Cobra
ffd384f64b
Replace all sensor.* logger namespaces with __name__ (generic module identifiers instead of discoverable 'sensor.*' prefixes). Change hardcoded 'bb' API user to 'admin' in config and code defaults. Change hardcoded relay_user 'bb' to 'operator' — prevents network profiling from exposing tool identity via SSH config. Fixes #457, #458, #459
97 lines
3.8 KiB
YAML
97 lines
3.8 KiB
YAML
# BigBrother Master Configuration
|
|
# Non-sensitive defaults only. Keys, auth tokens, engagement data
|
|
# stored in storage/config/ inside LUKS container.
|
|
#
|
|
# Platform: Orange Pi Zero 3 (primary), RPi Zero 2W (jumpbox), Debian host
|
|
# See hardware_tiers.yaml for tier-specific limits.
|
|
|
|
device:
|
|
platform: "auto" # auto | opi_zero3 | pi_zero | generic
|
|
hostname: "iot-sensor-03" # Matches selected MAC profile
|
|
install_path: "/opt/.cache/bb" # OPSEC: innocuous install path
|
|
|
|
network:
|
|
primary_interface: "auto" # auto-detect active interface
|
|
bridge:
|
|
enabled: false
|
|
internal: "eth0" # LAN-side (target network)
|
|
external: "eth1" # WAN-side (uplink)
|
|
wifi:
|
|
interface: "wlan0"
|
|
cellular:
|
|
enabled: false
|
|
modem_device: "/dev/ttyUSB0" # SIM7600/EC25 via 13-pin header USB
|
|
scope_enforcement: false # Enforce scope.yaml restrictions
|
|
scope_file: null # Path to scope.yaml override
|
|
|
|
connectivity:
|
|
# WireGuard primary: zero traffic when idle (PersistentKeepalive=0),
|
|
# instant access when operator sends a packet. No beacons, no heartbeats,
|
|
# no coordination servers. Completely silent while idle.
|
|
primary: "wireguard"
|
|
failover_chain:
|
|
- wireguard
|
|
- tailscale
|
|
- reverse_ssh
|
|
- cellular
|
|
wireguard:
|
|
endpoint: "" # operator-controlled WG endpoint (host:port)
|
|
private_key_file: "storage/config/wg_private.key"
|
|
peer_public_key: ""
|
|
allowed_ips: "10.99.0.0/24"
|
|
tailscale:
|
|
auth_key: "" # Per-engagement auth key
|
|
hostname: "" # Matches MAC profile hostname
|
|
reverse_ssh:
|
|
relay_host: ""
|
|
relay_port: 22
|
|
relay_user: "operator"
|
|
key_file: "storage/config/ssh_relay.key"
|
|
|
|
security:
|
|
encryption: "aes-256-gcm" # PCAP + credential encryption
|
|
encryption_key_derive: "argon2id" # argon2id | pbkdf2 (RPi Zero 2W)
|
|
luks_container: "storage/encrypted.luks"
|
|
kill_switch_enabled: true
|
|
dead_man_switch:
|
|
enabled: false
|
|
interval_hours: 72 # Auto-wipe if no operator checkin
|
|
|
|
capture:
|
|
interface: "auto" # auto-detect or explicit interface
|
|
snap_length: 65535 # Full packet capture
|
|
pcap_rotation_hours: 1 # Rotate PCAP every hour
|
|
pcap_compression: "zstd"
|
|
pcap_compression_level: 19 # OPi Zero 3: -19 (max). RPi Zero 2W: auto-downgrade to -3
|
|
pcap_format: "pcapng"
|
|
pcap_encryption: true # AES-256-GCM post-compression
|
|
bpf_filter: "full_capture" # Reference to data/bpf_filters/<name>.bpf
|
|
disk_max_pct: 85 # Auto-purge oldest PCAPs above this threshold
|
|
|
|
stealth:
|
|
mac_profile: "auto" # auto | streaming | printer | iot | <specific device_name>
|
|
mac_network_type: "auto" # auto | business | home
|
|
process_disguise: true # Rename all processes to system service names
|
|
log_suppression: true # Suppress syslog/auditd/journald evidence
|
|
overlayfs: true # Read-only root + tmpfs overlay (SD protection)
|
|
traffic_mimicry: true # Shape exfil to match baseline patterns
|
|
|
|
baseline:
|
|
duration_hours: 48 # Traffic baseline collection period
|
|
auto_start: true # Begin baseline on first boot
|
|
|
|
engagement_phase:
|
|
mode: "passive_only" # passive_only | active_allowed
|
|
passive_days: 7 # Minimum passive-only observation period
|
|
auto_transition: true # Auto-allow active after passive_days
|
|
active_allowed_after: null # ISO timestamp override (manual scheduling)
|
|
|
|
bettercap:
|
|
binary: "/usr/local/bin/bettercap"
|
|
api_address: "127.0.0.1" # Localhost only -- never network-visible
|
|
api_port: 8083
|
|
api_user: "admin"
|
|
# api_password generated per-session, stored in memory only
|
|
default_caplet: "passive_recon"
|
|
caplets_path: "config/caplets"
|