USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.45k stars 1.14k forks source link

Create ALT-Makefile #96

Closed necrose99 closed 3 years ago

necrose99 commented 7 years ago

make file for Linux System packaging , at least friendlier DESTDIR=/opt/Dshell

may be some to-do's per say ,

but with SRPM spec from others or debian control spec , and or my ebuild
MV Makefile Makefile.orginal mv ALT-Makefile Makefile Emake ALL

also can add on third party Plugins /decoders via packaging and call a script to build or rebuild decoders allowing $USER/.dshell/logs etc to be made might be an improvement if not running as sudo/su.

Make Dshell use avalible to more users.

dev195 commented 7 years ago

Hey, thanks for coming back. I admit, many of the older pull requests have fallen off of our plate.

If I'm understanding this correctly, you primarily want the Makefile updated to point to a more static destination, rather than $PWD, for the sake of packaging? In your ALT-Makefile, that looks like /opt/Dshell.

I'm not entirely against the idea, but one thing our development team takes into account is that there are cases where users don't have root privileges. I know many package managers (apt-get, yum, etc.) require root to run, and there's no getting around that. But for an underprivileged user, a manual install in an accessible directory without sudo is still desired.

Maybe we can find some middle ground. Would it work if, instead of /opt/dshell, we installed in $HOME/dshell? Alternatively, we can try putting in some logic that checks the user, and changes install location based on it (/opt for root, /home/user for a user). I confess, I don't know much about Gentoo Linux and how it differs from other distributions. It's possible that something prevents any of these things.

necrose99 commented 7 years ago

$HOME/dshell/ , $HOME/.dshell/decoders , , .dshellrc ,
/etc/skell/.dhsell ,.dshellrc , useradd > can get /opt/Dhsell , to home dir. one could ride the main install not as root , have some userland settings for non root use. $Home/dhsell/logs

for now i could also /etc/skell/dshell symlnks so it would get added to an operates dir. but it would force them to edit dshellrc once droped in thier home.

/opt/Dhsell , ln -s /usr/bin/dhsell , dshell-decode

users could have a trivial , .dshellrc -> (master /opt/dshell/dshellrc) + any user config opts ie any addhoc $home/dshell/decoders and $home/dshell/logs

A: should be able to use as root & as non root,. once installed.

I: distro Agnostic make , make it crazy easy to package for anyone's distro II : centralized Install location /opt/dshell or /usr/bin/dshell (syms to /usr/bin) , and user logic ie $/home III: more users able to use , more contributions , faster evolution , more interesting interrogations Cooler better ideas... IV: easier to administrate via packages , simple chron scrip as root for updates , ( https://github.com/biggiesmallsAG/nightHawkResponse , with Dshell , pcap/wireshark support would be interesting. opensource option. ) RPMspec , and debs could be added to dshell's dirs

B: for packaging , a location ie /opt/dshell or /usr/bin/dshell/ , sym links /usr/bin C: user-land $home dirs , and minimal skell , /$HOME/.dshell/decoders/testdecoder.py /root/dshell/ likewise for ROOT , fix-decoders.sh A, compile py to pyc for recently added decoders , find and user added decoders py -> pyc D: logging options to home dir .dshellrc $HOME/dshell/logs. E: Sandbox , fix-dshellrc.sh would be a plus. , however I can /$files/dshellrc .... for now, (Gentoo uses a sandbox to build for security , other distros debian/RH based too) defining a DESTDDIR allows it to be better faked

However , Gentoo isnt the only one. Redhat/Centos , Ubuntoo , all use a build-root I can stuff the /opt/dshell , then remove and replace etc. with a pre-generated one.

I may favor Gentoo based distros for Pentesting/Security auditing/forensics research/ side consulting , as often you can freshly squeeze the tools. ie version 9999 aka git clone ./configure make && make install. or get the current stable version. and less gems or pip install insanity ... breakage ... but that's just me. and most of the packaging is done in ebuild (bash + eclasses)

however for Enterprise , Debian/Rehat is old fathful , rarely coreos /gentoo (Webfarms/datacenters) work loves RH based ...
http://openbuildservice.org/ nightly builds anyone ? as rpm /deb. would be handy on core-entrprise distros , for Network Security engineers (I would love to deploy dshell more often for IT Forensics uses... || graylog & ||suricata/ossec-wazuh --> graylog input , have the nice elastic search who's now trying to hack my cloud.... for allerts... )

Gentoo , ( Pentoo , Pentesting Distro. Sabayon Binary based Gentoo distro , with SPM , and some level of easy to use polish, for more intermediate to advanced users. coreos cloud centric Enterprise distro Funtoo Former Gentoo Developer & Gentoo Founder... , , Google-Chrome-OS

dev195 commented 7 years ago

Unfortunately, your ALT-Makefile did not work for me; it threw an error before it could even begin. However, it did get me looking into the issue.

I created a new Dshell branch ("makefile-updates") that contains a new Makefile, README, and generate-dshellrc.py. The new Makefile is a combination of some of your ideas, some of our ideas, and some general cleanup.

It should hopefully do everything you need it to do for packaging (i.e. install to a more standard location when root), while still allowing non-root users to build and run locally.

A non-root user can just run make, as before, and get the same results. You and your packages, instead, can run make install. This will install Dshell in /opt/dshell (or whatever DESTDIR is set to) and create symlinks to dshell and dshell-decode.

Similarly, a non-root user can run make clean to tidy up a local install, but a root user can run make uninstall to remove a system-wide install.

Give it a try and let us know if it works for you.

necrose99 commented 7 years ago

https://www.youtube.com/watch?v=e3XUcg0bhY4 Milan Gabor: When hacker uses ELK stack for visualization

definitely I'll retry building the package in gentoo when I get a chance , for network forensics ELK Stack is frightfully powerful , https://github.com/aol/moloch likewise with a few added shell scripts a developer could daemeonize dshell and give it a pretty UI with ELK, just having a centrlized install helps :-)

dek443 commented 3 years ago

The Python 2 version of Dshell is now deprecated and frozen as Release v2.4.10. We are closing all Pull Requests and Issues associated with that version, as Dshell development has shifted to the current version for Python 3. Thank you for your support.