Torjus Håkestad
0ad6f4cb6a
Implement phase 2.1 (human detection) and 2.2 (notifications): - Detection scorer computes 0.0-1.0 human likelihood from keystroke timing variance, special key usage, typing speed, command diversity, and session duration - Webhook notifier sends JSON POST to configured endpoints with deduplication, custom headers, and event filtering - RecordingChannel gains an event callback for feeding keystrokes to the scorer without coupling shell and detection packages - Server wires scorer into session lifecycle with periodic updates and threshold-based notification triggers - Web UI shows human score in session tables with highlighting - New config sections: [detection] and [[notify.webhooks]] Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
44 lines
1.0 KiB
Plaintext
44 lines
1.0 KiB
Plaintext
log_level = "info"
|
||
log_format = "text" # "text" or "json"
|
||
|
||
[ssh]
|
||
listen_addr = ":2222"
|
||
host_key_path = "oubliette_host_key"
|
||
max_connections = 500
|
||
|
||
[auth]
|
||
accept_after = 10
|
||
credential_ttl = "24h"
|
||
|
||
[[auth.static_credentials]]
|
||
username = "root"
|
||
password = "toor"
|
||
|
||
[[auth.static_credentials]]
|
||
username = "admin"
|
||
password = "admin"
|
||
|
||
[storage]
|
||
db_path = "oubliette.db"
|
||
retention_days = 90
|
||
retention_interval = "1h"
|
||
|
||
# [web]
|
||
# enabled = true
|
||
# listen_addr = ":8080"
|
||
|
||
[shell]
|
||
hostname = "ubuntu-server"
|
||
# banner = "Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-89-generic x86_64)\r\n\r\n"
|
||
# fake_user = "" # override username in prompt; empty = use authenticated user
|
||
|
||
# [detection]
|
||
# enabled = true
|
||
# threshold = 0.6 # 0.0–1.0, sessions above this trigger notifications
|
||
# update_interval = "5s" # how often to recompute the score during a session
|
||
|
||
# [[notify.webhooks]]
|
||
# url = "https://ntfy.example.com/honeypot"
|
||
# headers = { Authorization = "Bearer your-token" }
|
||
# events = ["human_detected", "session_started"] # empty = all events
|