net-sentry 0.1.0__tar.gz

net_sentry-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Lukasz Szymanski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

net_sentry-0.1.0/PKG-INFO

@@ -0,0 +1,215 @@
+Metadata-Version: 2.4
+Name: net-sentry
+Version: 0.1.0
+Summary: A lightweight Linux network sentinel and threat monitoring daemon
+Author: Lukasz Szymanski
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Lukasz-Szymanski/net-sentry
+Project-URL: Documentation, https://github.com/Lukasz-Szymanski/net-sentry#readme
+Project-URL: Repository, https://github.com/Lukasz-Szymanski/net-sentry.git
+Project-URL: Issues, https://github.com/Lukasz-Szymanski/net-sentry/issues
+Keywords: linux,security,network-monitor,threat-detection,firewall,ids
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Networking :: Monitoring
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: psutil>=5.9.0
+Requires-Dist: rich>=13.0.0
+Requires-Dist: requests>=2.28.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.0.0; extra == "dev"
+Requires-Dist: twine>=5.0.0; extra == "dev"
+Dynamic: license-file
+
+# 🛡️ NetSentry
+
+[![CI](https://github.com/Lukasz-Szymanski/net-sentry/actions/workflows/ci.yml/badge.svg)](https://github.com/Lukasz-Szymanski/net-sentry/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/net-sentry.svg)](https://pypi.org/project/net-sentry/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Linux Daemon](https://img.shields.io/badge/platform-Linux-orange.svg)](https://kernel.org)
+
+**NetSentry** is a lightweight, real-time Linux network bodyguard and threat sentinel. Running silently in the background or interactively via an htop-style terminal dashboard (TUI), NetSentry correlates network sockets with Linux processes, flags suspicious outbound connections (reverse shells, untrusted `/tmp` binaries, known malicious botnets/C2 nodes), and dispatches desktop notifications or executes firewall countermeasures.
+
+---
+
+## ✨ Features
+
+- 🕵️ **Process-Network Correlation**: Maps every active socket to its PID, executable path, process name, and user.
+- 🚨 **Real-Time Threat Detection**:
+  - **Reverse Shell Detection**: Detects shells (`bash`, `zsh`, `sh`) or net tools (`nc`, `socat`) opening remote sockets.
+  - **Untrusted Path Execution**: Flags binaries running from temporary directories like `/tmp/`, `/dev/shm/`, or `/var/tmp/`.
+  - **Suspicious Port Alerts**: Identifies connections on backdoor ports (4444, 1337, 31337, 6667, etc.).
+  - **Threat Intelligence**: Built-in and downloadable IP reputation feeds (Tor exits, botnet C2s, scanner IPs).
+- 🖥️ **Live Terminal Dashboard (TUI)**: Beautiful `htop`-style live monitoring dashboard built with Rich.
+- 🔔 **Linux Desktop Notifications**: Native `notify-send` desktop popups with rate-limiting and urgency levels.
+- 🧱 **Firewall Integration**: One-click or automated IP dropping via `iptables` / `nftables` with loopback protection.
+- ⚙️ **Systemd Integration**: Single-command user service setup (`netsentry install-service`).
+
+---
+
+## 🏗️ Architecture
+
+```
+                      ┌────────────────────────┐
+                      │ Linux Kernel / Sockets │
+                      └───────────┬────────────┘
+                                  │
+                                  ▼
+               ┌─────────────────────────────────────┐
+               │    Network Monitor (psutil/proc)    │
+               │  Maps sockets to PID & Binary Path  │
+               └──────────────────┬──────────────────┘
+                                  │
+                                  ▼
+               ┌─────────────────────────────────────┐
+               │         Threat Detector             │
+               ├──────────────────┬──────────────────┤
+               │ • Threat Intel   │ • Port Blacklist │
+               │ • Shell Sockets  │ • Untrusted Path │
+               └──────────────────┬──────────────────┘
+                                  │
+                  ┌───────────────┼───────────────┐
+                  ▼               ▼               ▼
+           ┌────────────┐  ┌─────────────┐  ┌────────────┐
+           │ Desktop UI │  │  SQLite DB  │  │  Firewall  │
+           │ (notify)   │  │  (sentry.db)│  │ (iptables) │
+           └────────────┘  └─────────────┘  └────────────┘
+```
+
+---
+
+## 🚀 Quick Start
+
+### 1. Installation
+
+#### Via `pipx` (Recommended on Linux)
+```bash
+pipx install net-sentry
+```
+
+#### Via `pip`
+```bash
+pip install net-sentry
+```
+
+#### From source (for development)
+```bash
+git clone https://github.com/Lukasz-Szymanski/net-sentry.git
+cd net-sentry
+
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -e ".[dev]"
+```
+
+### 2. Launch Interactive TUI Dashboard
+
+```bash
+netsentry tui
+```
+
+### 3. Start Background Monitoring Daemon
+
+```bash
+# Start background daemon
+netsentry start
+
+# Check running status
+netsentry status
+```
+
+### 4. Install GNOME Top Panel Indicator (Optional)
+
+To show the live shield status on the Linux top panel:
+
+```bash
+netsentry install-extension
+```
+
+Log out and log back in (Wayland) or press `Alt + F2` -> `r` (X11) to activate the shield in your top bar.
+
+---
+
+## 📖 CLI Commands
+
+| Command | Description |
+| :--- | :--- |
+| `netsentry tui` | Open the interactive real-time terminal dashboard |
+| `netsentry start` | Start the background monitoring daemon |
+| `netsentry start -f` | Run the monitoring daemon in foreground |
+| `netsentry stop` | Stop the running daemon |
+| `netsentry status` | Display daemon status, total alerts, and active connections |
+| `netsentry status --json` | Output system metrics and alerts in JSON format |
+| `netsentry scan` | Run an instant socket scan and print security analysis table |
+| `netsentry alerts` | Display recent security events recorded in SQLite |
+| `netsentry block <IP>` | Add IP to blacklist and apply firewall DROP rule |
+| `netsentry unblock <IP>` | Remove firewall DROP rule for IP |
+| `netsentry update-intel` | Download updated threat intelligence feeds |
+| `netsentry install-service` | Install and enable the background systemd user service |
+| `netsentry uninstall-service` | Stop and remove the systemd user service |
+| `netsentry install-extension` | Install and enable the GNOME Shell top panel extension |
+| `netsentry uninstall-extension` | Remove the GNOME Shell extension |
+
+---
+
+## ⚙️ Configuration
+
+Configuration is automatically generated on first run at:
+`~/.config/netsentry/config.json`
+
+```json
+{
+  "scan_interval_seconds": 2.0,
+  "desktop_notifications": true,
+  "notification_cooldown_seconds": 30,
+  "auto_block_threats": false,
+  "threat_score_threshold": 60,
+  "suspicious_ports": [23, 2323, 4444, 5555, 6667, 9001, 9050, 9051, 1337, 31337],
+  "whitelist_ips": ["127.0.0.1", "::1", "0.0.0.0"],
+  "whitelist_processes": ["systemd-resolved", "chronyd", "ntpd", "NetworkManager"]
+}
+```
+
+---
+
+## 🐧 Systemd Service (Autostart)
+
+To enable NetSentry as a systemd user service with a single command:
+
+```bash
+netsentry install-service
+```
+
+To stop and remove the service:
+
+```bash
+netsentry uninstall-service
+```
+
+---
+
+## 🧪 Testing
+
+```bash
+pytest -v
+```
+
+---
+
+## 📜 License
+
+Released under the [MIT License](LICENSE).

net_sentry-0.1.0/README.md

@@ -0,0 +1,179 @@
+# 🛡️ NetSentry
+
+[![CI](https://github.com/Lukasz-Szymanski/net-sentry/actions/workflows/ci.yml/badge.svg)](https://github.com/Lukasz-Szymanski/net-sentry/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/net-sentry.svg)](https://pypi.org/project/net-sentry/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Linux Daemon](https://img.shields.io/badge/platform-Linux-orange.svg)](https://kernel.org)
+
+**NetSentry** is a lightweight, real-time Linux network bodyguard and threat sentinel. Running silently in the background or interactively via an htop-style terminal dashboard (TUI), NetSentry correlates network sockets with Linux processes, flags suspicious outbound connections (reverse shells, untrusted `/tmp` binaries, known malicious botnets/C2 nodes), and dispatches desktop notifications or executes firewall countermeasures.
+
+---
+
+## ✨ Features
+
+- 🕵️ **Process-Network Correlation**: Maps every active socket to its PID, executable path, process name, and user.
+- 🚨 **Real-Time Threat Detection**:
+  - **Reverse Shell Detection**: Detects shells (`bash`, `zsh`, `sh`) or net tools (`nc`, `socat`) opening remote sockets.
+  - **Untrusted Path Execution**: Flags binaries running from temporary directories like `/tmp/`, `/dev/shm/`, or `/var/tmp/`.
+  - **Suspicious Port Alerts**: Identifies connections on backdoor ports (4444, 1337, 31337, 6667, etc.).
+  - **Threat Intelligence**: Built-in and downloadable IP reputation feeds (Tor exits, botnet C2s, scanner IPs).
+- 🖥️ **Live Terminal Dashboard (TUI)**: Beautiful `htop`-style live monitoring dashboard built with Rich.
+- 🔔 **Linux Desktop Notifications**: Native `notify-send` desktop popups with rate-limiting and urgency levels.
+- 🧱 **Firewall Integration**: One-click or automated IP dropping via `iptables` / `nftables` with loopback protection.
+- ⚙️ **Systemd Integration**: Single-command user service setup (`netsentry install-service`).
+
+---
+
+## 🏗️ Architecture
+
+```
+                      ┌────────────────────────┐
+                      │ Linux Kernel / Sockets │
+                      └───────────┬────────────┘
+                                  │
+                                  ▼
+               ┌─────────────────────────────────────┐
+               │    Network Monitor (psutil/proc)    │
+               │  Maps sockets to PID & Binary Path  │
+               └──────────────────┬──────────────────┘
+                                  │
+                                  ▼
+               ┌─────────────────────────────────────┐
+               │         Threat Detector             │
+               ├──────────────────┬──────────────────┤
+               │ • Threat Intel   │ • Port Blacklist │
+               │ • Shell Sockets  │ • Untrusted Path │
+               └──────────────────┬──────────────────┘
+                                  │
+                  ┌───────────────┼───────────────┐
+                  ▼               ▼               ▼
+           ┌────────────┐  ┌─────────────┐  ┌────────────┐
+           │ Desktop UI │  │  SQLite DB  │  │  Firewall  │
+           │ (notify)   │  │  (sentry.db)│  │ (iptables) │
+           └────────────┘  └─────────────┘  └────────────┘
+```
+
+---
+
+## 🚀 Quick Start
+
+### 1. Installation
+
+#### Via `pipx` (Recommended on Linux)
+```bash
+pipx install net-sentry
+```
+
+#### Via `pip`
+```bash
+pip install net-sentry
+```
+
+#### From source (for development)
+```bash
+git clone https://github.com/Lukasz-Szymanski/net-sentry.git
+cd net-sentry
+
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -e ".[dev]"
+```
+
+### 2. Launch Interactive TUI Dashboard
+
+```bash
+netsentry tui
+```
+
+### 3. Start Background Monitoring Daemon
+
+```bash
+# Start background daemon
+netsentry start
+
+# Check running status
+netsentry status
+```
+
+### 4. Install GNOME Top Panel Indicator (Optional)
+
+To show the live shield status on the Linux top panel:
+
+```bash
+netsentry install-extension
+```
+
+Log out and log back in (Wayland) or press `Alt + F2` -> `r` (X11) to activate the shield in your top bar.
+
+---
+
+## 📖 CLI Commands
+
+| Command | Description |
+| :--- | :--- |
+| `netsentry tui` | Open the interactive real-time terminal dashboard |
+| `netsentry start` | Start the background monitoring daemon |
+| `netsentry start -f` | Run the monitoring daemon in foreground |
+| `netsentry stop` | Stop the running daemon |
+| `netsentry status` | Display daemon status, total alerts, and active connections |
+| `netsentry status --json` | Output system metrics and alerts in JSON format |
+| `netsentry scan` | Run an instant socket scan and print security analysis table |
+| `netsentry alerts` | Display recent security events recorded in SQLite |
+| `netsentry block <IP>` | Add IP to blacklist and apply firewall DROP rule |
+| `netsentry unblock <IP>` | Remove firewall DROP rule for IP |
+| `netsentry update-intel` | Download updated threat intelligence feeds |
+| `netsentry install-service` | Install and enable the background systemd user service |
+| `netsentry uninstall-service` | Stop and remove the systemd user service |
+| `netsentry install-extension` | Install and enable the GNOME Shell top panel extension |
+| `netsentry uninstall-extension` | Remove the GNOME Shell extension |
+
+---
+
+## ⚙️ Configuration
+
+Configuration is automatically generated on first run at:
+`~/.config/netsentry/config.json`
+
+```json
+{
+  "scan_interval_seconds": 2.0,
+  "desktop_notifications": true,
+  "notification_cooldown_seconds": 30,
+  "auto_block_threats": false,
+  "threat_score_threshold": 60,
+  "suspicious_ports": [23, 2323, 4444, 5555, 6667, 9001, 9050, 9051, 1337, 31337],
+  "whitelist_ips": ["127.0.0.1", "::1", "0.0.0.0"],
+  "whitelist_processes": ["systemd-resolved", "chronyd", "ntpd", "NetworkManager"]
+}
+```
+
+---
+
+## 🐧 Systemd Service (Autostart)
+
+To enable NetSentry as a systemd user service with a single command:
+
+```bash
+netsentry install-service
+```
+
+To stop and remove the service:
+
+```bash
+netsentry uninstall-service
+```
+
+---
+
+## 🧪 Testing
+
+```bash
+pytest -v
+```
+
+---
+
+## 📜 License
+
+Released under the [MIT License](LICENSE).

net_sentry-0.1.0/pyproject.toml

@@ -0,0 +1,61 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "net-sentry"
+version = "0.1.0"
+description = "A lightweight Linux network sentinel and threat monitoring daemon"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+authors = [
+    { name = "Lukasz Szymanski" }
+]
+keywords = ["linux", "security", "network-monitor", "threat-detection", "firewall", "ids"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: System Administrators",
+    "Intended Audience :: Developers",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Security",
+    "Topic :: System :: Networking :: Monitoring",
+]
+dependencies = [
+    "psutil>=5.9.0",
+    "rich>=13.0.0",
+    "requests>=2.28.0",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0.0",
+    "build>=1.0.0",
+    "twine>=5.0.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/Lukasz-Szymanski/net-sentry"
+Documentation = "https://github.com/Lukasz-Szymanski/net-sentry#readme"
+Repository = "https://github.com/Lukasz-Szymanski/net-sentry.git"
+Issues = "https://github.com/Lukasz-Szymanski/net-sentry/issues"
+
+[project.scripts]
+netsentry = "netsentry.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+netsentry = ["data/**/*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+python_files = ["test_*.py"]

net_sentry-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+