mirror of
https://github.com/DaLaw2/NetGuardia.git
synced 2026-08-24 14:10:28 +09:00
DaLaw2
fbaef94082
* feat: Phase 2-5 — architecture, detection, security, SOAR, operations Architecture: - Hexagonal port traits (10 modules migrated from Arc<Database>) - Domain model types moved to model/ directory - Constants centralized + 7 made runtime-configurable via DB - Dead Error/Log variants cleaned up, SystemLog split Detection (Phase 5): - Detection orchestrator with dedup + enrichment + source attribution - Cross-flow correlation engine: botnet, scan, lateral movement (T9) - Temporal beaconing detector: CV-based C2 periodicity (T10) - LRU flow eviction replacing O(n) min_by_key scan (T12) Security hardening: - 7 fixes: alg:none, config secret leak, HTTPS open redirect, log traversal, HKDF salt, SOAR whitelist+cooldown, operator validation - 4 memory safety fixes: LRU dedup, frequency cleanup, drift cap, clock - Envelope encryption for secrets (AES-256-GCM + HKDF) - 17 new tests (SecretStore + SOAR conditions) SOAR (Phase 3): - Multi-condition playbooks (5 condition types, AND logic) - Playbook update API (PUT + toggle endpoints) Operations (Phase 4): - Dynamic log level, system control APIs (shutdown/restart) - HTTP config hot reload, spawn_blocking for CPU-bound work - CLI encrypt-db / decrypt-db commands - Audit log API Log level audit: - 16 variants adjusted (noisy hot-path → TRACE/DEBUG) - 5 dead variants removed Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address Copilot review — 6 issues from PR #18 1. Botnet detector source_ip was set to victim dst_ip, causing SOAR to block the victim instead of the attacker 2. HTTPS redirect host header injection: validate host is private IP, localhost, or .local hostname before constructing redirect URL 3. smtp_password plaintext residue: clear settings table after writing to SecretStore to prevent pre-migration plaintext from persisting 4. install.sh: add apt-get update before install on Debian/Ubuntu 5. download_log OOM risk: add 50MB file size limit before reading 6. update_config restart trigger: check return value, report if shutdown already in progress instead of claiming success Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address Agent Team review — security, perf, correctness Security: - S1: Add RBAC permission check for /api/logs/ and /api/audit/ endpoints (previously any authenticated user could access) - S2/S3: Remove report_dir and log_dir from configurable settings to prevent arbitrary directory write via config API - A2: Pin DNS-resolved IPs in webhook reqwest client to prevent DNS rebinding TOCTOU attack (resolve() instead of re-resolving) Performance: - P7: Add 50K key cap to FrequencyTracker to prevent unbounded growth under DDoS (was unbounded, worst case 1.6GB) - P9: Increase ML alert broadcast capacity 100 → 1024 to prevent lost alerts during DDoS spikes (3 subscribers contend on 100-slot buffer) - P2: Reduce FLOW_MAX_PERIODS 10000 → 1000 (saves 144KB/flow, feature extraction only uses aggregate stats) - P1: Remove unnecessary FlowKey clone on hot path (~1.9MB/s saved) - P5: Beaconing detector: split analyze_and_alert into read-lock scan + selective write-lock update (reduces DashMap contention) Correctness: - A4: Capture correlation counts inside DashMap guard before dropping, eliminating TOCTOU in logged values (botnet, scan, lateral) - A6: Log warning when SOAR playbook action params JSON is malformed instead of silently replacing with empty object Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add trainer submodule, update frontend submodule - Add net-guardia-trainer submodule (ParrotXray/NetGuardia-Trainer@dalaw2-dev) - Update frontend submodule with code quality fixes Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
47 lines
927 B
Plaintext
47 lines
927 B
Plaintext
#cloud-config
|
|
autoinstall:
|
|
version: 1
|
|
locale: en_US.UTF-8
|
|
keyboard:
|
|
layout: us
|
|
|
|
identity:
|
|
hostname: netguardia
|
|
username: netguardia
|
|
# Password: netguardia (mkpasswd --method=SHA-512)
|
|
password: "$6$rounds=4096$randomsalt$PLACEHOLDER_HASH"
|
|
|
|
ssh:
|
|
install-server: true
|
|
allow-pw: true
|
|
|
|
storage:
|
|
layout:
|
|
name: lvm
|
|
sizing-policy: all
|
|
|
|
network:
|
|
version: 2
|
|
ethernets:
|
|
ens3:
|
|
dhcp4: true
|
|
|
|
packages:
|
|
- curl
|
|
- net-tools
|
|
- iproute2
|
|
- linux-tools-common
|
|
|
|
late-commands:
|
|
# Create required directories
|
|
- mkdir -p /target/opt/netguardia/bin
|
|
- mkdir -p /target/var/log/netguardia
|
|
|
|
# Enable serial console for headless access
|
|
- >-
|
|
curtin in-target -- systemctl enable serial-getty@ttyS0.service
|
|
|
|
final_message: |
|
|
NetGuardia image provisioning complete.
|
|
The HTTP setup wizard starts automatically on port 8080.
|