dvash 0.0.1 → 0.0.2

data/dvash.gemspec

@@ -2,15 +2,15 @@
 
 Gem::Specification.new do |s|
   s.name = "dvash"
-  s.version = "0.0.1"
+  s.version = "0.0.2"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Ari Mizrahi"]
-  s.date = "2013-04-01"
+  s.date = "2013-04-26"
   s.description = "Part honeypot, part defense system.  Opens up ports and simulates services in order to look like an attractive target.  Hosts that try to connect to the fake services are considered attackers and blocked from all access."
   s.email = "codemunchies@gmail.com"
   s.executables = ["dvash"]
-  s.files = ["lib/dvash/honeyports/ipv4/http.rb", "lib/dvash/honeyports/ipv6/http.rb", "lib/dvash/os/linux.rb", "lib/dvash/os/mac.rb", "lib/dvash/os/windows.rb", "lib/dvash/application.rb", "lib/dvash/validation.rb", "lib/dvash.rb", "dvash.gemspec", "Gemfile"]
+  s.files = ["etc/dvash-baseline.conf", "lib/dvash/honeyports/ipv4/http.rb", "lib/dvash/honeyports/ipv6/http.rb", "lib/dvash/os/linux.rb", "lib/dvash/os/mac.rb", "lib/dvash/os/windows.rb", "lib/dvash/application.rb", "lib/dvash/validation.rb", "lib/dvash.rb", "dvash.gemspec", "Gemfile"]
   s.homepage = "http://github.com/codemunchies/dvash"
   s.require_paths = ["lib"]
   s.rubygems_version = "1.8.25"

data/etc/dvash-baseline.conf

@@ -0,0 +1,45 @@
+###############################################################################
+#
+#  Dvash Configuration File
+#
+###############################################################################
+
+###############################################################################
+#
+#  Honeyports are listed here according to the filename of the module in the
+#  honeyports path.  Dvash will automatically look for the honeyport load it
+#  if it is enabled here.
+#
+#  Enabled:
+#  ipv4_http = true
+#
+#  Disabled:
+#  ipv4_http = false
+#
+###############################################################################
+[honeyports]
+ipv4_http = true
+ipv6_http = false
+ipv4_ssh = false
+ipv6_ssh = false
+ipv4_telnet = false
+
+###############################################################################
+#
+#  Dvash configures iptables and ip6tables for linux using the binaries 
+#  according to the paths you configure here.
+#
+###############################################################################
+[iptables]
+ipv4 = /usr/sbin/iptables
+ipv6 = /usr/sbin/ip6tables
+
+###############################################################################
+#
+#  Dvash configures ipfw for mac using the binaries according to the paths
+#  you configure here.
+#
+###############################################################################
+[ipfw]
+ipfw = /sbin/ipfw
+

data/lib/dvash/application.rb

@@ -10,6 +10,7 @@ module Dvash
 			@honey_threads = Array.new
 			@paths = paths
 
+			load_conf
 			validate_os
 		end
 
@@ -19,7 +20,6 @@ module Dvash
 				exit
 			end
 
-			load_conf
 			load_honeyport
 			@honey_threads.each { |thr| thr.join }
 		end

data/lib/dvash/honeyports/ipv4/http.rb

@@ -18,7 +18,9 @@ module Dvash
 			    Thread.fork(server.accept) do |client| 
 			        # send the client junk data
 			        client.puts(random_data)
-			        @@os.block_ip(client_ip(client))
+			        if valid_ip?(client_ip(client)) then 
+			        	@@os.block_ip(client_ip(client))
+			        end
 			        client.close
 			    end
 			end

data/lib/dvash/honeyports/ipv6/http.rb

@@ -18,7 +18,9 @@ module Dvash
 			    Thread.fork(server.accept) do |client| 
 			        # send the client junk data
 			        client.puts(random_data)
-			        @@os.block_ip(client_ip(client))
+			        if valid_ip?(client_ip(client)) then 
+			        	@@os.block_ip(client_ip(client))
+			        end
 			        client.close
 			    end
 			end

data/lib/dvash/os/linux.rb

@@ -1,15 +1,43 @@
 module Dvash
 
-	class Linux
+	class Linux < Validation
 
 		def initialize
+			unless File.exist?(@@cfgfile['iptables']['ipv4'])
+				puts "can't find iptables"
+				exit
+			end
 
-			# TODO: prepare iptables
+			# do not create if it has already been created
+			unless `"#{@@cfgfile['iptables']['ipv4']}" -L INPUT`.include?('DVASH')
+				# create a new chain
+				system("#{@@cfgfile['iptables']['ipv4']} -N DVASH")
+				# flush the new chain
+				system("#{@@cfgfile['iptables']['ipv4']} -F DVASH")
+				# associate new chain to INPUT chain
+				system("#{@cfgfile['iptables']['ipv4']} -I INPUT -j DVASH")
+			end
+
+			# do not create if it has already been created
+			unless `"#{@@cfgfile['iptables']['ipv6']}" -L INPUT`.include?('DVASH')
+				# create a new chain
+				system("#{@@cfgfile['iptables']['ipv6']} -N DVASH")
+				# flush the new chain
+				system("#{@@cfgfile['iptables']['ipv6']} -F DVASH")
+				# associate new chain to INPUT chain
+				system("#{@@cfgfile['iptables']['ipv6']} -I INPUT -j DVASH")
+			end
 		end
 
 		def block_ip(address)
 
-			# TODO
+			if IPAddr.new("#{address}").ipv4? then
+				system("#{@@cfgfile['iptables']['ipv4']} -I DVASH -s #{badip} -j DROP")
+			end
+
+			if IPAddr.new("#{address}").ipv6? then
+				system("#{@@cfgfile['iptables']['ipv6']} -I DVASH -s #{badip} -j DROP")
+			end
 		end
 
 	end

data/lib/dvash/os/mac.rb

@@ -2,6 +2,13 @@ module Dvash
 
 	class Mac < Validation
 
+		def initialize
+			unless File.exist?(@@cfgfile['ipfw']['ipfw'])
+				puts "can't find ipfw"
+				exit
+			end
+		end
+
 		def block_ip(address)
 			system("#{@@cfgfile['ipfw']['ipfw']} -q add deny src-ip #{address}")
 		end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dvash
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-04-01 00:00:00.000000000 Z
+date: 2013-04-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: parseconfig
@@ -52,6 +52,7 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- etc/dvash-baseline.conf
 - lib/dvash/honeyports/ipv4/http.rb
 - lib/dvash/honeyports/ipv6/http.rb
 - lib/dvash/os/linux.rb