软件加固/安全沙箱>> tr1pd>> 返回
项目作者： kpcyrd

项目描述 ：
tamper resistant audit log
高级语言： Rust
项目地址: git://github.com/kpcyrd/tr1pd.git
创建时间： 2018-01-01T18:48:25Z
项目社区：https://github.com/kpcyrd/tr1pd
开源协议：GNU Affero General Public License v3.0
下载


tr1pd Build Status Crates.io docs.rs

Status: Very unstable, do not use

tr1pd is a tamper resistant audit log.

Usage

  1. # setup your keyring
  2. tr1pctl init
  3. # start the tr1pd daemon
  4. systemctl start tr1pd
  5. # start a sensor
  6. ./sensor01 | tr1pctl write &
  7. # verify your logs
  8. tr1pctl fsck
  9. # view the logs of your current session
  10. tr1pctl ls @..

Installation

Make sure you have the following dependencies installed:
Debian/Ubuntu: libsodium-dev libseccomp-dev libzmq3-dev,
Archlinux: libsodium libseccomp zeromq,
Alpine: make libsodium-dev libseccomp-dev zeromq-dev,
OpenBSD: libsodium zeromq.

  1. cargo install tr1pd

Setup

If possible, use your package manager to setup the system (Archlinux AUR).
After that you need to add the users that should have access to tr1pctl to the
tr1pd group with usermod -aG tr1pd youruser.

If no package is available, you can also run a standalone setup (this is also
recommended for development). Edit the paths as needed.

  1. # standalone configuration (~/.config/tr1pd.toml)
  3. [daemon]
  4. socket = "ipc:///home/user/.tr1pd/tr1pd.sock"
  5. datadir = "/home/user/.tr1pd/"
  7. pub_key = "/home/user/.tr1pd/pub.key"
  8. sec_key = "/home/user/.tr1pd/sec.key"

Run tr1pctl init to setup the keyring in your homefolder and tr1pd in a
seperate terminal. Verify everything is working correctly by executing
tr1pctl ping.

Writing sensors

Sensors can be written in any language using stdio. tr1pctl write is a simple
line based interface that writes each line into a block. You can also enable
binary mode with tr1pctl write -s 65535. To monitor your auth.log you can
simply write:

  1. tail -f /var/log/auth.log | tr1pctl write

Benchmark

While this is not a common usecase, tr1pd is fast enough for Ultra HD video,
according to netflix. This means that you can write >= 25 Megabits per
second. Make sure you’re compiling both tr1pctl and tr1pd with --release.

  1. dd if=/dev/zero | pv | cargo run --release --bin tr1pctl -- write -s 65535

The program says block a lot, is this a blockchain?

No. tr1pd uses merkle tree like constructs that are
heavily inspired by bitcoin, but lacks some essential properties to qualify as
a blockchain.

Trivia

The initial draft for the protocol was designed in 2014 for perimeter
intrustion detection to verify integrity of buildings. Multiple prototypes have
been written in 2017 and the first deployment was on a server located at the
34C3 to ensure integrity inside the congress colocation.

License

AGPLv3+