CLM (Centralized Log Management)

CLIENT-SERVER Architecture where there is a CENTRAL server to which multiple clients sends their LOGS to.

Getting Started

Pre-Requisite:

• Python3

  sudo apt-get install python3
  

Client-Side Script

Getting the client-side script ready.

SERVER = "X.X.X.X" # Replace the x.x.x.x with the Server IP.
LOCALIP = "y.y.y.y" # Replace the y.y.y.y with your Local IP.

# Add in all the files you want to READ FROM in:

FilesToMonitor = ["[PATH 1]", "[PATH 2]"]  # separated by comma (,).

# ALLOWED PORTS:
ALLOW = [22,3306]

# If you want scanning on, Change:

SCANNING = True # STILL ON TESTING! GETTING FALSE POSITIVES!

Server-Side Script

Getting the Server-side script ready.

SERVER = "X.X.X.X" # Replace the x.x.x.x with the Server IP. LocalIP

Running the scripts:

Make sure the port that is being used by these scripts are open!
Default = 8975

On Server:

python3 server_side.py

Note: The logs with be written in the same directory as: clientlogs.txt

• If there is no response from any client for 5 Minutes, the server will close the connection to it.

On Client:

python3 client.py

Scanning:

Along with the CLM System, It also consists of a realtime port scanning that runs on localhost of each client. Anytime a port that is not in the ALLOW list open up, the server will receive an Alert.

TESTING IN PROGRESS! GETTING FALSE POSITIVES!

Testing:

• Deployed 2 VM's:

  Testing log feature!

  • Server:

    • IP: 192.168.100.214
    • Python3 installed.

  • Client:

    • IP: 192.168.100.215

    • Python3 installed.

    • ALLOWED ROOT SSH LOGIN.

    • Generate come logs or manually add tests to the file that is being monitored!

  Testing OPEN PORTS feature. Still in progress!

  • Locally: EDID THE hosts file in: Ansible/hosts, change to the [client_IP]

    $ docker build -t ansible-protect:latest .
    $ docker run -it --rm ansible-protect:latest bash
    $ ssh-keygen
    $ ssh-copy-id [client_IP]
    $ ansible main.yml
    $ exit
    
    $ cd ../OPEN
    
    CHECK THE hosts file again.
    
    $ docker build -t ansible-expose:latest .
    $ docker run -it --rm ansible-expose:latest bash
    $ ssh-keygen
    $ ssh-copy-id [client_IP]
    $ ansible main.yml
    $ exit

    Here we should get the open port alert on the server since we opened the port 10066, that is not in the Allowed List.