy.toml
API Endpoints
GET /api/v1/mitmproxy/status- Module statusGET /api/v1/mitmproxy/health- Health check
Addons
secubox_waf.py
Inspects every HTTP response in transit, applies the SecuBox WAF ruleset
and injects the health-banner + cookie-inventory bootstrap script before
</body> on text/html responses. Domain allow/exclude lists configurable
via [cdn].
cookie_audit.py (issue #156)
Companion to the WAF addon. Captures every Set-Cookie header observed in
transit and appends a structured JSONL record to
/var/log/secubox/cookie-audit/server.jsonl. Cookie values are
sha256-hashed at the addon — the raw value never leaves the process.
Register both addons together:
mitmdump -s /usr/share/secubox/addons/secubox_waf.py \
-s /usr/share/secubox/addons/cookie_audit.py
The companion browser script shared/cookie-inventory.js (loaded via the
WAF banner injection) snapshots document.cookie and posts to
/api/v1/cookie-audit/ingest. The secubox-metrics
CookieAuditAggregator reconciles both streams and flags RGPD/ePrivacy
violations (JS-set, non-strictly-necessary cookies).
Enable via [cookie_audit] enabled = true in /etc/secubox/secubox.conf.
License
MIT License - CyberMind © 2024-2026