Initial release: ghost_protocol privacy toolkit

2026-03-04 09:13:16 -05:00
commit 973cede31f
99 changed files with 12158 additions and 0 deletions
@@ -0,0 +1,119 @@
+#!/bin/bash
+# /usr/local/bin/opsec-monitor.sh — Background connection monitor
+# Watches for non-Tor/non-VPN outbound connections, new listening ports,
+# unexpected DNS queries. Sends desktop notifications + logs.
+# Usage: sudo opsec-monitor.sh start|stop|status
+
+set -euo pipefail
+
+PIDFILE="/var/run/opsec-monitor.pid"
+LOGFILE="/var/log/opsec-monitor.log"
+INTERVAL=10
+
+OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
+if [ -f "$OPSEC_LIB" ]; then
+    . "$OPSEC_LIB"
+else
+    opsec_green()  { echo "[+] $*"; }
+    opsec_red()    { echo "[-] $*"; }
+    opsec_info()   { echo "[~] $*"; }
+fi
+
+notify() {
+    local msg="$1" urgency="${2:-normal}"
+    local real_user="${SUDO_USER:-$USER}"
+    # Desktop notification
+    su - "$real_user" -c "DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u "$real_user")/bus notify-send -u '$urgency' 'OPSEC Monitor' '$msg'" 2>/dev/null || true
+    # Log
+    echo "[$(date '+%H:%M:%S')] $msg" >> "$LOGFILE"
+}
+
+monitor_loop() {
+    local known_listeners=""
+    local tor_uid
+    tor_uid=$(id -u debian-tor 2>/dev/null || id -u tor 2>/dev/null || echo "")
+
+    while true; do
+        # ─── Check for non-Tor/VPN outbound connections ────────────────────
+        local suspicious
+        suspicious=$(ss -tunp 2>/dev/null | grep ESTAB | grep -v '127.0.0.1' | grep -v '::1' | \
+            grep -v "tun\|wg\|tor\|${tor_uid:-NOOP}" | \
+            grep -v ':9050\|:5353\|:1194\|:51820' || true)
+
+        if [ -n "$suspicious" ]; then
+            local count
+            count=$(echo "$suspicious" | wc -l)
+            notify "ALERT: ${count} non-Tor/VPN outbound connection(s) detected" "critical"
+        fi
+
+        # ─── Check for new listening ports ─────────────────────────────────
+        local current_listeners
+        current_listeners=$(ss -tlnp 2>/dev/null | tail -n +2 | awk '{print $4}' | sort)
+
+        if [ -n "$known_listeners" ] && [ "$current_listeners" != "$known_listeners" ]; then
+            local new_ports
+            new_ports=$(comm -13 <(echo "$known_listeners") <(echo "$current_listeners") 2>/dev/null || true)
+            if [ -n "$new_ports" ]; then
+                notify "New listening port(s): ${new_ports}" "critical"
+            fi
+        fi
+        known_listeners="$current_listeners"
+
+        # ─── Check for unexpected DNS queries ──────────────────────────────
+        local dns_leaks
+        dns_leaks=$(ss -tunp 2>/dev/null | grep ':53 ' | grep -v '127.0.0.1' | grep -v '::1' || true)
+        if [ -n "$dns_leaks" ]; then
+            notify "DNS LEAK: Non-local DNS query detected" "critical"
+        fi
+
+        sleep "$INTERVAL"
+    done
+}
+
+do_start() {
+    if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then
+        opsec_info "Monitor already running (PID: $(cat "$PIDFILE"))"
+        return
+    fi
+
+    monitor_loop &
+    echo $! > "$PIDFILE"
+    opsec_green "Monitor started (PID: $!, logging to ${LOGFILE})"
+}
+
+do_stop() {
+    if [ -f "$PIDFILE" ]; then
+        local pid
+        pid=$(cat "$PIDFILE")
+        kill "$pid" 2>/dev/null || true
+        # Kill child processes
+        pkill -P "$pid" 2>/dev/null || true
+        rm -f "$PIDFILE"
+        opsec_green "Monitor stopped"
+    else
+        opsec_info "Monitor not running"
+    fi
+}
+
+do_status() {
+    if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then
+        opsec_green "Monitor running (PID: $(cat "$PIDFILE"))"
+        if [ -f "$LOGFILE" ]; then
+            echo ""
+            echo "Last 10 log entries:"
+            tail -10 "$LOGFILE" 2>/dev/null || true
+        fi
+    else
+        opsec_info "Monitor not running"
+    fi
+}
+
+case "${1:-}" in
+    start)  do_start ;;
+    stop)   do_stop ;;
+    status) do_status ;;
+    *)
+        echo "Usage: $(basename "$0") start|stop|status"
+        exit 1
+        ;;
+esac