maltrail/maltrail-sensor.service at master · stamparm/maltrail · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
[Unit]
Description=Maltrail. Sensor of malicious traffic detection system
Documentation=https://github.com/stamparm/maltrail#readme
Documentation=file:/opt/maltrail/sensor/docs/INSTALL.md
# Replaces the Python sensor. old/maltrail-sensor-old.service still starts that one if needed,
# but it is a test fixture rather than a supported alternative - see old/README.md.
Requires=network.target
Wants=maltrail-server.service
After=network-online.target maltrail-server.service

[Service]
Type=exec

# The sensor does NOT need root. Packet capture needs CAP_NET_RAW; promiscuous mode and
# PACKET_FANOUT need CAP_NET_ADMIN. Granting exactly those two and running as an unprivileged
# user means a parser bug in a packet-facing process cannot become root on the host.
#
#     groupadd --system maltrail
#     useradd --system --gid maltrail --no-create-home --shell /usr/sbin/nologin maltrail
#
# The groupadd is not optional: Group=maltrail below needs it to exist, and `useradd` only
# creates a matching group on distributions that default to per-user groups.
#
# StateDirectory/LogsDirectory create and chown the rest, so there is nothing else to set up:
#   /var/lib/maltrail   the trail set  (point TRAILS_FILE here)
#   /var/log/maltrail   the event logs (LOG_DIR)
DynamicUser=no
User=maltrail
Group=maltrail
StateDirectory=maltrail
StateDirectoryMode=0750
LogsDirectory=maltrail
LogsDirectoryMode=0750
# Event logs name internal addresses, domains and URLs. World-readable is the wrong default.
UMask=0027

AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN
CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN
NoNewPrivileges=yes

WorkingDirectory=/opt/maltrail
# `maltrail` has no home, and ProtectHome=yes hides one anyway, so the default
# ~/.maltrail/trails.csv is unusable here. Keep the trail set in StateDirectory.
Environment=HOME=/var/lib/maltrail

# Fail fast on a broken deployment instead of starting a sensor that cannot detect: validates the
# configuration, trails, whitelist, log directory, capture filter and capabilities. A trails file
# that does not exist yet is a warning, not a failure — ExecStart builds it on first start.
ExecStartPre=/opt/maltrail/sensor/target/release/maltrail-sensor -T
ExecStart=/opt/maltrail/sensor/target/release/maltrail-sensor
ExecReload=/bin/kill -HUP $MAINPID

Restart=on-failure
RestartSec=5
# SIGTERM is handled: workers stop within CAPTURE_TIMEOUT, condensed events are flushed and
# the final metrics line is printed before exit.
KillMode=mixed
KillSignal=SIGTERM
TimeoutStopSec=30

# Hardening. None of this restricts what the sensor legitimately does (capture, read trails,
# append to LOG_DIR, send UDP to LOG_SERVER / SYSLOG_SERVER / LOGSTASH_SERVER).
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_PACKET
# ProtectSystem=strict makes the filesystem read-only; StateDirectory= and LogsDirectory= are
# writable automatically, so nothing else needs naming here.

[Install]
WantedBy=multi-user.target