mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
62e8631f2b
* docs: spec — Sentinel C2/botnet auto-learning (high-precision, report-only) (ref #823) * docs: implementation plan — Sentinel C2/botnet auto-learning (ref #823) * feat(sentinel): C2 autolearn false-positive allowlist gate (ref #826) * fix(sentinel): serialize c2allow Add + robust atomicWriteFile (relative-path + temp cleanup) (ref #826) * feat(sentinel): C2 autolearn corroborating signals (rare/non-browser-JA/DGA) (ref #826) * feat(sentinel): C2 autolearn candidate lifecycle + persistence (ref #826) * fix(sentinel): c2cand deep-copy snapshots (persist/snapshot/record race) + evict order + device cap (ref #826) * feat(sentinel): C2 autolearn orchestrator — learned set + report-only verdicts (ref #826) * feat(sentinel): wire C2 learner into daemon + /c2 endpoints + seeded allowlist (ref #826) * fix(sentinel): make /c2/allow writable in packaged deploy (RW path + ownership) + sanitize Add (ref #826) POST /c2/allow could never write in production: sbx-sentinel.service runs User=secubox-toolbox under ProtectSystem=strict + ReadOnlyPaths=/etc/secubox, and the seeded c2-allow.txt ships root:root. Fix both halves: nest ReadWritePaths=/etc/secubox/sentinel under the existing ReadOnlyPaths=/etc/secubox in the unit, and chown/chmod 0750 the sentinel/ subdir + file (never the shared /etc/secubox parent) in postinst's configure branch, fail-safe. Also: fix the /c2/allow doc comment (form/query only, not JSON — r.FormValue never parses a body), and sanitize C2Allow.Add against newline injection now that host is network-reachable. * feat(toolbox): WebUI C2 appris sub-view + Ignorer allowlist proxy (ref #826) * fix(toolbox): C2 view XSS (data-host not onclick) + normalize candidate signal maps (ref #826) * fix(sentinel): bound c2 beaconing/learned maps + drop promoted from candidates + reject bare-TLD allow (ref #826) --------- Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
78 lines
4.4 KiB
Bash
78 lines
4.4 KiB
Bash
# SPDX-License-Identifier: LicenseRef-CMSD-1.0
|
|
# SecuBox-Deb :: Sentinel configuration (#823)
|
|
#
|
|
# EnvironmentFile shared by sbx-sentinel.service, secubox-sentinel-feeds.service,
|
|
# AND (when the operator opts in) the sbxmitm workers — the SENTINEL_* names are
|
|
# identical across all three so one file configures the whole engine.
|
|
#
|
|
# This is a dpkg conffile: local edits survive package upgrades.
|
|
|
|
# ── sbxmitm inline gate ──────────────────────────────────────────────────────
|
|
# The inline gate in the sbxmitm workers is OFF unless SENTINEL_ENABLED is truthy
|
|
# AND this file (or the same vars) is loaded by the worker unit. To turn the
|
|
# inline neutralization gate on at the #823 cutover, ALSO add these SENTINEL_*
|
|
# vars to the workers' env (/etc/secubox/toolbox-ng.env) or point that unit's
|
|
# EnvironmentFile at this file. sbx-sentinel itself ignores SENTINEL_ENABLED —
|
|
# the daemon always analyzes what it is sent.
|
|
SENTINEL_ENABLED=0
|
|
|
|
# ── Shared paths ─────────────────────────────────────────────────────────────
|
|
# Unix socket the sbxmitm workers mirror flow observations to and sbx-sentinel
|
|
# listens on. Must live under the shared /run/secubox runtime dir.
|
|
SENTINEL_MIRROR_SOCK=/run/secubox/sentinel-mirror.sock
|
|
|
|
# Shipped base IOC/YARA content pack (read-only, from this package).
|
|
SENTINEL_PACK_DIR=/usr/share/secubox/sentinel/packs/base
|
|
|
|
# Live-feed overlay dir (written by secubox-sentinel-feeds, hot-reloaded).
|
|
SENTINEL_OVERLAY_DIR=/var/lib/secubox/sentinel/overlay
|
|
|
|
# bbolt verdict store (TTL-bounded).
|
|
SENTINEL_STORE_DB=/var/lib/secubox/sentinel/verdicts.db
|
|
|
|
# Verdict retention (Go duration).
|
|
SENTINEL_TTL=72h
|
|
|
|
# ── Optional read-only status HTTP surface (sbx-sentinel) ────────────────────
|
|
# Empty = OFF (socket-only, the default). Set to a local bind (e.g. 127.0.0.1:8790)
|
|
# to expose GET /stats and /verdicts for a local operator/portal read. This is
|
|
# read-only, carries no PII beyond mac_hash, and does NOT bypass the WAF.
|
|
SENTINEL_HTTP_ADDR=
|
|
|
|
# ── YARA (optional, cgo build only) ──────────────────────────────────────────
|
|
# The default .deb ships the cgo-free YARA stub (no-op). A YARA-enabled build
|
|
# (-tags yara + libyara-dev) reads ":"-separated rule file paths from here.
|
|
SENTINEL_YARA_RULES=
|
|
|
|
# ── C2 auto-learn (#826) ──────────────────────────────────────────────────────
|
|
# Operator allowlist — hosts here are never learned as C2 (the WebUI
|
|
# "Ignorer" action appends here too). This is a dpkg conffile: local edits
|
|
# survive package upgrades.
|
|
SENTINEL_C2_ALLOW_FILE=/etc/secubox/sentinel/c2-allow.txt
|
|
|
|
# Box/vhost domains (HAProxy routes) — cross-referenced so the board's own
|
|
# exposed services are never mistaken for C2 destinations.
|
|
SENTINEL_C2_BOX_DOMAINS=/etc/secubox/waf/haproxy-routes.json
|
|
|
|
# In-progress candidate set (beaconing hosts not yet promoted to learned).
|
|
SENTINEL_C2_CANDIDATES=/var/lib/secubox/sentinel/c2-candidates.json
|
|
|
|
# Confirmed learned-C2 set (persisted, report-only re-contact detection).
|
|
SENTINEL_C2_LEARNED=/var/lib/secubox/sentinel/c2-learned.json
|
|
|
|
# Known browser JA4/JA3 fingerprints — a destination polled with one of these
|
|
# is treated as browser-driven, so the non_browser_ja corroborating signal
|
|
# does not fire for it. Empty file = signal simply never fires.
|
|
SENTINEL_C2_BROWSER_JA4=/usr/share/secubox/sentinel/browser-ja4.txt
|
|
|
|
# ── Live feed source URLs (secubox-sentinel-feeds) ───────────────────────────
|
|
# Override to pin/mirror a feed; set empty to DISABLE a feed (its last-good
|
|
# overlay is kept, never wiped).
|
|
SENTINEL_FEED_THREATFOX_URL=https://threatfox.abuse.ch/export/json/recent/
|
|
SENTINEL_FEED_FEODO_URL=https://feodotracker.abuse.ch/downloads/ipblocklist.json
|
|
SENTINEL_FEED_SSLBL_URL=https://sslbl.abuse.ch/blacklist/sslblacklist.csv
|
|
SENTINEL_FEED_MVT_URL=https://raw.githubusercontent.com/mvt-project/mvt-indicators/main/indicators/pegasus.stix2
|
|
# Citizen Lab has no single canonical machine feed — point this at a published
|
|
# STIX 2.x indicator bundle to enable it (empty = skipped).
|
|
SENTINEL_FEED_CITIZENLAB_URL=
|