{"id":24990021,"url":"https://github.com/secynic/nfsinkhole","last_synced_at":"2025-04-12T01:20:41.789Z","repository":{"id":57445985,"uuid":"68874908","full_name":"secynic/nfsinkhole","owner":"secynic","description":"nfsinkhole is a Python library and scripts for setting up a Linux server as a sinkhole (monitor, log/capture, and drop all traffic to a secondary interface).","archived":false,"fork":false,"pushed_at":"2017-04-08T05:34:35.000Z","size":137,"stargazers_count":12,"open_issues_count":4,"forks_count":3,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-03-25T21:02:06.140Z","etag":null,"topics":["bsd-license","firewalld","iptables","linux","netfilter","network","networking","rsyslog","service","sinkhole","syslog","syslog-ng","systemd","tcpdump"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/secynic.png","metadata":{"files":{"readme":"README.rst","changelog":"CHANGES.rst","contributing":"CONTRIBUTING.rst","funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-09-22T02:03:54.000Z","updated_at":"2024-07-29T04:35:19.000Z","dependencies_parsed_at":"2022-09-26T16:31:00.985Z","dependency_job_id":null,"html_url":"https://github.com/secynic/nfsinkhole","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secynic%2Fnfsinkhole","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secynic%2Fnfsinkhole/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secynic%2Fnfsinkhole/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secynic%2Fnfsinkhole/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/secynic","download_url":"https://codeload.github.com/secynic/nfsinkhole/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247878018,"owners_count":21011158,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bsd-license","firewalld","iptables","linux","netfilter","network","networking","rsyslog","service","sinkhole","syslog","syslog-ng","systemd","tcpdump"],"created_at":"2025-02-04T13:04:21.109Z","updated_at":"2025-04-12T01:20:41.753Z","avatar_url":"https://github.com/secynic.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"==========\nnfsinkhole\n==========\n\n.. image:: https://travis-ci.org/secynic/nfsinkhole.svg?branch=master\n    :target: https://travis-ci.org/secynic/nfsinkhole\n.. image:: https://coveralls.io/repos/github/secynic/nfsinkhole/badge.svg?branch=master\u0026dummy=none\n    :target: https://coveralls.io/github/secynic/nfsinkhole?branch=master\n.. image:: https://img.shields.io/badge/license-BSD%202--Clause-blue.svg\n    :target: https://github.com/secynic/nfsinkhole/tree/master/LICENSE.txt\n.. image:: https://img.shields.io/badge/python-2.6%2C%202.7%2C%203.3+-blue.svg\n.. image:: https://img.shields.io/badge/os-RHEL%2FCentOS%206%2F7-blue.svg\n.. image:: https://img.shields.io/badge/docs-release%20v0.1.0-green.svg?style=flat\n    :target: https://nfsinkhole.readthedocs.io/en/v0.1.0\n.. image:: https://readthedocs.org/projects/pip/badge/?version=latest\n    :target: https://nfsinkhole.readthedocs.io/en/latest\n.. image:: https://img.shields.io/badge/docs-dev-yellow.svg?style=flat\n    :target: https://nfsinkhole.readthedocs.io/en/dev\n\nSummary\n=======\n\nnfsinkhole is a Python library and scripts for setting up a Linux server\nas a sinkhole (monitor, log/capture, and drop all traffic to a secondary\ninterface).\n\nThe default setup arguments monitor/capture all traffic. Setup arguments are\nprovided to configure protocols, ports, rate limiting, logging,\nsource IP/CIDR exclusions from logging, and optional packet capture.\n\nAll sinkhole events are written to /var/log/nfsinkhole-events.log. Optionally,\nyou can enable tcpdump to output packet capture text to\n/var/log/nfsinkhole-pcap.log if your version of tcpdump supports packet\nprinting; otherwise reverts to /var/log/nfsinkhole.pcap.\n\n.. warning::\n\n    This version is considered experimental. Do not attempt to use this\n    library in production until tests via travis and docker are setup, stable,\n    and sufficiently covered.\n\n.. attention::\n\n    You are responsible for rotating log files (/var/log/nfsinkhole*), and\n    syslog forwarding must be configured manually (automation pending).\n\nFeatures\n========\n\n* Simple install script\n* Installs as a init.d/systemctl service\n* Service modifies iptables on start/stop, no need to persist iptables\n* rsyslog and syslog-ng supported\n* RedHat/CentOS 6/7 tested\n* Python 2.6+ and 3.3+ supported\n* Built-in support for dealing with SELinux/AppArmor\n* Packet capture of sinkhole traffic (printed output to log for tcpdump v4.5+)\n* Useful set of utilities\n* Detailed logging to /var/log/nfsinkhole-*\n* Syslog forwarding configuration (pending)\n* BSD license\n\nPlanned Improvements\n====================\n\n* API/class documentation\n* Tests via travis-ci/docker\n* Exception handling overhaul\n* Set logging level (currently debug)\n* BIND/Microsoft/etc DNS server configuration documentation/examples\n* Monitoring use case examples\n* Automatic configuration for syslog forwarding\n* SIEM parsers/apps/plugins\n* Official support/testing for more OS environments\n* Support handling exceptions for HIPS and other endpoint security products\n* Intelligent handling/handshakes (inspired by iptrap -\n  https://github.com/jedisct1/iptrap)\n\nLinks\n=====\n\nDocumentation\n-------------\n\nRelease v0.1.0\n^^^^^^^^^^^^^^\n\nhttps://nfsinkhole.readthedocs.io/en/v0.1.0\n\nGitHub master\n^^^^^^^^^^^^^\n\nhttps://nfsinkhole.readthedocs.io/en/latest\n\nGitHub dev\n^^^^^^^^^^\n\nhttps://nfsinkhole.readthedocs.io/en/dev\n\nExamples\n--------\n\nPending\n\nGithub\n------\n\nhttps://github.com/secynic/nfsinkhole\n\nPypi\n----\n\nhttps://pypi.python.org/pypi/nfsinkhole\n\nChanges\n-------\n\nhttps://nfsinkhole.readthedocs.io/en/latest/CHANGES.html\n\nDependencies\n============\n\nOS::\n\n    iptables (likely already included in base OS)\n    tcpdump (optional - likely already included in base OS)\n\nPython 2.6::\n\n    argparse\n\nPython 2.7, 3.3+::\n\n    None!\n\nInstalling\n==========\n\n.. attention::\n\n    The nfsinkhole service, iptables rules, and tcpdump must run as root.\n    You can still use user/virtualenv Python environments, for the library,\n    but ultimately, the core sinkhole will be run as root.\n\n.. note::\n\n    Replace any below occurence of \u003cINTERFACE\u003e with the name of your\n    sinkhole network interface name.\n\nBase OS (pip) -- RECOMMENDED\n----------------------------\n\nIf pip is not installed, you will first need to add the EPEL repo and install::\n\n    sudo yum install epel-release\n    sudo yum install python-pip\n\nRHEL/CentOS 6/7\n^^^^^^^^^^^^^^^\n\nBasic::\n\n    pip install --user --upgrade nfsinkhole\n    python ~/.local/bin/nfsinkhole-setup.py --interface \u003cINTERFACE\u003e --install --pcap\n\nvirtualenv::\n\n    pip install virtualenv\n    virtualenv nfsinkhole\n    source nfsinkhole/bin/activate\n    nfsinkhole/bin/pip install nfsinkhole\n    nfsinkhole/bin/python nfsinkhole/bin/nfsinkhole-setup.py --interface \u003cINTERFACE\u003e --install --pcap\n\nBase OS (no pip)\n----------------\n\nRHEL/CentOS 6\n^^^^^^^^^^^^^\n\nGitHub - Stable::\n\n    wget -O argparse.tar.gz https://github.com/ThomasWaldmann/argparse/tarball/master\n    tar -C argparse -zxvf argparse.tar.gz\n    cd argparse\n    python setup.py install --user prefix=\n    cd ..\n    rm -Rf argparse\n    wget -O nfsinkhole.tar.gz https://github.com/secynic/nfsinkhole/tarball/master\n    tar -C nfsinkhole -zxvf nfsinkhole.tar.gz\n    cd nfsinkhole\n    python setup.py install --user prefix=\n    cd ..\n    rm -Rf nfsinkhole\n    python ~/.local/bin/nfsinkhole-setup.py --interface \u003cINTERFACE\u003e --install --pcap\n\nRHEL/CentOS 7\n^^^^^^^^^^^^^\n\nGitHub - Stable::\n\n    wget -O nfsinkhole.tar.gz https://github.com/secynic/nfsinkhole/tarball/master\n    tar -C nfsinkhole -zxvf nfsinkhole.tar.gz\n    cd nfsinkhole\n    python setup.py install --user prefix=\n    cd ..\n    rm -Rf nfsinkhole\n    python ~/.local/bin/nfsinkhole-setup.py --interface \u003cINTERFACE\u003e --install --pcap\n\nService\n=======\n\nOnce installed you need to start the nfsinkhole service.\n\nRHEL/CentOS 6\n-------------\n\n::\n\n    sudo service nfsinkhole start\n\nRHEL/CentOS 7\n-------------\n\n::\n\n    sudo systemctl start nfsinkhole.service\n\nAPI\n===\n\nAppArmor\n--------\n\nAppArmor documentation:\n\nhttps://nfsinkhole.readthedocs.io/en/latest/apparmor.html\n\niptables\n--------\n\niptables documentation:\n\nhttps://nfsinkhole.readthedocs.io/en/latest/iptables.html\n\nrsyslog\n-------\n\nrsyslog documentation:\n\nhttps://nfsinkhole.readthedocs.io/en/latest/rsyslog.html\n\nSELinux\n-------\n\nSELinux documentation:\n\nhttps://nfsinkhole.readthedocs.io/en/latest/selinux.html\n\nService\n-------\n\nService (systemd/init.d) documentation:\n\nhttps://nfsinkhole.readthedocs.io/en/latest/service.html\n\nsyslog-ng\n---------\n\nsyslog-ng documentation:\n\nhttps://nfsinkhole.readthedocs.io/en/latest/syslog_ng.html\n\ntcpdump\n-------\n\ntcpdump documentation:\n\nhttps://nfsinkhole.readthedocs.io/en/latest/tcpdump.html\n\nUtilities\n---------\n\nUtilities documentation:\n\nhttps://nfsinkhole.readthedocs.io/en/latest/utils.html\n\nContributing\n============\n\nhttps://nfsinkhole.readthedocs.io/en/latest/CONTRIBUTING.html\n\nSpecial Thanks\n==============\n\nThank you JetBrains for the `PyCharm \u003chttps://www.jetbrains.com/pycharm/\u003e`_\nopen source support!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecynic%2Fnfsinkhole","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecynic%2Fnfsinkhole","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecynic%2Fnfsinkhole/lists"}