Hacker News Reader

Comment by metadat | Hacker News Reader

This looks great, but is there a TUI or headless mode?

I don't really like GUIs in my Linux, setting up VNC is such a pain.

I think the whole point of LittleSnitch/OpenSnitch is the GUI. I feel like this is sort of a descendant of (or rather inspired by) a piece of software from long ago called "ZoneAlarm" for Windows. I mention this because I primarily used it before I could code or knew about the "system"; which, also happened to be when I was pirating a lot of software (high school). You should be able to accomplish most all of this, and more, from the command line already. `netstat` alone would probably get you most of the way there.

ZoneAlarm, now there is something I haven't thought about in nearly two decades!!! (since HS or early uni)

Netstat sort of fills this niche, but not without a lot of manual toil on behalf of the operator. In general, Linux and the apps in the ecosystem are much more well-behaved with regard to "wtf is this traffic" compared to macOS or Windows.

Trust is great and all but visibility is better. Linux is still dicey to correlate traffic with a particular app, especially if the connection is/was shortlived.

> Linux is still dicey to correlate traffic with a particular app, especially if the connection is/was shortlived.

This is has become a lot easier and more reliable to do now with BPF [0].

I also used the same approach to create a somewhat user-friendly TUI and web dashboard for it [1]. It is also able to hash the executable (even if it was shortlived).

[0] https://www.gcardone.net/2020-07-31-per-process-bandwidth-mo...

[1] https://github.com/elesiuta/picosnitch

ebpf used in this way is typically nonblocking. it drops data instead of blocking. for a firewall, that’s potentially bad.

can ebpf operate in a blocking manner while making drop/allow decisions on packets WITH reliable access to the callers pid and argv?

I think OpenSnitch just uses eBPF to capture metadata about the new connection, the "hold for user confirmation" does not happen inside eBPF. The eBPF does not need to block waiting for user input.

https://github.com/evilsocket/opensnitch/blob/4ce8b0e57cfb25... https://github.com/evilsocket/opensnitch/blob/d9e0c59158ddf6...

by the time a user prompt is displayed, all metadata has been joined to the packet, and libnetfilterqueue is waiting for a decision.

my understanding of what is happening is as follows:

- 1: libnetfilterqueue gets a packet.

- 2: lookup packet via ebpf to get pid and argv.

- 3: lookup rule, on miss prompt user to allow/deny.

- 4: libnetfilterqueue allows/denies the packet.

the tricky part is step 2. afaik there are 3 possibilities:

- ebpf already knows about about this packet, return pid and argv.

- ebpf will know about this packet shortly, wait, then return pid and argv.

- ebpf dropped the data because of ringbuffer overflow, wait, then give up.

My understanding: ebpf runs at connect(2) time, stores metadata in a map; later, an NFQUEUE userspace helper fetches the metadata from the map.

this is correct. it's the datarace between these components, and the possibility of ebpf dropping data because of a slow userspace callback, that makes this flaky.

Very cool! I also found it recently submitted to HN: https://news.ycombinator.com/item?id=31160863

> for a firewall, that’s potentially bad

I wasn't talking about using it as a firewall, just a connection/bandwidth monitor that correlates traffic with a particular app.

bandwidth monitor use case seems like a perfect fit, and the occasional missed packet wouldn’t be an issue.

picosnitch looks really cool! i’ve rss subscribed to its github commits.

Thanks! Also I used lost_cb [0] to detect if a packet or connection (with security_socket_connect) was missed between the BPF and Python parts, but is it possible for the BPF program to miss either entirely without triggering that callback?

If so (without a kernel vulnerability which should be a given) I'd like to have it mentioned under the limitations section for picosnitch so others can be aware as well.

[0] https://github.com/iovisor/bcc/blob/master/docs/reference_gu...

i don’t think so. i think exactly what you’ve documented is the case. if the callback can’t keep up with the data before the ringbuffer overflows, data is lost. in that case, the solution is to increase the size of the ringbuffer, giving the callback a larger window to keep up with incoming data bursts.

in the end there are only two ways to handle this: drop data or block. for a bandwidth monitor, i’d choose drop. for a firewall, i’d choose block.

i use bpftrace to monitor docker filesystem access in a similar way[1]. i also increase the ringbuffer size until i stop seeing lost data.

1. https://github.com/nathants/docker-trace#files

Agree on the GUI however opensnitch does seem to assume a single user with a single X server, I have not been able to figure out a way last time I tried to get it to work with say 2 X servers and a VNC session or two running concurrently (meaning I couldn’t figure out a way to get connection alerts anywhere but in one of them, as also described here https://github.com/evilsocket/opensnitch/issues/388 )

Little snitch does not have this issues and you can have multiple users logged in with fast user switching and all can operate their notifications no problem.

You can use lsof in Linux to show connexions:

lsof -i -n -P | grep "\\-\>" | awk '{a[\$1"_p"\$2]++;}END{ for (it in a){print it,a[it]}}' | sort -nr -k2,2

This project uses conky to display the current connexions:

https://github.com/viviparous/plonky/blob/main/plonky.pl

unfortunately malicious lkms and userland rootkits can hide processes/connections from lsof/netstat

https://github.com/gianlucaborello/libprocesshider

that awk expression fails here (v5.1)

Ah yes, it doesn't require the escapes that I pasted above.

awk '{a[$1"_p"$2]++;}END{ for(it in a){print it,a[it]}}'

Take a look into rustdesk the server ie self hosting bit has been recently open sourced. It's basically Teamviewer but faster and rock solid so far. Some features are missing but the basics are there. I'm going to be dumping our TV account quite soon.

The missing piece was remote installing the client on Windows en mass to be able to be able to switch to root errr Administrator. TV allows you to pass Windows creds through to remote install itself but rustdesk can't yet or that might become an "enterprise feature". However Ansible can manage a WinRM enabled Windows box with Kerb and encryption over http and no client install. You can switch on WinRM via a GPO.

Getting some bits of Ansible working on Arch and certain other bleeding edge distros might involve pip install --update pycrypto (and/or) pykerberos. Python 3.10 deprecated something in a rather cryptic way, that I'm sure was jolly important but broke quite a lot of things important to a Linux sporting sysadmin in a Windows world.

Yes, recently submitted ( https://news.ycombinator.com/item?id=31456007 ) and IIRC, the verdict was it's a bit shady and sketchy on the security front. Unfortunate.

Take a look into the source. I've only cast a vague eye so far but it looks like it reuses quite a lot of well regarded stuff including VNC, so I'll take issue with "shady and sketchy".

If you skim read that thread from HN where I also learned about Rust Desk then there is no consensus about "sketchy". Searching for the word "security" gets a discussion about SSL/TLS and some pontificating.

I'm no real expert on IT security but I do have a Nessus license and a box to wield it from. I've run quite a few firewalls from Fortinet, pfSense, Juniper, hand crafted Linux, <various others>. I have 15 VLANs at home 8)

In my office I have a pair of Dell S funky devops switches worth around £20,000 sat on the bench as I plough through the 2000 page manual. I've got over the lack of old school stacking (why do they still have a stack LED indicator?) They have a LACP mediated VLT domain link running at 200Gbs-1 (Gb/s) - two physical wires. Now, do I partition the 100Gb links into four lots of 25Gb because that will allow more flows. Ok let's look at how this thing is used: iSCSI for data and VMware. The iSCSI links are 10Gb to the M series SAN so more links seem indicated.

I also learned Ansible on Thursday rather rapidly because I can deploy these beasts with it (they boot Debian and have Docker installed already, which is adorable!) and coincidentally, I need a non MS way of getting at Windows boxes from Linux. Ansible doesn't need a client app.

It's getting busy in IT. I'm 52 FFS (and absolutely love it!)

The Rust Desk security concern is due to it's not 100% self-hosted, it uses some kind of TURN or fw hole puncher which they host and didn't provide the sources for.

If I'm mistaken please tell me, would love to use it if it's "safe".

I've got a self hosted host in my office. When you deploy a client, you can rename the Windows exe to include the DNS name and public key of your host and it will then use them - clever idea. So I don't think you need their TURN/STUN. I suspect those are simply provided as a service and nothing more sinister.

They also provide three or so really low spec jump boxes to get people up and running if they can't self host - again, I call that altruism not sinister.

I will get Wireshark out anyway to check about this stuff next week.

You can do your own real due-dil stuff yourself by browsing around this: https://github.com/rustdesk/rustdesk - read the issues, browse the source (read the comments!) get a feel for the software.

I'm asserting that it is no worse than anything else. I can also assert that the binaries that I get on Arch Linux are probably from the official sources (I checked a few strings etc). I can't sign off the Windows binaries but I can assert that I do trust them from their GitHub repo.

I can assert things until I'm blue in the face but I trust rustdesk more than most remote access facilities for now but I am still kicking the tyres.

i use a kind of tui. it is actually a gui, pops up fullscreen. you can’t click it though, just keypress interaction.

i agree with you. especially if i’m filtering all traffic, i need to be able to y/n quickly and easily.

https://github.com/nathants/tinysnitch#demo

Reply on news.ycombinator.com