diff --git a/roles/Sharingan/files/Core b/roles/Sharingan/files/Core deleted file mode 100644 index cd5ac5f..0000000 --- a/roles/Sharingan/files/Core +++ /dev/null @@ -1,9 +0,0 @@ -check program anixix-HTTP with path "/usr/lib/monitoring-plugins/check_http -H aninix.net -e 301" - if status == 1 then exec "/usr/bin/bash /etc/monit.d/scripts/notify aninix.net HTTP is CRITICAL" - -check program anixix-HTTPS with path "/usr/lib/monitoring-plugins/check_http -S -H aninix.net -e 200" - if status == 1 then exec "/usr/bin/bash /etc/monit.d/scripts/notify aninix.net HTTPS is CRITICAL" - -check program foundation-HTTPS with path "/usr/lib/monitoring-plugins/check_http -S -H foundation.aninix.net -e 200" - if status == 1 then exec "/usr/bin/bash /etc/monit.d/scripts/notify aninix.net HTTPS is CRITICAL" - diff --git a/roles/Sharingan/files/DarkNet b/roles/Sharingan/files/DarkNet deleted file mode 100644 index e69de29..0000000 diff --git a/roles/Sharingan/files/Geth-Hub-1 b/roles/Sharingan/files/Geth-Hub-1 deleted file mode 100644 index e69de29..0000000 diff --git a/roles/Sharingan/files/Geth-Hub-2 b/roles/Sharingan/files/Geth-Hub-2 deleted file mode 100644 index e69de29..0000000 diff --git a/roles/Sharingan/files/Geth-Hub-3 b/roles/Sharingan/files/Geth-Hub-3 deleted file mode 100644 index e69de29..0000000 diff --git a/roles/Sharingan/files/Maat b/roles/Sharingan/files/Maat deleted file mode 100644 index e69de29..0000000 diff --git a/roles/Sharingan/files/Nazara b/roles/Sharingan/files/Nazara deleted file mode 100644 index e69de29..0000000 diff --git a/roles/Sharingan/files/Node0 b/roles/Sharingan/files/Node0 deleted file mode 100644 index e69de29..0000000 diff --git a/roles/Sharingan/files/Sharingan b/roles/Sharingan/files/Sharingan deleted file mode 100644 index e69de29..0000000 diff --git a/roles/Sharingan/files/lynis/freshclam.service b/roles/Sharingan/files/clamav/freshclam.service similarity index 100% rename from roles/Sharingan/files/lynis/freshclam.service rename to roles/Sharingan/files/clamav/freshclam.service diff --git a/roles/Sharingan/files/lynis/freshclam.timer b/roles/Sharingan/files/clamav/freshclam.timer similarity index 100% rename from roles/Sharingan/files/lynis/freshclam.timer rename to roles/Sharingan/files/clamav/freshclam.timer diff --git a/roles/Sharingan/files/lynis/sharingan-scan.service b/roles/Sharingan/files/lynis/sharingan-scan.service new file mode 100644 index 0000000..6c7bf0d --- /dev/null +++ b/roles/Sharingan/files/lynis/sharingan-scan.service @@ -0,0 +1,16 @@ +[Unit] +Description=Sharingan-IDS | Vulnerability scanning + +[Service] +Nice=19 +IOSchedulingClass=best-effort +IOSchedulingPriority=7 +Type=simple +ExecStartPre=clamscan -r / -i --exclude-dir="/srv/ygddrasil" --exclude-dir="/dev" --exclude-dir="/sys" --exclude-dir="/proc" --exclude-dir="/media/Infected/" --exclude-dir="/etc/snort/rules" --exclude-dir="/etc/suricata/rules" +ExecStart=lynis audit system +ExecStartPost=systemd-cat -t sharingan-vulns arch-audit +User=root +group=root + +[Install] +WantedBy=multi-user.target diff --git a/roles/Sharingan/files/lynis/sharingan-vulns.timer b/roles/Sharingan/files/lynis/sharingan-scan.timer similarity index 63% rename from roles/Sharingan/files/lynis/sharingan-vulns.timer rename to roles/Sharingan/files/lynis/sharingan-scan.timer index 13cfabc..a212f63 100644 --- a/roles/Sharingan/files/lynis/sharingan-vulns.timer +++ b/roles/Sharingan/files/lynis/sharingan-scan.timer @@ -1,5 +1,5 @@ [Unit] -Description=Sharingan-IDS | rkhunter timer +Description=Sharingan-IDS | Vulnerability scanning [Timer] OnCalendar=15:00 diff --git a/roles/Sharingan/files/lynis/sharingan-vulns.service b/roles/Sharingan/files/lynis/sharingan-vulns.service deleted file mode 100644 index 819b416..0000000 --- a/roles/Sharingan/files/lynis/sharingan-vulns.service +++ /dev/null @@ -1,14 +0,0 @@ -[Unit] -Description=Sharingan-IDS | rkhunter HIDS - -[Service] -Nice=19 -IOSchedulingClass=best-effort -IOSchedulingPriority=7 -Type=simple -ExecStart=rkhunter --check --sk -User=root -group=root - -[Install] -WantedBy=multi-user.target diff --git a/roles/Sharingan/files/monit/checks/system b/roles/Sharingan/files/monit/checks/system new file mode 100644 index 0000000..cb61c72 --- /dev/null +++ b/roles/Sharingan/files/monit/checks/system @@ -0,0 +1,33 @@ +############################################################################### +## Services +############################################################################### +# +## Check general system resources such as load average, cpu and memory +## usage. Each test specifies a resource, conditions and the action to be +## performed should a test fail. +check system $HOST + if loadavg (1min) per core > 2 for 5 cycles then exec "/etc/monit.d/scripts/critical Load average is high" + if memory usage > 75% then exec "/etc/monit.d/scripts/critical Memory is overused." + if swap usage > 25% then exec "/etc/monit.d/scripts/critical Swap is overused." + group system +# +## Check filesystem permissions, uid, gid, space usage, inode usage and disk I/O. +## Other services, such as databases, may depend on this resource and an automatically +## graceful stop may be cascaded to them before the filesystem will become full and data +## lost. +check filesystem rootfs with path / + if space usage > 80% for 5 times within 15 cycles then exec "/etc/monit.d/scripts/critical Root filesystem is too full." + if read rate > 500 operations/s for 5 cycles then exec "/etc/monit.d/scripts/critical Too many reads on root filesystem." + if write rate > 500 operations/s for 5 cycles then exec "/etc/monit.d/scripts/critical Too many writes on root filesystem." + if service time > 50 milliseconds for 3 times within 5 cycles then exec "/etc/monit.d/scripts/critical Root filesystem performing slowly -- check iostat." + group system +# +## Check a network link status (up/down), link capacity changes, saturation +## and bandwidth usage. +# +# check network public with interface eth0 +# if failed link then alert +# if changed link then alert +# if saturation > 90% then alert +# if download > 10 MB/s then alert +# if total uploaded > 1 GB in last hour then alert diff --git a/roles/Sharingan/files/monit/checks/vips b/roles/Sharingan/files/monit/checks/vips new file mode 100644 index 0000000..dbfb775 --- /dev/null +++ b/roles/Sharingan/files/monit/checks/vips @@ -0,0 +1,29 @@ +check program https_aninix with path "/usr/lib/monitoring-plugins/check_http --ssl -H aninix.net" + if status != 0 then exec "/etc/monit.d/scripts/critical aninix.net not reporting OK" + +check program https_foundation with path "/usr/lib/monitoring-plugins/check_http --ssl -H foundation.aninix.net" + if status != 0 then exec "/etc/monit.d/scripts/critical foundation.aninix.net not reporting OK" + +check program https_geth with path "/usr/lib/monitoring-plugins/check_http --ssl -H geth.aninix.net" + if status != 0 then exec "/etc/monit.d/scripts/critical geth.aninix.net not reporting OK" + +check program https_lykos with path "/usr/lib/monitoring-plugins/check_http --ssl -H lykos.aninix.net" + if status != 0 then exec "/etc/monit.d/scripts/critical lykos.aninix.net not reporting OK" + +check program https_maat with path "/usr/lib/monitoring-plugins/check_http --ssl -H maat.aninix.net -r PASS" + if status != 0 then exec "/etc/monit.d/scripts/critical maat.aninix.net not reporting OK" + +check program https_password with path "/usr/lib/monitoring-plugins/check_http --ssl -H password.aninix.net" + if status != 0 then exec "/etc/monit.d/scripts/critical password.aninix.net not reporting OK" + +check program https_sharingan with path "/usr/lib/monitoring-plugins/check_http --ssl -H sharingan.aninix.net" + if status != 0 then exec "/etc/monit.d/scripts/critical sharingan.aninix.net not reporting OK" + +check program https_singularity with path "/usr/lib/monitoring-plugins/check_http --ssl -H singularity.aninix.net" + if status != 0 then exec "/etc/monit.d/scripts/critical singularity.aninix.net not reporting OK" + +check program https_wolfpack with path "/usr/lib/monitoring-plugins/check_http --ssl -H wolfpack.aninix.net" + if status != 0 then exec "/etc/monit.d/scripts/critical wolfpack.aninix.net not reporting OK" + +#check program https_yggdrasil with path "/usr/lib/monitoring-plugins/check_http --ssl -u /web/index.html -H yggdrasil.aninix.net" +# if status != 0 then exec "/etc/monit.d/scripts/critical yggdrasil.aninix.net not reporting OK" diff --git a/roles/Sharingan/files/monit/hostdefs/Core b/roles/Sharingan/files/monit/hostdefs/Core new file mode 100644 index 0000000..4229188 --- /dev/null +++ b/roles/Sharingan/files/monit/hostdefs/Core @@ -0,0 +1 @@ +include "/etc/monit.d/checks/system" diff --git a/roles/Sharingan/files/monit/hostdefs/DarkNet b/roles/Sharingan/files/monit/hostdefs/DarkNet new file mode 100644 index 0000000..4229188 --- /dev/null +++ b/roles/Sharingan/files/monit/hostdefs/DarkNet @@ -0,0 +1 @@ +include "/etc/monit.d/checks/system" diff --git a/roles/Sharingan/files/monit/hostdefs/Geth-Hub-1 b/roles/Sharingan/files/monit/hostdefs/Geth-Hub-1 new file mode 100644 index 0000000..4229188 --- /dev/null +++ b/roles/Sharingan/files/monit/hostdefs/Geth-Hub-1 @@ -0,0 +1 @@ +include "/etc/monit.d/checks/system" diff --git a/roles/Sharingan/files/monit/hostdefs/Geth-Hub-2 b/roles/Sharingan/files/monit/hostdefs/Geth-Hub-2 new file mode 100644 index 0000000..4229188 --- /dev/null +++ b/roles/Sharingan/files/monit/hostdefs/Geth-Hub-2 @@ -0,0 +1 @@ +include "/etc/monit.d/checks/system" diff --git a/roles/Sharingan/files/monit/hostdefs/Geth-Hub-3 b/roles/Sharingan/files/monit/hostdefs/Geth-Hub-3 new file mode 100644 index 0000000..4229188 --- /dev/null +++ b/roles/Sharingan/files/monit/hostdefs/Geth-Hub-3 @@ -0,0 +1 @@ +include "/etc/monit.d/checks/system" diff --git a/roles/Sharingan/files/monit/hostdefs/Maat b/roles/Sharingan/files/monit/hostdefs/Maat new file mode 100644 index 0000000..4229188 --- /dev/null +++ b/roles/Sharingan/files/monit/hostdefs/Maat @@ -0,0 +1 @@ +include "/etc/monit.d/checks/system" diff --git a/roles/Sharingan/files/monit/hostdefs/Nazara b/roles/Sharingan/files/monit/hostdefs/Nazara new file mode 100644 index 0000000..4229188 --- /dev/null +++ b/roles/Sharingan/files/monit/hostdefs/Nazara @@ -0,0 +1 @@ +include "/etc/monit.d/checks/system" diff --git a/roles/Sharingan/files/monit/hostdefs/Node0 b/roles/Sharingan/files/monit/hostdefs/Node0 new file mode 100644 index 0000000..4229188 --- /dev/null +++ b/roles/Sharingan/files/monit/hostdefs/Node0 @@ -0,0 +1 @@ +include "/etc/monit.d/checks/system" diff --git a/roles/Sharingan/files/monit/hostdefs/Sharingan b/roles/Sharingan/files/monit/hostdefs/Sharingan new file mode 100644 index 0000000..e81de7b --- /dev/null +++ b/roles/Sharingan/files/monit/hostdefs/Sharingan @@ -0,0 +1,3 @@ +include "/etc/monit.d/checks/system" +include "/etc/monit.d/checks/vips" + diff --git a/roles/Sharingan/files/monit/scripts/critical b/roles/Sharingan/files/monit/scripts/critical new file mode 100755 index 0000000..7ad9f32 --- /dev/null +++ b/roles/Sharingan/files/monit/scripts/critical @@ -0,0 +1,2 @@ +#!/bin/bash +/usr/bin/systemd-cat -t sharingan-eval echo CRITICAL: "$@" diff --git a/roles/Sharingan/files/monit/scripts/notify b/roles/Sharingan/files/monit/scripts/notify new file mode 100755 index 0000000..14fdca4 --- /dev/null +++ b/roles/Sharingan/files/monit/scripts/notify @@ -0,0 +1,2 @@ +#!/bin/bash +/usr/bin/systemd-cat -t sharingan-eval echo INFO: "$@" diff --git a/roles/Sharingan/files/sharingan-eval.service b/roles/Sharingan/files/monit/sharingan-eval.service similarity index 100% rename from roles/Sharingan/files/sharingan-eval.service rename to roles/Sharingan/files/monit/sharingan-eval.service diff --git a/roles/Sharingan/files/oinkmaster.conf b/roles/Sharingan/files/oinkmaster.conf deleted file mode 100644 index 743a247..0000000 --- a/roles/Sharingan/files/oinkmaster.conf +++ /dev/null @@ -1,425 +0,0 @@ -# $Id: oinkmaster.conf,v 1.132 2006/02/02 12:05:08 andreas_o Exp $ # - -# This file is pretty big by default, but don't worry. -# The only things required are "path" and "update_files". You must also -# set "url" to point to the correct rules archive for your version of -# Snort, unless you prefer to specify this on the command line. -# The rest in here is just a few recommended defaults, and examples -# how to use all the other optional features and give some ideas how they -# could be used. - -# Remember not to let untrusted users edit Oinkmaster configuration -# files, as things like the PATH to use during execution is defined -# in here. - - - -# Use "url = " to specify the location of the rules archive to -# download. The url must begin with http://, https://, ftp://, file:// -# or scp:// and end with .tar.gz or .tgz, and the file must be a -# gzipped tarball what contains a directory named "rules". -# You can also point to a local directory with dir://. -# Multiple "url = " lines can be specified to grab multiple rules -# archives from different locations. -# -# Note: if URL is specified on the command line, it overrides all -# possible URLs specified in the configuration file(s). -# -# The location of the official Snort rules you should use depends -# on which Snort version you run. Basically, you should go to -# http://www.snort.org/rules/ and follow the instructions -# there to pick the right URL for your version of Snort -# (and remember to update the URL when upgrading Snort in the -# future). You can of course also specify locations to third party -# rules. -# -# As of March 2005, you must register on the Snort site to get access -# to the official Snort rules. This will get you an "oinkcode". -# You then specify the URL as -# http://www.snort.org/pub-bin/oinkmaster.cgi// -# For example, if your code is 5a081649c06a277e1022e1284b and -# you use Snort 2.4, the url to use would be (without the wrap): -# http://www.snort.org/pub-bin/oinkmaster.cgi/ -# 5a081649c06a277e1022e1284bdc8fabda70e2a4/snortrules-snapshot-2.4.tar.gz -# See the Oinkmaster FAQ Q1 and http://www.snort.org/rules/ for -# more information. - - -# URL examples follows. Replace with the code you get on the -# Snort site in your registered user profile. - -# Example for Snort -# url = http://www.snort.org/pub-bin/oinkmaster.cgi/157f1670c58caa1bcb3e4de0d68e96c7e12a08ca/snortrules-snapshot-2976.tar.gz - -# Suricata - url = http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz - -# Example for Community rules -# url = http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules.tar.gz - -# Example for rules from the Bleeding Snort project -# url = http://www.bleedingsnort.com/bleeding.rules.tar.gz - -# If you prefer to download the rules archive from outside Oinkmaster, -# you can then point to the file on your local filesystem by using -# file://, for example: -# url = file:///tmp/snortrules.tar.gz - -# In rare cases you may want to grab the rules directly from a -# local directory (don't confuse this with the output directory). -# url = dir:///etc/snort/src/rules - -# Example to use scp to copy the rules archive from another host. -# Only OpenSSH is tested. See the FAQ for more information. -# url = scp://user@somehost.example.com:/somedir/snortrules.tar.gz - -# If you use -u scp://... and need to specify a private ssh key (passed -# as -i to the scp command) you can specify it here or add an -# entry in ~/.ssh/config for the Oinkmaster user as described in the -# OpenSSH manual. -# scp_key = /home/oinkmaster/oinkmaster_privkey - - -# The PATH to use during execution. If you prefer to use external -# binaries (i.e. use_external_bins=1, see below), tar and gzip must be -# found, and also wget if downloading via ftp, http or https. All with -# optional .exe suffix. If you're on Cygwin, make sure that the path -# contains the Cygwin binaries and not the native Win32 binaries or -# you will get problems. -# Assume UNIX style by default: -path = /bin:/usr/bin:/usr/local/bin - -# Example if running native Win32 or standalone Cygwin: -# path = c:\oinkmaster;c:\oinkmaster\bin - -# Example if running standalone Cygwin and you prefer Cygwin style path: -# path = /cygdrive/c/oinkmaster:/cygdrive/c/oinkmaster/bin - - -# We normally use external binaries (wget, tar and gzip) since they're -# already available on most systems and do a good job. If you have the -# Perl modules Archive::Tar, IO::Zlib and LWP::UserAgent, you can use -# those instead if you like. You can set use_external_bins below to -# choose which method you prefer. It's set to 0 by default on Win32 -# (i.e. use Perl modules), and 1 on other systems (i.e. use external -# binaries). The reason for that is that the required Perl modules -# are included on Windows/ActivePerl 5.8.1+, so it's easier to use -# those than to install the ported Unix tools. (Note that if you're -# using scp to download the archive, external scp binary is still -# used.) -# use_external_bins = 0 - - -# Temporary directory to use. This directory must exist when starting and -# Oinkmaster will then create a temporary sub directory in here. -# Keep it as a #comment if you want to use the default. -# The default will be checked for in the environment variables TMP, -# TMPDIR or TEMPDIR, or otherwise use "/tmp" if none of them was set. - -# Example for UNIX. -# tmpdir = /home/oinkmaster/tmp/ - -# Example if running native Win32 or Cygwin. -# tmpdir = c:\tmp - -# Example if running Cygwin and you prefer Cygwin style path. -# tmpdir = /cygdrive/c/tmp - - -# The umask to use during execution if you want it to be something -# else than the current value when starting Oinkmaster. -# This will affect the mode bits when writing new files. -# Keep it commented out to keep your system's current umask. -# umask = 0027 - - -# Files in the archive(s) matching this regular expression will be -# checked for changes, and then updated or added if needed. -# All other files will be ignored. You can then choose to skip -# individual files by specifying the "skipfile" keyword below. -# Normally you shouldn't need to change this one. -update_files = \.rules$|\.config$|\.conf$|\.txt$|\.map$ - - -# Regexp of keywords that starts a Snort rule. -# May be useful if you create your own ruletypes and want those -# lines to be regarded as rules as well. -# rule_actions = alert|drop|log|pass|reject|sdrop|activate|dynamic - - -# If the number of rules files in the downloaded archive matching the -# 'update_files' regexp is below min_files, or if the number -# of rules is below min_rules, the rules are regarded as broken -# and the update is aborted with an error message. -# Both are set to 1 by default (i.e. the archive is only regarded as -# broken if it's totally empty). -# If you download from multiple URLs, the count is the total number -# of files/rules across all archives. -# min_files = 1 -# min_rules = 1 - - -# By default, a basic sanity check is performed on most paths/filenames -# to see if they contain illegal characters that may screw things up. -# If this check is too strict for your system (e.g. you get bogus -# "illegal characters in filename" errors because of your local language -# etc) and you're sure you want to disable the checks completely, -# set use_path_checks to 0. -# use_path_checks = 1 - - -# If you want Oinkmaster to send a User-Agent HTTP header string -# other than the default one for wget/LWP, set this variable. -# user_agent = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) - - -# You can include other files anywhere in here by using -# "include ". will be parsed just like a regular -# oinkmaster.conf as soon as the include statement is seen, and then -# return and continue parsing the rest of the original file. If an -# option is redefined, it will override the previous value. You can use -# as many "include" statements as you wish, and also include even more -# files from included files. Example to load stuff from "/etc/foo.conf". -# include /etc/foo.conf - - - -####################################################################### -# Files to totally skip (i.e. never update or check for changes) # -# # -# Syntax: skipfile filename # -# or: skipfile filename1, filename2, filename3, ... # -####################################################################### - -# Ignore local.rules from the rules archive by default since we might -# have put some local rules in our own local.rules and we don't want it -# to get overwritten by the empty one from the archive after each -# update. -skipfile local.rules - -# The file deleted.rules contains rules that have been deleted from -# other files, so there is usually no point in updating it. -skipfile deleted.rules - -# Also skip snort.conf by default since we don't want to overwrite our -# own snort.conf if we have it in the same directory as the rules. If -# you have your own production copy of snort.conf in another directory, -# it may be really nice to check for changes in this file though, -# especially since variables are sometimes added or modified and -# new/old files are included/excluded. -skipfile snort.conf - -# You may want to consider ignoring threshold.conf for the same reasons -# as for snort.conf, i.e. if you customize it locally and don't want it -# to become overwritten by the default one. It may be better to put -# local thresholding/suppressing in some local file and still update -# and use the official one though, in case important stuff is added to -# it some day. We do update it by default, but it's your call. -# skipfile threshold.conf - -# If you update from multiple URLs at the same time you may need to -# ignore the sid-msg.map (and generate it yourself if you need one) as -# it's usually included in each rules tarball. See the FAQ for more info. -# skipfile sid-msg.map - - - -########################################################################## -# SIDs to modify after each update (only for the skilled/stupid/brave). # -# Don't use it unless you have to. There is nothing that stops you from # -# modifying rules in such ways that they become invalid or generally # -# break things. You have been warned. # -# If you just want to disable SIDs, please skip this section and have a # -# look at the "disablesid" keyword below. # -# # -# You may specify multiple modifysid directives for the same SID (they # -# will be processed in order of appearance), and you may also specify a # -# list of SIDs on which the substitution should be applied. # -# If the argument is in the form something.something it's regarded # -# as a filename and the substitution will apply on all rules in that # -# file. The wildcard ("*") can be used to apply the substitution on all # -# rules regardless of the SID or file. Please avoid using #comments # -# at the end of modifysid lines, they may confuse the parser in some # -# situations. # -# # -# Syntax: # -# modifysid SID "replacethis" | "withthis" # -# or: # -# modifysid SID1, SID2, SID3, ... "replacethis" | "withthis" # -# or: # -# modifysid file "replacethis" | "withthis" # -# or: # -# modifysid * "replacethis" | "withthis" # -# # -# The strings within the quotes will basically be passed to a # -# s/replacethis/withthis/ statement in Perl, so they must be valid # -# regular expressions. The strings are case-insensitive and only the # -# first occurrence will be replaced. If there are multiple occurrences # -# you want to replace, simply repeat the same modifysid line. # -# As the strings are regular expressions, you MUST escape special # -# characters like $ \ / ( ) | by prepending a "\" to them. # -# # -# If you specify a modifysid statement for a multi-line rule, Oinkmaster # -# will first translate the rule into a single-line version and then # -# perform the substitution, so you don't have to care about the trailing # -# backslashes and newlines. # -# # -# If you use backreference variables in the substitution expression, # -# it's strongly recommended to specify them as ${1} instead of $1 and so # -# on, to avoid parsing confusion with unexpected results in some # -# situations. Note that modifysid statements will process both active # -# and inactive (disabled) rules. # -# # -# You may want to check out README.templates and template-examples.conf # -# to find how you can simplify the modifysid usage by using templates. # -########################################################################## - -# Example to enable a rule (in this case SID 1325) that is disabled by -# default, by simply replacing leading "#alert" with "alert". -# (You should really use 'enablesid' for this though.) -# Oinkmaster removes whitespaces next to the leading "#" so you don't -# have to worry about that, but be careful about possible whitespace in -# other places when writing the regexps. -# modifysid 1325 "^#alert" | "alert" - -# You could also do this to enable it no matter what type of rule it is -# (alert, log, pass, etc). -# modifysid 1325 "^#" | "" - -# Example to add "tag" stuff to SID 1325. -# modifysid 1325 "sid:1325;" | "sid:1325; tag: host, src, 300, seconds;" - -# Example to make SID 1378 a 'drop' rule (valid if you're running -# Snort_inline). -# modifysid 1378 "^alert" | "drop" - -# Example to replace first occurrence of $EXTERNAL_NET with $HOME_NET -# in SID 302. -# modifysid 302 "\$EXTERNAL_NET" | "\$HOME_NET" - -# You can also specify that a substitution should apply on multiple SIDs. -# modifysid 302,429,1821 "\$EXTERNAL_NET" | "\$HOME_NET" - -# You can take advantage of the fact that it's regular expressions and -# do more complex stuff. This example (for Snort_inline) adds a 'replace' -# statement to SID 1324 that replaces "/bin/sh" with "/foo/sh". -# modifysid 1324 "(content\s*:\s*"\/bin\/sh"\s*;)" | \ -# "${1} replace:"\/foo\/sh";" - -# If you for some reason would like to add a comment inside the actual -# rules file, like the reason why you disabled this rule, you can do -# like this (you would normally add such comments in oinkmaster.conf -# though). -# modifysid 1324 "(.+)" | "# 20020101: disabled this rule just for fun:\n#${1}" - -# Here is an example that is actually useful. Let's say you don't care -# about incoming welchia pings (detected by SID 483 at the time of -# writing) but you want to know when infected hosts on your network -# scans hosts on the outside. (Remember that watching for outgoing -# malicious packets is often just as important as watching for incoming -# ones, especially in this case.) The rule currently looks like -# "alert icmp $EXTERNAL_NET any -> $HOME_NET any ..." -# but we want to switch that so it becomes -# "alert icmp $HOME_NET any -> $EXTERNAL_NET any ...". -# Here is how it could be done. -# modifysid 483 \ -# "(.+) \$EXTERNAL_NET (.+) \$HOME_NET (.+)" | \ -# "${1} \$HOME_NET ${2} \$EXTERNAL_NET ${3}" - -# The wildcard (modifysid * ...) can be used to do all kinds of -# interesting things. The substitution expression will be applied on all -# matching rules. First, a silly example to replace "foo" with "bar" in -# all rules (that have the string "foo" in them, that is.) -# modifysid * "foo" | "bar" - -# If you for some reason don't want to use the stream preprocessor to -# match established streams, you may want to replace the 'flow' -# statement with 'flags:A+;' in all those rules. -# modifysid * "flow:[a-z,_ ]+;" | "flags:A+;" - -# Example to convert all rules of classtype attempted-admin to 'drop' -# rules (for Snort_inline only, obviously). -# modifysid * "^alert (.*classtype\s*:\s*attempted-admin)" | "drop ${1}" - -# This one will append some text to the 'msg' string for all rules that -# have the 'tag' keyword in them. -# modifysid * "(.*msg:\s*".+?)"(\s*;.+;\s*tag:.*)" | \ -# "${1}, going to tag this baby"${2}" - -# There may be times when you want to replace multiple occurrences of a -# certain keyword/string in a rule and not just the first one. To -# replace the first two occurrences of "foo" with "bar" in SID 100, -# simply repeat the modifysid statement: -# modifysid 100 "foo" | "bar" -# modifysid 100 "foo" | "bar" - -# Or you can even specify a SID list but repeat the same SID as many -# times as required, like: -# modifysid 100,100,100 "foo" | "bar" - -# Enable all rules in the file exploit.rules. -# modifysid exploit.rules "^#" | "" - -# Enable all rules in exploit.rules, icmp-info.rules and also SID 1171. -# modifysid exploit.rules, snmp.rules, 1171 "^#" | "" - - - -######################################################################## -# SIDs that we don't want to update. # -# If you for some reason don't want a specific rule to be updated # -# (e.g. you made local modifications to it and you never want to # -# update it and don't care about changes in the official version), you # -# can specify a "localsid" statement for it. This means that the old # -# version of the rule (i.e. the one in the rules file on your # -# harddrive) is always kept, regardless if the official version has # -# been updated. Please do not use this feature unless in special # -# cases as it's easy to end up with many signatures that aren't # -# maintained anymore. See the FAQ for details about this and hints # -# about better solutions regarding customization of rules. # -# # -# Syntax: localsid SID # -# or: localsid SID1, SID2, SID3, ... # -######################################################################## - -# Example to never update SID 1325. -# localsid 1325 - - - -######################################################################## -# SIDs to enable after each update. # -# Will simply remove all the leading '#' for a specified SID (if it's # -# a multi-line rule, the leading '#' for all lines are removed.) # -# These will be processed after all the modifysid and disablesid # -# statements. Using 'enablesid' on a rule that is not disabled is a # -# NOOP. # -# # -# Syntax: enablesid SID # -# or: enablesid SID1, SID2, SID3, ... # -######################################################################## - -# Example to enable SID 1325. -# enablesid 1325 - - - -######################################################################## -# SIDs to comment out, i.e. disable, after each update by placing a # -# '#' in front of the rule (if it's a multi-line rule, it will be put # -# in front of all lines). # -# # -# Syntax: disablesid SID # -# or: disablesid SID1, SID2, SID3, ... # -######################################################################## - -# You can specify one SID per line. -# disablesid 1 -# disablesid 2 -# disablesid 3 - -# And also as comma-separated lists. -# disablesid 4,5,6 - -# It's a good idea to also add comment about why you disable the sid: -# disablesid 1324 # 20020101: disabled this SID just because I can diff --git a/roles/Sharingan/files/rkhunter/rkhunter.conf b/roles/Sharingan/files/rkhunter/rkhunter.conf index 4fdf11f..c291594 100644 --- a/roles/Sharingan/files/rkhunter/rkhunter.conf +++ b/roles/Sharingan/files/rkhunter/rkhunter.conf @@ -191,8 +191,6 @@ # # The default value is based on the root account PATH environment variable. # -#BINDIR=/bin /usr/bin /sbin /usr/sbin -#BINDIR=+/usr/local/bin +/usr/local/sbin # # This option specifies the default language to use. This should be similar to @@ -1339,4 +1337,11 @@ SCRIPTWHITELIST=/usr/bin/egrep SCRIPTWHITELIST=/usr/bin/fgrep SCRIPTWHITELIST=/usr/bin/ldd SCRIPTWHITELIST=/usr/bin/vendor_perl/GET +BINDIR=/bin /usr/bin /sbin /usr/sbin +BINDIR=+/usr/local/bin +/usr/local/sbin +# Allowlist for false postives +ALLOWPROCLISTEN=/usr/bin/inspircd +PORT_WHITELIST=TCP:6667 +ALLOWDEVFILE=/dev/shm/PostgreSQL* +ALLOWDEVFILE=/dev/shm/mono* diff --git a/roles/Sharingan/files/scripts/notify b/roles/Sharingan/files/scripts/notify deleted file mode 100644 index 10a547c..0000000 --- a/roles/Sharingan/files/scripts/notify +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/bash -systemd-cat -t sharingan-eval "$@" diff --git a/roles/Sharingan/files/sharingan-data.service/Archlinux b/roles/Sharingan/files/syslog-ng/sharingan-data.service/Archlinux similarity index 100% rename from roles/Sharingan/files/sharingan-data.service/Archlinux rename to roles/Sharingan/files/syslog-ng/sharingan-data.service/Archlinux diff --git a/roles/Sharingan/files/sharingan-data.service/Debian b/roles/Sharingan/files/syslog-ng/sharingan-data.service/Debian similarity index 100% rename from roles/Sharingan/files/sharingan-data.service/Debian rename to roles/Sharingan/files/syslog-ng/sharingan-data.service/Debian diff --git a/roles/Sharingan/files/syslog-ng@sharingan-data b/roles/Sharingan/files/syslog-ng/syslog-ng@sharingan-data similarity index 100% rename from roles/Sharingan/files/syslog-ng@sharingan-data rename to roles/Sharingan/files/syslog-ng/syslog-ng@sharingan-data diff --git a/roles/Sharingan/tasks/data.yml b/roles/Sharingan/tasks/data.yml index 2581219..fc71599 100644 --- a/roles/Sharingan/tasks/data.yml +++ b/roles/Sharingan/tasks/data.yml @@ -37,7 +37,7 @@ - name: Sharingan-Data service conf become: yes copy: - src: syslog-ng@sharingan-data + src: syslog-ng/syslog-ng@sharingan-data dest: /etc/default/syslog-ng@sharingan-data owner: root group: root @@ -47,107 +47,8 @@ become: yes register: data_service copy: - src: "sharingan-data.service/{{ ansible_os_family }}" + src: "syslog-ng/sharingan-data.service/{{ ansible_os_family }}" dest: /usr/lib/systemd/system/sharingan-data.service owner: root group: root mode: 0750 - - - name: Sharingan-Eval service - become: yes - register: eval_service - copy: - src: sharingan-eval.service - dest: /usr/lib/systemd/system/sharingan-eval.service - owner: root - group: root - mode: 0750 - - - name: Sharingan-Eval monitrc - become: yes - template: - src: monitrc.j2 - dest: /etc/monitrc - owner: root - group: root - mode: 0700 - - - name: Sharingan-Eval includes dir - become: yes - file: - path: /etc/monit.d - state: directory - - - name: Sharingan-Eval monit templates - become: yes - copy: - src: templates - dest: /etc/monit.d/templates - owner: root - group: root - mode: 0700 - - - name: Sharingan-Eval monit scripts - become: yes - copy: - src: templates - dest: /etc/monit.d/scripts - owner: root - group: root - mode: 0700 - - - - name: Sharingan-Eval monit host config - become: yes - copy: - src: "{{ inventory_hostname }}" - dest: "/etc/monit.d/{{ inventory_hostname }}" - owner: root - group: root - mode: 0700 - - - name: Sharingan-Heartbeat service - become: yes - register: heartbeat_service - copy: - src: "{{ item }}" - dest: /usr/lib/systemd/system - owner: root - group: root - mode: 0750 - loop: - - sharingan-heartbeat.timer - - sharingan-heartbeat.service - - - name: Sharingan-Data heartbeat timer - become: yes - copy: - src: sharingan-heartbeat.timer - dest: /usr/lib/systemd/system - owner: root - group: root - mode: 0750 - - - systemd: - daemon_reload: yes - become: yes - when: data_service.changed or eval_service.changed or heartbeat_service.changed - - - name: Start Sharingan-Data services - become: yes - service: - name: "{{ item }}" - state: restarted - enabled: yes - loop: - - sharingan-data.service - - sharingan-heartbeat.timer - - sharingan-eval.service - - - name: Disable default service - become: yes - ignore_errors: yes - service: - name: syslog-ng@default.service - state: stopped - enabled: no diff --git a/roles/Sharingan/tasks/eval.yml b/roles/Sharingan/tasks/eval.yml new file mode 100644 index 0000000..5541d76 --- /dev/null +++ b/roles/Sharingan/tasks/eval.yml @@ -0,0 +1,59 @@ +--- + + - name: Sharingan-Eval service + become: yes + register: eval_service + copy: + src: monit/sharingan-eval.service + dest: /usr/lib/systemd/system/sharingan-eval.service + owner: root + group: root + mode: 0750 + + - name: Sharingan-Eval monitrc + become: yes + template: + src: monitrc.j2 + dest: /etc/monitrc + owner: root + group: root + mode: 0700 + + - name: Sharingan-Eval includes dir + become: yes + loop: + - "/etc/monit.d/" + - "/etc/monit.d/scripts" + - "/etc/monit.d/checks" + file: + path: "{{ item }}" + state: directory + + - name: Sharingan-Eval monit templates + become: yes + copy: + src: monit/checks/ + dest: /etc/monit.d/checks + owner: root + group: root + mode: 0700 + + - name: Sharingan-Eval monit scripts + become: yes + copy: + src: monit/scripts/ + dest: /etc/monit.d/scripts + owner: root + group: root + mode: 0700 + + - name: Sharingan-Eval monit host config + become: yes + copy: + src: "monit/hostdefs/{{ inventory_hostname }}" + dest: "/etc/monit.d/{{ inventory_hostname }}" + owner: root + group: root + mode: 0700 + + diff --git a/roles/Sharingan/tasks/heartbeat.yml b/roles/Sharingan/tasks/heartbeat.yml new file mode 100644 index 0000000..006ac43 --- /dev/null +++ b/roles/Sharingan/tasks/heartbeat.yml @@ -0,0 +1,48 @@ +--- + + - name: Sharingan-Heartbeat service + become: yes + register: heartbeat_service + copy: + src: "{{ item }}" + dest: /usr/lib/systemd/system + owner: root + group: root + mode: 0750 + loop: + - sharingan-heartbeat.timer + - sharingan-heartbeat.service + + - name: Sharingan-Data heartbeat timer + become: yes + copy: + src: sharingan-heartbeat.timer + dest: /usr/lib/systemd/system + owner: root + group: root + mode: 0750 + + - systemd: + daemon_reload: yes + become: yes + when: data_service.changed or eval_service.changed or heartbeat_service.changed + + - name: Start Sharingan-Data services + become: yes + service: + name: "{{ item }}" + state: restarted + enabled: yes + loop: + - sharingan-data.service + - sharingan-heartbeat.timer + - sharingan-eval.service + + - name: Disable default service + become: yes + ignore_errors: yes + service: + name: syslog-ng@default.service + state: stopped + enabled: no + diff --git a/roles/Sharingan/tasks/ids.yml b/roles/Sharingan/tasks/ids.yml index a034c74..498256d 100644 --- a/roles/Sharingan/tasks/ids.yml +++ b/roles/Sharingan/tasks/ids.yml @@ -1,14 +1,17 @@ --- - - name: sshguard package + - name: IDS packages become: yes + register: package_install package: name: - sshguard - suricata - oinkmaster + - rkhunter state: present + # Network IPS - name: sshguard config become: yes copy: @@ -28,32 +31,79 @@ group: root mode: 0600 -# - name: Copy oinkmaster service -# register: oinkmaster_service -# become: yes -# loop: -# - oinkmaster.service -# - oinkmaster.timer -# copy: -# src: "{{ item }}" -# dest: "/usr/lib/systemd/system/{{ item }}" -# owner: root -# group: root -# mode: 0644 -# -# - systemd: -# daemon_reload: yes -# become: yes -# when: oinkmaster_service.changed + # Host IDS + - name: Copy rkhunter service + register: rkhunter_conf + become: yes + copy: + src: rkhunter/rkhunter.conf + dest: "/etc/rkhunter.conf" + owner: root + group: root + mode: 0644 + + - name: Copy rkhunter service + register: rkhunter_service + become: yes + loop: + - rkhunter.service + - rkhunter.timer + copy: + src: "rkhunter/{{ item }}" + dest: "/usr/lib/systemd/system/{{ item }}" + owner: root + group: root + mode: 0644 + + # Network IDS + - name: Copy oinkmaster conf + register: oinkmaster_conf + become: yes + copy: + src: "oinkmaster/oinkmaster.conf" + dest: "/usr/lib/systemd/system/oinkmaster.conf" + owner: root + group: root + mode: 0644 + + - name: Copy oinkmaster service + register: oinkmaster_service + become: yes + loop: + - oinkmaster.service + - oinkmaster.timer + copy: + src: "oinkmaster/{{ item }}" + dest: "/usr/lib/systemd/system/{{ item }}" + owner: root + group: root + mode: 0644 + + - systemd: + daemon_reload: yes + become: yes + when: oinkmaster_service.changed or rkhunter_service.changed + + - name: Update oinkmaster DB + become: yes + when: package_install.changed or oinkmaster_conf.changed + service: + name: oinkmaster.service + state: started + + - name: Update rkhunter DB + become: yes + when: package_install.changed or rkhunter_conf.changed + command: "/bin/bash -c 'export PATH=/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; rkhunter -C && rkhunter --propupd'" - name: IDS services become: yes loop: - suricata.service - sshguard.service - # - oinkmaster.timer + - oinkmaster.timer + - rkhunter.timer service: name: "{{ item }}" state: restarted enabled: yes - diff --git a/roles/Sharingan/tasks/main.yml b/roles/Sharingan/tasks/main.yml index 9f8e3ae..2982405 100644 --- a/roles/Sharingan/tasks/main.yml +++ b/roles/Sharingan/tasks/main.yml @@ -1,4 +1,8 @@ --- + + - import_tasks: ../roles/Sharingan/tasks/data.yml + - import_tasks: ../roles/Sharingan/tasks/eval.yml + - import_tasks: ../roles/Sharingan/tasks/heartbeat.yml - import_tasks: ../roles/Sharingan/tasks/siem.yml when: siem is defined @@ -6,7 +10,6 @@ - import_tasks: ../roles/Sharingan/tasks/ids.yml when: secdetection is defined - - import_tasks: ../roles/Sharingan/tasks/vulns.yml + - import_tasks: ../roles/Sharingan/tasks/scans.yml when: ansible_os_family == "Archlinux" - - import_tasks: ../roles/Sharingan/tasks/data.yml diff --git a/roles/Sharingan/tasks/vulns.yml b/roles/Sharingan/tasks/scans.yml similarity index 70% rename from roles/Sharingan/tasks/vulns.yml rename to roles/Sharingan/tasks/scans.yml index 8c92b98..f4e6e5d 100644 --- a/roles/Sharingan/tasks/vulns.yml +++ b/roles/Sharingan/tasks/scans.yml @@ -20,7 +20,7 @@ group: root mode: 0600 - - name: lynis services + - name: Scanning services become: yes copy: src: "lynis/{{ item }}" @@ -29,8 +29,18 @@ group: root mode: 0664 loop: - - sharingan-vulns.service - - sharingan-vulns.timer + - sharingan-scan.service + - sharingan-scan.timer + + - name: Scanning services + become: yes + copy: + src: "clamav/{{ item }}" + dest: /usr/lib/systemd/system/ + owner: root + group: root + mode: 0664 + loop: - freshclam.service - freshclam.timer @@ -38,7 +48,7 @@ become: yes loop: - freshclam.timer - - sharingan-vulns.timer + - sharingan-scan.timer service: name: "{{ item }}" state: restarted