zwitschi
9f8ab0f61c
- Implemented a new utility for querying WHOIS information and consolidating IP addresses by subnet. - Added caching mechanism for WHOIS responses to improve performance. - Introduced functions for loading and saving the WHOIS cache, querying subnets, and consolidating IPs based on a threshold. feat: create Flask web UI for intrusion detection system - Developed a Flask web application to manage the intrusion detection system. - Implemented routes for scanning, reports, blocklist management, and firewall configuration. - Added helper functions for reading files and handling requests. feat: define routes for web UI - Registered routes for various web pages and API endpoints in the Flask application. - Implemented functionality for scanning, reporting, blocklist management, and firewall state retrieval. feat: implement background scan runner for web UI - Created a background scan runner to handle scan jobs in a separate thread. - Managed an in-memory job store for tracking scan jobs and their statuses. - Added persistence for scan jobs to maintain state across application restarts. chore: update start script for Flask application - Enhanced the PowerShell start script to check for the existence of the virtual environment. - Added comments and structured the script for better readability and usability.
85 lines
3.0 KiB
Bash
85 lines
3.0 KiB
Bash
# ---------------------------------------------------------------------------
|
|
# Intrusion Detection System — environment template
|
|
# ---------------------------------------------------------------------------
|
|
# Copy this file to `.env` for local development and fill in your values:
|
|
#
|
|
# copy .env.example .env
|
|
#
|
|
# Precedence: real system environment variables win over values in `.env`,
|
|
# so production deployments can set these via the OS and skip `.env`.
|
|
# `.env` is git-ignored — never commit real secrets to it.
|
|
|
|
# --- Web server (localhost only) -------------------------------------------------
|
|
|
|
# The Flask web UI binds to localhost so it is only reachable from this machine.
|
|
# Do not expose WEB_HOST beyond 127.0.0.1!
|
|
WEB_HOST=127.0.0.1
|
|
# Please choose a very high port number (e.g. 54666) to avoid conflicts with other services.
|
|
WEB_PORT=54666
|
|
|
|
# --- Log sources -----------------------------------------------------------
|
|
|
|
# Directory containing copyparty access logs (YYYY-MM-DD.txt files).
|
|
COPYPARTY_LOG_PATH=P:\copyparty
|
|
|
|
# Directory containing Nginx Proxy Manager proxy logs (.log / .gz files).
|
|
NPM_LOG_PATH=Y:\npm\logs
|
|
|
|
# --- MikroTik RouterOS connection -----------------------------------------
|
|
|
|
# IP/hostname of the router to sync the blocklist to.
|
|
ROUTER_IP=192.168.88.1
|
|
|
|
# SSH user for the router.
|
|
ROUTER_USER=admin
|
|
|
|
# SSH password for the router (required when --update-firewall is used).
|
|
ROUTER_PASSWORD=change-me
|
|
|
|
# Address list on the router that holds blocked IPs/subnets.
|
|
BLOCKLIST_NAME=Blocked
|
|
|
|
# Comma-separated address lists that are treated as whitelisted (never blocked).
|
|
WHITELIST_NAMES=Cloudflare,Openfactory
|
|
|
|
# --- WHOIS subnet consolidation --------------------------------------------
|
|
|
|
WHOIS_SERVER=whois.radb.net
|
|
WHOIS_PORT=43
|
|
WHOIS_TIMEOUT=3.0
|
|
|
|
# Minimum number of same-subnet IPs before blocking the whole subnet.
|
|
SUBNET_THRESHOLD=3
|
|
|
|
# --- Report retention ------------------------------------------------------
|
|
|
|
# Each subdirectory under /reports/ keeps at most REPORT_RETENTION_MAX_FILES
|
|
# files, all newer than REPORT_RETENTION_DAYS days. Older timestamped reports
|
|
# are pruned automatically after each consolidated scan. The blocklist files
|
|
# in reports/app/data/ are always protected.
|
|
REPORT_RETENTION_DAYS=30
|
|
REPORT_RETENTION_MAX_FILES=10
|
|
|
|
# --- Scan / flagging defaults ----------------------------------------------
|
|
|
|
# Rows in the top-IP report tables.
|
|
DEFAULT_TOP=30
|
|
|
|
# copyparty: minimum denied hits before flagging an IP.
|
|
DEFAULT_MIN_DENIED=1
|
|
|
|
# npm: minimum error responses before flagging an IP.
|
|
DEFAULT_MIN_ERRORS=5
|
|
|
|
# npm: minimum error ratio before flagging an IP.
|
|
DEFAULT_ERROR_RATIO=0.5
|
|
|
|
# Rows in the "top error paths" report section.
|
|
DEFAULT_TOP_PATHS=20
|
|
|
|
# --- Whitelist sources -----------------------------------------------------
|
|
|
|
OPENFACTORY_URL=https://openfactory.net/geofeed.csv
|
|
CLOUDFLARE_URL_V4=https://www.cloudflare.com/ips-v4
|
|
CLOUDFLARE_URL_V6=https://www.cloudflare.com/ips-v6
|
|
PALOALTO_URL=https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity |