Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api

9 files in utils/ providing the shared infrastructure layer: - crypto: AES-256-GCM file encryption, argon2id/PBKDF2 key derivation, HKDF network unlock, LUKS container management - networking: interface detection, MAC/IP helpers, BPF compilation via libpcap ctypes, gratuitous ARP, VLAN creation - logging: encrypted log writer (BBLogger) with rotation, per-module files, stdout suppression for stealth - stealth: process rename via prctl, cmdline spoofing, sysctl helpers, timestomping, core dump disable - resource: hardware tier detection (OPi Zero 3 / Pi Zero / generic) via /proc/device-tree and cpuinfo, resource monitoring - permissions: root/capability checks via capget ctypes, privilege dropping, directory permission enforcement - config_loader: YAML merge hierarchy (hardware_tiers -> bigbrother -> modules -> stealth -> CLI), tier auto-detection, SIGHUP reload - bettercap_api: REST client with per-session random credentials, session/events/command methods
2026-03-18 08:11:25 -04:00
parent 63e317176d
commit 62a1010ab4
35 changed files with 2145 additions and 0 deletions
@@ -0,0 +1,96 @@
+# BigBrother Master Configuration
+# Non-sensitive defaults only. Keys, auth tokens, engagement data
+# stored in storage/config/ inside LUKS container.
+#
+# Platform: Orange Pi Zero 3 (primary), RPi Zero 2W (jumpbox), Debian host
+# See hardware_tiers.yaml for tier-specific limits.
+
+device:
+  platform: "auto"                  # auto | opi_zero3 | pi_zero | generic
+  hostname: "iot-sensor-03"         # Matches selected MAC profile
+  install_path: "/opt/.cache/bb"    # OPSEC: innocuous install path
+
+network:
+  primary_interface: "auto"         # auto-detect active interface
+  bridge:
+    enabled: false
+    internal: "eth0"                # LAN-side (target network)
+    external: "eth1"                # WAN-side (uplink)
+  wifi:
+    interface: "wlan0"
+  cellular:
+    enabled: false
+    modem_device: "/dev/ttyUSB0"    # SIM7600/EC25 via 13-pin header USB
+  scope_enforcement: false          # Enforce scope.yaml restrictions
+  scope_file: null                  # Path to scope.yaml override
+
+connectivity:
+  # WireGuard primary: zero traffic when idle (PersistentKeepalive=0),
+  # instant access when operator sends a packet. No beacons, no heartbeats,
+  # no coordination servers. Completely silent while idle.
+  primary: "wireguard"
+  failover_chain:
+    - wireguard
+    - tailscale
+    - reverse_ssh
+    - cellular
+  wireguard:
+    endpoint: ""                    # operator-controlled WG endpoint (host:port)
+    private_key_file: "storage/config/wg_private.key"
+    peer_public_key: ""
+    allowed_ips: "10.99.0.0/24"
+  tailscale:
+    auth_key: ""                    # Per-engagement auth key
+    hostname: ""                    # Matches MAC profile hostname
+  reverse_ssh:
+    relay_host: ""
+    relay_port: 22
+    relay_user: "bb"
+    key_file: "storage/config/ssh_relay.key"
+
+security:
+  encryption: "aes-256-gcm"        # PCAP + credential encryption
+  encryption_key_derive: "argon2id" # argon2id | pbkdf2 (RPi Zero 2W)
+  luks_container: "storage/encrypted.luks"
+  kill_switch_enabled: true
+  dead_man_switch:
+    enabled: false
+    interval_hours: 72              # Auto-wipe if no operator checkin
+
+capture:
+  interface: "auto"                 # auto-detect or explicit interface
+  snap_length: 65535                # Full packet capture
+  pcap_rotation_hours: 1            # Rotate PCAP every hour
+  pcap_compression: "zstd"
+  pcap_compression_level: 19        # OPi Zero 3: -19 (max). RPi Zero 2W: auto-downgrade to -3
+  pcap_format: "pcapng"
+  pcap_encryption: true             # AES-256-GCM post-compression
+  bpf_filter: "full_capture"        # Reference to data/bpf_filters/<name>.bpf
+  disk_max_pct: 85                  # Auto-purge oldest PCAPs above this threshold
+
+stealth:
+  mac_profile: "auto"              # auto | streaming | printer | iot | <specific device_name>
+  mac_network_type: "auto"         # auto | business | home
+  process_disguise: true           # Rename all processes to system service names
+  log_suppression: true            # Suppress syslog/auditd/journald evidence
+  overlayfs: true                  # Read-only root + tmpfs overlay (SD protection)
+  traffic_mimicry: true            # Shape exfil to match baseline patterns
+
+baseline:
+  duration_hours: 48               # Traffic baseline collection period
+  auto_start: true                 # Begin baseline on first boot
+
+engagement_phase:
+  mode: "passive_only"             # passive_only | active_allowed
+  passive_days: 7                  # Minimum passive-only observation period
+  auto_transition: true            # Auto-allow active after passive_days
+  active_allowed_after: null       # ISO timestamp override (manual scheduling)
+
+bettercap:
+  binary: "/usr/local/bin/bettercap"
+  api_address: "127.0.0.1"        # Localhost only -- never network-visible
+  api_port: 8083
+  api_user: "bb"
+  # api_password generated per-session, stored in memory only
+  default_caplet: "passive_recon"
+  caplets_path: "config/caplets"