mirrors/opensnitch
1
0
Fork 0
mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 08:34:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

updated after opensnitch repo commit 20fe50277e

wiki auto updater 2023-02-05 10:12:02 +00:00
parent 9222cc6b1d
commit dfa26c5a79
1 changed files with 18 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
Configurations.md

@ -1,5 +1,6 @@
### Daemon configuration
Some default working options can be customized in the file _/etc/opensnitchd/default-config.json_:
The file _/etc/opensnitchd/default-config.json_ holds the daemon configuration:
```
{
@ -25,20 +26,23 @@ Option | Value
Server.Address | Unix socket (unix:///tmp/osui.sock, the "unix:///" part is mandatory) or TCP socket (192.168.1.100:50051)
Server.LogFile | file to write logs to (use /dev/stdout to write logs to standard output)
DefaultAction | allow, deny
DefaultDuration | once, always, until restart, 30s, 5m, 15m, 30m, 1h
~DefaultDuration~ | ~once, always, until restart, 30s, 5m, 15m, 30m, 1h~ DEPRECATED
InterceptUnknown | true, false
ProcMonitorMethod | ebpf, proc, ftrace, audit
ProcMonitorMethod | ebpf, proc, audit
LogLevel | 0 to 4 (debug, info, important, warning, error)
Firewall | "iptables" or "nftables"
Firewall | "nftables" or "iptables"
Stats.MaxEvents | Max events to send to the GUI every second. If you think that you're missing some connections increased this value.
Stats.MaxStats | Max stats per item (port, host, IP, process, etc) to keep in the backlog.
If you change the configuration or the rules under _/etc/opensnitchd/_, they'll be reloaded. No restart is needed.
If you change the configuration or the rules under _/etc/opensnitchd/rules/_, they'll be reloaded. No restart is needed.
**NOTE about _intercept_unknown_ option**: It was added when OpenSnitch used to miss a lot of connections (couldn't find pid/process in /proc). As of v1.4.0rc2 version, it's safe to set it to false, and just let drop those unknown spare connections. It's up to you.
Most of the connections intercepted by this option are those in a bad state or similar.
**NOTE about _intercept_unknown_ option**:
It refers to the connections that are not associated with a process due to several reasons, specially when using _proc_ as monitor method.
There's at least one scenario where this option is useful, and is when connecting a WireGuard VPN. As the connection is originated from kernel-space, you need to enable this option in order to allow the outgoing connection.
This option was added when OpenSnitch used to miss a lot of connections (couldn't find pid/process in /proc). As of v1.4.0rc2 version, it's safe to set it to false, and just let it drop those "unknown" connections. It's up to you. Most of the connections intercepted by this option are those in a bad state or similar.
There're some scenarios where this option is useful/needed though, for example when connecting to VPNs or mount NFS shares.
As the connections are originated from kernel-space, you need to enable this option in order to allow the outgoing connection.
***
@ -48,6 +52,11 @@ By default OpenSnitch UI listens on a local Unix socket in /tmp/osui.sock.
In some distros, /tmp is cleared out every time in a while, so you're encouraged to change it to other location.
On latest v.1.6.x version, you can change it to unix:///run/user/1000/opensnitch/osui.sock
![image](https://user-images.githubusercontent.com/2742953/216812535-111ab3ce-ad32-45d5-8d54-c0111b3a2fd2.png)
**Single UI with many computers**
Use `--socket "[::]:50051"` to have the UI use TCP instead of a Unix socket and run the daemon on another computer with `-ui-socket "x.x.x.x:50051"` (where x.x.x.x is the IP of the computer running the UI service).
@ -62,7 +71,7 @@ Use `--socket "[::]:50051"` to have the UI use TCP instead of a Unix socket and
The GUI saves the changes you make every time you resize the statistics window, or when answering a connection prompt dialog. It'll also remember which tab you clicked the last time.
The size of each column of each tab will also be saved.
The size of each column or each tab will also be saved.
It is saved under _$HOME/.config/opensnitch/settings.conf_, and it's handled by the GUI.