Secinfo-xmpp

Secinfo-xmpp is a system for sharing security information over an XMPP chat group.

This is an early release, for experimentation and testing and is expected to change, though it has been running for over 6 months on half a dozon internet facing hosts.

Internet facing hosts share security events via the chat group, and listen on that group for events detected by other hosts, and use them to preemptively defend against those attackers.

Presently implemented is a fail2ban action which notifies the group about a block or unblock, the listening part to ban, and an optional coordinator module for research and analysis.

The secinfo-xmpp daemon listens for messages on the group, and if informed that another host had banned an IP address on some jail then, if the same jail is used on the local host then that IP will be banned on the local jail

The protocol is at present XMPP messages of the form
 v=1,t=f2b-b,j=sshd,i=192.168.1.66
 
where
 v= gives the version number of the protocol
 t= gives the type, currently f2b-b, for a fai2ban ban, or f2b-u for a fail2ban unban
 j= gives the jail, which is the fail2ban jail
 i= give the IP address which is blocked or unblocked.
  
Potentially this could carry mail envelope sender addresses, XMPP spam JIDs etc.

The daemon listens on a local tcp or unix socket for information on locally detected attacks, which is shares with the group. There is a fail2ban action which can be invoked from a local jail to send the ban information to the daemon.

There is also a coordinator module which can be installed on a non-internet facing host, but part of the XMPP group, which receives and analyses the data from the internet facing hosts. See below for installation.

# Installation

First set up the required XMPP group and user as per https://gitlab.com/JohnLines/secinfo-xmpp/-/wikis/XMPP-setup

## Dependencies
The software implementation uses slixmpp, so

apt install --no-install-recommends python3-slixmpp

Note that slixmpp recommends several packages not required for this purpose, though they may be useful in other contexts. I have only tested with version 1.10

## secinfo-xmpp install

On the target host, create a temporary directory and do (for the latest version, which could be ahead of a release)

 wget https://gitlab.com/JohnLines/secinfo-xmpp/-/archive/main/secinfo-xmpp-main.tar.gz
 
or for the latest release go to https://gitlab.com/JohnLines/secinfo-xmpp/-/releases and download the tar.gz from there.
 
 extract it and, if you are a bit paranoid, review install.sh before running it. If you are not a bit paranoid are you SURE you should be installing software on a security related system.
 
 Configure /etc/sectinfo-xmpp/config.ini so that the values in the Id and Room sections match your configuration.
 
  systemctl daemon-reload

  systemctl start secinfo-xmpp
  
This should run but will not receve inforation about bans until fail2bn is restarted.

  systemctl restart fail2ban
  
- note that if you had an existing /etc/fail2ban/jail.d/sshd.local then this will not have been updated. Compare it with the distributed one, and copy across the part that reads
  action = %(known/action)s
         secinfo-xmpp

and any other bits which match your needs. Update any other jails you use to inoke the secinfo-xmpp action as well and do

 firewall-cmd --reload
 
 ### upgrading
 
 To upgrade an existing system, create a temporary directory and do (as above for a new install)
 
  wget https://gitlab.com/JohnLines/secinfo-xmpp/-/archive/main/secinfo-xmpp-main.tar.gz
  
Then as root go to the tempory directory and do

  ./install.sh  
  systemctl restart secinfo-xmpp


 ### Installing the Coordinator
 
 This requires as well as python3-slixmpp as above, the following packages  
  rdap - used to anyalse IP addresses  
  python3-geoip - ditto  
  sqlite3 - to manage the sqlite database (needed at present for installation)  
 it is also useful to have  
  sqlitebrowser - to view the database  
  
Edit install.sh to set 'install_configurator' to true, and run it.

The coordinator is under development, but should create a database and populate it with attack, attackers and countries


  
 
 
 
