wazuh env

README.md

@@ -15,8 +15,6 @@ The term [Mistborn](http://www.brandonsanderson.com/the-mistborn-saga-the-origin
 
 Mistborn started as a passion project for a husband and father protecting his family. Certain family members insisted on connecting their devices to free public WiFi networks. We needed a way to secure all family devices with a solid VPN (Wireguard). Once we had that we wanted to control DNS to block ads to all devices and block malicious websites across all family devices. Then we wanted chat, file-sharing, and webchat services that we could use for ourselves without entrusting our data to some big tech company. And then... home automation. I know I'll be adding more services so I made that easy to do.
 
-As an [Offensive Security Certified Professional (OSCP)](https://resources.infosecinstitute.com/certification/the-oscp-certification-and-exam/), I designed Mistborn thinking about how it would be attacked by both external and internal threats. In making design trade-off decisions I tend to the paranoid. See [Technical and Security Insights](#technical-and-security-insights).
-
 Ideal for teams who:
 - hate internet ads
 - need to be protected from malicious internet domains
@@ -41,10 +39,7 @@ These tools are not vital to Mistborn itself but are integrated to enhance secur
 - [Pi-hole](https://pi-hole.net): A DNS server for network-wide ad blocking, etc
 - [DNScrypt](https://www.dnscrypt.org): prevents DNS spoofing via cryptographic signatures to verify that responses originate from the chosen DNS resolver and haven't been tampered
 - [Traefik](https://docs.traefik.io): A modern, efficient reverse-proxy
-
-These tools can be turned on from the Mistborn Security Operations Center:
 - [Wazuh](https://wazuh.com/): Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.
-- [Suricata](https://suricata-ids.org/): Suricata is a free and open source, mature, fast and robust network threat detection engine. The Suricata engine is capable of real time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitoring (NSM) and offline pcap processing. Suricata inspects the network traffic using a powerful and extensive rules and signature language, and has powerful Lua scripting support for detection of complex threats.
 
 Within Mistborn is a panel to enable and manage these free extra services (off by default), locally hosted in Docker containers:
 - [Home Assistant](https://www.home-assistant.io): Open source home automation that puts local control and privacy first
@@ -104,7 +99,7 @@ sudo mistborn-cli getconf
 
 Connect via Wireguard then visit `http://home.mistborn`
 
-For more information, see the [Installation](#installation) section below.
+For more information, see the `Installation` section below.
 
 # Network Diagram
 ![Mistborn Network Diagram](https://gitlab.com/cyber5k/public/-/raw/master/graphics/mistborn_network.png)
@@ -122,8 +117,6 @@ See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/
 
 The Mistborn Security Operations Center provides SIEM services with Wazuh. The Wazuh Manager requires an Open Distro for Elasticsearch backend. When the Mistborn host has >8 GB RAM the provided Elasticsearch backend can be used. Just click "Start Wazuh" on the `Security Center` page and enjoy your Enterprise-grade SIEM. Wazuh agents can be installed on just about any OS and all Wazuh agent traffic is communicated over the Wireguard connections. Instructions for adding endpoint agents can be found within Wazuh itself.
 
-Mistborn's Wazuh installs and integrates with Suricata running on Mistborn with logs ingested into Wazuh.
-
 ![Mistborn Security Center: Wazuh Modules](https://gitlab.com/cyber5k/public/-/raw/master/graphics/wazuh_modules.png)
 
 The Wazuh Kibana plugin leverages the power of Elasticsearch:
@@ -559,8 +552,7 @@ Many features and refinements are in the works at various stages including:
 # Featured In
 
 - [Linux Magazine](https://www.linux-magazine.com/Issues/2020/240/Mistborn/(language)/eng-US) November 2020 (featuring Mistborn version from early May 2020)
-- [Awesome Open Source](https://www.youtube.com/watch?v=hekP0_crotw) July 2020
-- [DB Tech](https://www.youtube.com/watch?v=UE_OuAOgoZI) May 2021
+- [Awesome Open Source](https://www.youtube.com/watch?v=hekP0_crotw) July 2020 (featuring Mistborn version from early July 2020)
 
 # Follow
 You can find recent bugfixes, functional additions, some extra documentation and more at the Cyber5K Patreon page: [https://www.patreon.com/cyber5k](https://www.patreon.com/cyber5k)

base.yml

@@ -53,13 +53,6 @@ services:
     #image: mistborn_production_traefik
     image: traefik:v2.2
     container_name: mistborn_production_traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.api.rule=Host(`traefik.mistborn`)"
-      - "traefik.http.routers.api.service=api@internal"
-      - "traefik.http.routers.api.middlewares=mistborn_headers@file"
-      - "traefik.http.routers.api.entrypoints=web"
-      #- "traefik.http.services.internal.loadbalancer.server.port=5000"
     depends_on:
       - django
     volumes:
@@ -74,11 +67,11 @@ services:
     #  #- "0.0.0.0:8080:8080/tcp" # dashboard
     command:
       ## API settings
-      - --api.insecure=true
-      - --api.dashboard=true
-      - --api.debug=true
+      #- --api.insecure=true
+      #- --api.dashboard=true
+      #- --api.debug=true
       ## Logs
-      - --log.level=INFO
+      - --log.level=ERROR
       ## Providers
       - --providers.docker=true
       - --providers.docker.exposedbydefault=false
@@ -175,16 +168,13 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.pihole-http.rule=Host(`pihole.mistborn`)"
       - "traefik.http.routers.pihole-http.entrypoints=web"
-      - "traefik.http.routers.pihole-http.middlewares=mistborn_auth,add-pihole-admin"
+      - "traefik.http.routers.pihole-http.middlewares=mistborn_auth@file,add-pihole-admin"
       - "traefik.http.routers.pihole-https.rule=Host(`pihole.mistborn`)"
       - "traefik.http.routers.pihole-https.entrypoints=websecure"
-      - "traefik.http.routers.pihole-https.middlewares=mistborn_auth,add-pihole-admin"
+      - "traefik.http.routers.pihole-https.middlewares=mistborn_auth@file,add-pihole-admin"
       - "traefik.http.routers.pihole-https.tls.certresolver=basic"
       - "traefik.http.middlewares.add-pihole-admin.addPrefix.prefix=/admin"
       - "traefik.http.services.pihole-service.loadbalancer.server.port=80"
-      - "traefik.http.middlewares.mistborn_auth.forwardAuth.address=http://${MISTBORN_BIND_IP}:5000/auth/"
-      - "traefik.http.middlewares.mistborn_auth.forwardAuth.trustForwardHeader=true"
-      - "traefik.http.middlewares.mistborn_auth.forwardAuth.tls.insecureSkipVerify=true"
    environment:
      - ServerIP=10.2.0.3
      - DNS1='10.2.0.2#5054' # docs say port 5054, was 54; use network_mode: host to see which port is used

compose/production/traefik/dynamic.toml

@@ -11,15 +11,21 @@
 [http.services]
   [http.services.cockpit.loadBalancer]
     [[http.services.cockpit.loadBalancer.servers]]
-      url = "http://127.0.0.1:9090"
+      url = "http://10.2.3.1:9090"
 
 [http.routers]
   [http.routers.cockpit]
     rule = "Host(`cockpit.mistborn`)"
     service = "cockpit"
     entrypoints = ["web", "websecure"]
-    middlewares = ["mistborn_auth@docker"]
+    middlewares = ["mistborn_auth"]
 
 [http.middlewares]
+  [http.middlewares.mistborn_auth.forwardAuth]
+    address = "http://10.2.3.1:5000/auth/"
+    trustForwardHeader = true
+    [http.middlewares.mistborn_auth.forwardAuth.tls]
+      insecureSkipVerify = true
+  
   [http.middlewares.mistborn_headers.headers]
     hostsProxyHeaders = ['X-CSRFToken']

extra/scirius.yml

@@ -0,0 +1,72 @@
+version: '3'
+
+services:
+  scirius:
+    container_name: mistborn_production_scirius
+    image: "cyber5k/scirius:${MISTBORN_TAG}"
+    #environment:
+    #  - SECRET_KEY: <SECRET KEY>
+    env_file:
+      - ../.envs/.production/.wazuh
+      - ../.envs/.production/.scirius
+    volumes:
+      - /var/log/suricata:/logs
+      - /etc/suricata/rules:/etc/suricata/rules
+      - ../../mistborn_volumes/extra/scirius/static:/static
+      - ../../mistborn_volumes/extra/scirius/data:/data
+      - /var/run:/var/run:ro
+      - /var/run/suricata/suricata-command.socket:/var/run/suricata/suricata-command.socket:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.scirius-http.rule=Host(`scirius.mistborn`)"
+      - "traefik.http.routers.scirius-http.entrypoints=web"
+      - "traefik.http.routers.scirius-http.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.scirius-https.rule=Host(`scirius.mistborn`)"
+      - "traefik.http.routers.scirius-https.entrypoints=websecure"
+      - "traefik.http.routers.scirius-https.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.scirius-https.tls.certresolver=basic"
+      - "traefik.http.services.scirius-service.loadbalancer.server.port=8000"
+    restart: unless-stopped 
+
+#   filebeat:
+#     image: docker.elastic.co/beats/filebeat:${ELASTIC_VERSION:-7.9.1}
+#     # https://github.com/docker/swarmkit/issues/1951
+#     hostname: "{{.Node.Hostname}}-filebeat"
+#     # Need to override user so we can access the log files, and docker.sock
+#     user: root
+#     configs:
+#       - source: fb_config
+#         target: /usr/share/filebeat/filebeat.yml
+#     volumes:
+#       - filebeat:/usr/share/filebeat/data
+#       - /var/run/docker.sock:/var/run/docker.sock
+#       # This is needed for filebeat to load container log path as specified in filebeat.yml
+#       - /var/lib/docker/containers/:/var/lib/docker/containers/:ro
+
+#       # # This is needed for filebeat to load jenkins build log path as specified in filebeat.yml
+#       # - /var/lib/docker/volumes/jenkins_home/_data/jobs/:/var/lib/docker/volumes/jenkins_home/_data/jobs/:ro
+
+#       # This is needed for filebeat to load logs for system and auth modules
+#       - /var/log/:/var/log/:ro
+#       # This is needed for filebeat to load logs for auditd module. you might have to install audit system
+#       # on ubuntu first (sudo apt-get install -y auditd audispd-plugins)
+#       - /var/log/audit/:/var/log/audit/:ro
+#     environment:
+#       - ELASTICSEARCH_HOST=${ELASTICSEARCH_HOST}
+#       - KIBANA_HOST=${KIBANA_HOST}
+#       - ELASTICSEARCH_USERNAME=${ELASTICSEARCH_USERNAME}
+#       - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD}
+#     # disable strict permission checks
+#     command: ["--strict.perms=false"]
+
+# volumes:
+#   filebeat:
+
+networks:
+  default:
+    external:
+      name: mistborn_default
+
+# configs:
+#   fb_config:
+#     file: /opt/mistborn_volumes/scirius/init/filebeat.docker.yml

scripts/services/Mistborn-scirius.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=Mistborn Scirius Service
+Requires=Mistborn-wazuh.service
+After=Mistborn-wazuh.service
+PartOf=Mistborn-base.service
+
+[Service]
+Restart=always
+RestartSec=15
+User=root
+Group=docker
+PermissionsStartOnly=true
+# Shutdown container (if running) when unit is stopped
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml down
+
+# Start container when unit is started
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml up --build
+# Suricata
+ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius /opt/mistborn/scripts/services/scirius/suricata_start.sh
+
+# Stop container when unit is stopped
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml down
+# Post stop
+ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius /opt/mistborn/scripts/services/scirius/suricata_stop.sh
+
+[Install]
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-wazuh.service

@@ -7,7 +7,6 @@ PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
-TimeoutStartSec=600
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -18,12 +17,8 @@ ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose
 # Agent install
 ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent.sh
 ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_start.sh
-# Suricata
-ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_init.sh
-ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_start.sh
 # Stop container when unit is stopped
 ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
-ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_stop.sh
 ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_stop.sh
 
 [Install]

scripts/services/scirius/files/agent.conf

@@ -0,0 +1,6 @@
+<agent_config>
+    <localfile>
+        <log_format>json</log_format>
+        <location>/var/log/suricata/eve.json</location>
+    </localfile>
+</agent_config>

scripts/services/scirius/files/filebeat.docker.yml

@@ -0,0 +1,62 @@
+filebeat.modules:
+- module: suricata 
+  eve:
+    enabled: true
+    var.paths: ["/var/log/suricata/eve.json"]
+# - module: system
+#   syslog:
+#     enabled: true
+#   auth:
+#     enabled: true
+# - module: auditd
+#   log:
+#     # - Does not look like Auditd is supported in Alpine linux: https://github.com/linuxkit/linuxkit/issues/52
+#     # - CentOS does not need us to install the audit system, it ships as standard. If you are using Ubuntu, though,
+#     # this is probably something you would want to install. (sudo apt-get install -y auditd audispd-plugins)
+#     enabled: true
+
+#filebeat.inputs:
+#- type: container
+#  enabled: true
+#  paths:
+#    -/var/lib/docker/containers/*/*.log
+#  stream: all # can be all, stdout or stderr
+
+#========================== Filebeat autodiscover ==============================
+# See this URL on how to run Apache2 Filebeat module: # https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html
+filebeat.autodiscover:
+  providers:
+    - type: docker
+      # https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover-hints.html
+      # This URL alos contains instructions on multi-line logs
+      hints.enabled: true
+
+#================================ Processors ===================================
+processors:
+#- add_cloud_metadata: ~
+- add_docker_metadata: ~
+- add_locale:
+    format: offset
+- add_host_metadata:
+    netinfo.enabled: true
+
+#========================== Elasticsearch output ===============================
+output.elasticsearch:
+  hosts: ["${ELASTICSEARCH_HOST}:9200"]
+  username: ${ELASTICSEARCH_USERNAME}
+  password: ${ELASTICSEARCH_PASSWORD}
+
+#============================== Dashboards =====================================
+setup.dashboards:
+  enabled: true
+
+#============================== Kibana =========================================
+setup.kibana:
+  host: "${KIBANA_HOST}:80"
+  username: ${ELASTICSEARCH_USERNAME}
+  password: ${ELASTICSEARCH_PASSWORD}
+
+#============================== Xpack Monitoring ===============================
+xpack.monitoring:
+  enabled: true
+  elasticsearch:

scripts/services/scirius/init.sh

@@ -13,7 +13,7 @@ source /opt/mistborn/scripts/subinstallers/platform.sh
 # minimal dependencies
 sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
                 libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
-                make libmagic-dev libjansson-dev jq wget
+                make libmagic-dev libjansson-dev
 
 ## recommended dependencies
 #sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
@@ -55,24 +55,11 @@ fi
 # sudo chown root:root /etc/rsyslog.d/20-suricata.conf
 # sudo systemctl restart rsyslog
 
-# rules
-pushd .
-cd /tmp
-wget https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz
-tar zxvf emerging.rules.tar.gz
-sudo -E rm /etc/suricata/rules/* -f
-sudo -E mv rules/*.rules /etc/suricata/rules/
-popd
-
-# suricata yaml
-sudo -E rm -f /etc/suricata/suricata.yaml
-sudo -E wget -O /etc/suricata/suricata.yaml http://www.branchnetconsulting.com/wazuh/suricata.yaml
-
 IFACE=$(ip -o -4 route show to default | awk 'NR==1{print $5}')
 sudo sed -i "s/eth0/${IFACE}/g" /etc/suricata/suricata.yaml
 sudo sed -i "s/eth0/${IFACE}/g" /etc/default/suricata
 
-#systemctl restart suricata
+systemctl restart suricata
 
 # wait for service to be listening
 while ! nc -z 10.2.3.1 55000; do
@@ -86,14 +73,14 @@ pushd .
 cd /opt/mistborn
 
 # ensure group exists
-sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -g suricata -q 2>/dev/null
+sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -g suricata -q 2>/dev/null
 
 # add this host to group
-WAZUH_ID=$(sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/manage_agents -l | egrep ^\ *ID | grep $(hostname) | awk '{print $2}' | tr -d ',')
-sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -i ${WAZUH_ID} -g suricata -q
+WAZUH_ID=$(sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/manage_agents -l | egrep ^\ *ID | grep $(hostname) | awk '{print $2}' | tr -d ',')
+sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -i ${WAZUH_ID} -g suricata -q
 
 # write agent.conf
-sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh bash -c "cat > /var/ossec/etc/shared/suricata/agent.conf << EOF
+sudo docker-compose -f extra/wazuh.yml exec -T wazuh bash -c "cat > /var/ossec/etc/shared/suricata/agent.conf << EOF
 <agent_config>
     <localfile>
         <log_format>json</log_format>
@@ -104,26 +91,11 @@ EOF
 "
 
 # restart manager
-sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml restart wazuh
+sudo docker-compose -f extra/wazuh.yml restart wazuh
 
 popd
 
-# suricata-update
-sudo -E apt install python3-pip
-sudo -E pip3 install pyyaml
-sudo -E pip3 install https://github.com/OISF/suricata-update/archive/master.zip
 
-sudo -E pip3 install --pre --upgrade suricata-update
-
-# sudo -E suricata-update enable-source oisf/trafficid
-# sudo -E suricata-update enable-source etnetera/aggressive
-# sudo -E suricata-update enable-source sslbl/ssl-fp-blacklist
-# sudo -E suricata-update enable-source et/open
-# sudo -E suricata-update enable-source tgreen/hunting
-# sudo -E suricata-update enable-source sslbl/ja3-fingerprints
-# sudo -E suricata-update enable-source ptresearch/attackdetection
-
-sudo -E suricata-update
-
-sudo systemctl daemon-reload
-sudo systemctl restart suricata
+mkdir -p /opt/mistborn_volumes/extra/scirius/init/ >/dev/null 2>&1
+chmod -R +x /opt/mistborn_volumes/extra/scirius/init/
+cp /opt/mistborn/scripts/services/scirius/files/filebeat.docker.yml /opt/mistborn_volumes/extra/scirius/init/

scripts/services/scirius/suri_reloader

@@ -0,0 +1,117 @@
+#!/usr/bin/python3
+"""
+Copyright(C) 2014-2020, Stamus Networks
+Written by Eric Leblond <eleblond@stamus-networks.com>
+
+This file is part of Scirius.
+
+Scirius is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+Scirius is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with Scirius.  If not, see <http://www.gnu.org/licenses/>.
+"""
+
+import pyinotify
+import argparse
+import subprocess
+import logging
+import os
+
+have_daemon = True
+try:
+    import daemon
+    import daemon.pidfile as pidlockfile
+except:
+    logging.warning("No daemon support available, install python-daemon if feature is needed")
+    have_daemon = False
+
+RELOAD_FILE = "scirius.reload"
+
+parser = argparse.ArgumentParser(description='Suricata reloader')
+parser.add_argument('-r', '--reload', default=False, action="store_true", help="If set reload Suricata instead of restarting")
+parser.add_argument('-p', '--path', default='/etc/suricata/rules', help='Directory to monitor for scirius.reload file')
+parser.add_argument('-l', '--log', default=None, help='File to log output to (default to stdout)')
+parser.add_argument('-v', '--verbose', default=False, action="count", help="Show verbose output, use multiple times increase verbosity")
+if have_daemon:
+    parser.add_argument('-D', '--daemon', default=False, action="store_true", help="Run as unix daemon")
+    parser.add_argument('-P', '--pidfile', default='/var/run/suri-reloader.pid', help='PID file for suri-reloader')
+
+args = parser.parse_args()
+
+if args.verbose >= 3:
+    loglevel=logging.DEBUG
+elif args.verbose >= 2:
+    loglevel=logging.INFO
+elif args.verbose >= 1:
+    loglevel=logging.WARNING
+else:
+    loglevel=logging.ERROR
+
+def SuriReload(reload = False):
+    if reload:
+        if subprocess.call(['service', 'suricata', 'reload']):
+            logging.error("Unable to reload suricata")
+        else:
+            logging.info("Reloaded suricata")
+    else:
+        if subprocess.call(['service', 'suricata', 'restart']):
+            logging.error("Unable to restart suricata")
+        else:
+            logging.info("Restarted suricata")
+
+class EventHandler(pyinotify.ProcessEvent):
+    def process_IN_CLOSE_WRITE(self, event):
+        if not RELOAD_FILE in event.pathname:
+            return
+        SuriReload(self.reload)
+        os.unlink(event.pathname)
+
+    def set_mode(self, mode):
+        if mode == "reload":
+            self.reload = True
+        else:
+            self.reload = False
+
+def setup_logging(args):
+    if args.log:
+        logging.basicConfig(filename=args.log,
+                            format='%(asctime)s %(name)-12s %(levelname)-8s %(message)s',
+                            level=loglevel)
+    else:
+        logging.basicConfig(level=loglevel)
+
+def main_task(args):
+    setup_logging(args)
+
+    reload_file = os.path.join(args.path, RELOAD_FILE)
+    if os.path.isfile(reload_file):
+        SuriReload(args.reload)
+        os.unlink(reload_file)
+
+    handler = EventHandler()
+    if args.reload:
+        handler.set_mode("reload")
+    else:
+        handler.set_mode("restart")
+
+    wm = pyinotify.WatchManager()  # Watch Manager
+    mask = pyinotify.IN_CLOSE_WRITE
+    notifier = pyinotify.Notifier(wm, handler)
+    wdd = wm.add_watch(args.path, mask, rec=True)
+    logging.info("Starting filesystem monitoring")
+    notifier.loop()
+
+if have_daemon and args.daemon:
+    pidfile = pidlockfile.TimeoutPIDLockFile(args.pidfile)
+    with daemon.DaemonContext(pidfile=pidfile):
+        main_task(args)
+else:
+    main_task(args)

scripts/services/scirius/suricata_start.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+systemctl start suricata
+systemctl enable suricata
+
+apt-get install -y python-pyinotify
+python /opt/mistborn/scripts/services/scirius/suri_reloader -p /etc/suricata/rules &

scripts/services/scirius/suricata_stop.sh

@@ -3,4 +3,4 @@
 systemctl stop suricata
 systemctl disable suricata
 
-#kill $(pgrep -f suri_reloader) 2>/dev/null
+kill $(pgrep -f suri_reloader) 2>/dev/null

scripts/services/wazuh/suricata/suricata_start.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-
-systemctl start suricata
-systemctl enable suricata
-
-#apt-get install -y python-pyinotify
-#python /opt/mistborn/scripts/services/scirius/suri_reloader -p /etc/suricata/rules &

scripts/subinstallers/docker_manual.sh

@@ -67,8 +67,3 @@ echo "Installing Docker Compose"
 sudo pip3 install cryptography==3.3.2 docker-compose
 #fi
 
-
-# check raspbian fixes
-if [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
-    source ./scripts/subinstallers/docker_raspbian.sh 
-fi

scripts/subinstallers/docker_raspbian.sh

@@ -1,44 +0,0 @@
-#!/bin/bash
-
-set +e
-
-compare_version() {
-  local versionOne="${1}"
-  local comparision="${2}"
-  local versionTwo="${3}"
-  local result=
-  local sortOpt=
-  local returncode=1
- 
-  if [[ "${versionOne}" == "${versionTwo}" ]] ; then
-    return 3
-  fi
- 
-  case ${comparision} in
-    lower|smaller|older|lt|"<" ) sortOpt= ;;
-    higher|bigger|newer|bt|">" ) sortOpt='r' ;;
-    * ) return 2 ;;
-  esac
- 
-  result=($(printf "%s\n" "${versionOne}" "${versionTwo}" | sort -${sortOpt}V ))
-  if [[ "${versionOne}" == "${result[0]}" ]] ; then
-    returncode=0
-  fi
- 
-  return ${returncode}
-} # end of function compare_version
-
-# libseccomp2
-LIBSECCOMP2_VERSION=$(sudo -E apt-cache policy libseccomp2 | egrep ^\ *Inst | awk '{print $2}')
-
-compare_version $LIBSECCOMP2_VERSION '<' '2.5.1-1'
-
-if [ $? -eq 0 ]; then
-    # this is dumb but the raspbian repo managers aren't impressive
-    echo "Installing newer libseccomp2"
-    pushd .
-    cd /tmp
-    wget http://ftp.us.debian.org/debian/pool/main/libs/libseccomp/libseccomp2_2.5.1-1_$(dpkg --print-architecture).deb
-    sudo dpkg -i libseccomp2_2.5.1-1_$(dpkg --print-architecture).deb
-    popd
-fi

scripts/subinstallers/extra/scirius.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# Scirius
+SCIRIUS_PROD_FILE="$1"
+SCIRIUS_SECRET_KEY=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(50)]))")
+echo "SECRET_KEY=$SCIRIUS_SECRET_KEY" > $SCIRIUS_PROD_FILE
+echo "ALLOWED_HOSTS=scirius.mistborn" >> $SCIRIUS_PROD_FILE
+echo "DJANGO_SUPERUSER_USERNAME=mistborn" >> $SCIRIUS_PROD_FILE
+echo "DJANGO_SUPERUSER_EMAIL=mistborn@email.mistborn" >> $SCIRIUS_PROD_FILE
+
+echo "ELASTICSEARCH_HOST=10.2.3.1" >> $SCIRIUS_PROD_FILE
+echo "KIBANA_HOST=wazuh.mistborn" >> $SCIRIUS_PROD_FILE
+
+echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $SCIRIUS_PROD_FILE
+
+chmod 600 $SCIRIUS_PROD_FILE

scripts/wrappers/mistborn_docker.sh

@@ -37,12 +37,6 @@ for SERVICE in "${SERVICES_ARRAY[@]}"; do
     fi
 done
 
-# check that netcat exists
-if ! [ -x "$(command -v nc)" ]; then
-    echo "Installing netcat"
-    sudo apt-get install -y netcat
-fi
-
 # ensure base is up and listening
 echo "Checking that Mistborn-base has finished starting up..."