121 lines
4.9 KiB
Python
121 lines
4.9 KiB
Python
#!/usr/bin/env python3
|
|
"""Central configuration constants for the intrusion-detection system.
|
|
|
|
All tunable values (paths, router credentials, whitelist sources, scan
|
|
thresholds) live here so they can be maintained and overridden from a
|
|
single place. Values that make sense per-deployment are read from
|
|
environment variables; see ``.env.example`` for the supported keys.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Project root + .env loading
|
|
# ---------------------------------------------------------------------------
|
|
|
|
PROJECT_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
|
|
|
|
# Load `.env` for local development (python-dotenv, optional dependency).
|
|
# `load_dotenv` does NOT override variables already present in the system
|
|
# environment, so production deployments that set these via the OS keep
|
|
# working without a `.env` file (or even without python-dotenv installed).
|
|
try:
|
|
from dotenv import load_dotenv
|
|
|
|
load_dotenv(os.path.join(PROJECT_ROOT, ".env"))
|
|
except ImportError:
|
|
pass
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Project paths
|
|
# ---------------------------------------------------------------------------
|
|
|
|
DATA_DIR = os.path.join(PROJECT_ROOT, "data")
|
|
REPORT_DIR = os.path.join(PROJECT_ROOT, "reports")
|
|
|
|
# Per-analyzer report directories
|
|
COPYPARTY_REPORT_DIR = os.path.join(REPORT_DIR, "copyparty")
|
|
NPM_REPORT_DIR = os.path.join(REPORT_DIR, "npm")
|
|
|
|
# MikroTik reports + structured snapshots from each run
|
|
MIKROTIK_REPORT_DIR = os.path.join(REPORT_DIR, "mikrotik")
|
|
MIKROTIK_REPORT_DATA_DIR = os.path.join(MIKROTIK_REPORT_DIR, "data")
|
|
|
|
# Common MikroTik state (latest snapshot; overwritten each run, used for
|
|
# git diffing / auditing changes to firewall rules and address lists).
|
|
MIKROTIK_DATA_DIR = os.path.join(DATA_DIR, "mikrotik")
|
|
|
|
WHOIS_CACHE_PATH = os.path.join(DATA_DIR, "whois_cache.json")
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Log sources (configurable via environment)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
COPYPARTY_LOG_PATH = os.environ.get("COPYPARTY_LOG_PATH", r"P:\copyparty")
|
|
NPM_LOG_PATH = os.environ.get("NPM_LOG_PATH", r"Y:\npm\logs")
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# MikroTik router connection (configurable via environment)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
SSH_PORT = 22
|
|
SSH_TIMEOUT = 10 # seconds
|
|
|
|
ROUTER_IP = os.environ.get("ROUTER_IP", "192.168.88.1")
|
|
ROUTER_USER = os.environ.get("ROUTER_USER", "admin")
|
|
ROUTER_PASSWORD = os.environ.get("ROUTER_PASSWORD", "M11ffpgm")
|
|
|
|
BLOCKLIST_NAME = os.environ.get("BLOCKLIST_NAME", "Blocked")
|
|
WHITELIST_NAMES = [
|
|
name.strip()
|
|
for name in os.environ.get(
|
|
"WHITELIST_NAMES", "Cloudflare,Openfactory").split(",")
|
|
if name.strip()
|
|
]
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# WHOIS subnet consolidation
|
|
# ---------------------------------------------------------------------------
|
|
|
|
WHOIS_SERVER = os.environ.get("WHOIS_SERVER", "whois.radb.net")
|
|
WHOIS_PORT = int(os.environ.get("WHOIS_PORT", "43"))
|
|
WHOIS_TIMEOUT = float(os.environ.get("WHOIS_TIMEOUT", "3.0")) # seconds
|
|
# Minimum number of same-subnet IPs before blocking the whole subnet
|
|
SUBNET_THRESHOLD = int(os.environ.get("SUBNET_THRESHOLD", "3"))
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Scan / flagging defaults
|
|
# ---------------------------------------------------------------------------
|
|
|
|
DEFAULT_TOP = int(os.environ.get("DEFAULT_TOP", "30")
|
|
) # top-IP table rows
|
|
DEFAULT_MIN_DENIED = int(os.environ.get(
|
|
"DEFAULT_MIN_DENIED", "1")) # copyparty
|
|
DEFAULT_MIN_ERRORS = int(os.environ.get("DEFAULT_MIN_ERRORS", "5")) # npm
|
|
DEFAULT_ERROR_RATIO = float(os.environ.get(
|
|
"DEFAULT_ERROR_RATIO", "0.5")) # npm
|
|
DEFAULT_TOP_PATHS = int(os.environ.get("DEFAULT_TOP_PATHS", "20"))
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Whitelist sources (configurable via environment)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
OPENFACTORY_URL = os.environ.get(
|
|
"OPENFACTORY_URL", "https://openfactory.net/geofeed.csv")
|
|
CLOUDFLARE_URL_V4 = os.environ.get(
|
|
"CLOUDFLARE_URL_V4", "https://www.cloudflare.com/ips-v4")
|
|
CLOUDFLARE_URL_V6 = os.environ.get(
|
|
"CLOUDFLARE_URL_V6", "https://www.cloudflare.com/ips-v6")
|
|
PALOALTO_URL = os.environ.get(
|
|
"PALOALTO_URL",
|
|
"https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity",
|
|
)
|
|
|
|
# Local whitelist files (checked before remote download)
|
|
OPENFACTORY_FILE = os.path.join(DATA_DIR, "openfactory", "geofeed.csv")
|
|
CLOUDFLARE_V4_FILE = os.path.join(DATA_DIR, "cloudflare", "ips-v4.txt")
|
|
CLOUDFLARE_V6_FILE = os.path.join(DATA_DIR, "cloudflare", "ips-v6.txt")
|
|
PALOALTO_FILE = os.path.join(DATA_DIR, "paloalto", "scanner-ips.txt")
|