SilentDune-Client 0.5.1

Configuration File

/etc/silentdune/sdc.conf

Executables

sdc-install

The installer disables any running firewall services, runs the installer and configuration code from each module. The final configuration is stored in /etc/silentdune/sdc.conf.

sdc-firewall

This is the firewall service, it must be run as root. It can be run in the foreground (SystemD style) or in the background (SysInit style). Init service scripts and configuration files are in the project init directory.

Firewall Manager Module

The FM module is the core of the SDC. This module communicates with the other modules to add, remove and query firewall rules. This module also saves running rules when shutdown and restores them on startup.

Logging Module

The LM is used to set firewall logging rules and to monitor the system log for triggered rule events. The LM provides a subscription service for other modules to subscribe to receive the system log events.

Goal:

The purpose of the LM is to promote setting egress firewall rules. If all egress network traffic is constrained by rules, then any network activity that does not match the egress rules is potentially malicious and should be blocked. The LM module can then capture that activity and depending on which other modules are used can provide alerts to administrators.

Auto Discovery Module

The AD module looks at the local system configuration to create egress rules and sometimes ingress rules for external services required by the system. The AD module will also over time recheck all items, looking for changes and update the firewall rules accordingly.

This helps administrators by automating rule building for important external services.

Goal:

Auto discover external services required for a system to be completely functional and set egress firewall rules to allow access to those services. Keep those rules up to date over time.

Note:

The AD module will also set ingress and egress rules for SSH. Any of the discovery items can be disabled by administrators. Administrators using the SDS module (Silent Dune Server module) may want to disable SSH in AD and create fine grain SSH rules in the Silent Dune Server.

The AD module also auto creates egress rejection rules for the OUTPUT and FORWARD chains.

Discovery items include:

• DNS

• NTP

• System Updates (apt and yum, including mirrors)

• DHCP

Silent Dune Server Module

The SDS module provides a connection with a Silent Dune Server to allow central management of a large number systems.

When used in conjunction with the Auto Discovery and Logging modules, creating and managing egress firewall rules can be greatly simplified for administrators. See: [Silent Dune GitHub project](https://github.com/EntPack/SilentDune)

DBUS Module

Using DBUS inter-process communications to allow other process to create firewall rules, specifically egress rules.

Goal:

One application of this I would like to see eventually is a email or web browser plugin that communicates with the SDC to allow egress traffic to high quality web sites. So if malicious code executes in an email attachment or the web browser and tries to communicate to an external Command and Control server, it would be blocked from doing so.

See BBC pure javascript ransomware article: http://www.bbc.com/news/technology-36575687

Docker Container Module

After talking with the Docker people at PyCon 2016, having a module that could centrally manage and monitor the firewall settings on Docker containers would be an exciting module for administrators to have.