Simple tool to monitor network changes over time and trigger alerts.
- Golang (optional if you compile the sources)
- masscan
- postfix/smtp relay (optional for want E-mail reports)
- mysql (optional if you want to track changes over time)
Run the bash script (install.sh) to install all the required dependencies. WARNING: this script will install automatically postfix,mysql-server and masscan
bash install.sh
Downloads the binaries and installs them into your system, after you changed the example configuration (/etc/opn/opn.conf) you can run the scans with the command:
opn
- Continuos scanning of your Networks and monitor service exposure (All scans are saved into Mysql and/or sent via email/tg).. "pro-tip" -> run on crontab -> http://crontab.guru/
- Constant Alerting of critical service or when a firewall (could be software or hardware) stops working
- Tracking service/hosts from your VPN/Allowed cidr to know where your services are without running everytime the slow Nmap
- Install Metabase and connect the OPN database, then you can easily create dashboards to dynamically track hosts on your networks.
- The example below is made in 10 minutes (https://www.metabase.com/ - docker run -d -p 3000:3000 --name metabase metabase/metabase) and connected the db to Metabase + running OPN on crontab so every XYZ hour/minutes i can just check the dashboard and see the email report/telegram notifications.
To compile and install binaries run: WARNING: this script will install automatically postfix,mysql-server and masscan
bash compile.sh
If you already have Golang installed and know your stuff you can just get the sources from the src/ folder and build the .go files.
- Reads from /etc/opn/opn.conf configuration, if these values (SMTPhost,MysqlAuth,Telegram) are nulled ("") will be skipped and the feature is omitted
- Scan the Networks using Masscan (because nmap is slow)
- Send output to screen and trigger alerts if ports open are on "CriticalPorts" list
- All the scans are saved into the configured database
- For large scans set a bigger ulimit (open files limit) and max_connections on mysql or the script will fail
- Large scale scans require high ulimit setting ( http://posidev.com/blog/2009/06/04/set-ulimit-parameters-on-ubuntu/ )
- Set high ammount of max connections on MySQL to sustain large scans (max_connections = 10000 on my.cnf or SET GLOBAL)
- Once OPN is installed you can just insert the following cron
00 0 * * * root opnto run the scan every day at 00:00 - Installing an OpenVPN/IPSec client and let the traffic route to your VPN/Allowed Network so you can scan your entire nets and avoid FWs