From 1f0e3ee79a40f5b2c04798831fe672eedf0d728a Mon Sep 17 00:00:00 2001 From: Cobra Date: Mon, 6 Apr 2026 22:44:52 -0400 Subject: [PATCH] Cap stealth/intel/connectivity modules on Pi3B tier to prevent OOM - Add max_stealth: 3 and max_other: 4 limits to pi3b tier in HARDWARE_TIERS - Enforce those caps in _tier_allows() for stealth and intel+connectivity modules - Disable heavy passive modules: vlan_discovery, network_mapper, auth_flow_tracker, smb_monitor, cloud_token_harvester, ldap_harvester, rdp_monitor, quic_analyzer - Disable heavy stealth modules: lkm_rootkit, ids_tester, ja3_spoofer, overlayfs_manager, encrypted_storage, anti_forensics, traffic_mimicry - Disable heavy intel modules: supply_chain_detect, security_posture, tool_output_parser, topology_mapper, user_timeline, net_intel - Disable heavy connectivity modules: ble_emergency, cellular_backup, bridge, wireguard, wifi_client On Pi 3B (1GB RAM, 700MB budget), this prevents 35+ subprocesses spawning and causing OOM crashes. Keeps lightweight modules running: dns_logger, tls_sni_extractor, credential_sniffer, host_discovery, os_fingerprint, traffic_analyzer, packet_capture, mac_manager, process_disguise, log_suppression, tmpfs_manager, watchdog, credential_db, change_detector, operator_audit, tailscale, data_exfil. --- config/modules.yaml | 52 ++++++++++++++++++++++----------------------- core/engine.py | 9 ++++++++ 2 files changed, 35 insertions(+), 26 deletions(-) diff --git a/config/modules.yaml b/config/modules.yaml index 9d8d8f2..5f742c4 100644 --- a/config/modules.yaml +++ b/config/modules.yaml @@ -60,36 +60,36 @@ passive: beacon_min_count: 10 # Min occurrences to confirm beacon vlan_discovery: - enabled: true + enabled: false description: "802.1Q/DTP/STP/CDP/LLDP/802.1X detection" network_mapper: - enabled: true + enabled: false description: "Communication graph construction (all-pairs, protocol/volume)" snapshot_interval_hours: 4 auth_flow_tracker: - enabled: true + enabled: false description: "Cross-protocol auth correlation (Kerberos/NTLM/SSH/LDAP)" smb_monitor: - enabled: true + enabled: false description: "SMB2/3 share/file access metadata, GPP/SYSVOL detection" cloud_token_harvester: - enabled: true + enabled: false description: "Passive AWS/JWT/OAuth token extraction from cleartext HTTP" ldap_harvester: - enabled: true + enabled: false description: "LDAP query/response parsing, AD object inventory" rdp_monitor: - enabled: true + enabled: false description: "RDP NLA username/hostname/domain extraction" quic_analyzer: - enabled: true + enabled: false description: "QUIC Initial packet SNI extraction (RFC 9000/9001)" db_interceptor: @@ -184,7 +184,7 @@ stealth: description: "rsyslog filter, auditd exclusion, journald rate-limit, history clear" encrypted_storage: - enabled: true + enabled: false description: "LUKS encrypted storage with network-derived key" tmpfs_manager: @@ -196,27 +196,27 @@ stealth: description: "Monitor all services + subprocesses, auto-restart (max 3)" anti_forensics: - enabled: true + enabled: false description: "Timestomp, secure deletion, no core dumps, no swap" traffic_mimicry: - enabled: true + enabled: false description: "Shape implant traffic to match 48h baseline patterns" ja3_spoofer: - enabled: true + enabled: false description: "Chrome/Firefox/Edge JA3 on all outbound HTTPS" ids_tester: - enabled: true + enabled: false description: "Check planned actions against Snort/Suricata rules" lkm_rootkit: - enabled: false # Debian host only, requires kernel headers + enabled: false # Pi3B: disabled to conserve RAM description: "LKM to hide processes/files/connections from /proc" overlayfs_manager: - enabled: true + enabled: false description: "Read-only root FS + tmpfs overlay (zero SD writes)" # --------------------------------------------------------------------------- @@ -233,19 +233,19 @@ intel: - json topology_mapper: - enabled: true + enabled: false description: "Network topology aggregation + Graphviz DOT/SVG output" net_intel: - enabled: true + enabled: false description: "Beacon/C2 detection, anomaly baseline, service dependency mapping" user_timeline: - enabled: true + enabled: false description: "Per-user activity timeline (logins, services, files, websites)" supply_chain_detect: - enabled: true + enabled: false description: "Detect internal repos, WSUS, CA, SCCM, container registries, CI/CD" change_detector: @@ -254,7 +254,7 @@ intel: check_interval_s: 300 security_posture: - enabled: true + enabled: false description: "Detect EDR/SIEM/NAC/honeypots/vuln scanners/network taps" operator_audit: @@ -262,7 +262,7 @@ intel: description: "Append-only HMAC-chained SSH session + command audit trail" tool_output_parser: - enabled: true + enabled: false description: "Parse bettercap events, Responder logs, mitmproxy flows" # --------------------------------------------------------------------------- @@ -270,7 +270,7 @@ intel: # --------------------------------------------------------------------------- connectivity: wireguard: - enabled: true + enabled: false # Pi3B: disabled to conserve RAM description: "Primary C2 -- zero traffic when idle, instant on demand" persistent_keepalive: 0 # Silent until operator connects @@ -279,12 +279,12 @@ connectivity: description: "Fallback mesh VPN via Tailscale" bridge: - enabled: false + enabled: false # Pi3B: disabled to conserve RAM description: "Transparent inline bridge (802.1X bypass, STP/CDP suppression)" failsafe_timeout_s: 15 # C watchdog failsafe wifi_client: - enabled: false + enabled: false # Pi3B: disabled to conserve RAM description: "WPA2-PSK/Enterprise WiFi client via wpa_supplicant" reverse_tunnel: @@ -292,11 +292,11 @@ connectivity: description: "autossh reverse SSH (over WebSocket or TLS, never raw on 443)" cellular_backup: - enabled: false # OPi Zero 3+ only (13-pin header USB) + enabled: false # Pi3B: disabled to conserve RAM description: "LTE modem out-of-band backup (SIM7600/EC25)" ble_emergency: - enabled: false + enabled: false # Pi3B: disabled to conserve RAM description: "BLE GATT server for emergency status/kill/reboot (PSK auth)" data_exfil: diff --git a/core/engine.py b/core/engine.py index bf3113c..826963b 100644 --- a/core/engine.py +++ b/core/engine.py @@ -41,6 +41,8 @@ HARDWARE_TIERS = { "pi3b": { "max_passive": 8, "max_active": 2, + "max_stealth": 3, + "max_other": 4, "max_ram_mb": 700, # 900MB total - ~200MB OS overhead "max_cpu_pct": 75, "allow_mitmproxy": False, @@ -443,6 +445,13 @@ class Engine: elif cls.module_type == "active": if running_by_type.get("active", 0) >= limits["max_active"]: return False + elif cls.module_type == "stealth": + if running_by_type.get("stealth", 0) >= limits.get("max_stealth", 99): + return False + elif cls.module_type in ("intel", "connectivity"): + other_running = running_by_type.get("intel", 0) + running_by_type.get("connectivity", 0) + if other_running >= limits.get("max_other", 99): + return False return True def _count_running_by_type(self) -> dict[str, int]: