d75825278e
ja4ebpf: - Refactor BPF TC capture with improved SYN offset handling and TCP option parsing - Enhance TLS uprobe SSL hooking for better key extraction - Add ClickHouse writer improvements for HTTP log materialized views - Update RPM spec for Rocky Linux 8/9/10, fix systemd service - Simplify loader with cleaner bpf2go integration bot-detector: - Add H2 SETTINGS per-parameter comparison in browser_matcher - Enhance browser signatures and scoring pipeline - Improve preprocessing and cycle detection infra: - Multi-distro Vagrantfile (centos8, rocky9, rocky10) with per-distro provisioning - New Makefile targets: vm-up-all, test-vm-matrix, test-vm-centos8/rocky10 - Add debug helpers and run-test-from-host.sh for host-driven VM testing - Update run-tests-vm.sh for cross-distro compatibility - Remove accidental binary blob (\004) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
82 lines
3.6 KiB
Desktop File
82 lines
3.6 KiB
Desktop File
# =============================================================================
|
|
# ja4ebpf.service — Unité systemd pour l'agent eBPF ja4ebpf
|
|
#
|
|
# Installation :
|
|
# install -m 644 ja4ebpf.service /usr/lib/systemd/system/
|
|
# systemctl daemon-reload
|
|
# systemctl enable --now ja4ebpf
|
|
#
|
|
# Sécurité :
|
|
# L'agent fonctionne sous un compte dédié "ja4ebpf" sans shell ni home.
|
|
# Les capabilities Linux strictement nécessaires sont accordées via
|
|
# AmbientCapabilities + CapabilityBoundingSet (sans User=root).
|
|
# Cible : RHEL/CentOS/Rocky/Alma 8+ (kernel ≥ 4.18, BTF natif disponible).
|
|
# =============================================================================
|
|
[Unit]
|
|
Description=JA4 eBPF Network Fingerprint Agent
|
|
Documentation=https://github.com/antitbone/ja4-platform
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=ja4ebpf
|
|
Group=ja4ebpf
|
|
|
|
ExecStart=/usr/sbin/ja4ebpf
|
|
Environment=JA4EBPF_CONFIG=/etc/ja4ebpf/config.yml
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
TimeoutStopSec=30s
|
|
|
|
# ── Capabilities Linux ─────────────────────────────────────────────────────
|
|
# CAP_BPF : charger/créer des programmes et maps eBPF (kernel ≥ 5.8)
|
|
# Sur RHEL 8 (4.18), cilium/ebpf retombe sur CAP_SYS_ADMIN.
|
|
# CAP_NET_ADMIN : attacher un programme TC sur une interface réseau
|
|
# CAP_NET_RAW : accès raw socket (fallback sur kernels sans TCX)
|
|
# CAP_PERFMON : attacher des perf_events / uprobes (kernel ≥ 5.8)
|
|
# CAP_SYS_ADMIN : requis sur RHEL 8 / kernel < 5.8 pour charger eBPF
|
|
# CAP_SYS_PTRACE : résoudre les offsets de fonctions pour les uprobes
|
|
# CAP_DAC_READ_SEARCH : lire /proc/<pid>/maps pour localiser libssl.so
|
|
CapabilityBoundingSet=CAP_BPF CAP_NET_ADMIN CAP_NET_RAW CAP_PERFMON CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
|
|
AmbientCapabilities=CAP_BPF CAP_NET_ADMIN CAP_NET_RAW CAP_PERFMON CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
|
|
|
|
# Ne jamais acquérir de nouveaux privilèges via setuid/setgid
|
|
NoNewPrivileges=yes
|
|
|
|
# ── Isolation du système de fichiers ───────────────────────────────────────
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ReadWritePaths=/var/lib/ja4ebpf /var/log/ja4ebpf /run/ja4ebpf
|
|
PrivateTmp=yes
|
|
PrivateDevices=no
|
|
|
|
# ── Isolation réseau ───────────────────────────────────────────────────────
|
|
PrivateNetwork=no
|
|
|
|
# ── Divers ─────────────────────────────────────────────────────────────────
|
|
ProtectKernelTunables=no
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=no
|
|
ProtectControlGroups=yes
|
|
RestrictNamespaces=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=no # JIT eBPF requiert des mappings exécutables kernel-side
|
|
|
|
# ── Limites de ressources ──────────────────────────────────────────────────
|
|
LimitMEMLOCK=infinity
|
|
LimitNOFILE=65536
|
|
|
|
# ── Journalisation ─────────────────────────────────────────────────────────
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=ja4ebpf
|
|
|
|
WorkingDirectory=/var/lib/ja4ebpf
|
|
RuntimeDirectory=ja4ebpf
|
|
RuntimeDirectoryMode=0750
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|