mirrors/opensnitch
1
0
Fork 0
mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 08:34:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
opensnitch/daemon/default-config.json

40 lines
871 B
JSON
Raw Normal View History

allow to configure process monitor method in daemon config Added ProcMonitorMethod, which can be "proc", "ftrace" or "audit". Parameters passed by command line take prevalence over default configuration. breaking changes: config options changed from xx_yy to XxYy. Config example: { "DefaultAction": "allow", "DefaultDuration": "once", "InterceptUnknown": true, "ProcMonitorMethod": "audit" }
2020-03-16 01:37:33 +01:00
{
set server address and log file from the default config The server address and log file were hardcoded into the opensnitchd.service file, making it almost impossible to change. Soon we'll be able to change it from the UI.
2020-10-26 23:16:27 +01:00
"Server":
{
"Address":"unix:///tmp/osui.sock",
updated default-config.json with latest added opts More info about these options: https://github.com/evilsocket/opensnitch/wiki/Configurations
2024-05-16 00:51:30 +02:00
"Authentication": {
"Type": "simple"
},
set server address and log file from the default config The server address and log file were hardcoded into the opensnitchd.service file, making it almost impossible to change. Soon we'll be able to change it from the UI.
2020-10-26 23:16:27 +01:00
"LogFile":"/var/log/opensnitchd.log"
},
allow to configure process monitor method in daemon config Added ProcMonitorMethod, which can be "proc", "ftrace" or "audit". Parameters passed by command line take prevalence over default configuration. breaking changes: config options changed from xx_yy to XxYy. Config example: { "DefaultAction": "allow", "DefaultDuration": "once", "InterceptUnknown": true, "ProcMonitorMethod": "audit" }
2020-03-16 01:37:33 +01:00
"DefaultAction": "allow",
"DefaultDuration": "once",
"InterceptUnknown": false,
Use eBPF as procs monitor method by default If eBPF is not available we'll fallback to proc parsing.
2021-08-17 13:54:46 +02:00
"ProcMonitorMethod": "ebpf",
allow to configure what firewall to use Before this change, we tried to determine what firewall to use based on the version of iptables (if -V legacy -> nftables, otherwise iptables). This caused problems (#455), and as there's no support yet for nftables system firewall rules, it can't be configured to workaround these errors. Now the default firewall to use will be iptables. If it's not available (installed), can't be used or the configuration option is empty/missing, we'll use nftables.
2021-08-09 00:21:43 +02:00
"LogLevel": 2,
Introduce 2 new daemon logging options: LogUTC & LogMicro.
2023-06-05 20:46:42 -06:00
"LogUTC": true,
"LogMicro": false,
Allow to configure firewall rules from the GUI (#660) * Allow to configure firewall rules from the GUI (WIP) New features: - Configure and list system firewall rules from the GUI (nftables). - Configure chains' policies. - Add simple rules to allow incoming ports. - Add simple rules to exclude apps (ports) from being intercepted. This feature is only available for nftables. iptables is still supported, you can add rules to the configuration file and they'll be loaded, but you can't configure them from the GUI. More information: #592
2022-05-03 22:05:12 +02:00
"Firewall": "nftables",
updated default-config.json with latest added opts More info about these options: https://github.com/evilsocket/opensnitch/wiki/Configurations
2024-05-16 00:51:30 +02:00
"FwOptions": {
"ConfigPath": "/etc/opensnitchd/system-fw.json",
"MonitorInterval": "15s"
},
allow to filter connections by process checksum Now you can create rules to filter processes by checksum. Only md5 is available at the moment. There's a global configuration option that you can use to enable or disable this feature, from the config file or from the Preferences dialog. As part of this feature there have been more changes: - New proc monitor method (PROCESS CONNECTOR) that listens for exec/exit events from the kernel. This feature depends on CONFIG_PROC_EVENTS kernel option. - Only one cache of active processes for ebpf and proc monitor methods. More info and details: #413.
2023-09-22 00:36:26 +02:00
"Rules": {
updated default-config.json with latest added opts More info about these options: https://github.com/evilsocket/opensnitch/wiki/Configurations
2024-05-16 00:51:30 +02:00
"Path": "/etc/opensnitchd/rules/",
allow to filter connections by process checksum Now you can create rules to filter processes by checksum. Only md5 is available at the moment. There's a global configuration option that you can use to enable or disable this feature, from the config file or from the Preferences dialog. As part of this feature there have been more changes: - New proc monitor method (PROCESS CONNECTOR) that listens for exec/exit events from the kernel. This feature depends on CONFIG_PROC_EVENTS kernel option. - Only one cache of active processes for ebpf and proc monitor methods. More info and details: #413.
2023-09-22 00:36:26 +02:00
"EnableChecksums": false
},
updated default-config.json with latest added opts More info about these options: https://github.com/evilsocket/opensnitch/wiki/Configurations
2024-05-16 00:51:30 +02:00
"Ebpf": {
"EventsWorkers": 8,
"QueueEventsSize": 0
},
statistics: fixed missed connections Previous behaviour: 1) Before version 1.0.0b the daemon kept a list of processes that had established connections. The list was displayed on the GUI as is, so the maximum number of connections displayed were 100 (hardcoded). 2) When the intercepted connections reached 100, the last entry of the list was removed, and a new one was inserted on the top. After v1.0.0 we started saving connections to a DB on the GUI side, to get rid of the hardcoded connections limit. However, the point 2) was still present that caused some problems: - When the backlog was full we kept inserting and deleting connections from it continuously, one by one. - If there was a connections burst we could end up missing some connections. New behaviour: - The statisics are deleted from the daemon everytime we send them to the GUI, because we don't need them on the daemon anymore. - If the GUI is not connected, the connections will be added to the backlog as in the point 2). - When the backlog reaches the limit, it'll keep deleting the last one in order to insert a new one. - The number of connections to keep on the backlog is configurable. - If the statistics configuration is missing, default values will be 150 (maxEvents) and 25 (maxStats). Notes: If the GUI is saving the data to memory (default), there won't be any noticeable side effect. If the GUI is configured to save the connections to a DB on disk, and the daemon sends all the backlog at once, the GUI may experience a delay and a high CPU spike. This can occur on connecting to the daemon (because the backlog will be full), or when an app sends too many connections per second (like nmap).
2021-08-13 12:18:10 +02:00
"Stats": {
updated default-config.json with latest added opts More info about these options: https://github.com/evilsocket/opensnitch/wiki/Configurations
2024-05-16 00:51:30 +02:00
"MaxEvents": 250,
added way to send events to syslog Now you can send events to syslog, local or remote. This feature was requested here #638 This feature allows you to integrate opensnitch with your SIEM. Take a look at the above discussion to see examples with syslog-ng+promtail+loki+grafana. There's only one logger implemented (syslog), but it should be easily expandable to add more type of loggers (elastic, etc). The event format can be CSV or RFC5424. It sould also be easy to add more formats. - Allow to configure stats workers. They were hardcoded to 4.
2022-05-17 16:15:40 +02:00
"MaxStats": 25,
"Workers": 6
updated default-config.json with latest added opts More info about these options: https://github.com/evilsocket/opensnitch/wiki/Configurations
2024-05-16 00:51:30 +02:00
},
"Internal": {
"GCPercent": 100,
"FlushConnsOnStart": true
statistics: fixed missed connections Previous behaviour: 1) Before version 1.0.0b the daemon kept a list of processes that had established connections. The list was displayed on the GUI as is, so the maximum number of connections displayed were 100 (hardcoded). 2) When the intercepted connections reached 100, the last entry of the list was removed, and a new one was inserted on the top. After v1.0.0 we started saving connections to a DB on the GUI side, to get rid of the hardcoded connections limit. However, the point 2) was still present that caused some problems: - When the backlog was full we kept inserting and deleting connections from it continuously, one by one. - If there was a connections burst we could end up missing some connections. New behaviour: - The statisics are deleted from the daemon everytime we send them to the GUI, because we don't need them on the daemon anymore. - If the GUI is not connected, the connections will be added to the backlog as in the point 2). - When the backlog reaches the limit, it'll keep deleting the last one in order to insert a new one. - The number of connections to keep on the backlog is configurable. - If the statistics configuration is missing, default values will be 150 (maxEvents) and 25 (maxStats). Notes: If the GUI is saving the data to memory (default), there won't be any noticeable side effect. If the GUI is configured to save the connections to a DB on disk, and the daemon sends all the backlog at once, the GUI may experience a delay and a high CPU spike. This can occur on connecting to the daemon (because the backlog will be full), or when an app sends too many connections per second (like nmap).
2021-08-13 12:18:10 +02:00
}
allow to configure process monitor method in daemon config Added ProcMonitorMethod, which can be "proc", "ftrace" or "audit". Parameters passed by command line take prevalence over default configuration. breaking changes: config options changed from xx_yy to XxYy. Config example: { "DefaultAction": "allow", "DefaultDuration": "once", "InterceptUnknown": true, "ProcMonitorMethod": "audit" }
2020-03-16 01:37:33 +01:00
}
Reference in a new issue Copy permalink