mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 12:34:38 +00:00
62e8631f2b
* docs: spec — Sentinel C2/botnet auto-learning (high-precision, report-only) (ref #823) * docs: implementation plan — Sentinel C2/botnet auto-learning (ref #823) * feat(sentinel): C2 autolearn false-positive allowlist gate (ref #826) * fix(sentinel): serialize c2allow Add + robust atomicWriteFile (relative-path + temp cleanup) (ref #826) * feat(sentinel): C2 autolearn corroborating signals (rare/non-browser-JA/DGA) (ref #826) * feat(sentinel): C2 autolearn candidate lifecycle + persistence (ref #826) * fix(sentinel): c2cand deep-copy snapshots (persist/snapshot/record race) + evict order + device cap (ref #826) * feat(sentinel): C2 autolearn orchestrator — learned set + report-only verdicts (ref #826) * feat(sentinel): wire C2 learner into daemon + /c2 endpoints + seeded allowlist (ref #826) * fix(sentinel): make /c2/allow writable in packaged deploy (RW path + ownership) + sanitize Add (ref #826) POST /c2/allow could never write in production: sbx-sentinel.service runs User=secubox-toolbox under ProtectSystem=strict + ReadOnlyPaths=/etc/secubox, and the seeded c2-allow.txt ships root:root. Fix both halves: nest ReadWritePaths=/etc/secubox/sentinel under the existing ReadOnlyPaths=/etc/secubox in the unit, and chown/chmod 0750 the sentinel/ subdir + file (never the shared /etc/secubox parent) in postinst's configure branch, fail-safe. Also: fix the /c2/allow doc comment (form/query only, not JSON — r.FormValue never parses a body), and sanitize C2Allow.Add against newline injection now that host is network-reachable. * feat(toolbox): WebUI C2 appris sub-view + Ignorer allowlist proxy (ref #826) * fix(toolbox): C2 view XSS (data-host not onclick) + normalize candidate signal maps (ref #826) * fix(sentinel): bound c2 beaconing/learned maps + drop promoted from candidates + reject bare-TLD allow (ref #826) --------- Co-authored-by: CyberMind-FR <gandalf@Gk2.net> |
||
|---|---|---|
| .. | ||
| 2026-04-21-eye-remote-integration-design.md | ||
| 2026-04-23-eye-remote-bootstrap-design.md | ||
| 2026-04-24-eye-remote-touchscreen-controller-design.md | ||
| 2026-04-26-eye-remote-swiss-army-design.md | ||
| 2026-05-02-haproxy-webui-enhancement-design.md | ||
| 2026-05-03-mitmproxy-waf-migration-design.md | ||
| 2026-05-05-openwrt-to-debian-migration-design.md | ||
| 2026-05-10-meta-script-generator-design.md | ||
| 2026-05-11-secubox-apt-clone-design.md | ||
| 2026-05-12-apt-public-repo-staging-design.md | ||
| 2026-05-12-gitea-repair-design.md | ||
| 2026-05-12-license-headers-design.md | ||
| 2026-05-12-metablog-gitea-ingest-design.md | ||
| 2026-05-12-metablog-site-schema-design.md | ||
| 2026-05-12-metablog-version-dashboard-design.md | ||
| 2026-05-12-multi-agent-worktree-workflow-design.md | ||
| 2026-05-12-opad-doctrine-design.md | ||
| 2026-05-12-ssl-health-banner-design.md | ||
| 2026-05-12-streamlit-gitea-version-pinning-design.md | ||
| 2026-05-12-visitor-origin-feed-design.md | ||
| 2026-05-12-webui-obfuscation-design.md | ||
| 2026-05-13-eye-square-phase3-python-kiosk-design.md | ||
| 2026-05-13-eye-square-variant-design.md | ||
| 2026-05-13-metablog-deploy-webhook-design.md | ||
| 2026-05-13-secubox-users-auth-design.md | ||
| 2026-05-13-task18-regression-gate-report.txt | ||
| 2026-05-14-converged-dashboard-design.md | ||
| 2026-05-15-mail-phase2-rspamd-design.md | ||
| 2026-05-15-mail-stack-architecture-design.md | ||
| 2026-05-16-eye-remote-multi-gadget-dhcp-pairing-design.md | ||
| 2026-05-18-dropletctl-design.md | ||
| 2026-05-20-secubox-iot-hub-webui.md | ||
| 2026-05-20-secubox-sentinelle-gsm.md | ||
| 2026-05-20-secubox-sso-bridge.md | ||
| 2026-05-20-secubox-wall-ep06.md | ||
| 2026-05-20-secubox-zigbee-mqtt-iot-stack.md | ||
| 2026-06-16-security-posture-rewrite-design.md | ||
| 2026-06-16-toolbox-ttfb-stream-inject-design.md | ||
| 2026-06-17-anti-track-v2-plan2a-learning-design.md | ||
| 2026-06-17-anti-track-v2-plan2b-dns-design.md | ||
| 2026-06-17-anti-track-v2-plan2b-enforcement-design.md | ||
| 2026-06-17-anti-track-v2-plan2c-bypass-seed-design.md | ||
| 2026-06-17-anti-track-v2-plan2d-social-top5-design.md | ||
| 2026-06-17-anti-tracking-v2-design.md | ||
| 2026-06-17-banner-stream-inject-csp-r3-fix-design.md | ||
| 2026-06-17-haproxy-vhost-auto-discovery-design.md | ||
| 2026-06-17-social-ip-literal-fix-design.md | ||
| 2026-06-17-toolbox-clients-reset-all-and-emojis-design.md | ||
| 2026-06-18-ad-intelligence.md | ||
| 2026-06-18-hub-dashboard-latency-design.md | ||
| 2026-06-18-mitm-engine-migration-analysis.md | ||
| 2026-06-18-mitm-engine-phase2-bench.md | ||
| 2026-06-18-toolbox-selective-sni-splice.md | ||
| 2026-06-18-waf-engine-migration-analysis.md | ||
| 2026-06-19-kbin-tor-anonymized-surfing-design.md | ||
| 2026-06-26-cookies-crosssite-trackers-design.md | ||
| 2026-06-26-waf-go-sbxwaf-design.md | ||
| 2026-06-27-nft-based-network-stats-design.md | ||
| 2026-06-27-sw-neuter-targeted-autolearn-design.md | ||
| 2026-06-29-gondwana-phase1-mesh-substrate-design.md | ||
| 2026-06-29-secubox-appstore-module-manager-sketch.md | ||
| 2026-06-30-annuaire-miroir-trust-substrate-design.md | ||
| 2026-06-30-macro-subsystem-tor-exit-design.md | ||
| 2026-06-30-p2p-annuaire-service-registry-design.md | ||
| 2026-07-02-p2p-dht-federation-masterlink-design.md | ||
| 2026-07-02-toolbox-cert-mismatch-warn-design.md | ||
| 2026-07-03-rapport-kbin-media-types-design.md | ||
| 2026-07-03-secubox-proxypac-mesh-routing-design.md | ||
| 2026-07-04-media-buffer-design.md | ||
| 2026-07-04-mesh-federate-exclusion-lists-design.md | ||
| 2026-07-04-pdf-character-sheet-design.md | ||
| 2026-07-04-peertube-webui-admin-ops-design.md | ||
| 2026-07-04-vhost-exposure-switch-design.md | ||
| 2026-07-06-frigate-foundation-design.md | ||
| 2026-07-06-sbxmitm-sentinel-design.md | ||
| 2026-07-06-sentinel-activation-toolbox-tab-design.md | ||
| 2026-07-07-sentinel-c2-autolearn-design.md | ||