From 40922dc107725c53fdf7db6a074caff1f635f19c Mon Sep 17 00:00:00 2001 From: Zandre Witte Date: Wed, 6 Mar 2019 17:16:12 +0100 Subject: [PATCH 1/6] Updated config_template with unix based process filters, still WIP --- pkg/config/config_template.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkg/config/config_template.yaml b/pkg/config/config_template.yaml index a9835285aeb0..32e024741a49 100644 --- a/pkg/config/config_template.yaml +++ b/pkg/config/config_template.yaml @@ -621,7 +621,12 @@ process_config: process: 30 connections: 30 # A list of regex patterns that will exclude a process if matched. -# blacklist_patterns: + blacklist_patterns: + - "^/sbin/" + - "^/usr/sbin/" + - "^/usr/bin/vim.basic" + - "^sshd:" + - "^/bin/bash" # How many check results to buffer in memory when POST fails. The default is usually fine. queue_size: 10 # The maximum number of file descriptors to open when collecting net connections. From 33e234906725b2af0d20cbd1597f9fa09a390ab7 Mon Sep 17 00:00:00 2001 From: Zandre Witte Date: Tue, 12 Mar 2019 14:39:13 +0100 Subject: [PATCH 2/6] stac-3401 blacklisted process names --- pkg/config/config_template.yaml | 38 ++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/pkg/config/config_template.yaml b/pkg/config/config_template.yaml index 32e024741a49..ffc804ad03d3 100644 --- a/pkg/config/config_template.yaml +++ b/pkg/config/config_template.yaml @@ -622,11 +622,47 @@ process_config: connections: 30 # A list of regex patterns that will exclude a process if matched. blacklist_patterns: + # Linux Specific patterns - "^/sbin/" - "^/usr/sbin/" - - "^/usr/bin/vim.basic" + - "^/usr/bin/vi(?:m|m.basic)?$" - "^sshd:" - "^/bin/bash" + - "^/usr/bin/bash" + - "^/usr/lib/systemd/*" + - "^/usr/bin/dbus-daemon" + - "^/usr/bin/tail" + - "^-bash" + - "^\\(sd-pam\\)" + - "^pickup" + - "^qmgr" + # Windows Specific patterns + - "cmd.exe" + - "conhost.exe" + - "taskhostw.exe" + - "vim.exe" + - "winlogon.exe" + - "wininit.exe" + - "wlms.exe" + - "tasklist.exe" + - "svchost.exe" + - "wmiprvse.exe" + - "VBoxService.exe" + - "lsass.exe" + - "dwm.exe" + - "sihost.exe" + - "Explorer.EXE" + - "smartscreen.exe" + - "DllHost.exe" + - "msdtc.exe" + - "SearchUI.exe" +# Should be ignored, but gets reported with an empty command line +# - "sppsvc.exe" +# - "services.exe" +# - "csrss.exe" +# - "wininit.exe" +# - "System" +# - "smss.exe" # How many check results to buffer in memory when POST fails. The default is usually fine. queue_size: 10 # The maximum number of file descriptors to open when collecting net connections. From 1da2ddd10d6ffb31b8dde2cb07d56c246aa8d50d Mon Sep 17 00:00:00 2001 From: Zandre Witte Date: Wed, 13 Mar 2019 11:02:23 +0100 Subject: [PATCH 3/6] added process filtering test to molecule --- .../molecule/default/tests/test_receiver.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/test/molecule-role/molecule/default/tests/test_receiver.py b/test/molecule-role/molecule/default/tests/test_receiver.py index 8eea703be02a..48601b4a4b43 100644 --- a/test/molecule-role/molecule/default/tests/test_receiver.py +++ b/test/molecule-role/molecule/default/tests/test_receiver.py @@ -291,4 +291,17 @@ def _component_data(type_name, external_id_prefix, command): assert _component_data("process", "urn:process:/agent-ubuntu", "/opt/stackstate-agent/bin/agent/agent")["hostTags"] == ["os:linux"] assert _component_data("process", "urn:process:/agent-win", "\"C:\\Program Files\\StackState\\StackState Agent\\embedded\\agent.exe\"")["hostTags"] == ["os:windows"] + # assert that process filtering works correctly + # fedora specific process filtering + assert _component_data("process", "urn:process:/agent-fedora", "/usr/sbin/sshd") == None + assert _component_data("process", "urn:process:/agent-fedora", "/usr/sbin/dhclient") == None + assert _component_data("process", "urn:process:/agent-fedora", "/usr/lib/systemd/systemd-journald") == None + # ubuntu specific process filtering + assert _component_data("process", "urn:process:/agent-ubuntu", "/usr/sbin/sshd") == None + assert _component_data("process", "urn:process:/agent-ubuntu", "/lib/systemd/systemd-journald") == None + assert _component_data("process", "urn:process:/agent-ubuntu", "/sbin/agetty") == None + # windows specific process filtering + assert _component_data("process", "urn:process:/agent-win", "C:\\Windows\\system32\\svchost.exe") == None + assert _component_data("process", "urn:process:/agent-win", "winlogon.exe") == None + assert _component_data("process", "urn:process:/agent-win", "C:\\Windows\\system32\\wlms\\wlms.exe") == None util.wait_until(wait_for_components, 30, 3) From 8c281da6a2f17b18be92d5d2382660f2131554d1 Mon Sep 17 00:00:00 2001 From: Zandre Witte Date: Wed, 13 Mar 2019 12:24:14 +0100 Subject: [PATCH 4/6] added process filtering test to molecule --- .../molecule/default/tests/test_receiver.py | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/test/molecule-role/molecule/default/tests/test_receiver.py b/test/molecule-role/molecule/default/tests/test_receiver.py index 48601b4a4b43..cfc28f1bef09 100644 --- a/test/molecule-role/molecule/default/tests/test_receiver.py +++ b/test/molecule-role/molecule/default/tests/test_receiver.py @@ -293,15 +293,15 @@ def _component_data(type_name, external_id_prefix, command): # assert that process filtering works correctly # fedora specific process filtering - assert _component_data("process", "urn:process:/agent-fedora", "/usr/sbin/sshd") == None - assert _component_data("process", "urn:process:/agent-fedora", "/usr/sbin/dhclient") == None - assert _component_data("process", "urn:process:/agent-fedora", "/usr/lib/systemd/systemd-journald") == None + assert _component_data("process", "urn:process:/agent-fedora", "/usr/sbin/sshd") is None + assert _component_data("process", "urn:process:/agent-fedora", "/usr/sbin/dhclient") is None + assert _component_data("process", "urn:process:/agent-fedora", "/usr/lib/systemd/systemd-journald") is None # ubuntu specific process filtering - assert _component_data("process", "urn:process:/agent-ubuntu", "/usr/sbin/sshd") == None - assert _component_data("process", "urn:process:/agent-ubuntu", "/lib/systemd/systemd-journald") == None - assert _component_data("process", "urn:process:/agent-ubuntu", "/sbin/agetty") == None + assert _component_data("process", "urn:process:/agent-ubuntu", "/usr/sbin/sshd") is None + assert _component_data("process", "urn:process:/agent-ubuntu", "/lib/systemd/systemd-journald") is None + assert _component_data("process", "urn:process:/agent-ubuntu", "/sbin/agetty") is None # windows specific process filtering - assert _component_data("process", "urn:process:/agent-win", "C:\\Windows\\system32\\svchost.exe") == None - assert _component_data("process", "urn:process:/agent-win", "winlogon.exe") == None - assert _component_data("process", "urn:process:/agent-win", "C:\\Windows\\system32\\wlms\\wlms.exe") == None + assert _component_data("process", "urn:process:/agent-win", "C:\\Windows\\system32\\svchost.exe") is None + assert _component_data("process", "urn:process:/agent-win", "winlogon.exe") is None + assert _component_data("process", "urn:process:/agent-win", "C:\\Windows\\system32\\wlms\\wlms.exe") is None util.wait_until(wait_for_components, 30, 3) From e5160d4ef2ede46047845de3b06c934619e7805c Mon Sep 17 00:00:00 2001 From: Zandre Witte Date: Wed, 13 Mar 2019 14:10:17 +0100 Subject: [PATCH 5/6] fixed lib/system/* process filtering --- pkg/config/config_template.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/config/config_template.yaml b/pkg/config/config_template.yaml index ffc804ad03d3..64225d2dcb6e 100644 --- a/pkg/config/config_template.yaml +++ b/pkg/config/config_template.yaml @@ -630,6 +630,7 @@ process_config: - "^/bin/bash" - "^/usr/bin/bash" - "^/usr/lib/systemd/*" + - "^/lib/systemd/*" - "^/usr/bin/dbus-daemon" - "^/usr/bin/tail" - "^-bash" From c362beb5eafb6dee74508459a69eea60e86c4d6a Mon Sep 17 00:00:00 2001 From: Zandre Witte Date: Thu, 14 Mar 2019 09:20:42 +0100 Subject: [PATCH 6/6] alphabetically order the blacklisted patterns, fix * wildcard patterns, added windows 2012 R2 server to Vagrant boxes --- Vagrantfile | 4 ++++ pkg/config/config_template.yaml | 40 ++++++++++++++++----------------- 2 files changed, 24 insertions(+), 20 deletions(-) diff --git a/Vagrantfile b/Vagrantfile index b672ee69c3db..370825a333e7 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -49,6 +49,10 @@ machines = { :box => 'mwrock/Windows2016', :ip => '192.168.56.120', }, + :win12 => { + :box => 'mwrock/Windows2012R2', + :ip => '192.168.56.121', + }, } Vagrant.configure("2") do |config| diff --git a/pkg/config/config_template.yaml b/pkg/config/config_template.yaml index 64225d2dcb6e..244aa98af97f 100644 --- a/pkg/config/config_template.yaml +++ b/pkg/config/config_template.yaml @@ -623,40 +623,40 @@ process_config: # A list of regex patterns that will exclude a process if matched. blacklist_patterns: # Linux Specific patterns + - "^-bash" + - "^/bin/bash" + - "^/lib/systemd/" + - "^pickup" - "^/sbin/" - - "^/usr/sbin/" - - "^/usr/bin/vi(?:m|m.basic)?$" + - "^qmgr" - "^sshd:" - - "^/bin/bash" - "^/usr/bin/bash" - - "^/usr/lib/systemd/*" - - "^/lib/systemd/*" - "^/usr/bin/dbus-daemon" + - "^/usr/bin/vi(?:m|m.basic)?$" - "^/usr/bin/tail" - - "^-bash" + - "^/usr/lib/systemd/" + - "^/usr/sbin/" - "^\\(sd-pam\\)" - - "^pickup" - - "^qmgr" # Windows Specific patterns - "cmd.exe" - "conhost.exe" + - "DllHost.exe" + - "dwm.exe" + - "Explorer.EXE" + - "lsass.exe" + - "msdtc.exe" + - "SearchUI.exe" + - "sihost.exe" + - "smartscreen.exe" + - "svchost.exe" - "taskhostw.exe" + - "tasklist.exe" + - "VBoxService.exe" - "vim.exe" - - "winlogon.exe" - "wininit.exe" + - "winlogon.exe" - "wlms.exe" - - "tasklist.exe" - - "svchost.exe" - "wmiprvse.exe" - - "VBoxService.exe" - - "lsass.exe" - - "dwm.exe" - - "sihost.exe" - - "Explorer.EXE" - - "smartscreen.exe" - - "DllHost.exe" - - "msdtc.exe" - - "SearchUI.exe" # Should be ignored, but gets reported with an empty command line # - "sppsvc.exe" # - "services.exe"