Initial release: ghost_protocol privacy toolkit
This commit is contained in:
ghost
@@ -0,0 +1,3 @@
|
||||
# /etc/cron.d/opsec-banner-cache — Update WAN IP cache for terminal banner
|
||||
# Runs every 5 minutes to keep the cached external IP current
|
||||
*/5 * * * * root /usr/local/bin/opsec-banner-cache.sh >/dev/null 2>&1
|
||||
@@ -0,0 +1,6 @@
|
||||
# /etc/cron.d/opsec-log-rotate — Secure log rotation
|
||||
# Interval synced from LOG_ROTATION_HOURS in /etc/opsec/opsec.conf (default: 4h)
|
||||
SHELL=/bin/bash
|
||||
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
|
||||
|
||||
0 */4 * * * root /usr/local/bin/opsec-log-rotate.sh >/dev/null 2>&1
|
||||
@@ -0,0 +1,9 @@
|
||||
[Desktop Entry]
|
||||
Type=Application
|
||||
Name=OPSEC Mode Toggle
|
||||
Comment=Toggle between OPSEC Advanced and Standard modes
|
||||
Exec=/usr/local/bin/opsec-toggle.sh
|
||||
Icon=security-high
|
||||
Terminal=false
|
||||
Categories=System;Security;
|
||||
Keywords=opsec;security;toggle;mode;
|
||||
@@ -0,0 +1,85 @@
|
||||
# /etc/opsec/levels/bare-metal-paranoid.conf — Physical Machine (Paranoid)
|
||||
# Maximum security always on. Ghost mode is the default — cannot be disabled.
|
||||
# Apply via: sudo opsec-config.sh --level apply bare-metal-paranoid
|
||||
|
||||
# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
|
||||
# paranoid = ghost mode always on, cannot disable
|
||||
LEVEL_TYPE="paranoid"
|
||||
|
||||
# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
|
||||
PROFILE_NAME="default"
|
||||
|
||||
# ─── BASE STATE ───────────────────────────────────────────────────────────────
|
||||
BASE_DNS="quad9"
|
||||
BASE_MAC_RANDOMIZE="1"
|
||||
BASE_IPV6_DISABLE="1"
|
||||
|
||||
# ─── TOR SETTINGS ─────────────────────────────────────────────────────────────
|
||||
TOR_CIRCUIT_ROTATION="15"
|
||||
TOR_BLACKLIST=""
|
||||
TOR_STRICT_NODES="1"
|
||||
TOR_ISOLATION="1"
|
||||
TOR_PADDING="1"
|
||||
TOR_SOCKS_PORT="9050"
|
||||
TOR_DNS_PORT="5353"
|
||||
TOR_NUM_GUARDS="3"
|
||||
TOR_SAFE_LOGGING="1"
|
||||
|
||||
# ─── DNS SETTINGS ─────────────────────────────────────────────────────────────
|
||||
DNS_MODE="tor"
|
||||
DNS_CUSTOM_SERVERS=""
|
||||
|
||||
# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
|
||||
KILLSWITCH_ALLOW_DHCP="1"
|
||||
KILLSWITCH_ALLOW_OPENVPN="1"
|
||||
KILLSWITCH_ALLOW_WIREGUARD="1"
|
||||
KILLSWITCH_EXTRA_PORTS=""
|
||||
|
||||
# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
|
||||
MAC_INTERFACES="auto"
|
||||
MAC_VENDOR_SPOOF=""
|
||||
|
||||
# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
|
||||
HOSTNAME_PATTERN="random"
|
||||
HOSTNAME_CUSTOM_PREFIX=""
|
||||
|
||||
# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
|
||||
HARDEN_IPV6="1"
|
||||
HARDEN_SWAP="1"
|
||||
HARDEN_CORE_DUMPS="1"
|
||||
HARDEN_CLIPBOARD_CLEAR="1"
|
||||
HARDEN_SCREEN_LOCK="1"
|
||||
HARDEN_SCREEN_LOCK_TIMEOUT="300"
|
||||
HARDEN_TIMEZONE_SPOOF="1"
|
||||
HARDEN_TIMEZONE_VALUE="UTC"
|
||||
HARDEN_LOCALE_SPOOF="1"
|
||||
HARDEN_LOCALE_VALUE="en_US.UTF-8"
|
||||
|
||||
# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
|
||||
LEAK_WEBRTC_BLOCK="1"
|
||||
LEAK_USB_BLOCK="1"
|
||||
|
||||
# ─── MONITORING ────────────────────────────────────────────────────────────────
|
||||
MONITOR_PROCESSES="1"
|
||||
MONITOR_LOG_ROTATION="1"
|
||||
LOG_ROTATION_HOURS="1"
|
||||
|
||||
# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
|
||||
TRAFFIC_JITTER_ENABLED="1"
|
||||
TRAFFIC_JITTER_MS="50"
|
||||
|
||||
# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
|
||||
TOR_BRIDGE_MODE="obfs4"
|
||||
TOR_BRIDGE_RELAY=""
|
||||
|
||||
# ─── SECURE DELETION ──────────────────────────────────────────────────────────
|
||||
WIPE_METHOD="auto"
|
||||
|
||||
# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
|
||||
DEPLOYMENT_LEVEL="bare-metal-paranoid"
|
||||
|
||||
# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
|
||||
OPSEC_BANNER="compact"
|
||||
|
||||
# ─── WIDGET THEME ─────────────────────────────────────────────────────────────
|
||||
WIDGET_THEME="default"
|
||||
@@ -0,0 +1,86 @@
|
||||
# /etc/opsec/levels/bare-metal-standard.conf — Physical Machine (Standard)
|
||||
# Privacy-focused daily driver. Ghost mode available via: opsec-mode on
|
||||
# Apply via: sudo opsec-config.sh --level apply bare-metal-standard
|
||||
|
||||
# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
|
||||
# standard = privacy base, ghost mode toggle available
|
||||
# paranoid = ghost mode always on, cannot disable
|
||||
LEVEL_TYPE="standard"
|
||||
|
||||
# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
|
||||
PROFILE_NAME="default"
|
||||
|
||||
# ─── BASE STATE (always active in standard mode) ─────────────────────────────
|
||||
BASE_DNS="quad9"
|
||||
BASE_MAC_RANDOMIZE="1"
|
||||
BASE_IPV6_DISABLE="1"
|
||||
|
||||
# ─── TOR SETTINGS (used when ghost mode is toggled ON) ───────────────────────
|
||||
TOR_CIRCUIT_ROTATION="30"
|
||||
TOR_BLACKLIST=""
|
||||
TOR_STRICT_NODES="1"
|
||||
TOR_ISOLATION="1"
|
||||
TOR_PADDING="1"
|
||||
TOR_SOCKS_PORT="9050"
|
||||
TOR_DNS_PORT="5353"
|
||||
TOR_NUM_GUARDS="3"
|
||||
TOR_SAFE_LOGGING="1"
|
||||
|
||||
# ─── DNS SETTINGS (ghost mode DNS — base uses BASE_DNS above) ────────────────
|
||||
DNS_MODE="tor"
|
||||
DNS_CUSTOM_SERVERS=""
|
||||
|
||||
# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
|
||||
KILLSWITCH_ALLOW_DHCP="1"
|
||||
KILLSWITCH_ALLOW_OPENVPN="1"
|
||||
KILLSWITCH_ALLOW_WIREGUARD="1"
|
||||
KILLSWITCH_EXTRA_PORTS=""
|
||||
|
||||
# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
|
||||
MAC_INTERFACES="auto"
|
||||
MAC_VENDOR_SPOOF=""
|
||||
|
||||
# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
|
||||
HOSTNAME_PATTERN="random"
|
||||
HOSTNAME_CUSTOM_PREFIX=""
|
||||
|
||||
# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
|
||||
HARDEN_IPV6="1"
|
||||
HARDEN_SWAP="1"
|
||||
HARDEN_CORE_DUMPS="1"
|
||||
HARDEN_CLIPBOARD_CLEAR="1"
|
||||
HARDEN_SCREEN_LOCK="1"
|
||||
HARDEN_SCREEN_LOCK_TIMEOUT="300"
|
||||
HARDEN_TIMEZONE_SPOOF="0"
|
||||
HARDEN_TIMEZONE_VALUE="UTC"
|
||||
HARDEN_LOCALE_SPOOF="0"
|
||||
HARDEN_LOCALE_VALUE="en_US.UTF-8"
|
||||
|
||||
# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
|
||||
LEAK_WEBRTC_BLOCK="1"
|
||||
LEAK_USB_BLOCK="1"
|
||||
|
||||
# ─── MONITORING ────────────────────────────────────────────────────────────────
|
||||
MONITOR_PROCESSES="1"
|
||||
MONITOR_LOG_ROTATION="1"
|
||||
LOG_ROTATION_HOURS="4"
|
||||
|
||||
# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
|
||||
TRAFFIC_JITTER_ENABLED="0"
|
||||
TRAFFIC_JITTER_MS="50"
|
||||
|
||||
# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
|
||||
TOR_BRIDGE_MODE="off"
|
||||
TOR_BRIDGE_RELAY=""
|
||||
|
||||
# ─── SECURE DELETION ──────────────────────────────────────────────────────────
|
||||
WIPE_METHOD="auto"
|
||||
|
||||
# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
|
||||
DEPLOYMENT_LEVEL="bare-metal-standard"
|
||||
|
||||
# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
|
||||
OPSEC_BANNER="compact"
|
||||
|
||||
# ─── WIDGET THEME ─────────────────────────────────────────────────────────────
|
||||
WIDGET_THEME="default"
|
||||
@@ -0,0 +1,85 @@
|
||||
# /etc/opsec/levels/cloud-normal.conf — Cloud VPS (Standard)
|
||||
# Privacy-focused cloud deployment. Ghost mode available via: opsec-mode on
|
||||
# No MAC/hostname/screen/USB (hardware-irrelevant on cloud).
|
||||
# Apply via: sudo opsec-config.sh --level apply cloud-normal
|
||||
|
||||
# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
|
||||
LEVEL_TYPE="standard"
|
||||
|
||||
# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
|
||||
PROFILE_NAME="default"
|
||||
|
||||
# ─── BASE STATE (always active in standard mode) ─────────────────────────────
|
||||
BASE_DNS="quad9"
|
||||
BASE_MAC_RANDOMIZE="0"
|
||||
BASE_IPV6_DISABLE="1"
|
||||
|
||||
# ─── TOR SETTINGS (used when ghost mode is toggled ON) ───────────────────────
|
||||
TOR_CIRCUIT_ROTATION="30"
|
||||
TOR_BLACKLIST=""
|
||||
TOR_STRICT_NODES="1"
|
||||
TOR_ISOLATION="1"
|
||||
TOR_PADDING="0"
|
||||
TOR_SOCKS_PORT="9050"
|
||||
TOR_DNS_PORT="5353"
|
||||
TOR_NUM_GUARDS="3"
|
||||
TOR_SAFE_LOGGING="1"
|
||||
|
||||
# ─── DNS SETTINGS ─────────────────────────────────────────────────────────────
|
||||
DNS_MODE="tor"
|
||||
DNS_CUSTOM_SERVERS=""
|
||||
|
||||
# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
|
||||
KILLSWITCH_ALLOW_DHCP="1"
|
||||
KILLSWITCH_ALLOW_OPENVPN="1"
|
||||
KILLSWITCH_ALLOW_WIREGUARD="1"
|
||||
KILLSWITCH_EXTRA_PORTS=""
|
||||
|
||||
# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
|
||||
MAC_INTERFACES="auto"
|
||||
MAC_VENDOR_SPOOF=""
|
||||
|
||||
# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
|
||||
HOSTNAME_PATTERN="desktop"
|
||||
HOSTNAME_CUSTOM_PREFIX=""
|
||||
|
||||
# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
|
||||
HARDEN_IPV6="1"
|
||||
HARDEN_SWAP="1"
|
||||
HARDEN_CORE_DUMPS="1"
|
||||
HARDEN_CLIPBOARD_CLEAR="0"
|
||||
HARDEN_SCREEN_LOCK="0"
|
||||
HARDEN_SCREEN_LOCK_TIMEOUT="300"
|
||||
HARDEN_TIMEZONE_SPOOF="0"
|
||||
HARDEN_TIMEZONE_VALUE="UTC"
|
||||
HARDEN_LOCALE_SPOOF="0"
|
||||
HARDEN_LOCALE_VALUE="en_US.UTF-8"
|
||||
|
||||
# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
|
||||
LEAK_WEBRTC_BLOCK="1"
|
||||
LEAK_USB_BLOCK="0"
|
||||
|
||||
# ─── MONITORING ────────────────────────────────────────────────────────────────
|
||||
MONITOR_PROCESSES="1"
|
||||
MONITOR_LOG_ROTATION="1"
|
||||
LOG_ROTATION_HOURS="1"
|
||||
|
||||
# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
|
||||
TRAFFIC_JITTER_ENABLED="0"
|
||||
TRAFFIC_JITTER_MS="50"
|
||||
|
||||
# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
|
||||
TOR_BRIDGE_MODE="off"
|
||||
TOR_BRIDGE_RELAY=""
|
||||
|
||||
# ─── SECURE DELETION ──────────────────────────────────────────────────────────
|
||||
WIPE_METHOD="auto"
|
||||
|
||||
# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
|
||||
DEPLOYMENT_LEVEL="cloud-normal"
|
||||
|
||||
# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
|
||||
OPSEC_BANNER="compact"
|
||||
|
||||
# ─── WIDGET THEME ─────────────────────────────────────────────────────────────
|
||||
WIDGET_THEME="default"
|
||||
@@ -0,0 +1,84 @@
|
||||
# /etc/opsec/levels/cloud-paranoid.conf — Cloud VPS (Paranoid)
|
||||
# Maximum security always on. Ghost mode is the default — cannot be disabled.
|
||||
# Apply via: sudo opsec-config.sh --level apply cloud-paranoid
|
||||
|
||||
# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
|
||||
LEVEL_TYPE="paranoid"
|
||||
|
||||
# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
|
||||
PROFILE_NAME="default"
|
||||
|
||||
# ─── BASE STATE ───────────────────────────────────────────────────────────────
|
||||
BASE_DNS="quad9"
|
||||
BASE_MAC_RANDOMIZE="0"
|
||||
BASE_IPV6_DISABLE="1"
|
||||
|
||||
# ─── TOR SETTINGS ─────────────────────────────────────────────────────────────
|
||||
TOR_CIRCUIT_ROTATION="15"
|
||||
TOR_BLACKLIST=""
|
||||
TOR_STRICT_NODES="1"
|
||||
TOR_ISOLATION="1"
|
||||
TOR_PADDING="1"
|
||||
TOR_SOCKS_PORT="9050"
|
||||
TOR_DNS_PORT="5353"
|
||||
TOR_NUM_GUARDS="3"
|
||||
TOR_SAFE_LOGGING="1"
|
||||
|
||||
# ─── DNS SETTINGS ─────────────────────────────────────────────────────────────
|
||||
DNS_MODE="tor"
|
||||
DNS_CUSTOM_SERVERS=""
|
||||
|
||||
# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
|
||||
KILLSWITCH_ALLOW_DHCP="1"
|
||||
KILLSWITCH_ALLOW_OPENVPN="1"
|
||||
KILLSWITCH_ALLOW_WIREGUARD="1"
|
||||
KILLSWITCH_EXTRA_PORTS=""
|
||||
|
||||
# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
|
||||
MAC_INTERFACES="auto"
|
||||
MAC_VENDOR_SPOOF=""
|
||||
|
||||
# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
|
||||
HOSTNAME_PATTERN="desktop"
|
||||
HOSTNAME_CUSTOM_PREFIX=""
|
||||
|
||||
# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
|
||||
HARDEN_IPV6="1"
|
||||
HARDEN_SWAP="1"
|
||||
HARDEN_CORE_DUMPS="1"
|
||||
HARDEN_CLIPBOARD_CLEAR="1"
|
||||
HARDEN_SCREEN_LOCK="0"
|
||||
HARDEN_SCREEN_LOCK_TIMEOUT="300"
|
||||
HARDEN_TIMEZONE_SPOOF="1"
|
||||
HARDEN_TIMEZONE_VALUE="UTC"
|
||||
HARDEN_LOCALE_SPOOF="1"
|
||||
HARDEN_LOCALE_VALUE="en_US.UTF-8"
|
||||
|
||||
# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
|
||||
LEAK_WEBRTC_BLOCK="1"
|
||||
LEAK_USB_BLOCK="0"
|
||||
|
||||
# ─── MONITORING ────────────────────────────────────────────────────────────────
|
||||
MONITOR_PROCESSES="1"
|
||||
MONITOR_LOG_ROTATION="1"
|
||||
LOG_ROTATION_HOURS="1"
|
||||
|
||||
# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
|
||||
TRAFFIC_JITTER_ENABLED="1"
|
||||
TRAFFIC_JITTER_MS="50"
|
||||
|
||||
# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
|
||||
TOR_BRIDGE_MODE="obfs4"
|
||||
TOR_BRIDGE_RELAY=""
|
||||
|
||||
# ─── SECURE DELETION ──────────────────────────────────────────────────────────
|
||||
WIPE_METHOD="auto"
|
||||
|
||||
# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
|
||||
DEPLOYMENT_LEVEL="cloud-paranoid"
|
||||
|
||||
# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
|
||||
OPSEC_BANNER="compact"
|
||||
|
||||
# ─── WIDGET THEME ─────────────────────────────────────────────────────────────
|
||||
WIDGET_THEME="default"
|
||||
@@ -0,0 +1,100 @@
|
||||
# ─── OPSEC ALIASES ───────────────────────────────────────────────────────────
|
||||
|
||||
# Network checks
|
||||
alias myip='curl -s ifconfig.me'
|
||||
alias checkip='curl -s https://ipinfo.io/ip'
|
||||
alias checkdns='cat /etc/resolv.conf'
|
||||
alias ports='netstat -tulanp'
|
||||
alias listen='lsof -i -P | grep LISTEN'
|
||||
alias estab='lsof -i -P | grep ESTABLISHED'
|
||||
|
||||
# Process and connection monitoring
|
||||
alias checkcon='ss -tupan | grep ESTABLISHED'
|
||||
alias checklis='ss -tupan | grep LISTEN'
|
||||
alias checkproc='ps auxf | grep -v grep | grep'
|
||||
alias psg='ps aux | grep -v grep | grep -i'
|
||||
|
||||
# Emergency and cleanup
|
||||
alias killcon='killall -9 openvpn ssh 2>/dev/null'
|
||||
alias randmac='randomize-mac.sh'
|
||||
alias opsec='opsec-check.sh'
|
||||
|
||||
# Cleanup operations
|
||||
alias clear-logs='sudo find /var/log -name '\''opsec*'\'' -type f -exec truncate -s 0 {} \; && sudo truncate -s 0 /var/log/syslog /var/log/auth.log 2>/dev/null'
|
||||
alias clear-history='history -c && > ~/.bash_history && > ~/.zsh_history'
|
||||
alias shred-file='shred -vfz -n 3'
|
||||
|
||||
# Anonymity
|
||||
alias anon-on='sudo systemctl start tor && . torsocks on'
|
||||
alias anon-off='. torsocks off && sudo systemctl stop tor'
|
||||
alias check-tor='curl -s https://check.torproject.org/api/ip'
|
||||
|
||||
# Safe OPSEC status check
|
||||
alias opsec-status='echo "OPSEC Status:"; echo "VPN: $(pgrep openvpn > /dev/null && echo "Connected" || echo "Disconnected")"; echo "Tor: $(systemctl is-active tor 2>/dev/null | grep -q active && echo "Active" || echo "Inactive")"; echo "IP: $(curl -s --max-time 2 ifconfig.me || echo "Check failed")"'
|
||||
|
||||
# Quick OPSEC check
|
||||
alias quick-opsec='opsec-status && echo "" && echo "=== Connections ===" && ss -tupln | grep -E ":443|:9050|:1080" | head -5'
|
||||
|
||||
# ─── ADVANCED OPSEC MODE ──────────────────────────────────────────────────────
|
||||
|
||||
# Master toggle
|
||||
alias opsec-on='sudo /usr/local/bin/opsec-mode.sh on'
|
||||
alias opsec-off='sudo /usr/local/bin/opsec-mode.sh off'
|
||||
alias opsec-advanced='sudo /usr/local/bin/opsec-mode.sh status'
|
||||
|
||||
# Kill switch controls
|
||||
alias killswitch-on='sudo /usr/local/bin/opsec-killswitch.sh on'
|
||||
alias killswitch-off='sudo /usr/local/bin/opsec-killswitch.sh off'
|
||||
alias killswitch-status='sudo /usr/local/bin/opsec-killswitch.sh status'
|
||||
|
||||
# Hostname randomization
|
||||
alias randhostname='sudo /usr/local/bin/opsec-hostname-randomize.sh'
|
||||
|
||||
# Tor circuit management
|
||||
alias check-circuit='curl -s --socks5-hostname 127.0.0.1:9050 https://check.torproject.org/api/ip'
|
||||
alias new-circuit='sudo killall -HUP tor && echo "New Tor circuit requested"'
|
||||
|
||||
# DNS leak check
|
||||
alias check-dns-leak='echo "=== DNS Leak Check ===" && echo "resolv.conf:" && grep nameserver /etc/resolv.conf && echo "" && echo "Tor DNS test:" && dig +short @127.0.0.1 -p 5353 check.torproject.org 2>/dev/null || echo "Tor DNS not available"'
|
||||
|
||||
# OPSEC Config Manager
|
||||
alias opsec-config='sudo /usr/local/bin/opsec-config.sh'
|
||||
alias opsec-show='sudo /usr/local/bin/opsec-mode.sh status'
|
||||
|
||||
# Profile management
|
||||
alias opsec-profile='sudo /usr/local/bin/opsec-config.sh --profile'
|
||||
|
||||
# Boot mode
|
||||
alias opsec-boot-on='sudo /usr/local/bin/opsec-config.sh --boot on'
|
||||
alias opsec-boot-off='sudo /usr/local/bin/opsec-config.sh --boot off'
|
||||
|
||||
# SSH honeypot check
|
||||
alias ssh-safe='/usr/local/bin/opsec-ssh-check.sh'
|
||||
|
||||
# Connection monitor
|
||||
alias opsec-monitor-start='sudo /usr/local/bin/opsec-monitor.sh start'
|
||||
alias opsec-monitor-stop='sudo /usr/local/bin/opsec-monitor.sh stop'
|
||||
alias opsec-monitor-status='sudo /usr/local/bin/opsec-monitor.sh status'
|
||||
|
||||
# WiFi security
|
||||
alias opsec-wifi='sudo /usr/local/bin/opsec-wifi-check.sh'
|
||||
|
||||
# Conky widget controls — position: tl tc tr bl bc br (default: bl)
|
||||
alias opsec-widget-kill='killall conky 2>/dev/null && echo "Widget stopped" || echo "Widget not running"'
|
||||
opsec-widget() { ~/.config/conky/opsec-widget-launch.sh "${1:-bl}"; }
|
||||
opsec-widget-restart() { ~/.config/conky/opsec-widget-launch.sh "${1:-bl}"; }
|
||||
|
||||
# Deployment level and banner control
|
||||
alias opsec-level='sudo /usr/local/bin/opsec-config.sh --level apply'
|
||||
alias opsec-level-list='sudo /usr/local/bin/opsec-config.sh --level list'
|
||||
alias opsec-banner-set='sudo /usr/local/bin/opsec-config.sh --banner'
|
||||
alias opsec-toggle='/usr/local/bin/opsec-toggle.sh'
|
||||
|
||||
# Preflight and break-glass
|
||||
alias opsec-preflight='/usr/local/bin/opsec-preflight.sh'
|
||||
alias opsec-score='/usr/local/bin/opsec-preflight.sh --score'
|
||||
alias opsec-breakglass='sudo /usr/local/bin/opsec-mode.sh breakglass'
|
||||
alias opsec-breakglass-off='sudo /usr/local/bin/opsec-mode.sh breakglass-off'
|
||||
|
||||
# ─── OPSEC TERMINAL BANNER ──────────────────────────────────────────────────
|
||||
[ -x /usr/local/bin/opsec-banner.sh ] && /usr/local/bin/opsec-banner.sh
|
||||
@@ -0,0 +1,28 @@
|
||||
# /etc/opsec/country-codes.conf — Country Code Presets for Tor Blacklisting
|
||||
# Used by opsec-config.sh and opsec-lib.sh for quick preset loading
|
||||
# Format: PRESET_NAME="cc1,cc2,cc3,..."
|
||||
|
||||
# ─── INTELLIGENCE ALLIANCES ────────────────────────────────────────────────────
|
||||
|
||||
# Five Eyes — core anglosphere intelligence sharing
|
||||
FIVE_EYES="us,gb,ca,au,nz"
|
||||
|
||||
# Nine Eyes — Five Eyes + Denmark, France, Netherlands, Norway
|
||||
NINE_EYES="us,gb,ca,au,nz,dk,fr,nl,no"
|
||||
|
||||
# Fourteen Eyes — Nine Eyes + Germany, Belgium, Italy, Sweden, Spain
|
||||
FOURTEEN_EYES="us,gb,ca,au,nz,dk,fr,nl,no,de,be,it,se,es"
|
||||
|
||||
# ─── HIGH-SURVEILLANCE STATES ─────────────────────────────────────────────────
|
||||
|
||||
# Countries with known mass surveillance / hostile SIGINT
|
||||
SURVEILLANCE_STATES="cn,ru,ir,kp,il,sg,ae,sa,eg,tr,pk,th,vn,by,kz"
|
||||
|
||||
# ─── COMBINED PRESETS ──────────────────────────────────────────────────────────
|
||||
|
||||
# Maximum exclusion: Fourteen Eyes + surveillance states
|
||||
MAX_EXCLUSION="us,gb,ca,au,nz,dk,fr,nl,no,de,be,it,se,es,cn,ru,ir,kp,il,sg,ae,sa,eg,tr,pk,th,vn,by,kz"
|
||||
|
||||
# ─── VALID COUNTRY CODES (for input validation) ───────────────────────────────
|
||||
# ISO 3166-1 alpha-2 codes commonly used as Tor country codes
|
||||
VALID_CODES="ad,ae,af,ag,ai,al,am,ao,ar,as,at,au,az,ba,bb,bd,be,bf,bg,bh,bi,bj,bm,bn,bo,br,bs,bt,bw,by,bz,ca,cd,cf,cg,ch,ci,cl,cm,cn,co,cr,cu,cv,cy,cz,de,dj,dk,dm,do,dz,ec,ee,eg,er,es,et,fi,fj,fm,fr,ga,gb,gd,ge,gh,gm,gn,gp,gq,gr,gt,gw,gy,hk,hn,hr,ht,hu,id,ie,il,in,iq,ir,is,it,jm,jo,jp,ke,kg,kh,ki,km,kn,kp,kr,kw,kz,la,lb,lc,li,lk,lr,ls,lt,lu,lv,ly,ma,mc,md,me,mg,mh,mk,ml,mm,mn,mo,mr,mt,mu,mv,mw,mx,my,mz,na,ne,ng,ni,nl,no,np,nr,nz,om,pa,pe,pg,ph,pk,pl,pt,pw,py,qa,ro,rs,ru,rw,sa,sb,sc,sd,se,sg,si,sk,sl,sm,sn,so,sr,ss,st,sv,sy,sz,td,tg,th,tj,tl,tm,tn,to,tr,tt,tv,tw,tz,ua,ug,us,uy,uz,va,vc,ve,vn,vu,ws,ye,za,zm,zw"
|
||||
@@ -0,0 +1,96 @@
|
||||
# /etc/opsec/opsec.conf — Central OPSEC Configuration
|
||||
# Shell-sourceable KEY="value" format. All scripts source this file.
|
||||
# Edit via: sudo opsec-config.sh (interactive TUI)
|
||||
# Manual edits: source /usr/local/lib/opsec/opsec-lib.sh && opsec_set_value KEY "value"
|
||||
|
||||
# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
|
||||
PROFILE_NAME="default"
|
||||
|
||||
# ─── TOR SETTINGS ──────────────────────────────────────────────────────────────
|
||||
TOR_CIRCUIT_ROTATION="30"
|
||||
TOR_BLACKLIST=""
|
||||
TOR_STRICT_NODES="1"
|
||||
TOR_ISOLATION="1"
|
||||
TOR_PADDING="1"
|
||||
TOR_SOCKS_PORT="9050"
|
||||
TOR_DNS_PORT="5353"
|
||||
TOR_NUM_GUARDS="3"
|
||||
TOR_SAFE_LOGGING="1"
|
||||
|
||||
# ─── DNS SETTINGS ──────────────────────────────────────────────────────────────
|
||||
# Mode: tor | quad9 | cloudflare | doh | dot | custom
|
||||
DNS_MODE="tor"
|
||||
DNS_CUSTOM_SERVERS=""
|
||||
|
||||
# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
|
||||
KILLSWITCH_ALLOW_DHCP="1"
|
||||
KILLSWITCH_ALLOW_OPENVPN="1"
|
||||
KILLSWITCH_ALLOW_WIREGUARD="1"
|
||||
KILLSWITCH_EXTRA_PORTS=""
|
||||
|
||||
# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
|
||||
# Interfaces: auto (all non-lo) or comma-separated list (e.g. "eth0,wlan0")
|
||||
MAC_INTERFACES="auto"
|
||||
# Vendor spoof: empty for random, or OUI prefix (e.g. "00:1A:2B" for specific vendor)
|
||||
MAC_VENDOR_SPOOF=""
|
||||
|
||||
# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
|
||||
# Pattern: desktop | random | custom
|
||||
HOSTNAME_PATTERN="desktop"
|
||||
HOSTNAME_CUSTOM_PREFIX=""
|
||||
|
||||
# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
|
||||
HARDEN_IPV6="1"
|
||||
HARDEN_SWAP="1"
|
||||
HARDEN_CORE_DUMPS="1"
|
||||
HARDEN_CLIPBOARD_CLEAR="0"
|
||||
HARDEN_SCREEN_LOCK="1"
|
||||
HARDEN_SCREEN_LOCK_TIMEOUT="300"
|
||||
HARDEN_TIMEZONE_SPOOF="0"
|
||||
HARDEN_TIMEZONE_VALUE="UTC"
|
||||
HARDEN_LOCALE_SPOOF="0"
|
||||
HARDEN_LOCALE_VALUE="en_US.UTF-8"
|
||||
|
||||
# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
|
||||
LEAK_WEBRTC_BLOCK="1"
|
||||
LEAK_USB_BLOCK="0"
|
||||
|
||||
# ─── MONITORING ────────────────────────────────────────────────────────────────
|
||||
MONITOR_PROCESSES="0"
|
||||
MONITOR_LOG_ROTATION="1"
|
||||
LOG_ROTATION_HOURS="4"
|
||||
|
||||
# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
|
||||
TRAFFIC_JITTER_ENABLED="0"
|
||||
TRAFFIC_JITTER_MS="50"
|
||||
|
||||
# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
|
||||
# standard = privacy base, ghost mode toggle available
|
||||
# paranoid = ghost mode always on, cannot disable
|
||||
LEVEL_TYPE="standard"
|
||||
|
||||
# ─── BASE STATE (always active in standard mode) ─────────────────────────────
|
||||
BASE_DNS="quad9"
|
||||
BASE_MAC_RANDOMIZE="1"
|
||||
BASE_IPV6_DISABLE="1"
|
||||
|
||||
# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
|
||||
# Mode: off | obfs4 | meek-azure | snowflake
|
||||
TOR_BRIDGE_MODE="off"
|
||||
TOR_BRIDGE_RELAY=""
|
||||
|
||||
# ─── SECURE DELETION ──────────────────────────────────────────────────────────
|
||||
# Method: auto | shred | fstrim | luks
|
||||
WIPE_METHOD="auto"
|
||||
|
||||
# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
|
||||
# Level: bare-metal-standard | bare-metal-paranoid | cloud-normal | cloud-paranoid
|
||||
DEPLOYMENT_LEVEL="bare-metal-standard"
|
||||
|
||||
# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
|
||||
# Mode: compact | full | auto | off
|
||||
OPSEC_BANNER="compact"
|
||||
|
||||
# ─── WIDGET THEME ────────────────────────────────────────────────────────────
|
||||
# Theme: default | aurora | ember | slate | cyberpunk | frost | terminal
|
||||
WIDGET_THEME="default"
|
||||
@@ -0,0 +1,17 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE policyconfig PUBLIC
|
||||
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
||||
"http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
|
||||
<policyconfig>
|
||||
<action id="com.opsec.mode.toggle">
|
||||
<description>Toggle OPSEC Advanced Mode</description>
|
||||
<message>Authentication is required to toggle OPSEC mode</message>
|
||||
<defaults>
|
||||
<allow_any>auth_admin</allow_any>
|
||||
<allow_inactive>auth_admin</allow_inactive>
|
||||
<allow_active>yes</allow_active>
|
||||
</defaults>
|
||||
<annotate key="org.freedesktop.policykit.exec.path">/usr/local/bin/opsec-mode.sh</annotate>
|
||||
<annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
|
||||
</action>
|
||||
</policyconfig>
|
||||
Executable
+14
@@ -0,0 +1,14 @@
|
||||
# OPSEC DNS Servers
|
||||
# Quad9 (Security focused)
|
||||
nameserver 9.9.9.9
|
||||
nameserver 149.112.112.112
|
||||
|
||||
# Cloudflare (Privacy focused)
|
||||
nameserver 1.1.1.1
|
||||
nameserver 1.0.0.1
|
||||
|
||||
# DNS Options
|
||||
options edns0 trust-ad
|
||||
options timeout:1
|
||||
options attempts:1
|
||||
options rotate
|
||||
@@ -0,0 +1,3 @@
|
||||
# OPSEC Mode DNS — all resolution through Tor DNSPort
|
||||
# Deployed by opsec-mode on, locked with chattr +i
|
||||
nameserver 127.0.0.1
|
||||
@@ -0,0 +1,18 @@
|
||||
[Unit]
|
||||
Description=OPSEC Boot-into-Advanced Mode Initializer
|
||||
Documentation=man:opsec-mode(8)
|
||||
DefaultDependencies=no
|
||||
Before=network-pre.target NetworkManager.service networking.service
|
||||
Before=opsec-mac-randomize.service opsec-hostname-randomize.service opsec-killswitch.service
|
||||
After=local-fs.target sysinit.target
|
||||
ConditionPathExists=/etc/opsec/boot-advanced.enabled
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/bin/opsec-boot-init.sh
|
||||
RemainAfterExit=yes
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,14 @@
|
||||
[Unit]
|
||||
Description=OPSEC Hostname Randomization
|
||||
Before=NetworkManager.service
|
||||
Before=networking.service
|
||||
After=local-fs.target
|
||||
ConditionPathExists=/var/run/opsec-advanced.enabled
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/bin/opsec-hostname-randomize.sh
|
||||
RemainAfterExit=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,15 @@
|
||||
[Unit]
|
||||
Description=OPSEC Kill Switch (block non-Tor/VPN traffic)
|
||||
Before=NetworkManager.service
|
||||
Before=networking.service
|
||||
After=local-fs.target
|
||||
ConditionPathExists=/var/run/opsec-advanced.enabled
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/bin/opsec-killswitch.sh on
|
||||
ExecStop=/usr/local/bin/opsec-killswitch.sh off
|
||||
RemainAfterExit=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,14 @@
|
||||
[Unit]
|
||||
Description=OPSEC MAC Address Randomization
|
||||
Before=NetworkManager.service
|
||||
Before=networking.service
|
||||
After=local-fs.target
|
||||
ConditionPathExists=/var/run/opsec-advanced.enabled
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/bin/randomize-mac.sh
|
||||
RemainAfterExit=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,14 @@
|
||||
# Aurora theme — purple and cyan tones
|
||||
# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
|
||||
THEME_LABEL="Aurora"
|
||||
CONKY_BG="000000"
|
||||
CONKY_COLOR0="B55AFC"
|
||||
CONKY_COLOR1="FF63BE"
|
||||
CONKY_COLOR2="85E7FF"
|
||||
CONKY_COLOR3="000000"
|
||||
CONKY_COLOR4="268BD2"
|
||||
CONKY_COLOR5="07CAF9"
|
||||
CONKY_COLOR6="85E7FF"
|
||||
CONKY_COLOR7="ECDEF7"
|
||||
CONKY_COLOR8="B55AFC"
|
||||
CONKY_COLOR9="4A6A7A"
|
||||
@@ -0,0 +1,14 @@
|
||||
# CyberPunk theme — neon cyan/pink/green on black
|
||||
# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
|
||||
THEME_LABEL="CyberPunk"
|
||||
CONKY_BG="000000"
|
||||
CONKY_COLOR0="FF3B3B"
|
||||
CONKY_COLOR1="00F5A0"
|
||||
CONKY_COLOR2="08F7FE"
|
||||
CONKY_COLOR3="000000"
|
||||
CONKY_COLOR4="08F7FE"
|
||||
CONKY_COLOR5="FF2E88"
|
||||
CONKY_COLOR6="00D1FF"
|
||||
CONKY_COLOR7="EAEAFF"
|
||||
CONKY_COLOR8="08F7FE"
|
||||
CONKY_COLOR9="2A2A2A"
|
||||
@@ -0,0 +1,14 @@
|
||||
# Default theme — balanced green-on-black aesthetic
|
||||
# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
|
||||
THEME_LABEL="Default"
|
||||
CONKY_BG="000000"
|
||||
CONKY_COLOR0="FF4C4C"
|
||||
CONKY_COLOR1="00FF9C"
|
||||
CONKY_COLOR2="49D6B6"
|
||||
CONKY_COLOR3="000000"
|
||||
CONKY_COLOR4="49D6B6"
|
||||
CONKY_COLOR5="2AFFC6"
|
||||
CONKY_COLOR6="2AFFC6"
|
||||
CONKY_COLOR7="CFFFE6"
|
||||
CONKY_COLOR8="49D6B6"
|
||||
CONKY_COLOR9="1A1A1A"
|
||||
@@ -0,0 +1,14 @@
|
||||
# Ember theme — warm red and white tones
|
||||
# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
|
||||
THEME_LABEL="Ember"
|
||||
CONKY_BG="000000"
|
||||
CONKY_COLOR0="FF2B2B"
|
||||
CONKY_COLOR1="A0A0A0"
|
||||
CONKY_COLOR2="B0B0B0"
|
||||
CONKY_COLOR3="000000"
|
||||
CONKY_COLOR4="FF2B2B"
|
||||
CONKY_COLOR5="FF7A7A"
|
||||
CONKY_COLOR6="CFCFCF"
|
||||
CONKY_COLOR7="EDEDED"
|
||||
CONKY_COLOR8="FF2B2B"
|
||||
CONKY_COLOR9="A0A0A0"
|
||||
@@ -0,0 +1,14 @@
|
||||
# Frost theme — cool blues and teals
|
||||
# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
|
||||
THEME_LABEL="Frost"
|
||||
CONKY_BG="000000"
|
||||
CONKY_COLOR0="DC2626"
|
||||
CONKY_COLOR1="5EEAD4"
|
||||
CONKY_COLOR2="00E5FF"
|
||||
CONKY_COLOR3="000000"
|
||||
CONKY_COLOR4="22D3EE"
|
||||
CONKY_COLOR5="00E5FF"
|
||||
CONKY_COLOR6="22D3EE"
|
||||
CONKY_COLOR7="DDE6F3"
|
||||
CONKY_COLOR8="00E5FF"
|
||||
CONKY_COLOR9="1A1A1A"
|
||||
@@ -0,0 +1,14 @@
|
||||
# Slate theme — muted neutral tones with gold accent
|
||||
# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
|
||||
THEME_LABEL="Slate"
|
||||
CONKY_BG="000000"
|
||||
CONKY_COLOR0="C63636"
|
||||
CONKY_COLOR1="9A9A9A"
|
||||
CONKY_COLOR2="B0B0B0"
|
||||
CONKY_COLOR3="000000"
|
||||
CONKY_COLOR4="7A7A7A"
|
||||
CONKY_COLOR5="D1A954"
|
||||
CONKY_COLOR6="AFAFAF"
|
||||
CONKY_COLOR7="E6E6E6"
|
||||
CONKY_COLOR8="B0B0B0"
|
||||
CONKY_COLOR9="7A7A7A"
|
||||
@@ -0,0 +1,14 @@
|
||||
# Terminal theme — classic monochrome green CRT aesthetic
|
||||
# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
|
||||
THEME_LABEL="Terminal"
|
||||
CONKY_BG="0A0A0A"
|
||||
CONKY_COLOR0="FF3333"
|
||||
CONKY_COLOR1="33FF33"
|
||||
CONKY_COLOR2="22BB22"
|
||||
CONKY_COLOR3="0A0A0A"
|
||||
CONKY_COLOR4="118811"
|
||||
CONKY_COLOR5="44FF44"
|
||||
CONKY_COLOR6="33DD33"
|
||||
CONKY_COLOR7="AAFFAA"
|
||||
CONKY_COLOR8="22CC22"
|
||||
CONKY_COLOR9="1A3A1A"
|
||||
@@ -0,0 +1,5 @@
|
||||
# Minimal stock Tor configuration
|
||||
# Restored by opsec-mode off
|
||||
|
||||
SocksPort 9050
|
||||
Log notice file /var/log/tor/notices.log
|
||||
@@ -0,0 +1,32 @@
|
||||
# Hardened Tor Configuration for OPSEC Mode
|
||||
# Deployed by opsec-mode on — restored to torrc-default on off
|
||||
|
||||
# ─── SOCKS & DNS ────────────────────────────────────────────────────────────
|
||||
SocksPort 9050 IsolateDestAddr IsolateDestPort
|
||||
DNSPort 5353
|
||||
|
||||
# ─── FIVE EYES EXCLUSION ────────────────────────────────────────────────────
|
||||
# Never use exit nodes in Five Eyes countries
|
||||
ExcludeExitNodes {us},{gb},{ca},{au},{nz}
|
||||
StrictNodes 1
|
||||
|
||||
# ─── CIRCUIT ROTATION ───────────────────────────────────────────────────────
|
||||
# Rotate circuits every 30 seconds for maximum anonymity
|
||||
MaxCircuitDirtiness 30
|
||||
|
||||
# ─── STREAM ISOLATION ───────────────────────────────────────────────────────
|
||||
# Each destination gets its own circuit
|
||||
IsolateSOCKSAuth 1
|
||||
|
||||
# ─── TRAFFIC PADDING ────────────────────────────────────────────────────────
|
||||
# Pad cells to resist traffic analysis
|
||||
ConnectionPadding 1
|
||||
|
||||
# ─── SAFE LOGGING ────────────────────────────────────────────────────────────
|
||||
# Scrub sensitive info from logs
|
||||
SafeLogging 1
|
||||
Log notice file /var/log/tor/notices.log
|
||||
|
||||
# ─── PERFORMANCE ─────────────────────────────────────────────────────────────
|
||||
NumEntryGuards 3
|
||||
UseEntryGuards 1
|
||||
@@ -0,0 +1,15 @@
|
||||
# /etc/udev/rules.d/99-opsec-usb.rules — OPSEC USB Device Monitoring
|
||||
# Logs all USB insertions and sends desktop notification
|
||||
# Optionally blocks new devices when LEAK_USB_BLOCK=1 in /etc/opsec/opsec.conf
|
||||
|
||||
# Log all USB device insertions
|
||||
ACTION=="add", SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", \
|
||||
RUN+="/bin/bash -c 'echo \"[$(date +%%Y-%%m-%%d\\ %%H:%%M:%%S)] USB INSERT: vendor=$attr{idVendor} product=$attr{idProduct} serial=$attr{serial}\" >> /var/log/opsec-usb.log'"
|
||||
|
||||
# Desktop notification on USB insertion
|
||||
ACTION=="add", SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", \
|
||||
RUN+="/bin/bash -c 'REAL_USER=$(who | head -1 | awk \"{print \\$1}\"); [ -n \"$REAL_USER\" ] && su - $REAL_USER -c \"DISPLAY=:0 notify-send -u critical OPSEC\\ USB \\\"USB device inserted: $attr{idVendor}:$attr{idProduct}\\\"\" 2>/dev/null || true'"
|
||||
|
||||
# Log USB mass storage specifically (higher risk)
|
||||
ACTION=="add", SUBSYSTEM=="block", ENV{ID_USB_DRIVER}=="usb-storage", \
|
||||
RUN+="/bin/bash -c 'echo \"[$(date +%%Y-%%m-%%d\\ %%H:%%M:%%S)] USB STORAGE: $env{ID_VENDOR} $env{ID_MODEL} $env{ID_SERIAL}\" >> /var/log/opsec-usb.log'"
|
||||
@@ -0,0 +1,69 @@
|
||||
# Double-Hop OpenVPN Configuration Template
|
||||
# Chain two VPN servers for additional anonymity layer
|
||||
# Replace %%VARIABLES%% with actual values before use
|
||||
#
|
||||
# Usage: Copy and fill in variables, then:
|
||||
# sudo openvpn --config double-hop.ovpn
|
||||
|
||||
# ─── First Hop (Entry Server) ─────────────────────────────────────────────────
|
||||
# This is the server your ISP sees you connecting to
|
||||
|
||||
client
|
||||
dev tun
|
||||
proto %%PROTO_1%%
|
||||
remote %%SERVER_1%% %%PORT_1%%
|
||||
resolv-retry infinite
|
||||
nobind
|
||||
persist-key
|
||||
persist-tun
|
||||
|
||||
# Authentication
|
||||
auth-user-pass %%AUTH_FILE_1%%
|
||||
ca %%CA_FILE_1%%
|
||||
|
||||
# Security
|
||||
cipher AES-256-GCM
|
||||
auth SHA512
|
||||
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
|
||||
tls-version-min 1.2
|
||||
remote-cert-tls server
|
||||
|
||||
# Routing — send all traffic through VPN
|
||||
redirect-gateway def1
|
||||
dhcp-option DNS 10.8.0.1
|
||||
|
||||
# Keepalive
|
||||
keepalive 10 60
|
||||
ping-timer-rem
|
||||
|
||||
# Logging
|
||||
verb 3
|
||||
mute 10
|
||||
|
||||
# ─── Second Hop Configuration ─────────────────────────────────────────────────
|
||||
# After first VPN is established, launch second hop:
|
||||
#
|
||||
# sudo openvpn --config hop2.ovpn --route-nopull \
|
||||
# --route %%SERVER_2%% 255.255.255.255 net_gateway
|
||||
#
|
||||
# Where hop2.ovpn contains:
|
||||
# client
|
||||
# dev tun1
|
||||
# proto %%PROTO_2%%
|
||||
# remote %%SERVER_2%% %%PORT_2%%
|
||||
# auth-user-pass %%AUTH_FILE_2%%
|
||||
# ca %%CA_FILE_2%%
|
||||
# cipher AES-256-GCM
|
||||
# redirect-gateway def1
|
||||
|
||||
# ─── Variables Reference ───────────────────────────────────────────────────────
|
||||
# %%SERVER_1%% — First hop IP/hostname
|
||||
# %%PORT_1%% — First hop port (e.g. 1194, 443)
|
||||
# %%PROTO_1%% — First hop protocol (udp/tcp)
|
||||
# %%AUTH_FILE_1%% — First hop credentials file
|
||||
# %%CA_FILE_1%% — First hop CA certificate
|
||||
# %%SERVER_2%% — Second hop IP/hostname
|
||||
# %%PORT_2%% — Second hop port
|
||||
# %%PROTO_2%% — Second hop protocol
|
||||
# %%AUTH_FILE_2%% — Second hop credentials file
|
||||
# %%CA_FILE_2%% — Second hop CA certificate
|
||||
@@ -0,0 +1,72 @@
|
||||
# WireGuard Multi-Hop Configuration Template
|
||||
# Chain WireGuard tunnels for additional anonymity
|
||||
# Replace %%VARIABLES%% with actual values
|
||||
#
|
||||
# Architecture:
|
||||
# You → wg0 (Hop 1) → wg1 (Hop 2) → Internet
|
||||
#
|
||||
# Usage:
|
||||
# sudo cp this-file /etc/wireguard/wg0.conf (fill in variables)
|
||||
# sudo wg-quick up wg0
|
||||
# sudo wg-quick up wg1
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# HOP 1: /etc/wireguard/wg0.conf — Entry tunnel (your ISP sees this)
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
|
||||
[Interface]
|
||||
PrivateKey = %%PRIVATE_KEY_1%%
|
||||
Address = %%TUNNEL_IP_1%%/32
|
||||
DNS = %%DNS_1%%
|
||||
# MTU adjustment for encapsulation overhead
|
||||
MTU = 1380
|
||||
|
||||
# Post-routing to allow hop 2 through hop 1
|
||||
PostUp = ip rule add from %%TUNNEL_IP_2%% table 200; ip route add default via %%GATEWAY_1%% table 200
|
||||
PostDown = ip rule del from %%TUNNEL_IP_2%% table 200; ip route del default via %%GATEWAY_1%% table 200
|
||||
|
||||
[Peer]
|
||||
PublicKey = %%PUBLIC_KEY_1%%
|
||||
PresharedKey = %%PSK_1%%
|
||||
Endpoint = %%ENDPOINT_1%%:%%PORT_1%%
|
||||
AllowedIPs = 0.0.0.0/0, ::/0
|
||||
PersistentKeepalive = 25
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# HOP 2: /etc/wireguard/wg1.conf — Exit tunnel (internet sees this)
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
#
|
||||
# [Interface]
|
||||
# PrivateKey = %%PRIVATE_KEY_2%%
|
||||
# Address = %%TUNNEL_IP_2%%/32
|
||||
# DNS = %%DNS_2%%
|
||||
# MTU = 1340
|
||||
# # Route this tunnel's traffic through wg0
|
||||
# Table = off
|
||||
# PostUp = ip rule add from %%TUNNEL_IP_2%% table 200
|
||||
# PostDown = ip rule del from %%TUNNEL_IP_2%% table 200
|
||||
#
|
||||
# [Peer]
|
||||
# PublicKey = %%PUBLIC_KEY_2%%
|
||||
# PresharedKey = %%PSK_2%%
|
||||
# Endpoint = %%ENDPOINT_2%%:%%PORT_2%%
|
||||
# AllowedIPs = 0.0.0.0/0, ::/0
|
||||
# PersistentKeepalive = 25
|
||||
|
||||
# ─── Variables Reference ───────────────────────────────────────────────────────
|
||||
# %%PRIVATE_KEY_1%% — Your private key for hop 1 (wg genkey)
|
||||
# %%PUBLIC_KEY_1%% — Hop 1 server's public key
|
||||
# %%PSK_1%% — Preshared key for hop 1 (wg genpsk)
|
||||
# %%ENDPOINT_1%% — Hop 1 server IP/hostname
|
||||
# %%PORT_1%% — Hop 1 server port (default: 51820)
|
||||
# %%TUNNEL_IP_1%% — Your assigned tunnel IP on hop 1
|
||||
# %%GATEWAY_1%% — Hop 1 internal gateway IP
|
||||
# %%DNS_1%% — DNS server for hop 1
|
||||
#
|
||||
# %%PRIVATE_KEY_2%% — Your private key for hop 2
|
||||
# %%PUBLIC_KEY_2%% — Hop 2 server's public key
|
||||
# %%PSK_2%% — Preshared key for hop 2
|
||||
# %%ENDPOINT_2%% — Hop 2 server IP/hostname (reachable via hop 1)
|
||||
# %%PORT_2%% — Hop 2 server port
|
||||
# %%TUNNEL_IP_2%% — Your assigned tunnel IP on hop 2
|
||||
# %%DNS_2%% — DNS server for hop 2
|
||||
Reference in New Issue
Block a user