WAF>> OpenPortNotifier>> 返回
项目作者： fnzv

项目描述 ：
Simple tool to monitor network changes over time and trigger alerts
高级语言： Go
项目地址: git://github.com/fnzv/OpenPortNotifier.git
创建时间： 2018-03-03T12:17:49Z
项目社区：https://github.com/fnzv/OpenPortNotifier
开源协议：GNU General Public License v3.0
下载


OpenPortNotifier

Build Status

Simple tool to monitor network changes over time and trigger alerts.

Demo

asciicast

Requirements

  • Golang (optional if you compile the sources)
  • masscan
  • postfix/smtp relay (optional for want E-mail reports)
  • mysql (optional if you want to track changes over time)

Quickstart

Run the bash script (install.sh) to install all the required dependencies.
WARNING: this script will install automatically postfix,mysql-server and masscan

bash install.sh

Downloads the binaries and installs them into your system, after you changed the example configuration (/etc/opn/opn.conf) you can run the scans with the command:

  2. ### Use cases
  3. - Continuos scanning of your Networks and monitor service exposure (All scans are saved into Mysql and/or sent via email/tg).. "pro-tip" -> run on crontab -> http://crontab.guru/
  4. - Constant Alerting of critical service or when a firewall (could be software or hardware) stops working
  5. - Tracking service/hosts from your VPN/Allowed cidr to know where your services are without running everytime the slow Nmap 
  7. ### Integrating OPN with Metabase:
  8. - Install Metabase and connect the OPN database, then you can easily create dashboards to dynamically track hosts on your networks.
  9. - The example below is made in 10 minutes (https://www.metabase.com/ - docker run -d -p 3000:3000 --name metabase metabase/metabase) and connected the db to Metabase + running OPN on crontab so every XYZ hour/minutes i can just check the dashboard and see the email report/telegram notifications.
  11. ![](OPN-Metabase.png?raw=true)
  13. ### Compile
  15. To compile and install binaries run: 
  16. WARNING: this script will install automatically postfix,mysql-server and masscan
  18. ```bash compile.sh

If you already have Golang installed and know your stuff you can just get the sources from the src/ folder and build the .go files.

How OPN works

  • Reads from /etc/opn/opn.conf configuration, if these values (SMTPhost,MysqlAuth,Telegram) are nulled (“”) will be skipped and the feature is omitted
  • Scan the Networks using Masscan (because nmap is slow)
  • Send output to screen and trigger alerts if ports open are on “CriticalPorts” list
  • All the scans are saved into the configured database
  • For large scans set a bigger ulimit (open files limit) and max_connections on mysql or the script will fail

Notes/Pro tips

  • Large scale scans require high ulimit setting ( http://posidev.com/blog/2009/06/04/set-ulimit-parameters-on-ubuntu/ )
  • Set high ammount of max connections on MySQL to sustain large scans (max_connections = 10000 on my.cnf or SET GLOBAL)
  • Once OPN is installed you can just insert the following cron 00 0 * * * root opn to run the scan every day at 00:00
  • Installing an OpenVPN/IPSec client and let the traffic route to your VPN/Allowed Network so you can scan your entire nets and avoid FWs