Package: nfsinkhole
WarningThis version is considered experimental. Do not attempt to use this
library in production until tests via travis and docker are setup, stable,
and sufficiently covered.Attention!You are responsible for rotating log files (/var/log/nfsinkhole*), and
syslog forwarding must be configured manually (automation pending).nfsinkhole is a Python library and scripts for setting up a Unix server
as a sinkhole (monitor, log/capture, and drop all traffic to a secondary
interface).The default setup arguments monitor/capture all traffic. Setup arguments are
provided to configure protocols, ports, rate limiting, logging,
source IP/CIDR exclusions from logging, and optional packet capture.All sinkhole events are written to /var/log/nfsinkhole-events.log. Optionally,
you can enable tcpdump to output packet capture text to
/var/log/nfsinkhole-pcap.log if your version of tcpdump supports packet
printing; otherwise reverts to /var/log/nfsinkhole.pcap.FeaturesSimple install scriptInstalls as a init.d/systemctl serviceService modifies iptables on start/stop, no need to persist iptablesrsyslog and syslog-ng (pending) supportedRedHat/CentOS 6/7 testedPython 2.6+ and 3.0+ supportedBuilt-in support for dealing with SELinux/AppArmorPacket capture of sinkhole traffic (printed output to log for tcpdump v4.5+)Useful set of utilitiesDetailed logging to /var/log/nfsinkhole-*Syslog forwarding configuration (pending)BSD licensePlanned ImprovementsAPI/class documentationsyslog-ng support (currently partially built; unused)Tests via travis-ci/dockerCoverage via coverage.ioException handling overhaulSet logging level (currently debug)BIND/Microsoft/etc DNS server configuration documentation/examplesMonitoring use case examplesAutomatic configuration for syslog forwardingSIEM parsers/apps/pluginsOfficial support/testing for more OS environmentsSupport handling exceptions for HIPS and other endpoint security productsIntelligent handling/handshakes (inspired by iptrap -https://github.com/jedisct1/iptrap)LinksDocumentationRelease v0.1.0https://nfsinkhole.readthedocs.io/en/v0.1.0GitHub masterhttps://nfsinkhole.readthedocs.io/en/latestGitHub devhttps://nfsinkhole.readthedocs.io/en/devExamplesPendingGithubhttps://github.com/secynic/nfsinkholePypihttps://pypi.python.org/pypi/nfsinkholeChangeshttps://nfsinkhole.readthedocs.io/en/latest/CHANGES.htmlDependenciesOS:iptables (likely already included in base OS)
tcpdump (optional - likely already included in base OS)Python 2.6:argparsePython 2.7, 3.0+:None!InstallingAttention!The nfsinkhole service, iptables rules, and tcpdump must run as root.
You can still use user/virtualenv Python environments, for the library,
but ultimately, the core sinkhole will be run as root.NoteReplace any below occurence of <INTERFACE> with the name of your
sinkhole network interface name.Base OS (pip) – RECOMMENDEDIf pip is not installed, you will first need to add the EPEL repo and install:sudo yum install epel-release
sudo yum install python-pipRHEL/CentOS 6/7Basic:pip install --user --upgrade nfsinkhole
python ~/.local/bin/nfsinkhole-setup.py --interface <INTERFACE> --install --pcapvirtualenv:pip install virtualenv
virtualenv nfsinkhole
source nfsinkhole/bin/activate
nfsinkhole/bin/pip install nfsinkhole
nfsinkhole/bin/python nfsinkhole/bin/nfsinkhole-setup.py --interface <INTERFACE> --install --pcapBase OS (no pip)RHEL/CentOS 6GitHub - Stable:wget -O argparse.tar.gz https://github.com/ThomasWaldmann/argparse/tarball/master
tar -C argparse -zxvf argparse.tar.gz
cd argparse
python setup.py install --user prefix=
cd ..
rm -Rf argparse
wget -O nfsinkhole.tar.gz https://github.com/secynic/nfsinkhole/tarball/master
tar -C nfsinkhole -zxvf nfsinkhole.tar.gz
cd nfsinkhole
python setup.py install --user prefix=
cd ..
rm -Rf nfsinkhole
python ~/.local/bin/nfsinkhole-setup.py --interface <INTERFACE> --install --pcapRHEL/CentOS 7GitHub - Stable:wget -O nfsinkhole.tar.gz https://github.com/secynic/nfsinkhole/tarball/master
tar -C nfsinkhole -zxvf nfsinkhole.tar.gz
cd nfsinkhole
python setup.py install --user prefix=
cd ..
rm -Rf nfsinkhole
python ~/.local/bin/nfsinkhole-setup.py --interface <INTERFACE> --install --pcapServiceOnce installed you need to start the nfsinkhole service.RHEL/CentOS 6sudo service nfsinkhole startRHEL/CentOS 7sudo systemctl start nfsinkhole.serviceAPIAppArmorAppArmor documentation:https://nfsinkhole.readthedocs.io/en/latest/apparmor.htmliptablesiptables documentation:https://nfsinkhole.readthedocs.io/en/latest/iptables.htmlrsyslogrsyslog documentation:https://nfsinkhole.readthedocs.io/en/latest/rsyslog.htmlSELinuxSELinux documentation:https://nfsinkhole.readthedocs.io/en/latest/selinux.htmlServiceService (systemd/init.d) documentation:https://nfsinkhole.readthedocs.io/en/latest/service.htmlsyslog-ngsyslog-ng documentation:https://nfsinkhole.readthedocs.io/en/latest/syslog_ng.htmltcpdumptcpdump documentation:https://nfsinkhole.readthedocs.io/en/latest/tcpdump.htmlUtilitiesUtilities documentation:https://nfsinkhole.readthedocs.io/en/latest/utils.htmlContributinghttps://nfsinkhole.readthedocs.io/en/latest/CONTRIBUTING.htmlSpecial ThanksThank you JetBrains for thePyCharmopen source support!Changelog0.1.0 (2016-08-29)Initial release