├── .bowerrc
├── .codeclimate.yml
├── .csslintrc
├── .dockerignore
├── .eslintignore
├── .eslintrc
├── .gitignore
├── .travis.yml
├── Dockerfile
├── LICENSE
├── MANIFEST.in
├── Procfile
├── README.md
├── Vagrantfile
├── app.json
├── bower.json
├── docker
    ├── default-settings.cfg
    ├── redis.conf
    └── service
    │   ├── api
    │       └── run
    │   ├── celery
    │       └── run
    │   └── redis
    │       └── run
├── docs
    └── screenshots
    │   ├── distributed_queries.png
    │   ├── distributed_query.png
    │   ├── node.png
    │   ├── nodes.png
    │   ├── recent_activity.png
    │   └── rules.png
├── doorman
    ├── __init__.py
    ├── api.py
    ├── application.py
    ├── assets.py
    ├── celery_serializer.py
    ├── compat.py
    ├── database.py
    ├── extensions.py
    ├── extract_ddl.py
    ├── manage
    │   ├── __init__.py
    │   ├── forms.py
    │   └── views.py
    ├── models.py
    ├── plugins
    │   ├── __init__.py
    │   ├── alerters
    │   │   ├── __init__.py
    │   │   ├── base.py
    │   │   ├── debug.py
    │   │   ├── emailer.py
    │   │   ├── pagerduty.py
    │   │   ├── sentry.py
    │   │   └── slack.py
    │   └── logs
    │   │   ├── __init__.py
    │   │   ├── base.py
    │   │   ├── file.py
    │   │   └── logstash.py
    ├── resources
    │   └── osquery_schema.sql
    ├── rules.py
    ├── settings.py
    ├── static
    │   ├── css
    │   │   ├── bootstrap.less
    │   │   ├── bootswatch.less
    │   │   ├── font-awesome.less
    │   │   ├── style.css
    │   │   └── variables.less
    │   └── js
    │   │   └── plugins.js
    ├── tasks.py
    ├── templates
    │   ├── 401.html
    │   ├── 403.html
    │   ├── 404.html
    │   ├── 500.html
    │   ├── email
    │   │   ├── alert.body.txt
    │   │   └── alert.subject.txt
    │   ├── footer.html
    │   ├── layout.html
    │   ├── login.html
    │   ├── manage
    │   │   ├── _activity.html
    │   │   ├── _pack.html
    │   │   ├── _query.html
    │   │   ├── _rule.html
    │   │   ├── activity.html
    │   │   ├── distributed.html
    │   │   ├── distributed.result.html
    │   │   ├── distributed_results.html
    │   │   ├── file.html
    │   │   ├── files.html
    │   │   ├── forms
    │   │   │   ├── distributed.html
    │   │   │   ├── file.html
    │   │   │   ├── pack.html
    │   │   │   ├── query.html
    │   │   │   ├── rule.html
    │   │   │   └── tag.html
    │   │   ├── index.html
    │   │   ├── logs.html
    │   │   ├── node.html
    │   │   ├── nodes.html
    │   │   ├── pack.html
    │   │   ├── packs.html
    │   │   ├── queries.html
    │   │   ├── query.html
    │   │   ├── reports.html
    │   │   ├── results.html
    │   │   ├── rule.html
    │   │   ├── rules.html
    │   │   ├── tables
    │   │   │   ├── distributed.html
    │   │   │   ├── distributed_results.html
    │   │   │   ├── logs.html
    │   │   │   ├── nodes.html
    │   │   │   ├── packs.html
    │   │   │   ├── queries.html
    │   │   │   └── results.html
    │   │   ├── tag.html
    │   │   └── tags.html
    │   └── nav.html
    ├── users
    │   ├── __init__.py
    │   ├── forms.py
    │   ├── mixins.py
    │   ├── oauth.py
    │   └── views.py
    ├── utils.py
    └── worker.py
├── manage.py
├── migrations
    ├── README
    ├── alembic.ini
    ├── env.py
    ├── script.py.mako
    └── versions
    │   ├── 0bc0a93ac867_.py
    │   ├── 14c992522209_.py
    │   ├── 236318ee3d3e_add_is_active_and_last_ip_columns.py
    │   ├── 4f95ecd76bf8_normalize_distributed_query_architecture.py
    │   ├── 54ef3f06612c_add_node_info_column_to_capture.py
    │   ├── a76be8b92780_add_shard_column_to_query.py
    │   ├── b50c705fea80_migrate_to_new_rules_architecture.py
    │   ├── c107fa0468ff_add_indexes_to_improve_various_sql_.py
    │   ├── c17f01adbe31_add_updated_at_column_to_rule.py
    │   ├── d2b00dd93241_initial_revision.py
    │   └── fd28e46e46a6_.py
├── package.json
├── requirements.txt
├── requirements
    ├── dev.txt
    └── prod.txt
├── setup.py
├── tests
    ├── __init__.py
    ├── conftest.py
    ├── factories.py
    ├── test_alerters.py
    ├── test_celery.py
    ├── test_forms.py
    ├── test_functional.py
    ├── test_integration.py
    ├── test_models.py
    ├── test_rules.py
    └── test_utils.py
└── tools
    ├── lib.sh
    ├── motd-doorman.sh
    ├── nginx.conf
    ├── osquery.flags
    ├── pg_hba.conf
    └── provision.sh


/.bowerrc:
--------------------------------------------------------------------------------
1 | {
2 |   "directory": "doorman/static/libs"
3 | }
4 | 


--------------------------------------------------------------------------------
/.codeclimate.yml:
--------------------------------------------------------------------------------
 1 | engines:
 2 |   duplication:
 3 |     enabled: true
 4 |     config:
 5 |       languages:
 6 |         python:
 7 |           mass_threshold: 36
 8 |   fixme:
 9 |     enabled: true
10 |   radon:
11 |     enabled: true
12 |     config:
13 |       threshold: "C"
14 |   pep8:
15 |     enabled: true
16 |     checks:
17 |       E501:
18 |         enabled: false
19 |     exclude_paths:
20 |     - "**/migrations/**/*"
21 |   csslint:
22 |     enabled: true
23 |   eslint:
24 |     enabled: true
25 | ratings:
26 |   paths:
27 |   - "**.py"
28 |   - "**.css"
29 |   - "**.js"
30 | exclude_paths:
31 | - "**/docs/**/*"
32 | - "**/migrations/**/*"
33 | 


--------------------------------------------------------------------------------
/.csslintrc:
--------------------------------------------------------------------------------
1 | --exclude-exts=.min.css
2 | --ignore=adjoining-classes,box-model,ids,order-alphabetical,unqualified-attributes,box-sizing
3 | 


--------------------------------------------------------------------------------
/.dockerignore:
--------------------------------------------------------------------------------
1 | .git
2 | database
3 | venv
4 | doorman/static/libs
5 | 
6 | *.log
7 | 


--------------------------------------------------------------------------------
/.eslintignore:
--------------------------------------------------------------------------------
1 | **/*{.,-}min.js
2 | 


--------------------------------------------------------------------------------
/.eslintrc:
--------------------------------------------------------------------------------
  1 | ecmaFeatures:
  2 |   modules: false
  3 |   jsx: false
  4 | 
  5 | env:
  6 |   amd: true
  7 |   browser: true
  8 |   es6: true
  9 |   jquery: false
 10 |   node: false
 11 | 
 12 | # http://eslint.org/docs/rules/
 13 | rules:
 14 |   # Possible Errors
 15 |   comma-dangle: [2, never]
 16 |   no-cond-assign: 2
 17 |   no-console: 0
 18 |   no-constant-condition: 2
 19 |   no-control-regex: 2
 20 |   no-debugger: 2
 21 |   no-dupe-args: 2
 22 |   no-dupe-keys: 2
 23 |   no-duplicate-case: 2
 24 |   no-empty: 2
 25 |   no-empty-character-class: 2
 26 |   no-ex-assign: 2
 27 |   no-extra-boolean-cast: 2
 28 |   no-extra-parens: 0
 29 |   no-extra-semi: 2
 30 |   no-func-assign: 2
 31 |   no-inner-declarations: [2, functions]
 32 |   no-invalid-regexp: 2
 33 |   no-irregular-whitespace: 2
 34 |   no-negated-in-lhs: 2
 35 |   no-obj-calls: 2
 36 |   no-regex-spaces: 2
 37 |   no-sparse-arrays: 2
 38 |   no-unexpected-multiline: 2
 39 |   no-unreachable: 2
 40 |   use-isnan: 2
 41 |   valid-jsdoc: 0
 42 |   valid-typeof: 2
 43 | 
 44 |   # Best Practices
 45 |   accessor-pairs: 2
 46 |   block-scoped-var: 0
 47 |   complexity: [2, 6]
 48 |   consistent-return: 0
 49 |   curly: 0
 50 |   default-case: 0
 51 |   dot-location: 0
 52 |   dot-notation: 0
 53 |   eqeqeq: 2
 54 |   guard-for-in: 2
 55 |   no-alert: 2
 56 |   no-caller: 2
 57 |   no-case-declarations: 2
 58 |   no-div-regex: 2
 59 |   no-else-return: 0
 60 |   no-empty-label: 2
 61 |   no-empty-pattern: 2
 62 |   no-eq-null: 2
 63 |   no-eval: 2
 64 |   no-extend-native: 2
 65 |   no-extra-bind: 2
 66 |   no-fallthrough: 2
 67 |   no-floating-decimal: 0
 68 |   no-implicit-coercion: 0
 69 |   no-implied-eval: 2
 70 |   no-invalid-this: 0
 71 |   no-iterator: 2
 72 |   no-labels: 0
 73 |   no-lone-blocks: 2
 74 |   no-loop-func: 2
 75 |   no-magic-number: 0
 76 |   no-multi-spaces: 0
 77 |   no-multi-str: 0
 78 |   no-native-reassign: 2
 79 |   no-new-func: 2
 80 |   no-new-wrappers: 2
 81 |   no-new: 2
 82 |   no-octal-escape: 2
 83 |   no-octal: 2
 84 |   no-proto: 2
 85 |   no-redeclare: 2
 86 |   no-return-assign: 2
 87 |   no-script-url: 2
 88 |   no-self-compare: 2
 89 |   no-sequences: 0
 90 |   no-throw-literal: 0
 91 |   no-unused-expressions: 2
 92 |   no-useless-call: 2
 93 |   no-useless-concat: 2
 94 |   no-void: 2
 95 |   no-warning-comments: 0
 96 |   no-with: 2
 97 |   radix: 2
 98 |   vars-on-top: 0
 99 |   wrap-iife: 2
100 |   yoda: 0
101 | 
102 |   # Strict
103 |   strict: 0
104 | 
105 |   # Variables
106 |   init-declarations: 0
107 |   no-catch-shadow: 2
108 |   no-delete-var: 2
109 |   no-label-var: 2
110 |   no-shadow-restricted-names: 2
111 |   no-shadow: 0
112 |   no-undef-init: 2
113 |   no-undef: 0
114 |   no-undefined: 0
115 |   no-unused-vars: 0
116 |   no-use-before-define: 0
117 | 
118 |   # Node.js and CommonJS
119 |   callback-return: 2
120 |   global-require: 2
121 |   handle-callback-err: 2
122 |   no-mixed-requires: 0
123 |   no-new-require: 0
124 |   no-path-concat: 2
125 |   no-process-exit: 2
126 |   no-restricted-modules: 0
127 |   no-sync: 0
128 | 
129 |   # Stylistic Issues
130 |   array-bracket-spacing: 0
131 |   block-spacing: 0
132 |   brace-style: 0
133 |   camelcase: 0
134 |   comma-spacing: 0
135 |   comma-style: 0
136 |   computed-property-spacing: 0
137 |   consistent-this: 0
138 |   eol-last: 0
139 |   func-names: 0
140 |   func-style: 0
141 |   id-length: 0
142 |   id-match: 0
143 |   indent: 0
144 |   jsx-quotes: 0
145 |   key-spacing: 0
146 |   linebreak-style: 0
147 |   lines-around-comment: 0
148 |   max-depth: 0
149 |   max-len: 0
150 |   max-nested-callbacks: 0
151 |   max-params: 0
152 |   max-statements: [2, 30]
153 |   new-cap: 0
154 |   new-parens: 0
155 |   newline-after-var: 0
156 |   no-array-constructor: 0
157 |   no-bitwise: 0
158 |   no-continue: 0
159 |   no-inline-comments: 0
160 |   no-lonely-if: 0
161 |   no-mixed-spaces-and-tabs: 0
162 |   no-multiple-empty-lines: 0
163 |   no-negated-condition: 0
164 |   no-nested-ternary: 0
165 |   no-new-object: 0
166 |   no-plusplus: 0
167 |   no-restricted-syntax: 0
168 |   no-spaced-func: 0
169 |   no-ternary: 0
170 |   no-trailing-spaces: 0
171 |   no-underscore-dangle: 0
172 |   no-unneeded-ternary: 0
173 |   object-curly-spacing: 0
174 |   one-var: 0
175 |   operator-assignment: 0
176 |   operator-linebreak: 0
177 |   padded-blocks: 0
178 |   quote-props: 0
179 |   quotes: 0
180 |   require-jsdoc: 0
181 |   semi-spacing: 0
182 |   semi: 0
183 |   sort-vars: 0
184 |   space-after-keywords: 0
185 |   space-before-blocks: 0
186 |   space-before-function-paren: 0
187 |   space-before-keywords: 0
188 |   space-in-parens: 0
189 |   space-infix-ops: 0
190 |   space-return-throw-case: 0
191 |   space-unary-ops: 0
192 |   spaced-comment: 0
193 |   wrap-regex: 0
194 | 
195 |   # ECMAScript 6
196 |   arrow-body-style: 0
197 |   arrow-parens: 0
198 |   arrow-spacing: 0
199 |   constructor-super: 0
200 |   generator-star-spacing: 0
201 |   no-arrow-condition: 0
202 |   no-class-assign: 0
203 |   no-const-assign: 0
204 |   no-dupe-class-members: 0
205 |   no-this-before-super: 0
206 |   no-var: 0
207 |   object-shorthand: 0
208 |   prefer-arrow-callback: 0
209 |   prefer-const: 0
210 |   prefer-reflect: 0
211 |   prefer-spread: 0
212 |   prefer-template: 0
213 |   require-yield: 0
214 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
  1 | 
  2 | # Created by https://www.gitignore.io/api/python,osx,sublimetext,vim
  3 | 
  4 | ### Python ###
  5 | # Byte-compiled / optimized / DLL files
  6 | __pycache__/
  7 | *.py[cod]
  8 | *$py.class
  9 | 
 10 | # C extensions
 11 | *.so
 12 | 
 13 | # Distribution / packaging
 14 | .Python
 15 | env/
 16 | build/
 17 | develop-eggs/
 18 | dist/
 19 | downloads/
 20 | eggs/
 21 | .eggs/
 22 | lib/
 23 | lib64/
 24 | parts/
 25 | sdist/
 26 | var/
 27 | *.egg-info/
 28 | .installed.cfg
 29 | *.egg
 30 | 
 31 | # PyInstaller
 32 | #  Usually these files are written by a python script from a template
 33 | #  before PyInstaller builds the exe, so as to inject date/other infos into it.
 34 | *.manifest
 35 | *.spec
 36 | 
 37 | # Installer logs
 38 | pip-log.txt
 39 | pip-delete-this-directory.txt
 40 | 
 41 | # Unit test / coverage reports
 42 | htmlcov/
 43 | .tox/
 44 | .coverage
 45 | .coverage.*
 46 | .cache
 47 | nosetests.xml
 48 | coverage.xml
 49 | *,cover
 50 | .hypothesis/
 51 | 
 52 | # Translations
 53 | *.mo
 54 | *.pot
 55 | 
 56 | # Django stuff:
 57 | *.log
 58 | local_settings.py
 59 | 
 60 | # Flask instance folder
 61 | instance/
 62 | 
 63 | # Scrapy stuff:
 64 | .scrapy
 65 | 
 66 | # Sphinx documentation
 67 | docs/_build/
 68 | 
 69 | # PyBuilder
 70 | target/
 71 | 
 72 | # IPython Notebook
 73 | .ipynb_checkpoints
 74 | 
 75 | # pyenv
 76 | .python-version
 77 | 
 78 | # celery beat schedule file
 79 | celerybeat-schedule
 80 | 
 81 | # dotenv
 82 | .env
 83 | 
 84 | # virtualenv
 85 | venv/
 86 | ENV/
 87 | 
 88 | # Spyder project settings
 89 | .spyderproject
 90 | 
 91 | # Rope project settings
 92 | .ropeproject
 93 | 
 94 | # Webassets cache
 95 | .webassets-cache
 96 | 
 97 | ### OSX ###
 98 | .DS_Store
 99 | .AppleDouble
100 | .LSOverride
101 | 
102 | # Icon must end with two \r
103 | Icon
104 | 
105 | 
106 | # Thumbnails
107 | ._*
108 | 
109 | # Files that might appear in the root of a volume
110 | .DocumentRevisions-V100
111 | .fseventsd
112 | .Spotlight-V100
113 | .TemporaryItems
114 | .Trashes
115 | .VolumeIcon.icns
116 | 
117 | # Directories potentially created on remote AFP share
118 | .AppleDB
119 | .AppleDesktop
120 | Network Trash Folder
121 | Temporary Items
122 | .apdisk
123 | 
124 | 
125 | ### SublimeText ###
126 | # cache files for sublime text
127 | *.tmlanguage.cache
128 | *.tmPreferences.cache
129 | *.stTheme.cache
130 | 
131 | # workspace files are user-specific
132 | *.sublime-workspace
133 | 
134 | # project files should be checked into the repository, unless a significant
135 | # proportion of contributors will probably not be using SublimeText
136 | # *.sublime-project
137 | 
138 | # sftp configuration file
139 | sftp-config.json
140 | 
141 | 
142 | ### Vim ###
143 | # swap
144 | [._]*.s[a-w][a-z]
145 | [._]s[a-w][a-z]
146 | # session
147 | Session.vim
148 | # temporary
149 | .netrwhist
150 | *~
151 | # auto-generated tag files
152 | tags
153 | 
154 | .tags
155 | .tags_sorted_by_file
156 | 
157 | dev.db
158 | database/
159 | 
160 | # Downloaded or generated assets
161 | doorman/static/css/bootstrap.css
162 | doorman/static/libs/
163 | doorman/static/public/
164 | 
165 | # Vagrant artifacts
166 | .vagrant
167 | 
168 | # Avoid commiting secrets
169 | certificate.crt
170 | private.key
171 | 


--------------------------------------------------------------------------------
/.travis.yml:
--------------------------------------------------------------------------------
 1 | sudo: false
 2 | language: python
 3 | cache: pip
 4 | python:
 5 |   - "2.7"
 6 |   - "3.6"
 7 | 
 8 | install:
 9 |   - "pip install -r requirements/dev.txt"
10 |   - "pip install flake8"
11 | 
12 | services:
13 |   - postgresql
14 |   - redis-server
15 | 
16 | addons:
17 |   postgresql: "9.4"
18 | 
19 | before_script:
20 |   # stop the build if there are Python syntax errors or undefined names
21 |   - flake8 . --count --select=E901,E999,F821,F822,F823 --show-source --statistics
22 |   # exit-zero treats all errors as warnings.  The GitHub editor is 127 chars wide
23 |   - flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
24 | 
25 |   # Install JS dependencies
26 |   - npm install -g bower less
27 |   - bower install
28 | 
29 |   # Create test DB
30 |   - psql -c 'create database doorman_test;' -U postgres
31 | 
32 |   # Launch celery worker for tests
33 |   - env DOORMAN_ENV=test celery worker -D -A doorman.worker:celery -l DEBUG
34 | 
35 | script: python manage.py test
36 | 


--------------------------------------------------------------------------------
/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM alpine:latest
 2 | 
 3 | # Install Python
 4 | RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories \
 5 |   && apk add --update \
 6 |               bash \
 7 |               build-base \
 8 |               git \
 9 |               libffi-dev \
10 |               musl \
11 |               nodejs \
12 |               nodejs-npm \
13 |               postgresql-dev \
14 |               py2-pip \
15 |               python \
16 |               python-dev \
17 |               redis \
18 |               runit \
19 |   && pip install --upgrade pip \
20 |   && npm install -g bower less \
21 |   && rm /var/cache/apk/*
22 | 
23 | # Make some useful symlinks that are expected to exist
24 | RUN cd /usr/bin \
25 |   && ln -sf easy_install-2.7 easy_install \
26 |   && ln -sf python2.7 python \
27 |   && ln -sf python2.7-config python-config \
28 |   && ln -sf pip2.7 pip
29 | 
30 | # Copy and install our requirements first, so they can be cached
31 | COPY ./requirements/prod.txt /tmp/requirements.txt
32 | RUN pip install -r /tmp/requirements.txt \
33 |   && pip install 'gunicorn==19.6.0'
34 | 
35 | # Add our application to the container
36 | COPY . /src/
37 | 
38 | # Create service directories to allow running services, along with the Doorman
39 | # user/group.
40 | RUN rm -rf /etc/service \
41 |   && mv /src/docker/service /etc/ \
42 |   && mv /src/docker/redis.conf /etc/ \
43 |   && if [ ! -f /src/settings.cfg ]; then \
44 |        mv /src/docker/default-settings.cfg /src/settings.cfg; \
45 |      fi \
46 |   && addgroup doorman \
47 |   && adduser -G doorman -D doorman
48 | 
49 | # Install vendor libraries, pre-build static assets, and create default log
50 | # file directory.
51 | RUN cd /src/ \
52 |   && bower install --allow-root \
53 |   && python manage.py assets build \
54 |   && mkdir /var/log/doorman/ \
55 |   && chown doorman:doorman -R . \
56 |   && chown doorman:doorman /var/log/doorman/
57 | 
58 | CMD ["runsvdir", "/etc/service"]
59 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2016-present, Marcin Wielgoszewski, All rights reserved.
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/MANIFEST.in:
--------------------------------------------------------------------------------
1 | recursive-include doorman/templates *
2 | recursive-include doorman/static *
3 | recursive-include doorman/resources *
4 | 


--------------------------------------------------------------------------------
/Procfile:
--------------------------------------------------------------------------------
1 | worker: celery worker -A doorman.worker:celery -l INFO
2 | web: python manage.py runserver -h '0.0.0.0' -p $PORT
3 | 


--------------------------------------------------------------------------------
/Vagrantfile:
--------------------------------------------------------------------------------
 1 | # -*- mode: ruby -*-
 2 | # vi: set ft=ruby :
 3 | 
 4 | VAGRANTFILE_API_VERSION = "2"
 5 | 
 6 | Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
 7 |   config.vm.define :doorman_server do |doorman_server|
 8 |     doorman_server.vm.box = "ubuntu/trusty64"
 9 |     doorman_server.vm.hostname = "doorman"
10 |     doorman_server.ssh.shell = "bash -c 'BASH_ENV=/etc/profile exec bash'"
11 |     doorman_server.vm.provision "shell",
12 |       path: "tools/provision.sh",
13 |       preserve_order: true,
14 |       privileged: false
15 |     doorman_server.vm.network :private_network, ip: "10.11.22.33"
16 |     doorman_server.vm.provider :virtualbox do |v|
17 |       v.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]
18 |       v.customize ["modifyvm", :id, "--memory", 4096]
19 |       v.customize ["modifyvm", :id, "--cpus", 2]
20 |       v.customize ["modifyvm", :id, "--name", "doorman_server"]
21 |     end
22 |   end
23 | end
24 | 


--------------------------------------------------------------------------------
/app.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "name": "Doorman",
 3 |   "description": "An osquery fleet manager",
 4 |   "repository": "https://github.com/mwielgoszewski/doorman.git",
 5 |   "keywords": ["doorman", "fleet", "osquery"],
 6 | 
 7 |   "buildpacks": [
 8 | 	{
 9 | 	  "url": "heroku/nodejs"
10 | 	},
11 | 	{
12 | 	  "url": "heroku/python"
13 | 	}
14 |   ],
15 |   "addons": [
16 | 	"heroku-postgresql",
17 | 	"heroku-redis"
18 |   ],
19 |   "formation": {
20 | 	"web": {
21 | 	  "quantity": 1
22 | 	},
23 | 	"worker": {
24 | 	  "quantity": 1
25 | 	}
26 |   },
27 |   "scripts": {
28 |     "postdeploy": "python manage.py db upgrade"
29 |   },
30 |   "success_url": "/manage",
31 |   "env": {
32 |     "SECRET_KEY": {
33 |       "description": "Flask's secret key",
34 |       "generator": "secret"
35 |     },
36 |     "ENROLL_SECRET": {
37 |       "description": "Either one value or several space-delimited values",
38 |       "value": ""
39 |     },
40 | 
41 |     "OAUTH_CLIENT_ID": {
42 |       "description": "Google's client ID to use for user authentication, if not provided then auth will be disabled",
43 |       "required": false
44 |     },
45 |     "OAUTH_CLIENT_SECRET": {
46 |       "description": "Google's client ID to use for user authentication",
47 |       "required": false
48 |     },
49 |     "OAUTH_ALLOWED_USERS": {
50 |       "description": "Space-delimited list of allowed Google user IDs (or emails?)",
51 |       "required": false
52 |     },
53 | 
54 |     "MAIL_SERVER": {
55 |       "description": "SMTP server to send emails with (mailing will be disabled unless this is provided)",
56 |       "required": false
57 |     },
58 |     "MAIL_PORT": {
59 |       "description": "SSL-enabled port on the mail server",
60 |       "required": false
61 |     },
62 |     "MAIL_USERNAME": {
63 |       "description": "Username for SMTP",
64 |       "required": false
65 |     },
66 |     "MAIL_PASSWORD": {
67 |       "description": "Password for SMTP",
68 |       "required": false
69 |     },
70 |     "MAIL_DEFAULT_SENDER": {
71 |       "description": "Default sender for emails",
72 |       "required": false
73 |     },
74 |     "MAIL_RECIPIENTS": {
75 |       "description": "List of mail recipients, separated by ';'",
76 |       "required": false
77 |     }
78 |   }
79 | }
80 | 


--------------------------------------------------------------------------------
/bower.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "name": "doorman",
 3 |   "dependencies": {
 4 |     "bootstrap": "~3.2.0",
 5 |     "jQuery": "~2.1.3",
 6 |     "font-awesome": "~4.5.0",
 7 |     "bootstrap-tagsinput": "~0.8.0",
 8 |     "bootstrap-vertical-tabs": "~1.2.1",
 9 |     "jQuery-QueryBuilder": "^2.3.3",
10 |     "interact": "^1.2.6"
11 |   }
12 | }
13 | 


--------------------------------------------------------------------------------
/docker/default-settings.cfg:
--------------------------------------------------------------------------------
 1 | import os
 2 | 
 3 | if os.environ.get('DOORMAN_SECRET_KEY'):
 4 |     SECRET_KEY = os.environ['DOORMAN_SECRET_KEY']
 5 | 
 6 | DOORMAN_ENROLL_SECRET = [
 7 |     os.environ['DOORMAN_ENROLL_SECRET']
 8 | ]
 9 | 
10 | # This reads the postgres host from the environment.  Note that this
11 | # environment variable is in Docker link format, and, despite the name,
12 | # contains both the hostname and the port of the Postgres DB.
13 | host = os.environ['POSTGRES_PORT']
14 | if host.startswith('tcp://'):
15 |     host = host[6:]
16 | 
17 | SQLALCHEMY_DATABASE_URI = "postgresql://{user}:{pwd}@{uri}/{dbname}".format(
18 |     user=os.environ['POSTGRES_USER'],
19 |     pwd=os.environ['POSTGRES_PASSWORD'],
20 |     uri=host,
21 |     dbname=os.environ.get('POSTGRES_DATABASE', 'doorman')
22 | )
23 | 
24 | BROKER_URL = 'redis://localhost:6379/0'
25 | CELERY_RESULT_BACKEND = 'redis://localhost:6379/0'
26 | DOORMAN_LOGGING_FILENAME = '/var/log/doorman/doorman.log'
27 | 
28 | DOORMAN_LOG_PLUGINS = ['doorman.plugins.logs.file.LogPlugin']
29 | DOORMAN_LOG_FILE_PLUGIN_STATUS_LOG = '/var/log/doorman/status.log'
30 | DOORMAN_LOG_FILE_PLUGIN_RESULT_LOG = '/var/log/doorman/result.log'
31 | DOORMAN_LOG_FILE_PLUGIN_APPEND = True
32 | 
33 | DOORMAN_ALERTER_PLUGINS = {
34 |     'debug': ('doorman.plugins.alerters.debug.DebugAlerter', {
35 |         'level': 'error',
36 |     }),
37 | }
38 | 


--------------------------------------------------------------------------------
/docker/service/api/run:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | cd /src/
 4 | 
 5 | if [ -z $DOORMAN_ENV ]; then
 6 |   export DOORMAN_ENV=prod
 7 | fi
 8 | export DOORMAN_SETTINGS=$PWD/settings.cfg
 9 | 
10 | exec chpst \
11 |   -u doorman \
12 |   -U doorman \
13 |   gunicorn \
14 |     --workers 4 \
15 |     --bind 0.0.0.0:5000 \
16 |     manage:app
17 | 


--------------------------------------------------------------------------------
/docker/service/celery/run:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | cd /src/
 4 | 
 5 | export DOORMAN_ENV=prod
 6 | export DOORMAN_SETTINGS=$PWD/settings.cfg
 7 | 
 8 | exec chpst \
 9 |   -u doorman \
10 |   -U doorman \
11 |   celery \
12 |     worker \
13 |     -A doorman.worker:celery \
14 |     -l INFO
15 | 


--------------------------------------------------------------------------------
/docker/service/redis/run:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 | 
3 | exec chpst \
4 |    -u redis \
5 |    -U redis \
6 |    redis-server /etc/redis.conf
7 | 


--------------------------------------------------------------------------------
/docs/screenshots/distributed_queries.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mwielgoszewski/doorman/9a9b97c814625fcdd281b55c82177c9f777c5526/docs/screenshots/distributed_queries.png


--------------------------------------------------------------------------------
/docs/screenshots/distributed_query.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mwielgoszewski/doorman/9a9b97c814625fcdd281b55c82177c9f777c5526/docs/screenshots/distributed_query.png


--------------------------------------------------------------------------------
/docs/screenshots/node.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mwielgoszewski/doorman/9a9b97c814625fcdd281b55c82177c9f777c5526/docs/screenshots/node.png


--------------------------------------------------------------------------------
/docs/screenshots/nodes.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mwielgoszewski/doorman/9a9b97c814625fcdd281b55c82177c9f777c5526/docs/screenshots/nodes.png


--------------------------------------------------------------------------------
/docs/screenshots/recent_activity.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mwielgoszewski/doorman/9a9b97c814625fcdd281b55c82177c9f777c5526/docs/screenshots/recent_activity.png


--------------------------------------------------------------------------------
/docs/screenshots/rules.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mwielgoszewski/doorman/9a9b97c814625fcdd281b55c82177c9f777c5526/docs/screenshots/rules.png


--------------------------------------------------------------------------------
/doorman/__init__.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | 
3 | from .application import create_app, db
4 | from .manage import blueprint as backend
5 | 


--------------------------------------------------------------------------------
/doorman/application.py:
--------------------------------------------------------------------------------
  1 | # -*- coding: utf-8 -*-
  2 | import os
  3 | 
  4 | from flask import Flask, render_template
  5 | 
  6 | from doorman.api import blueprint as api
  7 | from doorman.assets import assets
  8 | from doorman.manage import blueprint as backend
  9 | from doorman.extensions import (
 10 |     bcrypt, csrf, db, debug_toolbar, ldap_manager, log_tee, login_manager,
 11 |     mail, make_celery, migrate, rule_manager, sentry
 12 | )
 13 | from doorman.settings import ProdConfig
 14 | from doorman.tasks import celery
 15 | from doorman.utils import get_node_health, pretty_field, pretty_operator, render_column
 16 | 
 17 | 
 18 | def create_app(config=ProdConfig):
 19 |     app = Flask(__name__)
 20 |     app.config.from_object(config)
 21 |     app.config.from_envvar('DOORMAN_SETTINGS', silent=True)
 22 | 
 23 |     register_blueprints(app)
 24 |     register_errorhandlers(app)
 25 |     register_loggers(app)
 26 |     register_extensions(app)
 27 |     register_auth_method(app)
 28 |     register_filters(app)
 29 | 
 30 |     return app
 31 | 
 32 | 
 33 | def register_blueprints(app):
 34 |     app.register_blueprint(api)
 35 |     csrf.exempt(api)
 36 | 
 37 |     # if the DOORMAN_NO_MANAGER environment variable isn't set,
 38 |     # register the backend blueprint. This is useful when you want
 39 |     # to only deploy the api as a standalone service.
 40 | 
 41 |     if 'DOORMAN_NO_MANAGER' in os.environ:
 42 |         return
 43 | 
 44 |     app.register_blueprint(backend)
 45 | 
 46 | 
 47 | def register_extensions(app):
 48 |     bcrypt.init_app(app)
 49 |     csrf.init_app(app)
 50 |     db.init_app(app)
 51 |     migrate.init_app(app, db)
 52 |     assets.init_app(app)
 53 |     debug_toolbar.init_app(app)
 54 |     log_tee.init_app(app)
 55 |     rule_manager.init_app(app)
 56 |     mail.init_app(app)
 57 |     make_celery(app, celery)
 58 |     login_manager.init_app(app)
 59 |     sentry.init_app(app)
 60 |     if app.config['ENFORCE_SSL']:
 61 |         # Due to architecture of flask-sslify,
 62 |         # its constructor expects to be launched within app context
 63 |         # unless app is passed.
 64 |         # As a result, we cannot create sslify object in `extensions` module
 65 |         # without getting an error.
 66 |         from flask_sslify import SSLify
 67 |         SSLify(app)
 68 | 
 69 | 
 70 | def register_loggers(app):
 71 |     if app.debug:
 72 |         return
 73 | 
 74 |     import logging
 75 |     from logging.handlers import WatchedFileHandler
 76 |     import sys
 77 | 
 78 |     logfile = app.config['DOORMAN_LOGGING_FILENAME']
 79 |     if logfile == '-':
 80 |         handler = logging.StreamHandler(sys.stdout)
 81 |     else:
 82 |         handler = WatchedFileHandler(logfile)
 83 |     levelname = app.config['DOORMAN_LOGGING_LEVEL']
 84 |     if levelname in ('DEBUG', 'INFO', 'WARN', 'WARNING', 'ERROR', 'CRITICAL'):
 85 |         handler.setLevel(getattr(logging, levelname))
 86 |     formatter = logging.Formatter(app.config['DOORMAN_LOGGING_FORMAT'])
 87 |     handler.setFormatter(formatter)
 88 | 
 89 |     app.logger.addHandler(handler)
 90 | 
 91 | 
 92 | def register_errorhandlers(app):
 93 |     """Register error handlers."""
 94 |     def render_error(error):
 95 |         """Render error template."""
 96 |         # If a HTTPException, pull the `code` attribute; default to 500
 97 |         error_code = getattr(error, 'code', 500)
 98 |         if 'DOORMAN_NO_MANAGER' in os.environ:
 99 |             return '', 400
100 |         return render_template('{0}.html'.format(error_code)), error_code
101 | 
102 |     for errcode in [401, 403, 404, 500]:
103 |         app.errorhandler(errcode)(render_error)
104 | 
105 | 
106 | def register_filters(app):
107 |     app.jinja_env.filters['health'] = get_node_health
108 |     app.jinja_env.filters['pretty_field'] = pretty_field
109 |     app.jinja_env.filters['pretty_operator'] = pretty_operator
110 |     app.jinja_env.filters['render'] = render_column
111 | 
112 | 
113 | def register_auth_method(app):
114 |     from doorman.users import views
115 |     app.register_blueprint(views.blueprint)
116 | 
117 |     if app.config['DOORMAN_AUTH_METHOD'] is None:
118 |         from doorman.users.mixins import NoAuthUserMixin
119 |         login_manager.anonymous_user = NoAuthUserMixin
120 |         return
121 | 
122 |     login_manager.login_view = 'users.login'
123 |     login_manager.login_message_category = 'warning'
124 | 
125 |     if app.config['DOORMAN_AUTH_METHOD'] == 'ldap':
126 |         ldap_manager.init_app(app)
127 |         return
128 | 
129 |     # no other authentication methods left, falling back to OAuth
130 | 
131 |     if app.config['DOORMAN_AUTH_METHOD'] != 'doorman':
132 |         login_manager.login_message = None
133 |         login_manager.needs_refresh_message = None
134 | 
135 |         from doorman.users.oauth import OAuthLogin
136 |         provider = OAuthLogin.get_provider(app.config['DOORMAN_AUTH_METHOD'])
137 |         provider.init_app(app)
138 | 


--------------------------------------------------------------------------------
/doorman/assets.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | from flask_assets import Bundle, Environment
 3 | 
 4 | css = Bundle(
 5 |     Bundle('css/bootstrap.less',
 6 |            depends=('**/*.less'),
 7 |            output='css/bootstrap.css',
 8 |            filters='less',
 9 |     ),
10 |     'libs/bootstrap-tagsinput/dist/bootstrap-tagsinput.css',
11 |     'libs/bootstrap-vertical-tabs/bootstrap.vertical-tabs.css',
12 |     'libs/jQuery-QueryBuilder/dist/css/query-builder.default.css',
13 |     'css/style.css',
14 |     filters='cssmin',
15 |     output='public/css/common.css',
16 | )
17 | 
18 | js = Bundle(
19 |     'libs/jQuery/dist/jquery.js',
20 |     'libs/bootstrap/dist/js/bootstrap.js',
21 |     'libs/bootstrap-tagsinput/dist/bootstrap-tagsinput.js',
22 |     'libs/jquery-extendext/jQuery.extendext.js',
23 |     'libs/jQuery-QueryBuilder/dist/js/query-builder.standalone.js',
24 |     'libs/interact/dist/interact.js',
25 |     'js/plugins.js',
26 |     filters='jsmin',
27 |     output='public/js/common.js',
28 | )
29 | 
30 | assets = Environment()
31 | 
32 | assets.register('js_all', js)
33 | assets.register('css_all', css)
34 | 


--------------------------------------------------------------------------------
/doorman/celery_serializer.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | from datetime import datetime
 3 | from time import mktime
 4 | import json
 5 | 
 6 | from doorman.compat import string_types
 7 | 
 8 | 
 9 | class DJSONEncoder(json.JSONEncoder):
10 |     def default(self, obj):
11 |         if isinstance(obj, datetime):
12 |             return {
13 |                 '__type__': '__datetime__',
14 |                 'epoch': int(mktime(obj.timetuple()))
15 |             }
16 |         else:
17 |             return json.JSONEncoder.default(self, obj)
18 | 
19 | 
20 | def djson_decoder(obj):
21 |     if '__type__' in obj:
22 |         if obj['__type__'] == '__datetime__':
23 |             return datetime.fromtimestamp(obj['epoch'])
24 |     return obj
25 | 
26 | 
27 | # Encoder function
28 | def djson_dumps(obj):
29 |     return json.dumps(obj, cls=DJSONEncoder)
30 | 
31 | 
32 | # Decoder function
33 | def djson_loads(s):
34 |     if not isinstance(s, string_types):
35 |         s = s.decode('utf-8')
36 |     return json.loads(s, object_hook=djson_decoder)
37 | 


--------------------------------------------------------------------------------
/doorman/compat.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | """Python 2/3 compatibility module."""
 3 | import sys
 4 | 
 5 | PY2 = int(sys.version[0]) == 2
 6 | 
 7 | if PY2:
 8 |     text_type = unicode  # noqa
 9 |     binary_type = str
10 |     string_types = (str, unicode)  # noqa
11 |     unicode = unicode  # noqa
12 |     basestring = basestring  # noqa
13 | else:
14 |     text_type = str
15 |     binary_type = bytes
16 |     string_types = (str,)
17 |     unicode = str
18 |     basestring = (str, bytes)
19 | 
20 | 
21 | def with_metaclass(meta, *bases):
22 |     """Create a base class with a metaclass."""
23 |     class metaclass(meta):
24 |         def __new__(cls, name, this_bases, d):
25 |             return meta(name, bases, d)
26 | 
27 |     return type.__new__(metaclass, 'temp_class', (), {})
28 | 


--------------------------------------------------------------------------------
/doorman/database.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | """Database module, including the SQLAlchemy database object and DB-related utilities."""
 3 | from sqlalchemy.dialects.postgresql import ARRAY, JSONB, INET  # noqa
 4 | from sqlalchemy.ext.declarative import declared_attr
 5 | from sqlalchemy.orm import relationship
 6 | 
 7 | from doorman.compat import basestring
 8 | from doorman.extensions import db
 9 | 
10 | 
11 | # Alias common SQLAlchemy names
12 | Column = db.Column
13 | Table = db.Table
14 | ForeignKey = db.ForeignKey
15 | UniqueConstraint = db.UniqueConstraint
16 | relationship = relationship
17 | Index = db.Index
18 | 
19 | 
20 | class CRUDMixin(object):
21 |     """Mixin that adds convenience methods for CRUD (create, read, update, delete) operations."""
22 | 
23 |     @classmethod
24 |     def create(cls, **kwargs):
25 |         """Create a new record and save it the database."""
26 |         instance = cls(**kwargs)
27 |         return instance.save()
28 | 
29 |     def update(self, commit=True, **kwargs):
30 |         """Update specific fields of a record."""
31 |         for attr, value in kwargs.items():
32 |             setattr(self, attr, value)
33 |         return commit and self.save() or self
34 | 
35 |     def save(self, commit=True):
36 |         """Save the record."""
37 |         db.session.add(self)
38 |         if commit:
39 |             db.session.commit()
40 |         return self
41 | 
42 |     def delete(self, commit=True):
43 |         """Remove the record from the database."""
44 |         db.session.delete(self)
45 |         return commit and db.session.commit()
46 | 
47 | 
48 | class Model(CRUDMixin, db.Model):
49 |     """Base model class that includes CRUD convenience methods."""
50 | 
51 |     __abstract__ = True
52 | 
53 | 
54 | # From Mike Bayer's "Building the app" talk
55 | # https://speakerdeck.com/zzzeek/building-the-app
56 | class SurrogatePK(object):
57 |     """A mixin that adds a surrogate integer 'primary key' column named ``id`` to any declarative-mapped class."""
58 | 
59 |     __table_args__ = {'extend_existing': True}
60 | 
61 |     id = db.Column(db.Integer, primary_key=True)
62 | 
63 |     @classmethod
64 |     def get_by_id(cls, record_id):
65 |         """Get record by ID."""
66 |         if any(
67 |                 (isinstance(record_id, basestring) and record_id.isdigit(),
68 |                  isinstance(record_id, (int, float))),
69 |         ):
70 |             return cls.query.get(int(record_id))
71 |         return None
72 | 
73 | 
74 | def reference_col(tablename, nullable=False, pk_name='id', **kwargs):
75 |     """Column that adds primary key foreign key reference.
76 | 
77 |     Usage: ::
78 | 
79 |         category_id = reference_col('category')
80 |         category = relationship('Category', backref='categories')
81 |     """
82 |     return db.Column(
83 |         ForeignKey('{0}.{1}'.format(tablename, pk_name)),
84 |         nullable=nullable, **kwargs)
85 | 


--------------------------------------------------------------------------------
/doorman/extract_ddl.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import ast
 3 | 
 4 | 
 5 | # This has to be a global due to `exec` shenanigans :-(
 6 | current_spec = {}
 7 | 
 8 | # SQL types
 9 | SQL_TYPES = [
10 |     'TEXT',
11 |     'DATE',
12 |     'DATETIME',
13 |     'INTEGER',
14 |     'BIGINT',
15 |     'UNSIGNED_BIGINT',
16 |     'DOUBLE',
17 |     'BLOB',
18 | ]
19 | 
20 | # Functions that we don't need
21 | DUMMY_FUNCTIONS = [
22 |     'ForeignKey',
23 |     'attributes',
24 |     'description',
25 |     'examples',
26 |     'implementation',
27 |     'fuzz_paths',
28 |     'WINDOWS',
29 |     'POSIX',
30 |     'LINUX',
31 |     'DARWIN',
32 | ]
33 | 
34 | 
35 | RESERVED_KEYWORDS = [
36 |     'table',
37 |     'set',
38 | ]
39 | 
40 | 
41 | def table_name(name, aliases=None):
42 |     current_spec['name'] = name
43 |     current_spec['aliases'] = aliases
44 | 
45 | 
46 | def Column(name, col_type, *args, **kwargs):
47 |     if name in RESERVED_KEYWORDS:
48 |         name = '"%s"' % name
49 |     return (name, col_type)
50 | 
51 | 
52 | def schema(schema):
53 |     # Filter out 'None' entries (usually from ForeignKeys)
54 |     real_schema = [x for x in schema if x is not None]
55 |     current_spec['schema'] = real_schema
56 | 
57 | def extended_schema(macro, schema):
58 |     # Filter out 'None' entries (usually from ForeignKeys)
59 |     real_schema = [x for x in schema if x is not None]
60 |     current_spec.setdefault('extended_schema', []).extend(real_schema)
61 | 
62 | def extract_schema(filename):
63 |     namespace = {
64 |         'Column': Column,
65 |         'schema': schema,
66 |         'table_name': table_name,
67 |         'extended_schema': extended_schema,
68 |         'current_spec': {},
69 |     }
70 | 
71 |     for fn in DUMMY_FUNCTIONS:
72 |         namespace[fn] = lambda *args, **kwargs: None
73 | 
74 |     for ty in SQL_TYPES:
75 |         namespace[ty] = ty
76 | 
77 |     with open(filename, 'rU') as f:
78 |         tree = ast.parse(f.read())
79 |         exec(compile(tree, '<string>', 'exec'), namespace)
80 | 
81 |     columns = ', '.join('%s %s' % (x[0], x[1]) for x in current_spec['schema'])
82 |     statements = []
83 |     statements = []
84 |     statements.append('CREATE TABLE %s (%s);' % (current_spec['name'], columns))
85 |     if 'extended_schema' in current_spec:
86 |         statement = 'ALTER TABLE %s ADD %%s %%s;' % (current_spec['name'], )
87 |         for column_name, column_definition in current_spec['extended_schema']:
88 |             statements.append(statement % (column_name, column_definition))
89 |         del current_spec['extended_schema']
90 |     return '\n'.join(statements)
91 | 
92 | 
93 | if __name__ == '__main__':
94 |     import sys
95 |     print(extract_schema(sys.argv[1]))
96 | 


--------------------------------------------------------------------------------
/doorman/manage/__init__.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | 
3 | from .views import blueprint
4 | 


--------------------------------------------------------------------------------
/doorman/plugins/__init__.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | 
3 | from .alerters import AbstractAlerterPlugin
4 | from .logs import AbstractLogsPlugin
5 | 


--------------------------------------------------------------------------------
/doorman/plugins/alerters/__init__.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | 
3 | from .base import AbstractAlerterPlugin
4 | 


--------------------------------------------------------------------------------
/doorman/plugins/alerters/base.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | from abc import ABCMeta, abstractmethod
 3 | 
 4 | from doorman.compat import with_metaclass
 5 | 
 6 | 
 7 | class AbstractAlerterPlugin(with_metaclass(ABCMeta)):
 8 |     """
 9 |     AbstractAlerterPlugin is the base class for all alerters in Doorman. It
10 |     defines the interface that an alerter should implement in order to support
11 |     sending an alert.
12 |     """
13 |     @abstractmethod
14 |     def handle_alert(self, node, match):
15 |         raise NotImplementedError()
16 | 


--------------------------------------------------------------------------------
/doorman/plugins/alerters/debug.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import logging
 3 | 
 4 | from flask import current_app
 5 | 
 6 | from .base import AbstractAlerterPlugin
 7 | 
 8 | 
 9 | class DebugAlerter(AbstractAlerterPlugin):
10 |     LEVEL_MAPPINGS = {
11 |         'debug': logging.DEBUG,
12 |         'info': logging.INFO,
13 |         'warn': logging.WARNING,
14 |         'error': logging.ERROR,
15 |         'critical': logging.CRITICAL,
16 |     }
17 | 
18 |     def __init__(self, config):
19 |         levelname = config.get('level', 'debug')
20 |         self.level = self.LEVEL_MAPPINGS.get(levelname, logging.DEBUG)
21 | 
22 |     def handle_alert(self, node, match):
23 |         # TODO(andrew-d): better message?
24 |         current_app.logger.log(self.level, 'Triggered alert: {0!r}'.format(match))
25 | 


--------------------------------------------------------------------------------
/doorman/plugins/alerters/emailer.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import datetime as dt
 3 | import string
 4 | 
 5 | from flask import render_template
 6 | from flask_mail import Message
 7 | 
 8 | from doorman.extensions import mail
 9 | from .base import AbstractAlerterPlugin
10 | 
11 | 
12 | class EmailAlerter(AbstractAlerterPlugin):
13 | 
14 |     def __init__(self, config):
15 |         self.recipients = config['recipients']
16 |         self.config = config
17 | 
18 |     def handle_alert(self, node, match):
19 |         subject_template = self.config.setdefault(
20 |             'subject_template', 'email/alert.subject.txt'
21 |         )
22 |         message_template = self.config.setdefault(
23 |             'message_template', 'email/alert.body.txt'
24 |         )
25 |         subject_prefix = self.config.setdefault(
26 |             'subject_prefix', '[Doorman]'
27 |         )
28 | 
29 |         params = {}
30 |         params.update(node)
31 |         params.update(node.get('node_info', {}))
32 |         params.update(match.result['columns'])
33 | 
34 |         subject = string.Template(
35 |             render_template(
36 |                 subject_template,
37 |                 prefix=subject_prefix,
38 |                 match=match,
39 |                 timestamp=dt.datetime.utcnow(),
40 |                 node=node
41 |             )
42 |         ).safe_substitute(**params)
43 | 
44 |         body = string.Template(
45 |             render_template(
46 |                 message_template,
47 |                 match=match,
48 |                 timestamp=dt.datetime.utcnow(),
49 |                 node=node
50 |             )
51 |         ).safe_substitute(**params)
52 | 
53 |         message = Message(
54 |             subject.strip(),
55 |             recipients=self.recipients,
56 |             body=body,
57 |             charset='utf-8',
58 |         )
59 | 
60 |         return mail.send(message)
61 | 


--------------------------------------------------------------------------------
/doorman/plugins/alerters/pagerduty.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import json
 3 | import logging
 4 | 
 5 | import requests
 6 | 
 7 | from doorman.utils import DateTimeEncoder
 8 | from .base import AbstractAlerterPlugin
 9 | 
10 | 
11 | DEFAULT_KEY_FORMAT = 'doorman-incident-{count}'
12 | 
13 | 
14 | class PagerDutyAlerter(AbstractAlerterPlugin):
15 |     def __init__(self, config):
16 |         # Required configuration
17 |         self.service_key = config['service_key']
18 | 
19 |         # Optional
20 |         self.client_url = config.get('client_url', '')
21 |         self.key_format = config.get('key_format', DEFAULT_KEY_FORMAT)
22 | 
23 |         # Other
24 |         self.incident_count = 0
25 |         self.logger = logging.getLogger(__name__ + '.PagerDutyAlerter')
26 | 
27 |     def handle_alert(self, node, match):
28 |         self.incident_count += 1
29 |         key = self.key_format.format(
30 |             count=self.incident_count
31 |         )
32 | 
33 |         description = match.rule.template.safe_substitute(
34 |             match.result['columns'],
35 |             **node
36 |         ).rstrip()
37 | 
38 |         description = ":".join(description.split('\r\n\r\n', 1))
39 | 
40 |         details = {
41 |             'node': node,
42 |             'rule_name': match.rule.name,
43 |             'rule_description': match.rule.description,
44 |             'action': match.result['action'],
45 |             'match': match.result['columns'],
46 |         }
47 | 
48 |         headers = {
49 |             'Content-type': 'application/json',
50 |         }
51 | 
52 |         payload = json.dumps({
53 |             'event_type': 'trigger',
54 |             'service_key': self.service_key,
55 |             'incident_key': key,
56 |             'description': description,
57 |             'client': 'Doorman',
58 |             "client_url": self.client_url,
59 |             'details': details,
60 |         }, cls=DateTimeEncoder)
61 | 
62 |         resp = requests.post(
63 |             'https://events.pagerduty.com/generic/2010-04-15/create_event.json',
64 |             headers=headers,
65 |             data=payload
66 |         )
67 | 
68 |         if not resp.ok:
69 |             self.logger.warn('Could not trigger PagerDuty alert!')
70 | 
71 |         self.logger.debug('Response from PagerDuty: %r', resp.content)
72 | 


--------------------------------------------------------------------------------
/doorman/plugins/alerters/sentry.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import string
 3 | 
 4 | from flask import current_app
 5 | from raven import Client
 6 | 
 7 | from .base import AbstractAlerterPlugin
 8 | 
 9 | 
10 | class SentryAlerter(AbstractAlerterPlugin):
11 |     def __init__(self, config):
12 |         self.client = Client(
13 |             config['dsn'],
14 |             auto_log_stacks=False,
15 |             enable_breadcrumbs=False,
16 |         )
17 |         self.config = config
18 | 
19 |     def handle_alert(self, node, match):
20 |         name = match.result['name']
21 | 
22 |         if name.startswith('pack'):
23 |             try:
24 |                 _, pack, query = name.split(current_app.config['DOORMAN_PACK_DELIMITER'])
25 |             except ValueError:
26 |                 pack, query = None, name
27 |         else:
28 |             pack, query = None, name
29 | 
30 |         message = match.rule.template.safe_substitute(
31 |             match.result['columns'],
32 |             **node
33 |         )
34 | 
35 |         self.client.captureMessage(
36 |             message=message.rstrip(),
37 |             data={
38 |                 'logger': current_app.name
39 |             },
40 |             extra={
41 |                 'action': match.result['action'],
42 |                 'columns': match.result['columns'],
43 |                 'timestamp': match.result['timestamp'].strftime('%Y-%m-%d %H:%M:%S'),
44 |                 'node': node,
45 |             },
46 |             tags={
47 |                 'host_identifier': node.get('host_identifier'),
48 |                 'pack': pack,
49 |                 'query': query,
50 |             },
51 |         )
52 | 


--------------------------------------------------------------------------------
/doorman/plugins/alerters/slack.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import json
 3 | import logging
 4 | import requests
 5 | 
 6 | from .base import AbstractAlerterPlugin
 7 | 
 8 | DEFAULT_COLOR = '#36a64f'
 9 | 
10 | class SlackAlerter(AbstractAlerterPlugin):
11 |     def __init__(self, config):
12 |         # Required configuration
13 |         self.slack_webhook = config['slack_webhook']
14 | 
15 |         # Optional
16 |         self.printColumns = config.get('printColumns', False)
17 |         self.color = config.get('color', DEFAULT_COLOR)
18 | 
19 |         # Other
20 |         self.logger = logging.getLogger(__name__ + '.SlackAlerter')
21 | 
22 |     def handle_alert(self, node, match):
23 |         fields = [
24 |             {'title' : 'Node', 'value' : node['display_name']},
25 |             {'title' : 'Description', 'value' : match.rule.description},
26 |             {'title' : 'Action', 'value' : match.result['action']},
27 |         ]
28 | 
29 |         if self.printColumns:
30 |             columns = []
31 |             for key in match.result['columns']:
32 |                 columns.append({"title" : key, 'value' : match.result['columns'][key]})
33 |             fields.extend(columns)
34 | 
35 |         attachments = [{
36 |             'pretext' : 'Doorman Alert: *%s*' % match.rule.name,
37 |             'fallback' : 'Doorman Alert: %s' % match.rule.name,
38 |             'color' : self.color,
39 |             'fields': fields,
40 |             'mrkdwn_in':['text', 'pretext']
41 |         }]
42 | 
43 |         headers = {
44 |             'Content-type': 'application/json',
45 |         }
46 | 
47 |         payload = json.dumps({'attachments': attachments})
48 | 
49 |         resp = requests.post(
50 |             self.slack_webhook,
51 |             headers=headers,
52 |             data=payload
53 |         )
54 | 
55 |         if not resp.ok:
56 |             self.logger.warn('Could not trigger Slack alert!')
57 | 
58 |         self.logger.debug('Response from Slack: %r', resp.content)
59 | 


--------------------------------------------------------------------------------
/doorman/plugins/logs/__init__.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | 
3 | from .base import AbstractLogsPlugin
4 | 


--------------------------------------------------------------------------------
/doorman/plugins/logs/base.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | from abc import ABCMeta, abstractmethod, abstractproperty
 3 | 
 4 | from doorman.compat import with_metaclass
 5 | 
 6 | 
 7 | class AbstractLogsPlugin(with_metaclass(ABCMeta)):
 8 |     @abstractproperty
 9 |     def name(self):
10 |         pass
11 | 
12 |     @abstractmethod
13 |     def handle_status(self, data, **kwargs):
14 |         pass
15 | 
16 |     @abstractmethod
17 |     def handle_result(self, data, **kwargs):
18 |         pass
19 | 


--------------------------------------------------------------------------------
/doorman/plugins/logs/file.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import os
 3 | import time
 4 | import datetime as dt
 5 | 
 6 | from doorman.plugins import AbstractLogsPlugin
 7 | from doorman.utils import extract_results, quote
 8 | 
 9 | 
10 | class LogPlugin(AbstractLogsPlugin):
11 |     def __init__(self, config):
12 |         append = config.setdefault('DOORMAN_LOG_FILE_PLUGIN_APPEND', True)
13 |         status_path = config.get('DOORMAN_LOG_FILE_PLUGIN_STATUS_LOG')
14 |         result_path = config.get('DOORMAN_LOG_FILE_PLUGIN_RESULT_LOG')
15 | 
16 |         mode = 'a' if append else 'w'
17 |         self.status = open(status_path, mode) if status_path else None
18 |         self.result = open(result_path, mode) if result_path else None
19 | 
20 |     @property
21 |     def name(self):
22 |         return "file"
23 | 
24 |     def join_fields(self, fields):
25 |         parts = []
26 |         for name, val in fields.items():
27 |             if not isinstance(val, str):
28 |                 val = str(val)
29 |             parts.append(name + '=' + quote(val))
30 | 
31 |         return ', '.join(parts)
32 | 
33 |     def handle_status(self, data, **kwargs):
34 |         if self.status is None:
35 |             return
36 | 
37 |         # Write each status log on a different line
38 |         try:
39 |             for item in data.get('data', []):
40 |                 fields = {}
41 |                 fields.update(kwargs)
42 |                 fields.update({
43 |                     'line':     item.get('line', ''),
44 |                     'message':  item.get('message', ''),
45 |                     'severity': item.get('severity', ''),
46 |                     'filename': item.get('filename', ''),
47 |                     'version': item.get('version'),  # be null
48 |                 })
49 | 
50 |                 if 'created' in item:
51 |                     fields['created'] = time.mktime(item['created'].timetuple())
52 |                 else:
53 |                     fields['created'] = time.mktime(dt.datetime.utcnow().timetuple())
54 | 
55 |                 self.status.write(self.join_fields(fields) + '\n')
56 |         finally:
57 |             self.status.flush()
58 |             os.fsync(self.status.fileno())
59 | 
60 |     def handle_result(self, data, **kwargs):
61 |         if self.result is None:
62 |             return
63 | 
64 |         # Process each result individually
65 |         try:
66 |             for item in extract_results(data):
67 |                 fields = {}
68 |                 fields.update(kwargs)
69 | 
70 |                 if item.timestamp:
71 |                     timestamp = time.mktime(item.timestamp.timetuple())
72 |                 else:
73 |                     timestamp = time.mktime(dt.datetime.utcnow.timetuple())
74 | 
75 |                 fields.update(name=item.name, timestamp=timestamp)
76 | 
77 |                 base = self.join_fields(fields)
78 | 
79 |                 # Write each added/removed entry on a different line
80 |                 curr_fields = {'result_type': item.action}
81 |                 for key, val in item.columns.items():
82 |                     curr_fields['_'.join([item.action, key])] = val
83 | 
84 |                 self.result.write(base + ', ' + self.join_fields(curr_fields) + '\n')
85 |         finally:
86 |             self.result.flush()
87 |             os.fsync(self.result.fileno())
88 | 


--------------------------------------------------------------------------------
/doorman/plugins/logs/logstash.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | from json import dump as json_dump
 3 | import datetime as dt
 4 | import os
 5 | import time
 6 | 
 7 | from doorman.plugins import AbstractLogsPlugin
 8 | from doorman.utils import extract_results, quote
 9 | 
10 | 
11 | class LogstashPlugin(AbstractLogsPlugin):
12 |     def __init__(self, config):
13 |         self.path = path = config.get('DOORMAN_LOG_FILE_PLUGIN_JSON_LOG')
14 |         self.minimum_severity = config.get('DOORMAN_MINIMUM_OSQUERY_LOG_LEVEL')
15 |         self.fp = open(path, 'a') if path else None
16 | 
17 |     @property
18 |     def name(self):
19 |         return "json"
20 | 
21 |     def handle_status(self, data, **kwargs):
22 |         if self.fp is None:
23 |             return
24 | 
25 |         fp = self.fp
26 |         minimum_severity = self.minimum_severity
27 | 
28 |         host_identifier = kwargs.get('host_identifier')
29 |         created = dt.datetime.utcnow().isoformat()
30 | 
31 |         try:
32 |             for item in data.get('data', []):
33 |                 if int(item['severity']) < minimum_severity:
34 |                     continue
35 | 
36 |                 if 'created' in item:
37 |                     item['created'] = item['created'].isoformat()
38 | 
39 |                 json_dump({
40 |                     '@version': 1,
41 |                     '@host_identifier': host_identifier,
42 |                     '@timestamp': item.get('created', created),
43 |                     '@message': item.get('message', ''),
44 |                     'log_type': 'status',
45 |                     'line': item.get('line', ''),
46 |                     'message': item.get('message', ''),
47 |                     'severity': item.get('severity', ''),
48 |                     'filename': item.get('filename', ''),
49 |                     'osquery_version': item.get('version'),  # be null
50 |                     'created': created,
51 |                 }, fp)
52 |                 fp.write('\r\n')
53 |         finally:
54 |             fp.flush()
55 |             os.fsync(fp.fileno())
56 | 
57 |     def handle_result(self, data, **kwargs):
58 |         if self.fp is None:
59 |             return
60 | 
61 |         fp = self.fp
62 | 
63 |         host_identifier = kwargs.get('host_identifier')
64 |         created = dt.datetime.utcnow().isoformat()
65 | 
66 |         try:
67 |             for item in extract_results(data):
68 |                 json_dump({
69 |                     '@version': 1,
70 |                     '@host_identifier': host_identifier,
71 |                     '@timestamp': item.timestamp.isoformat(),
72 |                     'log_type': 'result',
73 |                     'action': item.action,
74 |                     'columns': item.columns,
75 |                     'name': item.name,
76 |                     'created': created,
77 |                 }, fp)
78 |                 fp.write('\r\n')
79 |         finally:
80 |             fp.flush()
81 |             os.fsync(fp.fileno())
82 | 


--------------------------------------------------------------------------------
/doorman/static/css/bootstrap.less:
--------------------------------------------------------------------------------
 1 | @import "../libs/bootstrap/less/bootstrap.less";
 2 | @import "font-awesome.less";
 3 | @import "bootswatch.less";
 4 | @import "variables.less";
 5 | 
 6 | // bootstrap font path
 7 | @icon-font-path:        "/static/libs/bootstrap/fonts/";
 8 | 
 9 | 
10 | /* sidebar */
11 | .bs-docs-sidebar {
12 |   padding-left: 20px;
13 |   margin-top: 20px;
14 |   margin-bottom: 20px;
15 | }
16 | 
17 | /* all links */
18 | .bs-docs-sidebar .nav>li>a {
19 |   color: @navbar-default-link-color;
20 |   border-left: 2px solid transparent;
21 |   padding: 4px 20px;
22 |   font-size: 13px;
23 |   font-weight: 400;
24 | }
25 | 
26 | /* nested links */
27 | .bs-docs-sidebar .nav .nav>li>a {
28 |   padding-top: 1px;
29 |   padding-bottom: 1px;
30 |   padding-left: 30px;
31 |   font-size: 12px;
32 | }
33 | 
34 | /* active & hover links */
35 | .bs-docs-sidebar .nav>.active>a,
36 | .bs-docs-sidebar .nav>li>a:hover,
37 | .bs-docs-sidebar .nav>li>a:focus {
38 |   color: @navbar-default-link-hover-color;
39 |   text-decoration: none;
40 |   background-color: transparent;
41 |   border-left: 2px solid @navbar-default-link-hover-color;
42 | }
43 | 
44 | /* all active links */
45 | .bs-docs-sidebar .nav>.active>a,
46 | .bs-docs-sidebar .nav>.active:hover>a,
47 | .bs-docs-sidebar .nav>.active:focus>a {
48 |   font-weight: 700;
49 | }
50 | 
51 | /* nested active links */
52 | .bs-docs-sidebar .nav .nav>.active>a,
53 | .bs-docs-sidebar .nav .nav>.active:hover>a,
54 | .bs-docs-sidebar .nav .nav>.active:focus>a {
55 |   font-weight: 600;
56 | }
57 | 
58 | /* hide inactive nested list */
59 | .bs-docs-sidebar .nav ul.nav {
60 |   display: none;
61 | }
62 | 
63 | /* show active nested list */
64 | .bs-docs-sidebar .nav>.active>ul.nav {
65 |   display: block;
66 | }
67 | 
68 | /* scrollable navbar */
69 | .bs-docs-sidebar > ul {
70 |   overflow-y: auto;
71 |   height: 85%;
72 |   padding-bottom: 100px;
73 | }
74 | 


--------------------------------------------------------------------------------
/doorman/static/css/bootswatch.less:
--------------------------------------------------------------------------------
  1 | // Simplex 3.3.5
  2 | // Bootswatch
  3 | // -----------------------------------------------------
  4 | 
  5 | @web-font-path: "https://fonts.googleapis.com/css?family=Open+Sans:400,700";
  6 | 
  7 | .web-font(@web-font-path) {
  8 |   @import url("@{web-font-path}");
  9 | }
 10 | .web-font(@web-font-path);
 11 | 
 12 | .btn-shadow(@color) {
 13 |   #gradient > .vertical-three-colors(lighten(@color, 3%), @color, 6%, darken(@color, 3%));
 14 |   filter: none;
 15 |   border: 1px solid darken(@color, 10%);
 16 | }
 17 | 
 18 | // Navbar =====================================================================
 19 | 
 20 | .navbar {
 21 | 
 22 |   &-inverse {
 23 | 
 24 |     .badge {
 25 |       background-color: #fff;
 26 |       color: @brand-primary;
 27 |     }
 28 |   }
 29 | }
 30 | 
 31 | // Buttons ====================================================================
 32 | 
 33 | .btn {
 34 |   font-family: @headings-font-family;
 35 | }
 36 | 
 37 | .btn-default,
 38 | .btn-default:hover {
 39 |   .btn-shadow(@btn-default-bg);
 40 | }
 41 | 
 42 | .btn-primary,
 43 | .btn-primary:hover {
 44 |   .btn-shadow(@btn-primary-bg);
 45 | }
 46 | 
 47 | .btn-success,
 48 | .btn-success:hover {
 49 |   .btn-shadow(@btn-success-bg);
 50 | }
 51 | 
 52 | .btn-info,
 53 | .btn-info:hover {
 54 |   .btn-shadow(@btn-info-bg);
 55 | }
 56 | 
 57 | .btn-warning,
 58 | .btn-warning:hover {
 59 |   .btn-shadow(@btn-warning-bg);
 60 | }
 61 | 
 62 | .btn-danger,
 63 | .btn-danger:hover {
 64 |   .btn-shadow(@btn-danger-bg);
 65 | }
 66 | 
 67 | // Typography =================================================================
 68 | 
 69 | body {
 70 |   font-weight: 200;
 71 | }
 72 | 
 73 | // Tables =====================================================================
 74 | 
 75 | th {
 76 |   color: @headings-color;
 77 | }
 78 | 
 79 | // Forms ======================================================================
 80 | 
 81 | legend {
 82 |   color: @headings-color;
 83 | }
 84 | 
 85 | label {
 86 |   font-weight: normal;
 87 | }
 88 | 
 89 | .has-warning {
 90 |   .help-block,
 91 |   .control-label,
 92 |   .radio,
 93 |   .checkbox,
 94 |   .radio-inline,
 95 |   .checkbox-inline,
 96 |   &.radio label,
 97 |   &.checkbox label,
 98 |   &.radio-inline label,
 99 |   &.checkbox-inline label,
100 |   .form-control-feedback {
101 |     color: @brand-danger;
102 |   }
103 | 
104 |   .form-control,
105 |   .form-control:focus {
106 |     border-color: @brand-danger;
107 |   }
108 | }
109 | 
110 | .has-error {
111 |   .help-block,
112 |   .control-label,
113 |   .radio,
114 |   .checkbox,
115 |   .radio-inline,
116 |   .checkbox-inline,
117 |   &.radio label,
118 |   &.checkbox label,
119 |   &.radio-inline label,
120 |   &.checkbox-inline label,
121 |   .form-control-feedback {
122 |     color: @brand-primary;
123 |   }
124 | 
125 |   .form-control,
126 |   .form-control:focus {
127 |     border-color: @brand-primary;
128 |   }
129 | }
130 | 
131 | .has-success {
132 |   .help-block,
133 |   .control-label,
134 |   .radio,
135 |   .checkbox,
136 |   .radio-inline,
137 |   .checkbox-inline,
138 |   &.radio label,
139 |   &.checkbox label,
140 |   &.radio-inline label,
141 |   &.checkbox-inline label,
142 |   .form-control-feedback {
143 |     color: @brand-success;
144 |   }
145 | 
146 |   .form-control,
147 |   .form-control:focus {
148 |     border-color: @brand-success;
149 |   }
150 | }
151 | 
152 | // Navs =======================================================================
153 | 
154 | .pager {
155 |   a {
156 |     color: @headings-color;
157 |   }
158 | 
159 |   a:hover,
160 |   .active > a, {
161 |     border-color: @brand-primary;
162 |     color: #fff;
163 |   }
164 | 
165 |   .disabled > a {
166 |     border-color: @pager-border;
167 |   }
168 | }
169 | 
170 | // Indicators =================================================================
171 | 
172 | // Progress bars ==============================================================
173 | 
174 | // Containers =================================================================


--------------------------------------------------------------------------------
/doorman/static/css/font-awesome.less:
--------------------------------------------------------------------------------
1 | @import "../libs/font-awesome/less/font-awesome.less";
2 | 
3 | // font-awesome font path
4 | @fa-font-path:          "/static/libs/font-awesome/fonts";
5 | 


--------------------------------------------------------------------------------
/doorman/static/css/style.css:
--------------------------------------------------------------------------------
  1 | /* =============================================================================
  2 |    App specific CSS file.
  3 |    ========================================================================== */
  4 | 
  5 | /* universal */
  6 | 
  7 | html {
  8 |   overflow-y: scroll;
  9 | }
 10 | 
 11 | body {
 12 |   padding-top: 50px;
 13 |   position: relative;
 14 | }
 15 | 
 16 | section {
 17 |   overflow: auto;
 18 | }
 19 | 
 20 | textarea {
 21 |   resize: vertical;
 22 | }
 23 | 
 24 | .container-narrow{
 25 |   margin: 0 auto;
 26 |   max-width: 700px;
 27 | }
 28 | 
 29 | /* Forms */
 30 | 
 31 | .navbar-form input[type="text"],
 32 | .navbar-form input[type="password"] {
 33 |   width: 180px;
 34 | }
 35 | 
 36 | 
 37 | .form-register {
 38 |   width: 50%;
 39 | }
 40 | 
 41 | .form-register .form-control {
 42 |   position: relative;
 43 |   font-size: 16px;
 44 |   height: auto;
 45 |   padding: 10px;
 46 |   -webkit-box-sizing: border-box;
 47 |      -moz-box-sizing: border-box;
 48 |           box-sizing: border-box;
 49 | }
 50 | 
 51 | /* footer */
 52 | 
 53 | footer {
 54 |   margin-top: 45px;
 55 |   padding-top: 5px;
 56 |   border-top: 1px solid #eaeaea;
 57 |   color: #999999;
 58 | }
 59 | 
 60 | footer a {
 61 |   color: #999999;
 62 | }
 63 | 
 64 | footer p {
 65 |   float: right;
 66 |   margin-right: 25px;
 67 | }
 68 | 
 69 | footer ul {
 70 |   list-style: none;
 71 | }
 72 | 
 73 | footer ul li {
 74 |   float: left;
 75 |   margin-left: 10px;
 76 | }
 77 | 
 78 | footer .company {
 79 |   float: left;
 80 |   margin-left: 25px;
 81 | }
 82 | 
 83 | footer .footer-nav {
 84 |   float: right;
 85 |   margin-right: 25px;
 86 |   list-style: none;
 87 | }
 88 | 
 89 | .bootstrap-tagsinput {
 90 |   width: 100%;
 91 |   margin-bottom: 1px;
 92 | }
 93 | 
 94 | td .bootstrap-tagsinput, p .bootstrap-tagsinput {
 95 |   width: 100%;
 96 |   margin-bottom: 1px;
 97 |   background-color: transparent;
 98 |   border: none;
 99 |   box-shadow: none;
100 | }
101 | 
102 | #sidebar.affix {
103 |   top: 70px;
104 | }
105 | 
106 | /* fix input padding on query builder */
107 | .query-builder .rule-value-container select,
108 | .query-builder .rule-value-container input[type=text],
109 | .query-builder .rule-value-container input[type=number] {
110 |   padding: 8px;
111 | }
112 | 
113 | .query-builder .rule-container .rule-filter-container,
114 | .query-builder .rule-container .rule-operator-container,
115 | .query-builder .rule-container .rule-value-container {
116 |   display: inline-block;
117 |   margin: 0 2px 0 0;
118 |   vertical-align: middle;
119 | }
120 | 


--------------------------------------------------------------------------------
/doorman/tasks.py:
--------------------------------------------------------------------------------
  1 | # -*- coding: utf-8 -*-
  2 | from celery import Celery
  3 | from flask import current_app
  4 | import datetime as dt
  5 | 
  6 | 
  7 | celery = Celery(__name__)
  8 | 
  9 | 
 10 | @celery.task()
 11 | def analyze_result(result, node):
 12 |     current_app.rule_manager.handle_log_entry(result, node)
 13 |     learn_from_result.s(result, node).delay()
 14 |     return
 15 | 
 16 | 
 17 | @celery.task()
 18 | def learn_from_result(result, node):
 19 |     from doorman.utils import learn_from_result
 20 |     learn_from_result(result, node)
 21 |     return
 22 | 
 23 | 
 24 | @celery.task()
 25 | def example_task(one, two):
 26 |     print('Adding {0} and {1}'.format(one, two))
 27 |     return one + two
 28 | 
 29 | 
 30 | @celery.task()
 31 | def notify_of_node_enrollment(node):
 32 |     '''
 33 |     Create a result that gets run through our Rule Manager whenever a new
 34 |     node is enrolled so that we may alert on this action.
 35 | 
 36 |     A rule can be created within Doorman's rule manager to alert on
 37 |     any of the following conditions:
 38 |         - query name: doorman/tasks/node_enrolled
 39 |         - action: triggered
 40 |         - columns:
 41 |             - enrolled_on
 42 |             - last_ip
 43 |             - node_id
 44 |     '''
 45 |     entry = {
 46 |         'name': 'doorman/tasks/node_enrolled',
 47 |         'calendarTime': dt.datetime.utcnow().strftime('%a %b %d %H:%M:%S %Y UTC'),
 48 |         'action': 'triggered',
 49 |     }
 50 |     columns = entry['columns'] = {}
 51 |     columns['enrolled_on'] = node.get('enrolled_on')
 52 |     columns['last_ip'] = node.get('last_ip')
 53 |     columns['node_id'] = node.get('id')
 54 |     result = {'data': [entry]}
 55 |     current_app.rule_manager.handle_log_entry(result, node)
 56 |     return
 57 | 
 58 | 
 59 | @celery.task()
 60 | def alert_when_node_goes_offline():
 61 |     '''
 62 |     This task is intended to periodically comb the database to identify
 63 |     nodes that have not posted results in some time, checked in for some
 64 |     time, or have not posted results within some time of their last
 65 |     checkin. The purpose of this task is to identify nodes that go offline,
 66 |     or in some cases, nodes with corrupted osquery rocksdb databases.
 67 | 
 68 |     A rule can be created within Doorman's rules manager to alert on
 69 |     any of the following conditions:
 70 |         - query name: doorman/tasks/node_offline_checks
 71 |         - action: triggered
 72 |         - columns:
 73 |             - since_last_result
 74 |             - since_last_result_days
 75 |             - since_last_result_seconds
 76 |             - since_last_checkin
 77 |             - since_last_checkin_days
 78 |             - since_last_checkin_seconds
 79 |             - since_last_checkin_to_last_result
 80 |             - since_last_checkin_to_last_result_days
 81 |             - since_last_checkin_to_last_result_seconds
 82 |     '''
 83 |     from collections import namedtuple
 84 |     from itertools import imap
 85 |     from sqlalchemy import func
 86 |     from doorman.models import db, Node, ResultLog
 87 | 
 88 |     _Node = namedtuple('Node', [
 89 |         'id', 'host_identifier', 'node_info', 'enrolled_on', 'is_active',
 90 |         'last_ip', 'last_checkin', 'last_result',
 91 |     ])
 92 | 
 93 |     query = db.session.query(
 94 |         ResultLog.node_id,
 95 |         Node.host_identifier,
 96 |         Node.node_info,
 97 |         Node.enrolled_on,
 98 |         Node.is_active,
 99 |         Node.last_ip,
100 |         Node.last_checkin,
101 |         func.max(ResultLog.timestamp),
102 |     ).join(Node).filter(Node.is_active).group_by(ResultLog.node_id, Node.id)
103 | 
104 |     now = dt.datetime.utcnow()
105 |     calendarTime = now.strftime('%a %b %d %H:%M:%S %Y UTC')
106 | 
107 |     for processed, node in enumerate(imap(_Node._make, query), 1):
108 |         entry = {
109 |             'name': 'doorman/tasks/node_offline_checks',
110 |             'calendarTime': calendarTime,
111 |             'action': 'triggered',
112 |         }
113 |         columns = entry['columns'] = {}
114 | 
115 |         since_last_result = now - node.last_result
116 |         since_last_checkin = now - node.last_checkin
117 |         since_last_checkin_to_last_result = node.last_checkin - node.last_result
118 | 
119 |         columns['since_last_result_seconds'] = since_last_result.total_seconds()
120 |         columns['since_last_checkin_seconds'] = since_last_checkin.total_seconds()
121 |         columns['since_last_checkin_to_last_result_seconds'] = since_last_checkin_to_last_result.total_seconds()
122 | 
123 |         columns['since_last_result_days'] = since_last_result.days
124 |         columns['since_last_checkin_days'] = since_last_checkin.days
125 |         columns['since_last_checkin_to_last_result_days'] = since_last_checkin_to_last_result.days
126 | 
127 |         columns['since_last_result'] = since_last_result
128 |         columns['since_last_checkin'] = since_last_checkin
129 |         columns['since_last_checkin_to_last_result'] = since_last_checkin_to_last_result
130 | 
131 |         _node = dict(node._asdict())
132 |         _node['display_name'] = node.node_info.get('display_name') or \
133 |             node.node_info.get('hostname') or \
134 |             node.node_info.get('computer_name') or \
135 |             node.host_identifier
136 | 
137 |         result = {'data': [entry]}
138 |         current_app.rule_manager.handle_log_entry(result, _node)
139 | 
140 |     else:
141 |         return processed
142 | 


--------------------------------------------------------------------------------
/doorman/templates/401.html:
--------------------------------------------------------------------------------
 1 | 
 2 | {% extends "layout.html" %}
 3 | 
 4 | {% block page_title %}Unauthorized{% endblock %}
 5 | 
 6 | {% block content %}
 7 | <div class="jumbotron">
 8 |     <div class="text-center">
 9 |         <h1>401</h1>
10 |         <p>You are not authorized to see this page.</p>
11 |     </div>
12 | </div>
13 | {% endblock %}
14 | 
15 | 


--------------------------------------------------------------------------------
/doorman/templates/403.html:
--------------------------------------------------------------------------------
 1 | 
 2 | {% extends "layout.html" %}
 3 | 
 4 | {% block page_title %}Unauthorized{% endblock %}
 5 | 
 6 | {% block content %}
 7 | <div class="jumbotron">
 8 |     <div class="text-center">
 9 |         <h1>403</h1>
10 |         <p>You are not authorized to perform this action.</p>
11 |     </div>
12 | </div>
13 | {% endblock %}
14 | 
15 | 


--------------------------------------------------------------------------------
/doorman/templates/404.html:
--------------------------------------------------------------------------------
 1 | 
 2 | {% extends "layout.html" %}
 3 | 
 4 | {% block page_title %}Page Not Found{% endblock %}
 5 | 
 6 | {% block content %}
 7 | <div class="jumbotron">
 8 |     <div class="text-center">
 9 |         <h1>404</h1>
10 |         <p>Sorry, that page doesn't exist.</p>
11 |     </div>
12 | </div>
13 | {% endblock %}
14 | 
15 | 


--------------------------------------------------------------------------------
/doorman/templates/500.html:
--------------------------------------------------------------------------------
 1 | 
 2 | {% extends "layout.html" %}
 3 | 
 4 | {% block page_title %}Server error{% endblock %}
 5 | 
 6 | {% block content %}
 7 | <div class="jumbotron">
 8 |     <div class="text-center">
 9 |         <h1>500</h1>
10 |         <p>Sorry, something went wrong on our system. Don't panic, we are fixing it! Please try again later.</p>
11 |     </div>
12 | </div>
13 | {% endblock %}
14 | 
15 | 


--------------------------------------------------------------------------------
/doorman/templates/email/alert.body.txt:
--------------------------------------------------------------------------------
 1 | A doorman alert was triggered: {{ match.rule.name }}
 2 | 
 3 | Timestamp: {{ timestamp }}
 4 | Action: {{ match.result.action }}
 5 | Content:
 6 | {%- for key, value in match.result.columns | dictsort %}
 7 |            {{ key }}: {{ value }}
 8 | {%- endfor %}
 9 | 
10 | {%- if match.rule.description %}
11 | 
12 | {{ match.rule.description }}
13 | {%- endif %}
14 | 
15 | Review most recent activity for {{ node.display_name }} at {{ url_for('manage.node_activity', node_id=node.id, _external=True) }}.
16 | This rule's configuration may be reviewed at {{ url_for('manage.rule', rule_id=match.rule.id, _external=True) }}.
17 | 
18 | ---END doorman notification
19 | 


--------------------------------------------------------------------------------
/doorman/templates/email/alert.subject.txt:
--------------------------------------------------------------------------------
1 | {{ prefix | trim }} {{ node.display_name }} {{ match.rule.name }} ({{ match.result.action }})
2 | 


--------------------------------------------------------------------------------
/doorman/templates/footer.html:
--------------------------------------------------------------------------------
1 | <footer>
2 |     <div class="row">
3 |         <p></p>
4 |     </div>
5 | </footer>
6 | 


--------------------------------------------------------------------------------
/doorman/templates/layout.html:
--------------------------------------------------------------------------------
 1 | <!doctype html>
 2 | <!-- paulirish.com/2008/conditional-stylesheets-vs-css-hacks-answer-neither/ -->
 3 | <!--[if lt IE 7]> <html class="no-js lt-ie9 lt-ie8 lt-ie7" lang="en"> <![endif]-->
 4 | <!--[if IE 7]>    <html class="no-js lt-ie9 lt-ie8" lang="en"> <![endif]-->
 5 | <!--[if IE 8]>    <html class="no-js lt-ie9" lang="en"> <![endif]-->
 6 | <!--[if gt IE 8]><!--> <html class="no-js" lang="en"> <!--<![endif]-->
 7 | <head>
 8 |   <meta charset="utf-8">
 9 | 
10 |   <title>{% block page_title %}
11 |   
12 |     Doorman
13 |   
14 |     {% endblock %}
15 |   </title>
16 |   <meta name="description" content="{% block meta_description %}{% endblock %}">
17 |   <meta name="author" content="{% block meta_author %}{% endblock %}">
18 | 
19 |   <!-- Mobile viewport optimized: h5bp.com/viewport -->
20 |   <meta name="viewport" content="width=device-width">
21 |   <meta name="csrf-token" content="{{ csrf_token() }}">
22 | 
23 |   {% assets "css_all" %}
24 |     <link rel="stylesheet" href="{{ ASSET_URL }}">
25 |   {% endassets %}
26 | 
27 |   {% block css %}{% endblock %}
28 | 
29 | </head>
30 | <body class="{% block body_class %}{% endblock %}">
31 | {% block body %}
32 | {% with form=form  %}
33 | {% include "nav.html" %}
34 | {% endwith %}
35 | 
36 | <header>{% block header %}{% endblock %}</header>
37 | <div class="{% block content_class %}container-fluid{% endblock content_class %}">
38 | 
39 |   <div role="main">
40 |     {% with messages = get_flashed_messages(with_categories=true) %}
41 |     {% if messages %}
42 |     <div class="row">
43 |       <div class="col-md-12">
44 |         {% for category, message in messages %}
45 |         <div class="alert alert-dissmissible alert-{{ category }}">
46 |           <a class="close" title="Close" href="#" data-dismiss="alert">&times;</a>
47 |          {{ message }}
48 |         </div><!-- end .alert -->
49 |         {% endfor %}
50 |       </div><!-- end col-md -->
51 |     </div><!-- end row -->
52 |         {% endif %}
53 |     {% endwith %}
54 | 
55 |     {% block content %}{% endblock %}
56 | 
57 |     {% include "footer.html" %}
58 |   </div><!-- end main -->
59 | 
60 | </div><!-- end container -->
61 | 
62 | <!-- JavaScript at the bottom for fast page loading -->
63 | {% assets "js_all" %}
64 |     <script type="text/javascript" src="{{ ASSET_URL }}"></script>
65 | {% endassets %}
66 | {% block js %}{% endblock %}
67 | <!-- end scripts -->
68 | {% endblock %}
69 | </body>
70 | </html>
71 | 
72 | 


--------------------------------------------------------------------------------
/doorman/templates/login.html:
--------------------------------------------------------------------------------
 1 | 
 2 | {% extends "layout.html" %}
 3 | 
 4 | {% block page_title %}Login{% endblock %}
 5 | 
 6 | {% block content %}
 7 | <div class="jumbotron">
 8 |     <div class="container">
 9 | 
10 |         <div class="col-md-4">
11 |         </div>
12 | 
13 |         <div class="col-md-4">
14 |             <form class="form-horizontal" method="POST" id="loginform">
15 |                 {{ form.csrf_token }}
16 | 
17 |                 <div class="form-group text-center">
18 |                     <div class="col-sm-10">
19 |                         Sign in with your {{ form.auth_method }} credentials.
20 |                     </div>
21 |                 </div>
22 | 
23 |                 {% if form.auth_method in ('doorman', 'ldap') %}
24 | 
25 |                 <div class="form-group">
26 |                     <div class="col-sm-10">
27 |                         {{ form.username(placeholder="username", class_="form-control", required=True, autofocus=True) }}
28 |                     </div>
29 |                 </div>
30 | 
31 |                 <div class="form-group">
32 |                     <div class="col-sm-10">
33 |                         {{ form.password(placeholder="password", class_="form-control", required=True) }}
34 |                     </div>
35 |                 </div>
36 | 
37 |                 <div class="form-group">
38 |                     <div class="col-sm-10">
39 |                         <button class="btn btn btn-default btn-block" type="submit">Sign in</button>
40 |                         <label class="checkbox pull-right">
41 |                             {{ form.remember() }}
42 |                             Remember me
43 |                         </label>
44 |                     </div>
45 |                   </div>
46 |                   {% endif %}
47 | 
48 |             </form>
49 |         </div>
50 | 
51 |         <div class="col-md-4">
52 |         </div>
53 | 
54 |     </div>
55 | 
56 | </div>
57 | {% endblock %}
58 | 
59 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/_activity.html:
--------------------------------------------------------------------------------
 1 | 
 2 |             <div class="col-md-3">
 3 |                 <ul class="nav nav-tabs tabs-left" role="tablist">
 4 |                     {% if queries %}
 5 |                     <li class="active">
 6 |                         <a href="#distributed_queries" aria-controls="distributed_queries" role="tab" data-toggle="tab">distributed queries
 7 |                             <span class="badge">{{ queries | count }}</span>
 8 |                         </a>
 9 |                     </li>
10 |                     {% endif %}
11 | 
12 |                     {% for group in recent | groupby('name') %}
13 |                     <li class="{% if not queries and loop.first %}active{% endif %}">
14 |                         <a href="#{{ loop.index }}" aria-controls="{{ loop.index }}" role="tab" data-toggle="tab">{{ group.grouper }}
15 |                             <span class="badge">{{ group.list | count }}</span>
16 |                         </a>
17 |                     </li>
18 |                     {% endfor %}
19 |                 </ul>
20 |             </div>
21 | 
22 |             <div class="col-md-9">
23 |                 <div class="tab-content">
24 | 
25 |                     {% if queries %}
26 |                     <div role="tabpanel" class="tab-pane active" id="distributed_queries">
27 |                         {% include "tables/distributed.html" %}
28 |                     </div>
29 |                     {% endif %}
30 | 
31 |                     {% for grouper, results in recent | groupby('name') %}
32 |                     <div role="tabpanel" class="tab-pane{% if not queries and loop.first %} active{% endif %}" id="{{ loop.index }}">
33 | 
34 |                         {% set columns = results | first | attr('columns') | list | sort %}
35 | 
36 |                         <div class="table-responsive">
37 |                             <table class="table table-striped table-condensed">
38 |                                 <thead>
39 |                                     <th>activity</th>
40 |                                     <th>timestamp</th>
41 |                                     {% for column in columns %}
42 |                                     <th>{{ column }}</th>
43 |                                     {% endfor %}
44 |                                 </thead>
45 | 
46 |                                 <tbody>
47 |                                     {% for result in results %}
48 |                                     <tr>
49 |                                         <td>{{ result.action }}</td>
50 |                                         <td>{{ result.timestamp }}</td>
51 |                                         {% for column in columns %}
52 |                                         <td>{{ result.columns[column] | render(column) }}</td>
53 |                                         {% endfor %}
54 |                                     </tr>
55 |                                     {% endfor %}
56 | 
57 |                                 </tbody>
58 |                             </table>
59 |                         </div>
60 | 
61 |                     </div><!-- ./tab-pane -->
62 | 
63 |                     {% endfor %}
64 | 
65 |                 </div><!-- ./tab-content -->
66 |             </div>
67 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/_pack.html:
--------------------------------------------------------------------------------
 1 | 
 2 |             {% if pack.platform %}
 3 |             <dt>Platform</dt>
 4 |             <dd>{{ pack.platform }}</dd>
 5 |             {% endif %}
 6 |             {% if pack.version %}
 7 |             <dt>Version</dt>
 8 |             <dd>{{ pack.version }}</dd>
 9 |             {% endif %}
10 |             {% if pack.description %}
11 |             <dt>Description</dt>
12 |             <dd>{{ pack.description }}</dd>
13 |             {% endif %}
14 |             {% if pack.shard %}
15 |             <dt>Shard</dt>
16 |             <dd>{{ pack.shard }}</dd>
17 |             {% endif %}
18 | 
19 |             {% for query in pack.queries | sort(attribute='name') %}
20 |                 {% include "_query.html" %}
21 |             {% endfor %}
22 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/_query.html:
--------------------------------------------------------------------------------
 1 |             <div class="panel panel-default" id="{{ pack.name + '-' if pack is defined }}{{ query.name }}">
 2 |                 <h4 class="panel-heading">
 3 |                     <a href="{{ url_for('manage.query', query_id=query.id) }}">{{ query.name }}</a> - {{ query.description }}
 4 |                 </h4>
 5 | 
 6 |                 <table class="table table-striped table-condensed">
 7 | 
 8 |                     <tbody>
 9 | 
10 |                         <tr>
11 |                             <th width="15%">Query</th>
12 |                             <td width="85%"><code>{{ query.sql }}</code></td>
13 |                         </tr>
14 | 
15 |                         <tr>
16 |                             <th width="15%">Interval</th>
17 |                             <td width="85%"><code>{{ query.interval }}</code></td>
18 |                         </tr>
19 | 
20 |                         <tr>
21 |                             <th width="15%">Platform</th>
22 |                             <td width="85%">{{ query.platform or 'all' }}</td>
23 |                         </tr>
24 | 
25 |                         {% if query.version %}
26 |                         <tr>
27 |                             <th width="15%">Version</th>
28 |                             <td width="85%">{{ query.version or '' }}</td>
29 |                         </tr>
30 |                         {% endif %}
31 | 
32 |                         {% if query.value %}
33 |                         <tr>
34 |                             <th width="15%">Value</th>
35 |                             <td width="85%">{{ query.value or '' }}</td>
36 |                         </tr>
37 |                         {% endif %}
38 | 
39 |                         {% if query.shard %}
40 |                         <tr>
41 |                             <th width="15%">Shard</th>
42 |                             <td width="85%">{{ query.shard or '' }}</td>
43 |                         </tr>
44 |                         {% endif %}
45 | 
46 |                         <tr>
47 |                             <th width="15%">Show Removed?</th>
48 |                             <td width="85%">{{ query.removed }}</td>
49 |                         </tr>
50 | 
51 |                         <tr>
52 |                             <th width="15%">Packs</th>
53 |                             <td width="85%">
54 |                                 {% for _pack in query.packs %}
55 |                                 <span class="label">
56 |                                     <a href="{{ url_for('manage.packs') }}#{{ _pack.name }}">{{ _pack.name }}</a>
57 |                                 </span>
58 |                                 {% endfor %}
59 |                             </td>
60 |                         </tr>
61 | 
62 |                         <tr>
63 |                             <th width="15%">Tags</th>
64 |                             <td width="85%">
65 |                                 <input class="tagsinput" placeholder="Add tags by typing here" value="{{ query.tags | map(attribute='value') | sort | join(',') }}" data-uri="{{ url_for('manage.tag_query', query_id=query.id) }}" size="23">
66 |                             </td>
67 |                         </tr>
68 | 
69 |                     </tbody>
70 | 
71 |                 </table>
72 |                 
73 |             </div>
74 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/_rule.html:
--------------------------------------------------------------------------------
 1 |             <div class="panel panel-default" id="rule-{{ rule.id }}">
 2 |                 <h4 class="panel-heading">
 3 |                     <a href="{{ url_for('manage.rule', rule_id=rule.id) }}">{{ rule.name }}</a>
 4 |                 </h4>
 5 | 
 6 |                 <table class="table table-striped table-condensed">
 7 | 
 8 |                     <tbody>
 9 | 
10 |                         <tr>
11 |                             <th width="15%">Description</th>
12 |                             <td width="85%">{{ rule.description }}</td>
13 |                         </tr>
14 | 
15 |                         <tr>
16 |                             <th width="15%">Alerters</th>
17 |                             <td width="85%">{{ rule.alerters | join(', ') }}</td>
18 |                         </tr>
19 | 
20 |                         <tr>
21 |                             <th width="15%">Conditions</th>
22 |                             {% if rule.conditions %}
23 |                             <td width="85%">
24 |                                 {{ rule.conditions.condition }}
25 |                                 <ul>
26 |                                 {% set group = rule.conditions %}
27 |                                 {%- for item in group.rules recursive %}
28 |                                     <li>
29 |                                         {%- if item.rules -%}
30 |                                             {{ item.condition }}<br/>
31 |                                             <ul>{{ loop(item.rules) }}</ul>
32 |                                         {%- else -%}
33 |                                             {%- if item.operator.startswith('column_') and not item.operator.endswith('_empty') %}
34 |                                                 Column "{{ item.value[0] }}" {{ item.operator[7:] | pretty_operator }} "{{ item.value[1] }}"
35 |                                             {%- elif item.operator.startswith('column_') and item.operator.endswith('_empty') %}
36 |                                                 Column "{{ item.value }}" {{ item.operator[7:] | pretty_operator }}
37 |                                             {%- else -%}
38 |                                                 {{ item.id | pretty_field }} {{ item.operator | pretty_operator }} "{{ item.value }}"
39 |                                             {%- endif %}
40 |                                         {%- endif -%}
41 |                                     </li>
42 |                                 {%- endfor %}
43 |                                 </ul>
44 |                             </td>
45 |                             {% else %}
46 |                             <td width="85%"><i>No conditions</i></td>
47 |                             {% endif %}
48 |                         </tr>
49 | 
50 |                     </tbody>
51 | 
52 |                 </table>
53 | 
54 |             </div>
55 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/activity.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-12">
 7 |                 <h1><a href="{{ url_for('manage.get_node', node_id=node.id) }}">{{ node.display_name }}</a> / recent activity / <a href="{{ url_for('manage.node_logs', node_id=node.id) }}">logs</a></h1>
 8 | 
 9 |                 {% if recent or queries %}
10 |                 {% include "_activity.html" %}
11 |                 {% else %}
12 |                 <p>No recent activity for this node.<p>
13 |                 {% endif %}
14 |             </div>
15 |         </div>
16 |     </div>
17 | 
18 | {% endblock %}
19 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/distributed.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             {% if queries is defined %}
 7 | 
 8 |             <div class="col-md-12">
 9 |                 <h1>{% if status %}{{ status }} {% endif %}distributed queries</h1>
10 | 
11 |                 {% if queries %}
12 |                 {% include "tables/distributed.html" %}
13 | 
14 |                 <div class="text-center">
15 |                     <small>{{ pagination.info }}</small>
16 |                     {{ pagination.links }}
17 |                 </div>
18 | 
19 |                 {% else %}
20 |                 <p>No distributed queries in {{ status | default('any', true) }} state.</p>
21 |                 {% endif %}
22 | 
23 |             {% else %}
24 |             <div class="col-md-9">
25 |                 {% include "forms/distributed.html" %}
26 |             {% endif %}
27 |             </div>
28 | 
29 |         </div>
30 |     </div>
31 | 
32 | {% endblock %}
33 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/distributed.result.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-12">
 7 | 
 8 |                 <h1><a href="{{ url_for('manage.get_node', node_id=node.id) }}">{{ node.display_name }}</a></h1>
 9 | 
10 |                 <p class="lead">{{ query.distributed_query.description or '' }}</p>
11 | 
12 |                 <p>
13 |                     <pre>{{ query.distributed_query.sql }}</pre>
14 |                 </p>
15 | 
16 |                 {% if query.results %}
17 | 
18 |                 {% set columns = query.results | first | attr('columns') | list | sort %}
19 | 
20 |                 <div class="table-responsive">
21 |                     <table class="table table-striped table-condensed">
22 |                         <thead>
23 |                             {% for column in columns %}
24 |                             <th>{{ column }}</th>
25 |                             {% endfor %}
26 |                         </thead>
27 |                         <tbody>
28 |                         {% for result in query.results %}
29 | 
30 |                         <tr>
31 |                             {% for column in columns %}
32 |                             <td>{{ result.columns[column] | render(column) }}</td>
33 |                             {% endfor %}
34 |                         </tr>
35 | 
36 |                         {% endfor %}
37 |                         </tbody>
38 |                     </table>
39 |                 </div>
40 |                 {% endif %}
41 | 
42 |             </div>
43 |         </div>
44 |     </div>
45 | 
46 | {% endblock %}
47 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/distributed_results.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-12">
 7 |                 <h1>{% if status %}{{ status }} {% endif %}distributed query results for query {{ distributed_id }}</h1>
 8 | 
 9 |                 <p class="lead">{{ query.description or '' }}</p>
10 |                 <pre>{{ query.sql }}</pre>
11 | 
12 |                 {% if tasks %}
13 |                 {% include "tables/distributed_results.html" %}
14 | 
15 |                 <div class="text-center">
16 |                     <small>{{ pagination.info }}</small>
17 |                     {{ pagination.links }}
18 |                 </div>
19 | 
20 |                 {% else %}
21 |                     <p>
22 |                         No distributed query results for query {{ distributed_id }}
23 |                         {%- if status %} in state {{ status }}{% endif -%}
24 |                     </p>
25 |                 {% endif %}
26 |             </div>
27 | 
28 |         </div>
29 |     </div>
30 | 
31 | {% endblock %}
32 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/file.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-9">
 7 | 
 8 |                 {% if file_path is defined %}
 9 |                 <h1>{{ file_path.name }}</h1>
10 |                 {% endif %}
11 | 
12 |                 {% include "forms/file.html" %}
13 | 
14 |             </div><!--./col-md-9-->
15 |         </div><!--./row-->
16 |     </div><!--./body-content-->
17 | 
18 | {% endblock %}
19 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/files.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-12">
 7 |                 <h1>files</h1>
 8 | 
 9 |                 {% if file_paths %}
10 | 
11 |                 {% for file_path in file_paths %}
12 |                 <h2>
13 |                     <a href="{{ url_for('manage.file_path', file_path_id=file_path.id) }}">{{ file_path.category }}</a>
14 |                 </h2>
15 | 
16 |                 <ul>
17 |                     {% for path in file_path.get_paths() %}
18 |                     <li>{{ path }}</li>
19 |                     {% endfor %}
20 |                 </ul>
21 | 
22 |                 <input class="tagsinput" placeholder="Add tags by typing here" value="{{ file_path.tags | map(attribute='value') | sort | join(',') }}" data-uri="{{ url_for('manage.tag_file', file_path_id=file_path.id) }}" size="23">
23 | 
24 |                 {% endfor %}
25 | 
26 |                 {% else %}
27 |                 <p>No file paths defined. Add some to use osquery's file integrity monitoring.</p>
28 |                 {% endif %}
29 | 
30 | 
31 |             </div>
32 |         </div>
33 |     </div>
34 | 
35 | {% endblock %}
36 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/forms/distributed.html:
--------------------------------------------------------------------------------
 1 |                 <form class="form-horizontal" method="POST">
 2 | 
 3 |                     <fieldset>
 4 |                         <legend>add distributed query</legend>
 5 | 
 6 |                         {{ form.csrf_token }}
 7 | 
 8 |                         <div class="form-group">
 9 |                             {{ form.sql.label(class_="col-sm-2 control-label") }}
10 |                             <div class="col-sm-10">
11 |                                 {{ form.sql(class_="form-control") }}
12 |                             </div>
13 |                         </div>
14 | 
15 |                         <div class="form-group">
16 |                             {{ form.description.label(class_="col-sm-2 control-label") }}
17 |                             <div class="col-sm-10">
18 |                                 {{ form.description(class_="form-control") }}
19 |                             </div>
20 |                         </div>
21 | 
22 |                         <div class="form-group">
23 |                             {{ form.not_before.label(class_="col-sm-2 control-label") }}
24 |                             <div class="col-sm-10">
25 |                                 {{ form.not_before(class_="datepicker form-control", placeholder=placeholder) }}
26 |                             </div>
27 | 
28 |                         </div>
29 | 
30 |                         <div class="form-group">
31 |                             {{ form.nodes.label(class_="col-sm-2 control-label") }}
32 |                             <div class="col-sm-10">
33 |                                 {{ form.nodes(class_="form-control") }}
34 |                             </div>
35 |                         </div>
36 | 
37 |                         <div class="form-group">
38 |                             {{ form.tags.label(class_="col-sm-2 control-label") }}
39 |                             <div class="col-sm-10">
40 |                                 {{ form.tags(class_="form-control") }}
41 |                             </div>
42 |                         </div>
43 | 
44 |                         <div class="form-group">
45 |                             <div class="col-sm-10 col-sm-offset-2">
46 |                                 <p><input class="btn-small btn-default btn-submit" type="submit" value="add distributed query"></p>
47 |                             </div>
48 |                         </div>
49 | 
50 |                     </fieldset>
51 | 
52 |                 </form>
53 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/forms/file.html:
--------------------------------------------------------------------------------
 1 |                 <form class="form-horizontal" method="POST">
 2 |                     <fieldset>
 3 |                         {% if file_path is defined %}
 4 |                         <legend>update file path</legend>
 5 |                         {% else %}
 6 |                         <legend>add file path</legend>
 7 |                         {% endif %}
 8 |                         {{ form.csrf_token }}
 9 | 
10 |                         <div class="form-group">
11 |                             {{ form.category.label(class_="col-sm-2 control-label") }}
12 |                             <div class="col-sm-10">
13 |                                 {{ form.category(class_="form-control") }}
14 |                             </div>
15 |                         </div>
16 | 
17 |                         <div class="form-group">
18 |                             {{ form.target_paths.label(class_="col-sm-2 control-label") }}
19 |                             <div class="col-sm-10">
20 |                                 {{ form.target_paths(placeholder="One file/directory glob pattern per line", class_="form-control") }}
21 |                             </div>
22 |                         </div>
23 | 
24 |                         <div class="form-group">
25 |                             {{ form.tags.label(class_="col-sm-2 control-label") }}
26 |                             <div class="col-sm-10">
27 |                                 {{ form.tags(placeholder="One tag per line", class_="form-control") }}
28 |                             </div>
29 |                         </div>
30 | 
31 |                         <div class="form-group"> 
32 |                             <div class="col-sm-10 col-sm-offset-2">
33 |                                 <p><input class="btn-small btn-default btn-submit" type="submit" value="{% if file_path is defined %}update{% else %}add{% endif %} file path"></p>
34 |                             </div>
35 |                         </div>
36 | 
37 |                     </fieldset>
38 | 
39 |                 </form>
40 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/forms/pack.html:
--------------------------------------------------------------------------------
 1 |                 <form class="form form-horizontal" method="POST" role="form" enctype="multipart/form-data">
 2 |                     <fieldset>
 3 |                         <legend>upload a query pack</legend>
 4 |                         {{ form.csrf_token }}
 5 | 
 6 |                         <p>Learn how to format your query packs <a href="https://osquery.readthedocs.org/en/stable/deployment/configuration/#query-packs">here</a>.</p>
 7 | 
 8 |                         <div class="form-group">
 9 |                             <!-- {{ form.pack.label(class_="col-md-2 control-label") }} -->
10 |                             <div class="col-md-10">
11 |                                 {{ form.pack(placeholder="Path to osquery pack", class_="form-control") }}
12 |                             </div>
13 |                         </div>
14 | 
15 |                         <div class="form-group">
16 |                             <div class="col-md-8">
17 |                                 <p><input class="btn-small btn-default btn-submit" type="submit" value="Upload Query Pack"></p>
18 |                             </div>
19 |                         </div>
20 | 
21 |                     </fieldset>
22 |                 </form>
23 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/forms/query.html:
--------------------------------------------------------------------------------
 1 |                 <form class="form-horizontal" method="POST">
 2 |                     <fieldset>
 3 |                         {% if query is defined %}
 4 |                         <legend>update query</legend>
 5 |                         {% else %}
 6 |                         <legend>add query</legend>
 7 |                         {% endif %}
 8 |                         {{ form.csrf_token }}
 9 | 
10 |                         <div class="form-group">
11 |                             {{ form.name.label(class_="col-sm-2 control-label") }}
12 |                             <div class="col-sm-10">
13 |                                 {{ form.name(class_="form-control") }}
14 |                             </div>
15 |                         </div>
16 | 
17 |                         <div class="form-group">
18 |                             {{ form.sql.label(class_="col-sm-2 control-label") }}
19 |                             <div class="col-sm-10">
20 |                                 {{ form.sql(class_="form-control") }}
21 |                             </div>
22 |                         </div>
23 | 
24 |                         <div class="form-group">
25 |                             {{ form.interval.label(class_="col-sm-2 control-label") }}
26 |                             <div class="col-sm-10">
27 |                                 {{ form.interval(class_="form-control", type="number") }}
28 |                             </div>
29 |                         </div>
30 | 
31 |                         <div class="form-group">
32 |                             {{ form.platform.label(class_="col-sm-2 control-label") }}
33 |                             <div class="col-sm-10">
34 |                                 {{ form.platform(class_="form-control") }}
35 |                             </div>
36 |                         </div>
37 | 
38 |                         <div class="form-group">
39 |                             {{ form.version.label(class_="col-sm-2 control-label") }}
40 |                             <div class="col-sm-10">
41 |                                 {{ form.version(class_="form-control") }}
42 |                             </div>
43 |                         </div>
44 | 
45 |                         <div class="form-group">
46 |                             {{ form.description.label(class_="col-sm-2 control-label") }}
47 |                             <div class="col-sm-10">
48 |                                 {{ form.description(class_="form-control") }}
49 |                             </div>
50 |                         </div>
51 | 
52 |                         <div class="form-group">
53 |                             {{ form.value.label(class_="col-sm-2 control-label") }}
54 |                             <div class="col-sm-10">
55 |                                 {{ form.value(class_="form-control") }}
56 |                             </div>
57 |                         </div>
58 | 
59 |                         <div class="form-group">
60 |                             {{ form.shard.label(class_="col-sm-2 control-label") }}
61 |                             <div class="col-sm-10">
62 |                                 {{ form.shard(class_="form-control", type="number") }}
63 |                             </div>
64 |                         </div>
65 | 
66 |                         <div class="form-group">
67 |                             <label class="col-sm-2 control-label">Query Options</label>
68 | 
69 |                             <div class="checkbox col-sm-5">
70 |                                 <label>
71 |                                     {{ form.removed() }} {{ form.removed.label.text }}
72 |                                 </label>
73 |                             </div>
74 |                         </div>
75 | 
76 |                         <div class="form-group">
77 |                             {{ form.packs.label(class_="col-sm-2 control-label") }}
78 |                             <div class="col-sm-10">
79 |                                 {{ form.packs(class_="form-control") }}
80 |                             </div>
81 |                         </div>
82 | 
83 |                         <div class="form-group">
84 |                             {{ form.tags.label(class_="col-sm-2 control-label") }}
85 |                             <div class="col-sm-10">
86 |                                 {{ form.tags(placeholder="One tag per line", class_="form-control") }}
87 |                             </div>
88 |                         </div>
89 | 
90 |                         <div class="form-group"> 
91 |                             <div class="col-sm-10 col-sm-offset-2">
92 |                                 <p><input class="btn-small btn-default btn-submit" type="submit" value="{% if query is defined %}update{% else %}add{% endif %} query"></p>
93 |                             </div>
94 |                         </div>
95 | 
96 |                     </fieldset>
97 | 
98 |                 </form>
99 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/forms/rule.html:
--------------------------------------------------------------------------------
 1 |                 <form class="form-horizontal" method="POST">
 2 |                     <fieldset>
 3 |                         {% if rule is defined %}
 4 |                         <legend>update rule</legend>
 5 |                         {% else %}
 6 |                         <legend>add rule</legend>
 7 |                         {% endif %}
 8 |                         {{ form.csrf_token }}
 9 | 
10 |                         <div class="form-group">
11 |                             {{ form.name.label(class_="col-sm-2 control-label") }}
12 |                             <div class="col-sm-10">
13 |                                 {{ form.name(class_="form-control") }}
14 |                             </div>
15 |                         </div>
16 | 
17 |                         <div class="form-group">
18 |                             {{ form.description.label(class_="col-sm-2 control-label") }}
19 |                             <div class="col-sm-10">
20 |                                 {{ form.description(class_="form-control") }}
21 |                                 <small>
22 |                                     Note: Rule names and descriptions may be treated as <a href="https://docs.python.org/dev/library/string.html#template-strings">Template strings</a> for <em>some</em> alerters.
23 |                                     Valid placeholders may include column keys returned in query results and/or node attributes (i.e., <tt>host_identifier</tt>, <tt>enrolled_on</tt>).
24 |                                     A missing placeholder will result in the original placeholder to appear in the resulting string intact.
25 |                                 </small>
26 |                             </div>
27 |                         </div>
28 | 
29 |                         <div class="form-group">
30 |                             {{ form.alerters.label(class_="col-sm-2 control-label") }}
31 |                             <div class="col-sm-10">
32 |                                 {{ form.alerters(class_="form-control") }}
33 |                             </div>
34 |                         </div>
35 | 
36 |                         <div class="form-group">
37 |                             {{ form.conditions.label(class_="col-sm-2 control-label") }}
38 |                             <div class="col-sm-10">
39 |                                 <div id='query-builder'></div>
40 |                                 {{ form.conditions(id='rules-hidden') }}
41 |                             </div>
42 |                         </div>
43 | 
44 |                         <div class="form-group"> 
45 |                             <div class="col-sm-10 col-sm-offset-2">
46 |                                 <p><input id='submit-button' class="btn-small btn-default btn-submit" type="submit" value="{% if rule is defined %}update{% else %}add{% endif %} rule"></p>
47 |                             </div>
48 |                         </div>
49 | 
50 |                     </fieldset>
51 | 
52 |                 </form>
53 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/forms/tag.html:
--------------------------------------------------------------------------------
 1 |                     <form class="form-horizontal" method="POST">
 2 |                         <fieldset>
 3 |                             <legend>add tags</legend>
 4 |                             {{ form.csrf_token }}
 5 | 
 6 |                             <div class="form-group">
 7 |                                 {{ form.value.label(class_="col-md-2 control-label") }}
 8 |                                 <div class="col-md-10">
 9 |                                     {{ form.value(placeholder="Enter tags here, one tag per line", class_="form-control") }}
10 |                                 </div>
11 |                             </div>
12 | 
13 |                             <div class="form-group"> 
14 |                                 <div class="col-md-10 col-md-offset-2">
15 |                                     <p><input class="btn-small btn-default btn-submit" type="submit" value="Add Tag"></p>
16 |                                 </div>
17 |                             </div>
18 | 
19 |                         </fieldset>
20 |                     </form>
21 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/index.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | <!-- Main jumbotron for a primary marketing message or call to action -->
 4 | <div class="jumbotron">
 5 | 
 6 |   <h1>welcome to doorman</h1>
 7 | 
 8 |   <p>an osquery fleet manager</p>
 9 | 
10 | </div><!-- /.jumbotron -->
11 | 
12 | <div class="body-content">
13 |   <div class="row">
14 |     <div class="col-md-4">
15 |     </div>
16 |     <div class="col-md-4">
17 |    </div>
18 |     <div class="col-md-4">
19 |     </div>
20 |   </div><!-- /.row -->
21 | </div>
22 | {% endblock %}
23 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/logs.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-12">
 7 |                 <h1>
 8 |                     <h1><a href="{{ url_for('manage.get_node', node_id=node.id) }}">{{ node.display_name }}</a> / <a href="{{ url_for('manage.node_activity', node_id=node.id) }}">recent activity</a> / logs</h1>
 9 |                 </h1>
10 | 
11 |                 {% if status_logs %}
12 |                 {% set logs = status_logs %}
13 |                 {% include "tables/logs.html" %}
14 | 
15 |                 <div class="text-center">
16 |                     <small>{{ pagination.info }}</small>
17 |                     {{ pagination.links }}
18 |                 </div>
19 | 
20 |                 {% else %}
21 |                 <p>No status logs for this node.</p>
22 |                 {% endif %}
23 | 
24 |         </div>
25 |     </div>
26 | 
27 | {% endblock %}
28 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/node.html:
--------------------------------------------------------------------------------
  1 | {% extends "layout.html" %}
  2 | {% block content %}
  3 | 
  4 |     <div class="body-content">
  5 |         <div class="row">
  6 |             <div class="col-md-12">
  7 |                 <h1>{{ node.display_name }} / <a href="{{ url_for('manage.node_activity', node_id=node.id) }}">recent activity</a> / <a href="{{ url_for('manage.node_logs', node_id=node.id) }}">logs</a></h1>
  8 | 
  9 |                 <div class="row">
 10 |                     <div class="col-md-3">
 11 | 
 12 |                         <h2>Details</h2>
 13 | 
 14 |                         <table class="table-condensed">
 15 |                             {% if current_app.config.DOORMAN_CAPTURE_NODE_INFO %}
 16 |                             {% for column, label in current_app.config.DOORMAN_CAPTURE_NODE_INFO %}
 17 |                             {% if column in node.node_info %}
 18 |                             <tr>
 19 |                                 <th class="text-right">{{ label | lower }}</th>
 20 |                                 <td>{{ node.node_info[column] | render(column) }}</td>
 21 |                             </tr>
 22 |                             {% endif %}
 23 |                             {% endfor %}
 24 |                             {% endif %}
 25 |                             <tr>
 26 |                                 <th class="text-right">last ip address</th>
 27 |                                 <td>{{ node.last_ip | default('', true) }}</td>
 28 |                             </tr>
 29 |                             <tr>
 30 |                                 <th class="text-right">host identifier</th>
 31 |                                 <td>{{ node.host_identifier }}</td>
 32 |                             </tr>
 33 |                             <tr>
 34 |                                 <th class="text-right">enrolled</th>
 35 |                                 <td>{{ node.enrolled_on }}</td>
 36 |                             </tr>
 37 |                             <tr>
 38 |                                 <th class="text-right">last check-in</th>
 39 |                                 <td>{{ node.last_checkin }}</td>
 40 |                             </tr>
 41 |                             <tr>
 42 |                                 <th class="text-right">active</th>
 43 |                                 <td>
 44 |                                     <button class="activate-node glyphicon glyphicon-{{ 'check' if node.is_active else 'unchecked' }}" data-uri="{{ url_for('manage.get_node', node_id=node.id) }}" ></button>
 45 |                                 </td>
 46 |                             </tr>
 47 |                         </table>
 48 | 
 49 |                     </div><!--./col-md-3-->
 50 | 
 51 |                     <div class="col-md-9">
 52 | 
 53 |                         <h2>Packs</h2>
 54 | 
 55 |                         {% if packs is not defined %}
 56 |                         {% set packs = node.packs.all() %}
 57 |                         {% endif %}
 58 | 
 59 |                         {% if packs %}
 60 |                         {% include "tables/packs.html" %}
 61 |                         {% else %}
 62 | 
 63 |                         <p>No packs currently associated with this node. Use the tag functionality to associate nodes with packs.</p>
 64 | 
 65 |                         {% endif %}
 66 | 
 67 |                         <h2>Queries</h2>
 68 | 
 69 |                         {% if queries is not defined %}
 70 |                         {% set queries = node.queries.all() %}
 71 |                         {% endif %}
 72 | 
 73 |                         {% if queries %}
 74 |                         {% include "tables/queries.html" %}
 75 |                         {% else %}
 76 | 
 77 |                         <p>No queries currently associated with this node. Use the tag functionality to associate nodes with queries.</p>
 78 | 
 79 |                         {% endif %}
 80 | 
 81 |                         <h2>File Integrity Monitoring</h2>
 82 | 
 83 |                         {% if file_paths is not defined %}
 84 |                         {% set file_paths = node.file_paths.all() %}
 85 |                         {% endif %}
 86 | 
 87 |                         {% if file_paths %}
 88 |                         <ul>
 89 |                             {% for file_path in file_paths %}
 90 |                             <li>{{ file_path.category }}</li>
 91 |                             <ul>
 92 |                                 {% for path in file_path.get_paths() %}
 93 |                                 <li><code>{{ path }}</code></li>
 94 |                                 {% endfor %}
 95 |                             </ul>
 96 |                             {% endfor %}
 97 |                         </ul>
 98 |                         {% else %}
 99 | 
100 |                         <p>No files currently being monitored on this node. Use the tag functionality to associate nodes with file paths to monitor.</p>
101 | 
102 |                         {% endif %}
103 | 
104 |                         <h2>Tags</h2>
105 | 
106 |                         <input class="tagsinput" placeholder="Add tags by typing here" value="{{ node.tags | map(attribute='value') | sort | join(',') }}" data-uri="{{ url_for('manage.tag_node', node_id=node.id) }}">
107 | 
108 |                     </div><!--./col-md-9-->
109 |                 </div><!--./row-->
110 |             </div><!--./col-md-12-->
111 |         </div><!--./row-->
112 |     </div><!--./body-content-->
113 | 
114 | {% endblock %}
115 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/nodes.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-12">
 7 |                 <h1>
 8 |                     {% if status == 'active' %}
 9 |                     active nodes /
10 |                     <a href="{{ url_for('manage.nodes', status='inactive') }}">inactive nodes</a>
11 |                     {% else %}
12 |                     <a href="{{ url_for('manage.nodes') }}">active nodes</a>
13 |                     / inactive nodes
14 |                     {% endif %}
15 |                 </h1>
16 |                 
17 |                 {% if nodes %}
18 |                 {% include "tables/nodes.html" %}
19 | 
20 |                 <div class="text-center">
21 |                     <small>{{ pagination.info }}</small>
22 |                     {{ pagination.links }}
23 |                 </div>
24 | 
25 |                 {% elif request.endpoint == url_for('manage.nodes') %}
26 |                 <p>No nodes have enrolled yet!</p>
27 |                 {% endif %}
28 | 
29 |             </div><!--./col-md-12-->
30 |         </div><!--./row-->
31 |     </div><!--./body-content-->
32 | 
33 | {% endblock %}
34 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/pack.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-9">
 7 | 
 8 |                 {% if pack is defined %}
 9 |                 <h1>{{ pack.name }}</h1>
10 | 
11 |                 {% include "_pack.html" %}
12 | 
13 |                 {% else %}
14 | 
15 |                 {% include "forms/pack.html" %}
16 | 
17 |                 {% endif %}
18 | 
19 |             </div><!--./col-md-9-->
20 |         </div><!--./row-->
21 |     </div><!--./body-content-->
22 | 
23 | {% endblock %}
24 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/packs.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-9">
 7 |                 <h1>packs</h1>
 8 | 
 9 |                 {% if packs %}
10 |                 {% for pack in packs %}
11 |                 <h2 id="{{ pack.name }}">{{ pack.name }}</h2>
12 |                 <p>
13 |                     <input class="tagsinput" placeholder="Add tags by typing here" value="{{ pack.tags | map(attribute='value') | sort | join(',') }}" data-uri="{{ url_for('manage.tag_pack', pack_name=pack.name) }}" size="23">
14 |                 </p>
15 |                 {% include "_pack.html" %}
16 |                 {% endfor %}
17 |                 {% else %}
18 |                 <p>No packs uploaded. You may upload a new pack <a href="{{ url_for('manage.add_pack') }}">here</a>.<p>
19 |                 {% endif %}
20 |             </div>
21 | 
22 |             <nav class="col-md-3 bs-docs-sidebar">
23 |                 <ul class="nav nav-stacked fixed" id="sidebar">
24 |                 {% if packs %}
25 |                     {% for pack in packs %}
26 |                     <li>
27 |                         <a href="#{{ pack.name }}">{{ pack.name }}</a>
28 |                         <ul class="nav nav-stacked">
29 |                         {% for query in pack.queries | sort(attribute='name') %}
30 |                             <li><a href="#{{ pack.name }}-{{ query.name }}">{{ query.name }}</a></li>
31 |                         {% endfor %}
32 |                         </ul>
33 |                     </li>
34 |                     {% endfor %}
35 |                 {% endif %}
36 |                 </ul>
37 |             </nav>
38 | 
39 |         </div>
40 |     </div>
41 | 
42 | {% endblock %}
43 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/queries.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-9">
 7 |                 <h1>queries</h1>
 8 | 
 9 |                 {% if queries %}
10 |                 {% for query in queries | sort(attribute='name') %}
11 |                 {% include "_query.html" %}
12 |                 {% endfor %}
13 |                 {% else %}
14 |                 <p>No queries created. You may <a href="{{ url_for('manage.add_query') }}">create a new query</a> or <a href="{{ url_for('manage.add_pack') }}">upload a new pack</a>.<p>
15 |                 {% endif %}
16 | 
17 |             </div>
18 | 
19 |             <nav class="col-md-3 bs-docs-sidebar">
20 |                 <ul class="nav nav-stacked fixed" id="sidebar">
21 |                 {% if queries %}
22 |                     {% for query in queries | sort(attribute='name') %}
23 |                     <li><a href="#{{ query.name }}">{{ query.name }}</a></li>
24 |                     {% endfor %}
25 |                 {% endif %}
26 |                 </ul>
27 |             </nav>
28 | 
29 |         </div>
30 |     </div>
31 | 
32 | {% endblock %}
33 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/query.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-9">
 7 | 
 8 |                 {% if query is defined %}
 9 |                 <h1>{{ query.name }}</h1>
10 |                 {% endif %}
11 | 
12 |                 {% include "forms/query.html" %}
13 | 
14 |             </div><!--./col-md-9-->
15 |         </div><!--./row-->
16 |     </div><!--./body-content-->
17 | 
18 | {% endblock %}
19 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/reports.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-12">
 7 | 
 8 |                 <h1>osquery coverage report</h1>
 9 | 
10 | 
11 |                 <table class="table table-striped table-condensed">
12 | 
13 |                     <thead>
14 |                         <th>id</th>
15 |                         <th>node</th>
16 |                         <th>packs included (#)</th>
17 |                         <th>pack coverage (%)</th>
18 |                         <th>queries included (#)</th>
19 |                         <th>query coverage (%)</th>
20 |                     </thead>
21 | 
22 |                     <tbody>
23 | 
24 |                         {% for node in Node.query %}
25 |                         {% set report = get_coverage_report_for_node(node) %}
26 |                         <tr>
27 |                             <td>{{ node.id }}</td>
28 |                             <td>
29 |                                 <a href="{{ url_for('manage.get_node', node_id=node.id) }}">
30 |                                 {{ node.display_name }}
31 |                             </a>
32 |                             </td>
33 |                             <td>{{ report.packs }}</td>
34 |                             <td>{{ report.packs_percent | round() }}</td>
35 |                             <td>{{ report.effective_queries }}</td>
36 |                             <td>{{ report.effective_queries_percent | round() }}</td>
37 |                         </tr>
38 |                         {% endfor %}
39 | 
40 |                     </tbody>
41 | 
42 |                 </table>
43 | 
44 | 
45 |             </div>
46 |         </div>
47 |     </div>
48 | 
49 | {% endblock %}
50 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/results.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-12">
 7 |                 <h1>search results</h1>
 8 | 
 9 |                 {% if results | list %}
10 |                 {% include "tables/results.html" %}
11 |                 <div class="text-center">
12 |                     <small>{{ pagination.info }}</small>
13 |                     {{ pagination.links }}
14 |                 </div>
15 |                 {% else %}
16 |                 <p>No results for this search.<p>
17 |                 {% endif %}
18 | 
19 |             </div>
20 |         </div>
21 |     </div>
22 | 
23 | {% endblock %}


--------------------------------------------------------------------------------
/doorman/templates/manage/rule.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-9">
 7 | 
 8 |                 {% if rule is defined %}
 9 |                 <h1>{{ rule.name }}</h1>
10 |                 {% endif %}
11 | 
12 |                 {% include "forms/rule.html" %}
13 | 
14 |             </div><!--./col-md-9-->
15 |         </div><!--./row-->
16 |     </div><!--./body-content-->
17 | 
18 | {% endblock %}
19 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/rules.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-9">
 7 |                 <h1>rules</h1>
 8 | 
 9 |                 {% if rules %}
10 | 
11 |                 {% for rule in rules | sort(attribute='name') %}
12 |                 {% include "_rule.html" %}
13 |                 {% endfor %}
14 | 
15 |                 {% else %}
16 |                 <p>No rules defined. You may <a href="{{ url_for('manage.add_rule') }}">create a new rule</a>.
17 |                 {% endif %}
18 | 
19 |             </div>
20 | 
21 |             <nav class="col-md-3 bs-docs-sidebar">
22 |                 <ul class="nav nav-stacked fixed" id="sidebar">
23 |                 {% if rules %}
24 |                     {% for rule in rules | sort(attribute='name') %}
25 |                     <li><a href="#rule-{{ rule.id }}">{{ rule.name }}</a></li>
26 |                     {% endfor %}
27 |                 {% endif %}
28 |                 </ul>
29 |             </nav>
30 | 
31 |         </div>
32 |     </div>
33 | 
34 | {% endblock %}
35 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/tables/distributed.html:
--------------------------------------------------------------------------------
 1 |                 <table class="table table-striped table-condensed">
 2 |                     <thead>
 3 |                         <th>node</th>
 4 |                         <th>query</th>
 5 |                         <th>created</th>
 6 |                         <th>run after</th>
 7 |                         <th>retrieved</th>
 8 |                         {% if not status %}<th>status</th>{% endif %}
 9 |                         <th>result</th>
10 |                     </thead>
11 | 
12 |                     <tbody>
13 |                         {% for query in queries %}
14 |                         <tr>
15 |                             <td>
16 |                                 <a href="{{ url_for('manage.get_node', node_id=query.node_id) }}">{{ query.node.display_name }}</a>
17 |                             </td>
18 |                             <td>
19 |                                 <code>{{ query.distributed_query.sql }}</code>
20 |                                 <a href="{{ url_for('manage.distributed_results', distributed_id=query.distributed_query.id) }}">
21 |                                     <i class="fa fa-list-alt" title="View results for only this query"></i>
22 |                                 </a>
23 |                             </td>
24 |                             <td>{{ query.distributed_query.timestamp }}</td>
25 |                             <td>{{ query.distributed_query.not_before or 'immediately' }}</td>
26 |                             <td>{{ query.timestamp or '' }}</td>
27 |                             {% if not status %}
28 |                             <td>
29 |                                 {%- if query.status == DistributedQueryTask.NEW -%}
30 |                                 NEW
31 |                                 {%- elif query.status == DistributedQueryTask.PENDING -%}
32 |                                 PENDING
33 |                                 {%- elif query.status == DistributedQueryTask.COMPLETE -%}
34 |                                 COMPLETE
35 |                                 {%- endif -%}
36 |                             </td>
37 |                             {% endif %}
38 | 
39 |                             <td>
40 |                                 {% if query.results %}
41 |                                 <a href="{{ url_for('manage.get_distributed_result', node_id=query.node_id, guid=query.guid) }}">{{ query.results | first | attr('timestamp') }}</a>
42 |                                 {% elif query.status == DistributedQueryTask.COMPLETE %}
43 |                                 <p class="text-center">&mdash;</p>
44 |                                 {% endif %}
45 |                             </td>
46 | 
47 |                         {% endfor %}
48 |                     </tbody>
49 | 
50 |                 </table>
51 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/tables/distributed_results.html:
--------------------------------------------------------------------------------
 1 | {% macro render_task_parts(task) %}
 2 |     <td>
 3 |         <a href="{{ url_for('manage.get_node', node_id=task.node_id) }}">{{ task.node.display_name }}</a>
 4 |     </td>
 5 |     <td>{{ task.distributed_query.timestamp }}</td>
 6 |     <td>{{ task.distributed_query.not_before or 'immediately' }}</td>
 7 |     <td>{{ task.timestamp or '' }}</td>
 8 |     {% if not status %}
 9 |     <td>
10 |         {%- if task.status == DistributedQueryTask.NEW -%}
11 |         NEW
12 |         {%- elif task.status == DistributedQueryTask.PENDING -%}
13 |         PENDING
14 |         {%- elif task.status == DistributedQueryTask.COMPLETE -%}
15 |         COMPLETE
16 |         {%- endif -%}
17 |     </td>
18 |     {% endif %}
19 | {% endmacro %}
20 | 
21 | 
22 |                 <table class="table table-striped table-condensed">
23 |                     <thead>
24 |                         <th>node</th>
25 |                         <th>created</th>
26 |                         <th>run after</th>
27 |                         <th>retrieved</th>
28 |                         {% if not status %}<th>status</th>{% endif %}
29 | 
30 |                         {% if columns %}
31 |                             {% for column in columns %}
32 |                                 <th>{{ column }}</th>
33 |                             {% endfor %}
34 |                         {% else %}
35 |                             <th></th>
36 |                         {% endif %}
37 |                     </thead>
38 | 
39 |                     <tbody>
40 |                         {% for task in tasks %}
41 | 
42 |                             {# If we have any results, render a row per-result.  Otherwise, we render a single row without them #}
43 |                             {% if task.results | length %}
44 |                                 {% for result in task.results %}
45 |                                     <tr>
46 |                                         {{ render_task_parts(task) }}
47 | 
48 |                                         {% for column in columns %}
49 |                                             <td>{{ result.columns[column] | render(column) }}</td>
50 |                                         {% endfor %}
51 |                                     </tr>
52 |                                 {% endfor %}
53 |                             {% else %}
54 |                                 <tr>
55 |                                     {{ render_task_parts(task) }}
56 | 
57 |                                     <td colspan='{{ columns | length }}'>
58 |                                         <i>no results</i>
59 |                                     </td>
60 |                                 </tr>
61 |                             {% endif %}
62 |                         {% endfor %}
63 |                     </tbody>
64 | 
65 |                 </table>
66 | 
67 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/tables/logs.html:
--------------------------------------------------------------------------------
 1 |                 <table class="table table-striped table-condensed">
 2 |                     <thead>
 3 |                         <tr>
 4 |                             <th>severity</th>
 5 |                             <th>filename</th>
 6 |                             <th>line</th>
 7 |                             <th>message</th>
 8 |                             <th>timestamp</th>
 9 |                             <th>version</th>
10 |                         </tr>
11 |                     </thead>
12 | 
13 |                     <tbody>
14 |                         {% for log in logs %}
15 | 
16 |                         <tr>
17 |                             <td>{{ log.severity }}</td>
18 |                             <td>{{ log.filename }}</td>
19 |                             <td>{{ log.line }}</td>
20 |                             <td>{{ log.message }}</td>
21 |                             <td>{{ log.created }}</td>
22 |                             <td>{{ log.version }}</td>
23 |                         </tr>
24 | 
25 |                         {% endfor %}
26 |                     </tbody>
27 | 
28 |                 </table>
29 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/tables/nodes.html:
--------------------------------------------------------------------------------
 1 |                 <table class="table table-striped table-condensed">
 2 |                     <thead>
 3 |                         <tr>
 4 |                             <th>Host Identifier</th>
 5 |                             <th>Node Key</th>
 6 |                             {% if current_app.config.DOORMAN_CAPTURE_NODE_INFO %}
 7 |                             {% for column, label in current_app.config.DOORMAN_CAPTURE_NODE_INFO %}
 8 |                             <th class="text-right">{{ label | title }}</th>
 9 |                             {% endfor %}
10 |                             {% endif %}
11 |                             <th>Last IP Address</th>
12 |                             <th>Enrolled Date</th>
13 |                             <th>Last Check-in Date</th>
14 |                             <th>Tags</th>
15 |                         </tr>
16 |                     </thead>
17 | 
18 |                     <tbody>
19 |                         {% for node in nodes %}
20 | 
21 |                         <tr class="{{ node | health }}">
22 |                             <td>
23 |                                 <a href="{{ url_for('manage.get_node', node_id=node.id) }}">{{ node.display_name }}</a>
24 |                             </td>
25 |                             <td>{{ node.node_key }}</td>
26 |                             {% if current_app.config.DOORMAN_CAPTURE_NODE_INFO %}
27 |                             {% for column, label in current_app.config.DOORMAN_CAPTURE_NODE_INFO %}
28 |                             <td>{{ node.node_info[column] | render(column) }}</td>
29 |                             {% endfor %}
30 |                             {% endif %}
31 |                             <td>{{ node.last_ip | default('', true) }}</td>
32 |                             <td>{{ node.enrolled_on }}</td>
33 |                             <td>{{ node.last_checkin }}</td>
34 |                             <td>
35 |                                 <input class="tagsinput" value="{{ node.tags | map(attribute='value') | sort | join(',') }}" data-uri="{{ url_for('manage.tag_node', node_id=node.id) }}">
36 |                             </td>
37 |                         </tr>
38 | 
39 |                         {% endfor %}
40 |                     </tbody>
41 | 
42 |                 </table>
43 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/tables/packs.html:
--------------------------------------------------------------------------------
 1 |                 <table class="table table-striped table-condensed">
 2 |                     <thead>
 3 |                         <tr>
 4 |                             <th>Pack</th>
 5 |                             <th>Platform</th>
 6 |                             <th>Version</th>
 7 |                             <th>Description</th>
 8 |                             <th>Shard</th>
 9 |                             <th>Queries</th>
10 |                             <th>Tags</th>
11 |                         </tr>
12 |                     </thead>
13 | 
14 |                     <tbody>
15 |                         {% for pack in packs %}
16 | 
17 |                         <tr>
18 |                             <td>
19 |                                 <a href="{{ url_for('manage.packs', _anchor=pack.name) }}">{{ pack.name }}</a>
20 |                             </td>
21 |                             <td>{{ pack.platform or 'all' }}</td>
22 |                             <td>{{ pack.version or '' }}</td>
23 |                             <td>{{ pack.description or '' }}</td>
24 |                             <td>{{ pack.shard or '' }}</td>
25 |                             <td>{{ pack.queries | count }}</td>
26 |                             <td>
27 |                                 <select multiple class="tagsinput" data-uri="{{ url_for('manage.tag_pack', pack_name=pack.name) }}"{% if not loop.index0 %} placeholder="Add tags by typing here"{% endif %}>
28 |                                     {% for tag in pack.tags | sort(attribute='value') %}
29 |                                     <option value="{{ tag.value }}">{{ tag.value }}</option>
30 |                                     {% endfor %}
31 |                                 </select>
32 |                             </td>
33 |                         </tr>
34 | 
35 |                         {% endfor %}
36 |                     </tbody>
37 | 
38 |                 </table>
39 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/tables/queries.html:
--------------------------------------------------------------------------------
1 | {% for query in queries %}
2 |     {% include "_query.html" %}
3 | {% endfor %}
4 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/tables/results.html:
--------------------------------------------------------------------------------
 1 |                 {% set columns = results | first | attr('columns') | list | sort %}
 2 | 
 3 |                 <div class="table-responsive">
 4 |                     <table class="table table-striped table-condensed">
 5 |                         <thead>
 6 |                             <th>node</th>
 7 |                             <th>activity</th>
 8 |                             <th>timestamp</th>
 9 |                             {% for column in columns %}
10 |                             <th>{{ column }}</th>
11 |                             {% endfor %}
12 |                         </thead>
13 | 
14 |                         <tbody>
15 |                             {% for result in results %}
16 |                             <tr>
17 |                                 <td>
18 |                                     {% if result.node is defined %}
19 |                                     <a href="{{ url_for('.get_node', node_id=result.node.id) }}">{{ result.node.host_identifier }}</a>
20 |                                     {% elif result.distributed_query is defined %}
21 |                                     <a href="{{ url_for('.get_node', node_id=result.distributed_query.node.id) }}">{{ result.distributed_query.node.host_identifier }}</a>
22 |                                     {% endif %}
23 |                                 </td>
24 |                                 <td>{{ result.action }}</td>
25 |                                 <td>{{ result.timestamp }}</td>
26 |                                 {% for column in columns %}
27 |                                 <td>
28 |                                     <a href="{{ url_for('manage.search', **{'columns.' + column: result.columns[column]}) }}">
29 |                                     {{ result.columns[column] }}
30 |                                     </a>
31 |                                 </td>
32 |                                 {% endfor %}
33 |                             </tr>
34 |                             {% endfor %}
35 |                         </tbody>
36 | 
37 |                     </table>
38 |                 </div>
39 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/tag.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-12">
 7 |                 {% if tag is defined %}
 8 |                 
 9 |                 <h2>nodes tagged <strong>{{ tag.value }}</strong></h2>
10 | 
11 |                 {% set nodes = tag.nodes %}
12 |                 {% if nodes %}
13 |                 {% include "tables/nodes.html" %}
14 |                 {% else %}
15 |                 <p>No nodes.</p>
16 |                 {% endif %}
17 | 
18 |                 <h2>Packs tagged <strong>{{ tag.value }}</strong></h2>
19 | 
20 |                 {% set packs = tag.packs %}
21 |                 {% if packs %}
22 |                 {% include "tables/packs.html" %}
23 |                 {% else %}
24 |                 <p>No packs.</p>
25 |                 {% endif %}
26 | 
27 |                 <h2>Queries tagged <strong>{{ tag.value }}</strong></h2>
28 | 
29 |                 {% set queries = tag.queries %}
30 |                 {% if queries %}
31 |                 {% include "tables/queries.html" %}
32 |                 {% else %}
33 |                 <p>No queries.</p>
34 |                 {% endif %}
35 | 
36 |                 <h2>File paths tagged <strong>{{ tag.value }}</strong></h2>
37 | 
38 |                 {% set file_paths = tag.file_paths %}
39 |                 {% if file_paths %}
40 |                 {% for file_path in file_paths %}
41 |                 <h2>
42 |                     <a href="{{ url_for('manage.file_path', file_path_id=file_path.id) }}">{{ file_path.category }}</a>
43 |                 </h2>
44 | 
45 |                 <ul>
46 |                     {% for path in file_path.get_paths() %}
47 |                     <li>{{ path }}</li>
48 |                     {% endfor %}
49 |                 </ul>
50 |                 {% endfor %}
51 |                 {% else %}
52 |                 <p>No files monitored.</p>
53 |                 {% endif %}
54 | 
55 |                 {% else %}
56 | 
57 |                 <div class="col-md-8">
58 |                     {% include "forms/tag.html" %}
59 | 
60 |                 </div><!--./col-md-8-->
61 |                 {% endif %}
62 | 
63 |             </div><!--./col-md-12-->
64 |         </div><!--./row-->
65 |     </div><!--./body-content-->
66 | 
67 | {% endblock %}
68 | 


--------------------------------------------------------------------------------
/doorman/templates/manage/tags.html:
--------------------------------------------------------------------------------
 1 | {% extends "layout.html" %}
 2 | {% block content %}
 3 | 
 4 |     <div class="body-content">
 5 |         <div class="row">
 6 |             <div class="col-md-12">
 7 |                 <h1>tags</h1>
 8 | 
 9 |                 {% if tags %}
10 | 
11 |                 <table class="table table-striped table-condensed">
12 |                     <thead>
13 |                         <tr>
14 |                             <th>Tag</th>
15 |                             <th>Nodes</th>
16 |                             <th>Packs</th>
17 |                             <th>Queries</th>
18 |                             <th>Files</th>
19 |                         </tr>
20 |                     </thead>
21 | 
22 |                     <tbody>
23 | 
24 |                         {% for tag, t in tags | dictsort %}
25 |                         <tr>
26 |                             <td>
27 |                                 <button type="button" class="btn btn-link btn-xs" aria-label="Delete Tag">
28 |                                     <span class="glyphicon glyphicon-trash" aria-hidden="true" data-uri="{{ url_for('manage.delete_tag', tag_value=tag) }}"></span>
29 |                                 </button>
30 |                                 <span class="label">
31 |                                     <a href="{{ url_for('manage.get_tag', tag_value=tag) }}">{{ tag }}</a>
32 |                                 </span>
33 |                             </td>
34 |                             <td>{{ t.nodes | default(0) }}</td>
35 |                             <td>{{ t.packs | default(0) }}</td>
36 |                             <td>{{ t.queries | default(0) }}</td>
37 |                             <td>{{ t.file_paths | default(0) }}</td>
38 |                         </tr>
39 |                         {% endfor %}
40 | 
41 |                     </tbody>
42 | 
43 |                 </table>
44 | 
45 |                 {% else %}
46 | 
47 |                 <p>No tags created. You may <a href="{{ url_for('manage.add_tag') }}">create new tags</a>.</p>
48 | 
49 |                 {% endif %}
50 | 
51 |             </div><!--./col-md-12-->
52 |         </div><!--./row-->
53 |     </div><!--./body-content-->
54 | 
55 | {% endblock %}
56 | 


--------------------------------------------------------------------------------
/doorman/templates/nav.html:
--------------------------------------------------------------------------------
 1 | 
 2 | <nav class="navbar navbar-default navbar-fixed-top" role="navigation">
 3 |   <div class="container-fluid">
 4 | 
 5 |   <!-- Brand and toggle get grouped for better mobile display -->
 6 |   <div class="navbar-header">
 7 |     <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-ex1-collapse">
 8 |       <span class="sr-only">Toggle navigation</span>
 9 |       <span class="icon-bar"></span>
10 |       <span class="icon-bar"></span>
11 |       <span class="icon-bar"></span>
12 |     </button>
13 |     <a class="navbar-brand" href="{{ url_for('manage.index') }}">
14 | 
15 |       doorman
16 | 
17 |     </a>
18 |   </div><!-- /.navbar-header -->
19 | 
20 |   {% set navigation_bar = [
21 | 
22 |     (url_for('manage.nodes'), 'manage.nodes', 'nodes'),
23 |     (url_for('manage.packs'), 'manage.packs', 'packs'),
24 |     (url_for('manage.queries'), 'manage.queries', 'queries'),
25 |     (url_for('manage.distributed'), 'manage.distributed', 'distributed'),
26 |     (url_for('manage.files'), 'manage.files', 'files'),
27 |     (url_for('manage.tags'), 'manage.tags', 'tags'),
28 |     (url_for('manage.rules'), 'manage.rules', 'rules'),
29 | 
30 |   ] %}
31 | 
32 |   <!-- Collect the nav links, forms, and other content for toggling -->
33 |   <div class="collapse navbar-collapse navbar-ex1-collapse">
34 |     {% if current_user and current_user.is_authenticated %}
35 |     <ul class="nav navbar-nav">
36 |       {% for href, page_id, page_name in navigation_bar %}
37 |       <li{% if page_id == request.endpoint %} class="active"{% endif %}>
38 |         <a href="{{ href }}">{{ page_name }}</a>
39 |       </li>
40 |       {% endfor %}
41 | 
42 |       <li class="dropdown">
43 |         <a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false">add <span class="caret"></span></a>
44 |         <ul class="dropdown-menu" role="menu">
45 |           <li>
46 |             <a href="{{ url_for('manage.add_pack') }}">pack</a>
47 |           </li>
48 |           <li>
49 |             <a href="{{ url_for('manage.add_query') }}">query</a>
50 |           </li>
51 |           <li>
52 |             <a href="{{ url_for('manage.add_distributed') }}">distributed</a>
53 |           </li>
54 |           <li>
55 |             <a href="{{ url_for('manage.add_file') }}">file</a>
56 |           </li>
57 |           <li>
58 |             <a href="{{ url_for('manage.add_tag') }}">tag</a>
59 |           </li>
60 |           <li>
61 |             <a href="{{ url_for('manage.add_rule') }}">rule</a>
62 |           </li>
63 |         </ul>
64 |       </li>
65 | 
66 |     </ul>
67 | 
68 |     {% endif %}
69 | 
70 |     {% if current_user.username %}
71 | 
72 |     <ul class="nav navbar-nav navbar-right">
73 |         <li>
74 |           <p class="navbar-text">
75 |             logged in as {{ current_user.username }}
76 |           </p>
77 |         </li>
78 |         <li>
79 |           <a class="navbar-link" href="{{ url_for('users.logout') }}"><i class="fa fa-sign-out"></i></a>
80 |         </li>
81 |     </ul>
82 | 
83 |     {% endif %}
84 | 
85 |   </div><!-- /.navbar-collapse -->
86 |   </div><!-- /.container -->
87 | </nav>
88 | 
89 | 


--------------------------------------------------------------------------------
/doorman/users/__init__.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | 


--------------------------------------------------------------------------------
/doorman/users/forms.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | 
 3 | from flask import current_app
 4 | from flask_ldap3_login import AuthenticationResponseStatus
 5 | 
 6 | from flask_wtf import FlaskForm as Form
 7 | from wtforms import BooleanField, PasswordField, StringField
 8 | from wtforms.validators import DataRequired, Optional
 9 | 
10 | from doorman.extensions import bcrypt, ldap_manager
11 | from doorman.models import User
12 | 
13 | 
14 | class LoginForm(Form):
15 | 
16 |     username = StringField('Username', validators=[DataRequired()])
17 |     password = PasswordField('Password', validators=[DataRequired()])
18 |     remember = BooleanField('Remember me', validators=[Optional()])
19 | 
20 |     def __init__(self, *args, **kwargs):
21 |         """Create instance."""
22 |         super(LoginForm, self).__init__(*args, **kwargs)
23 |         self.user = None
24 | 
25 |     def validate(self):
26 |         initial_validation = super(LoginForm, self).validate()
27 |         if not initial_validation:
28 |             return False
29 | 
30 |         error_message = u'Invalid username or password.'
31 | 
32 |         if current_app.config['DOORMAN_AUTH_METHOD'] == 'doorman':
33 |             self.user = User.query.filter_by(username=self.username.data).first()
34 | 
35 |             if not self.user:
36 |                 from doorman.extensions import bcrypt
37 |                 # avoid timing leaks
38 |                 bcrypt.generate_password_hash(self.password.data)
39 |                 self.username.errors.append(error_message)
40 |                 return False
41 | 
42 |             if not self.user.check_password(self.password.data):
43 |                 self.username.errors.append(error_message)
44 |                 return False
45 | 
46 |             return True
47 | 
48 |         elif current_app.config['DOORMAN_AUTH_METHOD'] == 'ldap':
49 |             result = ldap_manager.authenticate(
50 |                 self.username.data,
51 |                 self.password.data
52 |             )
53 | 
54 |             if result.status == AuthenticationResponseStatus.fail:
55 |                 self.username.errors.append(error_message)
56 |                 return False
57 | 
58 |             self.user = ldap_manager._save_user(
59 |                 result.user_dn,
60 |                 result.user_id,
61 |                 result.user_info,
62 |                 result.user_groups
63 |             )
64 |             return True
65 | 
66 |         elif current_app.config['DOORMAN_AUTH_METHOD'] is None:
67 |             return True
68 | 
69 |         return False
70 | 
71 |     @property
72 |     def auth_method(self):
73 |         return current_app.config['DOORMAN_AUTH_METHOD']
74 | 


--------------------------------------------------------------------------------
/doorman/users/mixins.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | 
 3 | from flask_login import UserMixin
 4 | 
 5 | 
 6 | class NoAuthUserMixin(UserMixin):
 7 | 
 8 |     def get_id(self):
 9 |         return u''
10 | 
11 |     @property
12 |     def username(self):
13 |         return u''
14 | 


--------------------------------------------------------------------------------
/doorman/users/oauth.py:
--------------------------------------------------------------------------------
  1 | # -*- coding: utf-8 -*-
  2 | from flask import abort, current_app, flash, request, session, url_for
  3 | from requests_oauthlib import OAuth2Session
  4 | 
  5 | from doorman.models import User
  6 | 
  7 | 
  8 | class OAuthLogin(object):
  9 |     providers = None
 10 | 
 11 |     @classmethod
 12 |     def get_provider(self, provider_name):
 13 |         if self.providers is None:
 14 |             self.providers = {}
 15 |             for provider_class in self.__subclasses__():
 16 |                 provider = provider_class()
 17 |                 self.providers[provider.provider_name] = provider
 18 |         return self.providers[provider_name]
 19 | 
 20 |     @property
 21 |     def client_id(self):
 22 |         return self.config.get('DOORMAN_OAUTH_CLIENT_ID')
 23 | 
 24 |     @property
 25 |     def client_secret(self):
 26 |         return self.config.get('DOORMAN_OAUTH_CLIENT_SECRET')
 27 | 
 28 |     @property
 29 |     def base_url(self):
 30 |         return self.config.get('DOORMAN_OAUTH_GOOGLE_BASE_URL')
 31 | 
 32 |     @property
 33 |     def redirect_uri(self):
 34 |         return url_for(self.config.get('DOORMAN_AUTH_REDIRECT_VIEW'),
 35 |                        _scheme=self.config.get('PREFERRED_URL_SCHEME'),
 36 |                        _external=True)
 37 | 
 38 |     @property
 39 |     def token_url(self):
 40 |         return self.config.get('DOORMAN_OAUTH_GOOGLE_TOKEN_URL')
 41 | 
 42 |     @property
 43 |     def scope(self):
 44 |         return self.config.get('DOORMAN_OAUTH_GOOGLE_SCOPE')
 45 | 
 46 |     def fetch_user(self):
 47 |         pass
 48 | 
 49 |     def get_authorize_url(self):
 50 |         pass
 51 | 
 52 | 
 53 | class GoogleOAuthV2Login(OAuthLogin):
 54 | 
 55 |     def __init__(self, app=None):
 56 |         self.provider_name = 'google'
 57 |         self.app = app
 58 |         self.config = {}
 59 |         if app:
 60 |             self.init_app(app)
 61 | 
 62 |     def init_app(self, app):
 63 |         self.config = app.config
 64 | 
 65 |         if not self.config['DOORMAN_OAUTH_CLIENT_ID']:
 66 |             raise ValueError("DOORMAN_OAUTH_CLIENT_ID must be configured")
 67 | 
 68 |         if not self.config['DOORMAN_OAUTH_CLIENT_SECRET']:
 69 |             raise ValueError("DOORMAN_OAUTH_CLIENT_SECRET must be configured")
 70 | 
 71 |         self.config.setdefault('DOORMAN_OAUTH_GOOGLE_BASE_URL',
 72 |                                'https://accounts.google.com/o/oauth2/auth')
 73 |         self.config.setdefault('DOORMAN_OAUTH_GOOGLE_TOKEN_URL',
 74 |                                'https://www.googleapis.com/oauth2/v3/token')
 75 |         self.config.setdefault('DOORMAN_AUTH_REDIRECT_VIEW',
 76 |                                'users.oauth2callback')
 77 | 
 78 |         self.config.setdefault('DOORMAN_OAUTH_GOOGLE_SCOPE', ['email', 'profile'])
 79 | 
 80 |         self.config.setdefault('DOORMAN_OAUTH_GOOGLE_ALLOWED_DOMAINS', [])
 81 |         self.config.setdefault('DOORMAN_OAUTH_GOOGLE_ALLOWED_USERS', [])
 82 | 
 83 |         app.oauth_provider = self
 84 | 
 85 |     @property
 86 |     def allowed_users(self):
 87 |         return self.config.get('DOORMAN_OAUTH_GOOGLE_ALLOWED_USERS', [])
 88 | 
 89 |     @property
 90 |     def allowed_domains(self):
 91 |         return self.config.get('DOORMAN_OAUTH_GOOGLE_ALLOWED_DOMAINS', [])
 92 | 
 93 |     def get_authorize_url(self):
 94 |         provider = OAuth2Session(self.client_id,
 95 |                                  scope=self.scope,
 96 |                                  redirect_uri=self.redirect_uri)
 97 | 
 98 |         authorization_url, state = provider.authorization_url(
 99 |             self.base_url,
100 |             access_type='online',
101 |             approval_prompt='force',
102 |         )
103 | 
104 |         session['_oauth_state'] = state
105 | 
106 |         return authorization_url
107 | 
108 |     def fetch_user(self):
109 |         code = request.args.get('code')
110 |         state = session.pop('_oauth_state')
111 | 
112 |         provider = OAuth2Session(
113 |             self.client_id,
114 |             redirect_uri=self.redirect_uri,
115 |             state=state
116 |         )
117 | 
118 |         token = provider.fetch_token(
119 |             self.token_url,
120 |             client_secret=self.client_secret,
121 |             code=code,
122 |             authorization_response=request.url,
123 |         )
124 | 
125 |         response = provider.get('https://www.googleapis.com/oauth2/v1/userinfo')
126 |         userinfo = response.json()
127 | 
128 |         if not userinfo:
129 |             current_app.logger.error("No userinfo object returned!")
130 |             abort(500)
131 | 
132 |         current_app.logger.debug("Got userinfo: %s", userinfo)
133 | 
134 |         if self.allowed_users and userinfo['email'] not in self.allowed_users:
135 |             current_app.logger.error("%s is not authorized for this application",
136 |                                      userinfo['email'])
137 |             flash(u"{0} is not authorized for this application.".format(
138 |                   userinfo['email']), 'danger')
139 |             abort(401)
140 | 
141 |         if self.allowed_domains and userinfo['hd'] not in self.allowed_domains:
142 |             current_app.logger.error("%s domain and %s not authorized",
143 |                                      userinfo['hd'], userinfo['email'])
144 |             flash(u"{0} is not authorized for this application.".format(
145 |                   userinfo['email']), 'danger')
146 |             abort(401)
147 | 
148 |         if not userinfo['verified_email']:
149 |             flash(u"You must verify your email before using this application.",
150 |                   'danger')
151 |             abort(401)
152 | 
153 |         user = User.query.filter_by(
154 |             email=userinfo['email'],
155 |             social_id=userinfo['id'],
156 |         ).first()
157 | 
158 |         if not user:
159 |             user = User.create(
160 |                 username=userinfo['email'],
161 |                 email=userinfo['email'],
162 |                 social_id=userinfo['id'],
163 |                 first_name=userinfo['given_name'],
164 |                 last_name=userinfo['family_name'],
165 |             )
166 |         else:
167 |             user.update(
168 |                 username=userinfo['email'],
169 |                 email=userinfo['email'],
170 |                 social_id=userinfo['id'],
171 |                 first_name=userinfo['given_name'],
172 |                 last_name=userinfo['family_name'],
173 |             )
174 | 
175 |         session['_oauth_token'] = token
176 | 
177 |         return user
178 | 


--------------------------------------------------------------------------------
/doorman/users/views.py:
--------------------------------------------------------------------------------
  1 | # -*- coding: utf-8 -*-
  2 | try:
  3 |     from urlparse import urlparse, urljoin
  4 | except ImportError:
  5 |     from urllib.parse import urlparse, urljoin
  6 | 
  7 | from flask import (
  8 |     Blueprint, abort, current_app, flash, redirect, render_template,
  9 |     request, session, url_for
 10 | )
 11 | from flask_login import current_user, login_user, logout_user, COOKIE_NAME
 12 | 
 13 | from oauthlib.oauth2 import OAuth2Error
 14 | 
 15 | from .forms import LoginForm
 16 | from doorman.extensions import csrf, ldap_manager, login_manager
 17 | from doorman.models import User
 18 | from doorman.utils import flash_errors
 19 | 
 20 | 
 21 | blueprint = Blueprint('users', __name__)
 22 | 
 23 | 
 24 | @login_manager.user_loader
 25 | def load_user(user_id):
 26 |     if current_app.config['DOORMAN_AUTH_METHOD'] is None:
 27 |         from doorman.users.mixins import NoAuthUserMixin
 28 |         return NoAuthUserMixin()
 29 |     return User.get_by_id(int(user_id))
 30 | 
 31 | 
 32 | @ldap_manager.save_user
 33 | def save_user(dn, username, userdata, memberships):
 34 |     user = User.query.filter_by(username=username).first()
 35 |     kwargs = {}
 36 |     kwargs['username'] = username
 37 | 
 38 |     if 'givenName' in userdata:
 39 |         kwargs['first_name'] = userdata['givenName'][0]
 40 | 
 41 |     if 'sn' in userdata:
 42 |         kwargs['last_name'] = userdata['sn'][0]
 43 | 
 44 |     return user.update(**kwargs) if user else User.create(**kwargs)
 45 | 
 46 | 
 47 | @blueprint.route('/login', methods=['GET', 'POST'])
 48 | def login():
 49 |     next = request.args.get('next', url_for('manage.index'))
 50 | 
 51 |     if current_user and current_user.is_authenticated:
 52 |         return safe_redirect(next, url_for('manage.index'))
 53 | 
 54 |     if current_app.config['DOORMAN_AUTH_METHOD'] not in (None, 'doorman', 'ldap'):
 55 |         authorization_url = current_app.oauth_provider.get_authorize_url()
 56 |         current_app.logger.debug("Redirecting user to %s", authorization_url)
 57 |         return redirect(authorization_url)
 58 | 
 59 |     form = LoginForm()
 60 |     if form.validate_on_submit():
 61 |         login_user(form.user, remember=form.remember.data)
 62 |         flash(u'Welcome {0}.'.format(form.user.username), 'info')
 63 |         current_app.logger.info("%s logged in", form.user.username)
 64 |         return safe_redirect(next, url_for('manage.index'))
 65 | 
 66 |     if form.errors:
 67 |         flash(u'Invalid username or password.', 'danger')
 68 | 
 69 |     return render_template('login.html', form=form)
 70 | 
 71 | 
 72 | @blueprint.route('/logout')
 73 | def logout():
 74 |     username = getattr(current_user, 'username', None)
 75 |     oauth = False
 76 | 
 77 |     logout_user()
 78 | 
 79 |     # clear any oauth state
 80 |     for key in ('_oauth_state', '_oauth_token'):
 81 |         oauth |= not not session.pop(key, None)
 82 | 
 83 |     response = redirect(url_for('users.login'))
 84 | 
 85 |     if username and not oauth:
 86 |         flash(u"You have successfully logged out.", "info")
 87 |         current_app.logger.info("%s logged out", username)
 88 | 
 89 |     # explicitly log the user out, and clear their remember me cookie
 90 | 
 91 |     cookie_name = current_app.config.get('REMEMBER_COOKIE_NAME', COOKIE_NAME)
 92 |     cookie_path = current_app.config.get('REMEMBER_COOKIE_PATH', '/')
 93 |     response.set_cookie(cookie_name, path=cookie_path, expires=0)
 94 |     return response, 302
 95 | 
 96 | 
 97 | @csrf.exempt
 98 | @blueprint.route('/oauth2callback')
 99 | def oauth2callback():
100 |     if '_oauth_state' not in session:
101 |         return redirect(url_for('users.login'))
102 | 
103 |     try:
104 |         user = current_app.oauth_provider.fetch_user()
105 |     except OAuth2Error:
106 |         current_app.logger.exception("Failed to authenticate with oauth")
107 |         return redirect(url_for('users.logout'))
108 | 
109 |     login_user(user)
110 |     flash(u'Welcome {0}.'.format(user.first_name or user.username), 'info')
111 |     current_app.logger.info("%s logged in", user.username)
112 | 
113 |     return redirect(url_for('users.login'))
114 | 
115 | 
116 | def is_safe_url(target):
117 |     ref_url = urlparse(request.host_url)
118 |     test_url = urlparse(urljoin(request.host_url, target))
119 |     return test_url.scheme in ('http', 'https') and \
120 |         ref_url.netloc == test_url.netloc
121 | 
122 | 
123 | def safe_redirect(target, default):
124 |     if is_safe_url(target):
125 |         return redirect(target)
126 |     else:
127 |         return redirect(default)
128 | 


--------------------------------------------------------------------------------
/doorman/worker.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | from doorman.application import create_app
3 | from doorman.settings import CurrentConfig
4 | from doorman.tasks import celery  # noqa
5 | 
6 | 
7 | app = create_app(config=CurrentConfig)
8 | 


--------------------------------------------------------------------------------
/manage.py:
--------------------------------------------------------------------------------
  1 | # -*- coding: utf-8 -*-
  2 | from os.path import abspath, dirname, join
  3 | import glob
  4 | 
  5 | from flask_assets import ManageAssets
  6 | from flask_migrate import MigrateCommand
  7 | from flask_script import Command, Manager, Server, Shell
  8 | from flask_script.commands import Clean, ShowUrls
  9 | 
 10 | from doorman import create_app, db
 11 | from doorman.settings import CurrentConfig
 12 | from doorman.assets import assets
 13 | 
 14 | 
 15 | app = create_app(config=CurrentConfig)
 16 | 
 17 | 
 18 | def _make_context():
 19 |     return {'app': app, 'db': db}
 20 | 
 21 | 
 22 | class SSLServer(Command):
 23 |     def run(self, *args, **kwargs):
 24 |         ssl_context = ('./certificate.crt', './private.key')
 25 |         app.run(ssl_context=ssl_context, *args, **kwargs)
 26 | 
 27 | 
 28 | manager = Manager(app)
 29 | manager.add_command('server', Server())
 30 | manager.add_command('ssl', SSLServer())
 31 | manager.add_command('shell', Shell(make_context=_make_context))
 32 | manager.add_command('db', MigrateCommand)
 33 | manager.add_command('clean', Clean())
 34 | manager.add_command('urls', ShowUrls())
 35 | manager.add_command("assets", ManageAssets(assets))
 36 | 
 37 | 
 38 | @manager.add_command
 39 | class test(Command):
 40 |     name = 'test'
 41 |     capture_all_args = True
 42 | 
 43 |     def run(self, remaining):
 44 |         import pytest
 45 |         test_path = join(abspath(dirname(__file__)), 'tests')
 46 | 
 47 |         if remaining:
 48 |             test_args = remaining + ['--verbose']
 49 |         else:
 50 |             test_args = [test_path, '--verbose']
 51 | 
 52 |         exit_code = pytest.main(test_args)
 53 |         return exit_code
 54 | 
 55 | 
 56 | @manager.command
 57 | def extract_ddl(specs_dir):
 58 |     """Extracts CREATE TABLE statements from osquery's table specifications"""
 59 |     from doorman.extract_ddl import extract_schema
 60 | 
 61 |     spec_files = []
 62 |     spec_files.extend(glob.glob(join(specs_dir, '*.table')))
 63 |     spec_files.extend(glob.glob(join(specs_dir, '**', '*.table')))
 64 | 
 65 |     ddl = sorted([extract_schema(f) for f in spec_files], key=lambda x:x.split()[2])
 66 | 
 67 |     opath = join(dirname(__file__), 'doorman', 'resources', 'osquery_schema.sql')
 68 |     with open(opath, 'w') as f:
 69 |         f.write('-- This file is generated using "python manage.py extract_ddl"'
 70 |                 '- do not edit manually\n')
 71 |         f.write('\n'.join(ddl))
 72 | 
 73 | 
 74 | @manager.option('username')
 75 | @manager.option('--email', default=None)
 76 | def adduser(username, email):
 77 |     from doorman.models import User
 78 |     import getpass
 79 |     import sys
 80 | 
 81 |     if User.query.filter_by(username=username).first():
 82 |         raise ValueError("Username already exists!")
 83 | 
 84 |     password = getpass.getpass(stream=sys.stderr)
 85 | 
 86 |     try:
 87 |         user = User.create(
 88 |             username=username,
 89 |             email=email or username,
 90 |             password=password,
 91 |         )
 92 |     except Exception as error:
 93 |         print("Failed to create user {0} - {1}".format(username, error))
 94 |         exit(1)
 95 |     else:
 96 |         print("Created user {0}".format(user.username))
 97 |         exit(0)
 98 | 
 99 | 
100 | if __name__ == '__main__':
101 |     manager.run()
102 | 


--------------------------------------------------------------------------------
/migrations/README:
--------------------------------------------------------------------------------
1 | Generic single-database configuration.


--------------------------------------------------------------------------------
/migrations/alembic.ini:
--------------------------------------------------------------------------------
 1 | # A generic, single database configuration.
 2 | 
 3 | [alembic]
 4 | # template used to generate migration files
 5 | # file_template = %%(rev)s_%%(slug)s
 6 | 
 7 | # set to 'true' to run the environment during
 8 | # the 'revision' command, regardless of autogenerate
 9 | # revision_environment = false
10 | 
11 | 
12 | # Logging configuration
13 | [loggers]
14 | keys = root,sqlalchemy,alembic
15 | 
16 | [handlers]
17 | keys = console
18 | 
19 | [formatters]
20 | keys = generic
21 | 
22 | [logger_root]
23 | level = WARN
24 | handlers = console
25 | qualname =
26 | 
27 | [logger_sqlalchemy]
28 | level = WARN
29 | handlers =
30 | qualname = sqlalchemy.engine
31 | 
32 | [logger_alembic]
33 | level = INFO
34 | handlers =
35 | qualname = alembic
36 | 
37 | [handler_console]
38 | class = StreamHandler
39 | args = (sys.stderr,)
40 | level = NOTSET
41 | formatter = generic
42 | 
43 | [formatter_generic]
44 | format = %(levelname)-5.5s [%(name)s] %(message)s
45 | datefmt = %H:%M:%S
46 | 


--------------------------------------------------------------------------------
/migrations/env.py:
--------------------------------------------------------------------------------
 1 | from __future__ import with_statement
 2 | from alembic import context
 3 | from sqlalchemy import engine_from_config, pool
 4 | from logging.config import fileConfig
 5 | import logging
 6 | from flask import current_app
 7 | 
 8 | # this is the Alembic Config object, which provides
 9 | # access to the values within the .ini file in use.
10 | config = context.config
11 | 
12 | # Interpret the config file for Python logging.
13 | # This line sets up loggers basically.
14 | fileConfig(config.config_file_name)
15 | logger = logging.getLogger('alembic.env')
16 | 
17 | # add your model's MetaData object here
18 | # for 'autogenerate' support
19 | # from myapp import mymodel
20 | # target_metadata = mymodel.Base.metadata
21 | config.set_main_option('sqlalchemy.url',
22 |                        current_app.config.get('SQLALCHEMY_DATABASE_URI'))
23 | target_metadata = current_app.extensions['migrate'].db.metadata
24 | 
25 | # other values from the config, defined by the needs of env.py,
26 | # can be acquired:
27 | # my_important_option = config.get_main_option("my_important_option")
28 | # ... etc.
29 | 
30 | 
31 | def run_migrations_offline():
32 |     """Run migrations in 'offline' mode.
33 | 
34 |     This configures the context with just a URL
35 |     and not an Engine, though an Engine is acceptable
36 |     here as well.  By skipping the Engine creation
37 |     we don't even need a DBAPI to be available.
38 | 
39 |     Calls to context.execute() here emit the given string to the
40 |     script output.
41 | 
42 |     """
43 |     url = config.get_main_option("sqlalchemy.url")
44 |     context.configure(url=url)
45 | 
46 |     with context.begin_transaction():
47 |         context.run_migrations()
48 | 
49 | 
50 | def run_migrations_online():
51 |     """Run migrations in 'online' mode.
52 | 
53 |     In this scenario we need to create an Engine
54 |     and associate a connection with the context.
55 | 
56 |     """
57 | 
58 |     # this callback is used to prevent an auto-migration from being generated
59 |     # when there are no changes to the schema
60 |     # reference: http://alembic.readthedocs.org/en/latest/cookbook.html
61 |     def process_revision_directives(context, revision, directives):
62 |         if getattr(config.cmd_opts, 'autogenerate', False):
63 |             script = directives[0]
64 |             if script.upgrade_ops.is_empty():
65 |                 directives[:] = []
66 |                 logger.info('No changes in schema detected.')
67 | 
68 |     engine = engine_from_config(config.get_section(config.config_ini_section),
69 |                                 prefix='sqlalchemy.',
70 |                                 poolclass=pool.NullPool)
71 | 
72 |     connection = engine.connect()
73 |     context.configure(connection=connection,
74 |                       target_metadata=target_metadata,
75 |                       process_revision_directives=process_revision_directives,
76 |                       **current_app.extensions['migrate'].configure_args)
77 | 
78 |     try:
79 |         with context.begin_transaction():
80 |             context.run_migrations()
81 |     finally:
82 |         connection.close()
83 | 
84 | if context.is_offline_mode():
85 |     run_migrations_offline()
86 | else:
87 |     run_migrations_online()
88 | 


--------------------------------------------------------------------------------
/migrations/script.py.mako:
--------------------------------------------------------------------------------
 1 | """${message}
 2 | 
 3 | Revision ID: ${up_revision}
 4 | Revises: ${down_revision}
 5 | Create Date: ${create_date}
 6 | 
 7 | """
 8 | 
 9 | # revision identifiers, used by Alembic.
10 | revision = ${repr(up_revision)}
11 | down_revision = ${repr(down_revision)}
12 | 
13 | from alembic import op
14 | import sqlalchemy as sa
15 | import doorman.database
16 | ${imports if imports else ""}
17 | 
18 | def upgrade():
19 |     ${upgrades if upgrades else "pass"}
20 | 
21 | 
22 | def downgrade():
23 |     ${downgrades if downgrades else "pass"}
24 | 


--------------------------------------------------------------------------------
/migrations/versions/0bc0a93ac867_.py:
--------------------------------------------------------------------------------
 1 | """Add user table to support doorman and oauth authentication.
 2 | 
 3 | Revision ID: 0bc0a93ac867
 4 | Revises: fd28e46e46a6
 5 | Create Date: 2016-05-11 11:01:40.472139
 6 | 
 7 | """
 8 | 
 9 | # revision identifiers, used by Alembic.
10 | revision = '0bc0a93ac867'
11 | down_revision = 'fd28e46e46a6'
12 | 
13 | from alembic import op
14 | import sqlalchemy as sa
15 | import doorman.database
16 | 
17 | 
18 | def upgrade():
19 |     ### commands auto generated by Alembic - please adjust! ###
20 |     op.create_table('user',
21 |     sa.Column('id', sa.Integer(), nullable=False),
22 |     sa.Column('username', sa.String(length=80), nullable=False),
23 |     sa.Column('email', sa.String(), nullable=True),
24 |     sa.Column('password', sa.String(), nullable=True),
25 |     sa.Column('created_at', sa.DateTime(), nullable=False),
26 |     sa.Column('social_id', sa.String(), nullable=True),
27 |     sa.Column('first_name', sa.String(), nullable=True),
28 |     sa.Column('last_name', sa.String(), nullable=True),
29 |     sa.PrimaryKeyConstraint('id'),
30 |     sa.UniqueConstraint('username')
31 |     )
32 |     ### end Alembic commands ###
33 | 
34 | 
35 | def downgrade():
36 |     ### commands auto generated by Alembic - please adjust! ###
37 |     op.drop_table('user')
38 |     ### end Alembic commands ###
39 | 


--------------------------------------------------------------------------------
/migrations/versions/14c992522209_.py:
--------------------------------------------------------------------------------
 1 | """Add version field introduced in osquery v1.7.4.
 2 | 
 3 | Revision ID: 14c992522209
 4 | Revises: 0bc0a93ac867
 5 | Create Date: 2016-05-13 14:31:45.273281
 6 | 
 7 | """
 8 | 
 9 | # revision identifiers, used by Alembic.
10 | revision = '14c992522209'
11 | down_revision = '0bc0a93ac867'
12 | 
13 | from alembic import op
14 | import sqlalchemy as sa
15 | import doorman.database
16 | 
17 | 
18 | def upgrade():
19 |     ### commands auto generated by Alembic - please adjust! ###
20 |     op.add_column('status_log', sa.Column('version', sa.String(), nullable=True))
21 |     ### end Alembic commands ###
22 | 
23 | 
24 | def downgrade():
25 |     ### commands auto generated by Alembic - please adjust! ###
26 |     op.drop_column('status_log', 'version')
27 |     ### end Alembic commands ###
28 | 


--------------------------------------------------------------------------------
/migrations/versions/236318ee3d3e_add_is_active_and_last_ip_columns.py:
--------------------------------------------------------------------------------
 1 | """Add is_active and last_ip columns to node table
 2 | 
 3 | Revision ID: 236318ee3d3e
 4 | Revises: 54ef3f06612c
 5 | Create Date: 2016-06-21 10:48:13.099132
 6 | 
 7 | """
 8 | 
 9 | # revision identifiers, used by Alembic.
10 | revision = '236318ee3d3e'
11 | down_revision = '54ef3f06612c'
12 | 
13 | from alembic import op
14 | import sqlalchemy as sa
15 | import doorman.database
16 | from sqlalchemy.dialects import postgresql
17 | 
18 | def upgrade():
19 |     ### commands auto generated by Alembic - please adjust! ###
20 |     op.add_column('node', sa.Column('is_active', sa.Boolean(), server_default='1', nullable=False))
21 |     op.add_column('node', sa.Column('last_ip', postgresql.INET(), nullable=True))
22 |     ### end Alembic commands ###
23 | 
24 | 
25 | def downgrade():
26 |     ### commands auto generated by Alembic - please adjust! ###
27 |     op.drop_column('node', 'last_ip')
28 |     op.drop_column('node', 'is_active')
29 |     ### end Alembic commands ###
30 | 


--------------------------------------------------------------------------------
/migrations/versions/4f95ecd76bf8_normalize_distributed_query_architecture.py:
--------------------------------------------------------------------------------
  1 | """Normalize distributed query architecture
  2 | 
  3 | Revision ID: 4f95ecd76bf8
  4 | Revises: 14c992522209
  5 | Create Date: 2016-05-16 23:52:00.328190
  6 | 
  7 | """
  8 | 
  9 | # revision identifiers, used by Alembic.
 10 | revision = '4f95ecd76bf8'
 11 | down_revision = '14c992522209'
 12 | 
 13 | from alembic import op
 14 | from collections import namedtuple
 15 | import sqlalchemy as sa
 16 | import doorman.database
 17 | from sqlalchemy.dialects import postgresql
 18 | 
 19 | 
 20 | def upgrade():
 21 |     ### commands auto generated by Alembic - please adjust! ###
 22 |     DistributedQueryTask = namedtuple('DistributedQueryTask', [
 23 |         'id', 'status', 'retrieved', 'guid', 'node_id'])
 24 | 
 25 |     distributed_query_task = op.create_table('distributed_query_task',
 26 |         sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
 27 |         sa.Column('guid', sa.String(), nullable=False),
 28 |         sa.Column('status', sa.Integer(), nullable=False),
 29 |         sa.Column('timestamp', sa.DateTime(), nullable=True),
 30 |         sa.Column('distributed_query_id', sa.Integer(), nullable=False),
 31 |         sa.Column('node_id', sa.Integer(), nullable=False),
 32 |         sa.ForeignKeyConstraint(['distributed_query_id'], ['distributed_query.id'], ),
 33 |         sa.ForeignKeyConstraint(['node_id'], ['node.id'], ),
 34 |         sa.PrimaryKeyConstraint('id'),
 35 |         sa.UniqueConstraint('guid')
 36 |     )
 37 | 
 38 |     cursor = op.get_bind().execute("""
 39 |         SELECT id, status, retrieved, guid, node_id
 40 |         FROM distributed_query
 41 |         ORDER BY id;"""
 42 |     )
 43 |     results = map(DistributedQueryTask._make, cursor.fetchall())
 44 |     distributed_query_tasks = [dict(
 45 |         distributed_query_id=r.id,
 46 |         status=r.status,
 47 |         timestamp=r.retrieved,
 48 |         guid=r.guid,
 49 |         node_id=r.node_id) for r in results]
 50 | 
 51 |     op.bulk_insert(distributed_query_task, distributed_query_tasks)
 52 | 
 53 |     op.add_column(u'distributed_query', sa.Column('description', sa.String(), nullable=True))
 54 |     op.drop_constraint(u'distributed_query_guid_key', 'distributed_query', type_='unique')
 55 |     op.drop_constraint(u'distributed_query_node_id_fkey', 'distributed_query', type_='foreignkey')
 56 |     op.drop_column(u'distributed_query', 'status')
 57 |     op.drop_column(u'distributed_query', 'retrieved')
 58 |     op.drop_column(u'distributed_query', 'guid')
 59 |     op.drop_column(u'distributed_query', 'node_id')
 60 |     op.add_column(u'distributed_query_result', sa.Column('distributed_query_task_id', sa.Integer(), nullable=True))
 61 | 
 62 |     # distributed queries and tasks were the same before,
 63 |     # so their id's will remain the same as well.
 64 |     op.execute("""
 65 |         UPDATE distributed_query_result
 66 |         SET distributed_query_task_id = distributed_query_id;"""
 67 |     )
 68 | 
 69 |     op.alter_column(u'distributed_query_result', 'distributed_query_task_id', nullable=False)
 70 |     op.create_foreign_key(None, 'distributed_query_result', 'distributed_query_task', ['distributed_query_task_id'], ['id'])
 71 |     ### end Alembic commands ###
 72 | 
 73 | 
 74 | def downgrade():
 75 |     ### commands auto generated by Alembic - please adjust! ###
 76 |     DistributedQuery = namedtuple('DistributedQuery', [
 77 |         'task_id', 'query_id',
 78 |         'guid', 'status', 'sql', 'timestamp', 'not_before',
 79 |         'retrieved', 'node_id'])
 80 | 
 81 |     cursor = op.get_bind().execute("""
 82 |         SELECT DISTINCT t.id AS task_id, q.id AS query_id,
 83 |             t.guid, t.status, q.sql, q.timestamp, q.not_before,
 84 |             t.timestamp AS retrieved, t.node_id
 85 |         FROM distributed_query q
 86 |         INNER JOIN distributed_query_task t
 87 |         ON q.id = t.distributed_query_id
 88 |         ORDER BY t.id;
 89 |     """)
 90 | 
 91 |     results = map(DistributedQuery._make, cursor.fetchall())
 92 | 
 93 |     op.drop_constraint(u'distributed_query_result_distributed_query_task_id_fkey', 'distributed_query_result', type_='foreignkey')
 94 |     op.drop_column(u'distributed_query_result', 'distributed_query_task_id')
 95 | 
 96 |     op.drop_constraint(u'distributed_query_task_distributed_query_id_fkey', 'distributed_query_task', type_='foreignkey')
 97 |     op.drop_table(u'distributed_query')
 98 | 
 99 |     distributed_query = op.create_table('distributed_query',
100 |         sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
101 |         sa.Column('guid', sa.String(), nullable=False),
102 |         sa.Column('status', sa.Integer(), nullable=False),
103 |         sa.Column('sql', sa.String(), nullable=False),
104 |         sa.Column('timestamp', sa.DateTime(), nullable=True),
105 |         sa.Column('not_before', sa.DateTime(), nullable=True),
106 |         sa.Column('retrieved', sa.DateTime(), nullable=True),
107 |         sa.Column('node_id', sa.Integer(), nullable=False),
108 |         sa.ForeignKeyConstraint(['node_id'], ['node.id'], ),
109 |         sa.PrimaryKeyConstraint('id'),
110 |         sa.UniqueConstraint('guid')
111 |     )
112 | 
113 |     distributed_queries = [dict(
114 |         guid=r.guid,
115 |         status=r.status,
116 |         sql=r.sql,
117 |         timestamp=r.timestamp,
118 |         not_before=r.not_before,
119 |         retrieved=r.retrieved,
120 |         node_id=r.node_id) for r in results]
121 | 
122 |     op.bulk_insert(distributed_query, distributed_queries)
123 |     op.drop_table('distributed_query_task')
124 |     ### end Alembic commands ###
125 | 


--------------------------------------------------------------------------------
/migrations/versions/54ef3f06612c_add_node_info_column_to_capture.py:
--------------------------------------------------------------------------------
 1 | """Add "node_info" column to capture arbitrary node information on the fly
 2 | 
 3 | Revision ID: 54ef3f06612c
 4 | Revises: c17f01adbe31
 5 | Create Date: 2016-06-15 10:31:13.791641
 6 | 
 7 | """
 8 | 
 9 | # revision identifiers, used by Alembic.
10 | revision = '54ef3f06612c'
11 | down_revision = 'c17f01adbe31'
12 | 
13 | from alembic import op
14 | import sqlalchemy as sa
15 | import doorman.database
16 | from sqlalchemy.dialects import postgresql
17 | 
18 | def upgrade():
19 |     ### commands auto generated by Alembic - please adjust! ###
20 |     op.add_column('node', sa.Column('node_info', postgresql.JSONB(), server_default='{}', nullable=False))
21 |     op.drop_index('idx__rule__updated_at', table_name='rule')
22 |     ### end Alembic commands ###
23 | 
24 | 
25 | def downgrade():
26 |     ### commands auto generated by Alembic - please adjust! ###
27 |     op.create_index('idx__rule__updated_at', 'rule', ['updated_at'], unique=False)
28 |     op.drop_column('node', 'node_info')
29 |     ### end Alembic commands ###
30 | 


--------------------------------------------------------------------------------
/migrations/versions/a76be8b92780_add_shard_column_to_query.py:
--------------------------------------------------------------------------------
 1 | """Add shard column to query
 2 | 
 3 | Revision ID: a76be8b92780
 4 | Revises: c107fa0468ff
 5 | Create Date: 2017-08-25 11:39:24.754460
 6 | 
 7 | """
 8 | 
 9 | # revision identifiers, used by Alembic.
10 | revision = 'a76be8b92780'
11 | down_revision = 'c107fa0468ff'
12 | 
13 | from alembic import op
14 | import sqlalchemy as sa
15 | import doorman.database
16 | 
17 | 
18 | def upgrade():
19 |     ### commands auto generated by Alembic - please adjust! ###
20 |     query_tbl = sa.sql.table('query', sa.sql.column('platform', sa.String))
21 |     pack_tbl = sa.sql.table('pack', sa.sql.column('platform', sa.String))
22 |     op.execute(
23 |         query_tbl.update() \
24 |             .where(
25 |                 sa.or_(
26 |                     query_tbl.c.platform==op.inline_literal('redhat,centos'),
27 |                     query_tbl.c.platform==op.inline_literal('ubuntu'),
28 |                 )
29 |             ).values({'platform': op.inline_literal('linux')})
30 |     )
31 |     op.execute(
32 |         pack_tbl.update() \
33 |             .where(
34 |                 sa.or_(
35 |                     query_tbl.c.platform==op.inline_literal('redhat,centos'),
36 |                     query_tbl.c.platform==op.inline_literal('ubuntu'),
37 |                 )
38 |             ).values({'platform': op.inline_literal('linux')})
39 |     )
40 |     op.add_column('query', sa.Column('shard', sa.Integer(), nullable=True))
41 |     ### end Alembic commands ###
42 | 
43 | 
44 | def downgrade():
45 |     ### commands auto generated by Alembic - please adjust! ###
46 |     op.drop_column('query', 'shard')
47 |     ### end Alembic commands ###
48 | 


--------------------------------------------------------------------------------
/migrations/versions/b50c705fea80_migrate_to_new_rules_architecture.py:
--------------------------------------------------------------------------------
 1 | """Migrate to new rules architecture
 2 | 
 3 | Revision ID: b50c705fea80
 4 | Revises: 4f95ecd76bf8
 5 | Create Date: 2016-05-26 16:17:40.084938
 6 | 
 7 | """
 8 | 
 9 | # revision identifiers, used by Alembic.
10 | revision = 'b50c705fea80'
11 | down_revision = '4f95ecd76bf8'
12 | 
13 | from alembic import op
14 | import sqlalchemy as sa
15 | import doorman.database
16 | from sqlalchemy.dialects import postgresql
17 | 
18 | def upgrade():
19 |     ### commands auto generated by Alembic - please adjust! ###
20 |     op.add_column('rule', sa.Column('conditions', postgresql.JSONB(), nullable=True))
21 |     op.add_column('rule', sa.Column('description', sa.String(), nullable=True))
22 |     op.drop_column('rule', 'action')
23 |     op.drop_column('rule', 'type')
24 |     op.drop_column('rule', 'config')
25 |     ### end Alembic commands ###
26 | 
27 | 
28 | def downgrade():
29 |     ### commands auto generated by Alembic - please adjust! ###
30 |     op.add_column('rule', sa.Column('config', postgresql.JSONB(), autoincrement=False, nullable=True))
31 |     op.add_column('rule', sa.Column('type', sa.VARCHAR(), autoincrement=False, nullable=False))
32 |     op.add_column('rule', sa.Column('action', postgresql.ENUM(u'added', u'removed', u'both', name='rule_actions'), autoincrement=False, nullable=False))
33 |     op.drop_column('rule', 'description')
34 |     op.drop_column('rule', 'conditions')
35 |     ### end Alembic commands ###
36 | 


--------------------------------------------------------------------------------
/migrations/versions/c107fa0468ff_add_indexes_to_improve_various_sql_.py:
--------------------------------------------------------------------------------
 1 | """Add indexes to improve various sql query performance
 2 | 
 3 | Revision ID: c107fa0468ff
 4 | Revises: 236318ee3d3e
 5 | Create Date: 2017-08-22 15:33:13.706301
 6 | 
 7 | """
 8 | 
 9 | # revision identifiers, used by Alembic.
10 | revision = 'c107fa0468ff'
11 | down_revision = '236318ee3d3e'
12 | 
13 | from alembic import op
14 | import sqlalchemy as sa
15 | import doorman.database
16 | 
17 | 
18 | def upgrade():
19 |     ### commands auto generated by Alembic - please adjust! ###
20 |     op.create_index('idx_distributed_query_task_node_id_status', 'distributed_query_task', ['node_id', 'status'], unique=False)
21 |     op.create_index(op.f('ix_file_path_tags_file_path.id'), 'file_path_tags', ['file_path.id'], unique=False)
22 |     op.create_index(op.f('ix_node_tags_node.id'), 'node_tags', ['node.id'], unique=False)
23 |     op.create_index(op.f('ix_pack_tags_pack.id'), 'pack_tags', ['pack.id'], unique=False)
24 |     op.create_index(op.f('ix_query_tags_query.id'), 'query_tags', ['query.id'], unique=False)
25 |     op.create_index('idx_result_log_node_id_timestamp_desc', 'result_log', ['node_id', sa.text(u'timestamp DESC')], unique=False)
26 |     op.create_index('idx_status_log_node_id_created_desc', 'status_log', ['node_id', sa.text(u'created DESC')], unique=False)
27 |     ### end Alembic commands ###
28 | 
29 | 
30 | def downgrade():
31 |     ### commands auto generated by Alembic - please adjust! ###
32 |     op.drop_index('idx_status_log_node_id_created_desc', table_name='status_log')
33 |     op.drop_index('idx_result_log_node_id_timestamp_desc', table_name='result_log')
34 |     op.drop_index(op.f('ix_query_tags_query.id'), table_name='query_tags')
35 |     op.drop_index(op.f('ix_pack_tags_pack.id'), table_name='pack_tags')
36 |     op.drop_index(op.f('ix_node_tags_node.id'), table_name='node_tags')
37 |     op.drop_index(op.f('ix_file_path_tags_file_path.id'), table_name='file_path_tags')
38 |     op.drop_index('idx_distributed_query_task_node_id_status', table_name='distributed_query_task')
39 |     ### end Alembic commands ###
40 | 


--------------------------------------------------------------------------------
/migrations/versions/c17f01adbe31_add_updated_at_column_to_rule.py:
--------------------------------------------------------------------------------
 1 | """Add "updated_at" column to Rule
 2 | 
 3 | Revision ID: c17f01adbe31
 4 | Revises: b50c705fea80
 5 | Create Date: 2016-05-27 15:51:58.168840
 6 | 
 7 | """
 8 | 
 9 | # revision identifiers, used by Alembic.
10 | revision = 'c17f01adbe31'
11 | down_revision = 'b50c705fea80'
12 | 
13 | from alembic import op
14 | import sqlalchemy as sa
15 | import doorman.database
16 | 
17 | 
18 | def upgrade():
19 |     ### commands auto generated by Alembic - please adjust! ###
20 |     op.add_column('rule',
21 |         sa.Column('updated_at', sa.DateTime(), nullable=False, server_default=sa.func.now()))
22 |     ### end Alembic commands ###
23 | 
24 |     op.create_index('idx__rule__updated_at', 'rule', ['updated_at'])
25 | 
26 | 
27 | def downgrade():
28 |     op.drop_index('idx__rule__updated_at')
29 |     ### commands auto generated by Alembic - please adjust! ###
30 |     op.drop_column('rule', 'updated_at')
31 |     ### end Alembic commands ###
32 | 


--------------------------------------------------------------------------------
/migrations/versions/fd28e46e46a6_.py:
--------------------------------------------------------------------------------
 1 | """Add rule table to configure rules and alerts.
 2 | 
 3 | Revision ID: fd28e46e46a6
 4 | Revises: d2b00dd93241
 5 | Create Date: 2016-05-02 17:46:46.658227
 6 | 
 7 | """
 8 | 
 9 | # revision identifiers, used by Alembic.
10 | revision = 'fd28e46e46a6'
11 | down_revision = 'd2b00dd93241'
12 | 
13 | from alembic import op
14 | import sqlalchemy as sa
15 | import doorman.database
16 | from sqlalchemy.dialects import postgresql
17 | 
18 | def upgrade():
19 |     ### commands auto generated by Alembic - please adjust! ###
20 |     op.create_table('rule',
21 |     sa.Column('id', sa.Integer(), nullable=False),
22 |     sa.Column('type', sa.String(), nullable=False),
23 |     sa.Column('name', sa.String(), nullable=False),
24 |     sa.Column('action', sa.Enum('added', 'removed', 'both', name='rule_actions'), nullable=False),
25 |     sa.Column('alerters', postgresql.ARRAY(sa.String()), nullable=False),
26 |     sa.Column('config', postgresql.JSONB(), nullable=True),
27 |     sa.PrimaryKeyConstraint('id')
28 |     )
29 |     ### end Alembic commands ###
30 | 
31 | 
32 | def downgrade():
33 |     ### commands auto generated by Alembic - please adjust! ###
34 |     op.drop_table('rule')
35 |     ### end Alembic commands ###
36 |     postgresql.ENUM(name='rule_actions').drop(op.get_bind(), checkfirst=False)
37 | 


--------------------------------------------------------------------------------
/package.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "name": "doorman",
 3 |   "version": "1.0.0",
 4 |   "description": "[![Build Status](https://travis-ci.org/mwielgoszewski/doorman.svg?branch=master)](https://travis-ci.org/mwielgoszewski/doorman) [![Code Climate](https://codeclimate.com/github/mwielgoszewski/doorman/badges/gpa.svg)](https://codeclimate.com/github/mwielgoszewski/doorman)",
 5 |   "main": "index.js",
 6 |   "directories": {
 7 |     "doc": "docs",
 8 |     "test": "tests"
 9 |   },
10 |   "scripts": {
11 |     "postinstall": "bower install"
12 |   },
13 |   "repository": {
14 |     "type": "git",
15 |     "url": "git+https://github.com/mwielgoszewski/doorman"
16 |   },
17 |   "author": "",
18 |   "license": "ISC",
19 |   "bugs": {
20 |     "url": "https://github.com/mwielgoszewski/doorman/issues"
21 |   },
22 |   "homepage": "https://github.com/mwielgoszewski/doorman#readme",
23 |   "dependencies": {
24 |     "bower": "^1.7.9",
25 |     "less": "^2.7.1"
26 |   }
27 | }


--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
1 | requirements/prod.txt


--------------------------------------------------------------------------------
/requirements/dev.txt:
--------------------------------------------------------------------------------
 1 | alembic==1.0.5
 2 | amqp==2.3.2
 3 | atomicwrites==1.2.1
 4 | attrs==18.2.0
 5 | backports.functools-lru-cache==1.5
 6 | bcrypt==3.1.5
 7 | beautifulsoup4==4.7.0
 8 | billiard==3.5.0.5
 9 | blinker==1.4
10 | celery==4.2.1
11 | certifi==2018.11.29
12 | cffi==1.11.5
13 | chardet==3.0.4
14 | Click==7.0
15 | contextlib2==0.5.5
16 | cssmin==0.2.0
17 | enum34==1.1.6
18 | factory-boy==2.11.1
19 | Faker==1.0.1
20 | Flask==1.0.2
21 | Flask-Assets==0.12
22 | Flask-Bcrypt==0.7.1
23 | Flask-DebugToolbar==0.10.1
24 | flask-ldap3-login==0.9.16
25 | Flask-Login==0.4.1
26 | Flask-Mail==0.9.1
27 | Flask-Migrate==2.3.1
28 | flask-paginate==0.5.1
29 | Flask-Script==2.0.6
30 | Flask-SQLAlchemy==2.3.2
31 | Flask-SSLify==0.1.5
32 | Flask-WTF==0.14.2
33 | funcsigs==1.0.2
34 | idna==2.8
35 | ipaddress==1.0.22
36 | itsdangerous==1.1.0
37 | Jinja2==2.10
38 | jsmin==2.2.2
39 | kombu==4.2.2.post1
40 | ldap3==2.5.2
41 | Mako==1.0.7
42 | MarkupSafe==1.1.0
43 | mock==2.0.0
44 | more-itertools==5.0.0
45 | oauthlib==2.1.0
46 | pathlib2==2.3.3
47 | pbr==5.1.1
48 | pluggy==0.8.0
49 | psycopg2-binary==2.7.6.1
50 | py==1.7.0
51 | pyasn1==0.4.5
52 | pycparser==2.19
53 | pytest==4.0.2
54 | python-dateutil==2.7.5
55 | python-editor==1.0.3
56 | pytz==2018.7
57 | raven==6.10.0
58 | redis==3.0.1
59 | requests==2.21.0
60 | scandir==1.9.0
61 | six==1.12.0
62 | soupsieve==1.6.2
63 | SQLAlchemy==1.2.15
64 | text-unidecode==1.2
65 | unicodecsv==0.14.1
66 | urllib3==1.24.1
67 | vine==1.1.4
68 | waitress==1.1.0
69 | webassets==0.12.1
70 | WebOb==1.8.5
71 | WebTest==2.0.32
72 | Werkzeug==0.14.1
73 | WTForms==2.2.1
74 | 


--------------------------------------------------------------------------------
/requirements/prod.txt:
--------------------------------------------------------------------------------
 1 | alembic==1.0.5
 2 | amqp==2.3.2
 3 | bcrypt==3.1.5
 4 | billiard==3.5.0.5
 5 | blinker==1.4
 6 | celery==4.2.1
 7 | certifi==2018.11.29
 8 | cffi==1.11.5
 9 | chardet==3.0.4
10 | Click==7.0
11 | contextlib2==0.5.5
12 | cssmin==0.2.0
13 | enum34==1.1.6
14 | Flask==1.0.2
15 | Flask-Assets==0.12
16 | Flask-Bcrypt==0.7.1
17 | Flask-DebugToolbar==0.10.1
18 | flask-ldap3-login==0.9.16
19 | Flask-Login==0.4.1
20 | Flask-Mail==0.9.1
21 | Flask-Migrate==2.3.1
22 | flask-paginate==0.5.1
23 | Flask-Script==2.0.6
24 | Flask-SQLAlchemy==2.3.2
25 | Flask-SSLify==0.1.5
26 | Flask-WTF==0.14.2
27 | idna==2.8
28 | itsdangerous==1.1.0
29 | Jinja2==2.10
30 | jsmin==2.2.2
31 | kombu==4.2.2.post1
32 | ldap3==2.5.2
33 | Mako==1.0.7
34 | MarkupSafe==1.1.0
35 | oauthlib==2.1.0
36 | psycopg2-binary==2.7.6.1
37 | pyasn1==0.4.5
38 | pycparser==2.19
39 | python-dateutil==2.7.5
40 | python-editor==1.0.3
41 | pytz==2018.7
42 | raven==6.10.0
43 | redis==3.0.1
44 | requests==2.21.0
45 | six==1.12.0
46 | SQLAlchemy==1.2.15
47 | unicodecsv==0.14.1
48 | urllib3==1.24.1
49 | vine==1.1.4
50 | webassets==0.12.1
51 | Werkzeug==0.14.1
52 | WTForms==2.2.1
53 | 


--------------------------------------------------------------------------------
/setup.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | from setuptools import setup, find_packages
 3 | 
 4 | 
 5 | setup(
 6 |     name='doorman',
 7 |     description='an osquery fleet manager',
 8 |     url='https://github.com/mwielgoszewski/doorman',
 9 |     version='0.5.1',
10 |     packages=find_packages(
11 |         exclude=[
12 |             'tests*',
13 |         ]
14 |     ),
15 |     include_package_data=True,
16 |     zip_safe=False,
17 |     install_requires=[
18 |         'alembic==1.0.5',
19 |         'amqp==2.3.2',
20 |         'bcrypt==3.1.5',
21 |         'billiard==3.5.0.5',
22 |         'blinker==1.4',
23 |         'celery==4.2.1',
24 |         'certifi==2018.11.29',
25 |         'cffi==1.11.5',
26 |         'chardet==3.0.4',
27 |         'Click==7.0',
28 |         'contextlib2==0.5.5',
29 |         'cssmin==0.2.0',
30 |         'enum34==1.1.6',
31 |         'Flask==1.0.2',
32 |         'Flask-Assets==0.12',
33 |         'Flask-Bcrypt==0.7.1',
34 |         'Flask-DebugToolbar==0.10.1',
35 |         'flask-ldap3-login==0.9.16',
36 |         'Flask-Login==0.4.1',
37 |         'Flask-Mail==0.9.1',
38 |         'Flask-Migrate==2.3.1',
39 |         'flask-paginate==0.5.1',
40 |         'Flask-Script==2.0.6',
41 |         'Flask-SQLAlchemy==2.3.2',
42 |         'Flask-SSLify==0.1.5',
43 |         'Flask-WTF==0.14.2',
44 |         'idna==2.8',
45 |         'itsdangerous==1.1.0',
46 |         'Jinja2==2.10',
47 |         'jsmin==2.2.2',
48 |         'kombu==4.2.2.post1',
49 |         'ldap3==2.5.2',
50 |         'Mako==1.0.7',
51 |         'MarkupSafe==1.1.0',
52 |         'oauthlib==2.1.0',
53 |         'psycopg2-binary==2.7.6.1',
54 |         'pyasn1==0.4.5',
55 |         'pycparser==2.19',
56 |         'python-dateutil==2.7.5',
57 |         'python-editor==1.0.3',
58 |         'pytz==2018.7',
59 |         'raven==6.10.0',
60 |         'redis==3.0.1',
61 |         'requests==2.21.0',
62 |         'six==1.12.0',
63 |         'SQLAlchemy==1.2.15',
64 |         'unicodecsv==0.14.1',
65 |         'urllib3==1.24.1',
66 |         'vine==1.1.4',
67 |         'webassets==0.12.1',
68 |         'Werkzeug==0.14.1',
69 |         'WTForms==2.2.1',
70 |     ],
71 |     package_data={
72 |         'resources': 'doorman/resources/*',
73 |         'static': 'doorman/static/*',
74 |         'templates': 'doorman/templates/*',
75 |     }
76 | )
77 | 


--------------------------------------------------------------------------------
/tests/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/mwielgoszewski/doorman/9a9b97c814625fcdd281b55c82177c9f777c5526/tests/__init__.py


--------------------------------------------------------------------------------
/tests/conftest.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | """Defines fixtures available to all tests."""
 3 | 
 4 | import pytest
 5 | from webtest import TestApp
 6 | 
 7 | from doorman.application import create_app
 8 | from doorman.database import db as _db
 9 | from doorman.models import Rule
10 | from doorman.settings import TestConfig
11 | 
12 | from .factories import NodeFactory, RuleFactory
13 | 
14 | 
15 | @pytest.yield_fixture(scope='function')
16 | def app():
17 |     """An application for the tests."""
18 |     _app = create_app(config=TestConfig)
19 |     ctx = _app.test_request_context()
20 |     ctx.push()
21 | 
22 |     try:
23 |         yield _app
24 |     finally:
25 |         ctx.pop()
26 | 
27 | 
28 | @pytest.yield_fixture(scope='function')
29 | def api():
30 |     """An api instance for the tests, no manager"""
31 |     import os
32 |     # the mere presence of the env var should prevent the manage
33 |     # blueprint from being registered
34 |     os.environ['DOORMAN_NO_MANAGER'] = '1'
35 | 
36 |     _app = create_app(config=TestConfig)
37 |     ctx = _app.test_request_context()
38 |     ctx.push()
39 | 
40 |     try:
41 |         yield _app
42 |     finally:
43 |         ctx.pop()
44 | 
45 | 
46 | @pytest.fixture(scope='function')
47 | def testapp(app):
48 |     """A Webtest app."""
49 |     return TestApp(app)
50 | 
51 | 
52 | @pytest.fixture(scope='function')
53 | def testapi(api):
54 |     return TestApp(api)
55 | 
56 | 
57 | @pytest.yield_fixture(scope='function')
58 | def db(app):
59 |     """A database for the tests."""
60 |     _db.app = app
61 |     with app.app_context():
62 |         _db.create_all()
63 | 
64 |     yield _db
65 | 
66 |     # Explicitly close DB connection
67 |     _db.session.close()
68 |     _db.drop_all()
69 | 
70 | 
71 | @pytest.fixture
72 | def node(db):
73 |     """A node for the tests."""
74 |     node = NodeFactory(host_identifier='foobar', enroll_secret='foobar')
75 |     db.session.commit()
76 |     return node
77 | 
78 | 
79 | @pytest.fixture
80 | def rule(db):
81 |     rule = RuleFactory(
82 |         name='testrule',
83 |         description='kung = $kung',
84 |         alerters=[],
85 |         conditions={}
86 |     )
87 |     db.session.commit()
88 |     return rule
89 | 


--------------------------------------------------------------------------------
/tests/factories.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | from factory import Sequence
 3 | from factory.alchemy import SQLAlchemyModelFactory
 4 | 
 5 | from doorman.database import db
 6 | from doorman.models import (
 7 |     Node, Pack, Query, Tag, FilePath,
 8 |     DistributedQuery, DistributedQueryTask, DistributedQueryResult,
 9 |     ResultLog, StatusLog, Rule
10 | )
11 | 
12 | 
13 | class BaseFactory(SQLAlchemyModelFactory):
14 |     class Meta:
15 |         abstract = True
16 |         sqlalchemy_session = db.session
17 | 
18 | 
19 | class NodeFactory(BaseFactory):
20 | 
21 |     class Meta:
22 |         model = Node
23 | 
24 | 
25 | class PackFactory(BaseFactory):
26 | 
27 |     class Meta:
28 |         model = Pack
29 | 
30 | 
31 | class QueryFactory(BaseFactory):
32 | 
33 |     class Meta:
34 |         model = Query
35 | 
36 | 
37 | class TagFactory(BaseFactory):
38 | 
39 |     class Meta:
40 |         model = Tag
41 | 
42 | 
43 | class FilePathFactory(BaseFactory):
44 | 
45 |     class Meta:
46 |         model = FilePath
47 | 
48 | 
49 | class DistributedQueryFactory(BaseFactory):
50 | 
51 |     class Meta:
52 |         model = DistributedQuery
53 | 
54 | 
55 | class DistributedQueryTaskFactory(BaseFactory):
56 | 
57 |     class Meta:
58 |         model = DistributedQueryTask
59 | 
60 | 
61 | class DistributedQueryResultFactory(BaseFactory):
62 | 
63 |     class Meta:
64 |         model = DistributedQueryResult
65 | 
66 | 
67 | class ResultLogFactory(BaseFactory):
68 | 
69 |     class Meta:
70 |         model = ResultLog
71 | 
72 | 
73 | class StatusLogFactory(BaseFactory):
74 | 
75 |     class Meta:
76 |         model = StatusLog
77 | 
78 | 
79 | class RuleFactory(BaseFactory):
80 | 
81 |     class Meta:
82 |         model = Rule
83 | 


--------------------------------------------------------------------------------
/tests/test_alerters.py:
--------------------------------------------------------------------------------
  1 | # -*- coding: utf-8 -*-
  2 | from collections import namedtuple
  3 | import datetime as dt
  4 | import json
  5 | import mock
  6 | import raven
  7 | 
  8 | from doorman.rules import RuleMatch
  9 | from doorman.plugins.alerters.emailer import EmailAlerter
 10 | from doorman.plugins.alerters.pagerduty import PagerDutyAlerter
 11 | from doorman.plugins.alerters.sentry import SentryAlerter
 12 | from doorman.plugins.alerters.slack import SlackAlerter
 13 | 
 14 | 
 15 | MockResponse = namedtuple('MockResponse', ['ok', 'content'])
 16 | 
 17 | 
 18 | class TestPagerDutyAlerter:
 19 | 
 20 |     def setup_method(self, _method):
 21 |         self.service_key = 'foobar'
 22 |         self.config = {
 23 |             'service_key': self.service_key,
 24 |         }
 25 | 
 26 |     def test_will_make_request(self, node, rule):
 27 |         """ Simple test to ensure that there's no serialization or syntax errors. """
 28 |         match = RuleMatch(
 29 |             rule=rule,
 30 |             node=node.to_dict(),
 31 |             result={
 32 |                 'name': 'foo',
 33 |                 'action': 'added',
 34 |                 'timestamp': 'bar',
 35 |                 'columns': {'boo': 'baz', 'kung': 'bloo'},
 36 |             }
 37 |         )
 38 | 
 39 |         resp = MockResponse(ok=True, content='blah')
 40 |         with mock.patch('requests.post', return_value=resp) as pmock:
 41 |             alerter = PagerDutyAlerter(self.config)
 42 |             alerter.handle_alert(node.to_dict(), match)
 43 | 
 44 |         assert pmock.called
 45 | 
 46 |         args, kwargs = pmock.call_args
 47 |         assert args[0] == 'https://events.pagerduty.com/generic/2010-04-15/create_event.json'
 48 | 
 49 |         assert rule.name in kwargs['data']
 50 |         assert 'boo' in kwargs['data']
 51 |         assert 'baz' in kwargs['data']
 52 | 
 53 |     def test_will_pass_service_key(self, node, rule):
 54 |         match = RuleMatch(
 55 |             rule=rule,
 56 |             node=node.to_dict(),
 57 |             result={
 58 |                 'name': 'foo',
 59 |                 'action': 'added',
 60 |                 'timestamp': 'bar',
 61 |                 'columns': {'boo': 'baz', 'kung': 'bloo'},
 62 |             }
 63 |         )
 64 | 
 65 |         resp = MockResponse(ok=True, content='blah')
 66 |         with mock.patch('requests.post', return_value=resp) as pmock:
 67 |             alerter = PagerDutyAlerter(self.config)
 68 |             alerter.handle_alert(node.to_dict(), match)
 69 | 
 70 |         assert pmock.called
 71 | 
 72 |         _, kwargs = pmock.call_args
 73 |         data = json.loads(kwargs['data'])
 74 |         assert data['service_key'] == self.service_key
 75 | 
 76 | 
 77 | class TestEmailerAlerter:
 78 |     def setup_method(self, _method):
 79 |         self.recipients = ['test@example.com']
 80 |         self.config = {
 81 |             'recipients': self.recipients,
 82 |             'subject_prefix': '[Doorman Test]',
 83 |             'enroll_subject_prefix': '[Doorman Test]',
 84 |         }
 85 | 
 86 |     def test_will_email_on_rule_match(self, node, rule, testapp):
 87 |         from flask_mail import email_dispatched
 88 | 
 89 |         match = RuleMatch(
 90 |             rule=rule,
 91 |             node=node.to_dict(),
 92 |             result={
 93 |                 'name': 'foo',
 94 |                 'action': 'added',
 95 |                 'timestamp': 'bar',
 96 |                 'columns': {'boo': 'baz', 'kung': 'bloo'},
 97 |             }
 98 |         )
 99 | 
100 |         expected_subject = '[Doorman Test] {host_identifier} {name} ({action})'.format(
101 |             host_identifier=node.host_identifier,
102 |             name=rule.name,
103 |             action=match.result['action']
104 |         )
105 | 
106 |         @email_dispatched.connect
107 |         def verify(message, app):
108 |             assert message.subject == expected_subject
109 |             assert self.recipients == message.recipients
110 |             assert rule.name in message.body
111 |             assert 'boo' in message.body
112 |             assert 'baz' in message.body
113 |             assert 'kung = bloo' in message.body
114 | 
115 |         alerter = EmailAlerter(self.config)
116 |         alerter.handle_alert(node.to_dict(), match)
117 | 
118 | 
119 | class TestSentryAlerter:
120 | 
121 |     def setup_method(self, _method):
122 |         self.config = {
123 |             'dsn': 'https://key:secret@app.getsentry.com/project'
124 |         }
125 | 
126 |     def test_will_alert(self, node, rule, testapp):
127 |         match = RuleMatch(
128 |             rule=rule,
129 |             node=node.to_dict(),
130 |             result={
131 |                 'name': 'foo',
132 |                 'action': 'added',
133 |                 'timestamp': dt.datetime.utcnow(),
134 |                 'columns': {'boo': 'baz', 'kung': 'bloo'},
135 |             }
136 |         )
137 | 
138 |         with mock.patch.object(raven.Client, 'captureMessage', return_value=None) as pmock:
139 |             alerter = SentryAlerter(self.config)
140 |             alerter.handle_alert(node.to_dict(), match)
141 | 
142 |         assert pmock.called
143 | 
144 |         _, kwargs = pmock.call_args
145 |         assert kwargs['message'] == rule.template.safe_substitute(
146 |             match.result['columns'],
147 |             **node.to_dict()
148 |         ).rstrip()
149 | 
150 | class TestSlackAlerter:
151 | 
152 |     def setup_method(self, _method):
153 |         self.config = {
154 |             'slack_webhook' : 'https://hooks.slack.com/services/foo',
155 |             'printColumns' : True,
156 |         }
157 | 
158 |     def test_will_make_request(self, node, rule):
159 |         """ Simple test to ensure that there's no serialization or syntax errors. """
160 |         match = RuleMatch(
161 |             rule=rule,
162 |             node=node.to_dict(),
163 |             result={
164 |                 'name': 'foo',
165 |                 'action': 'added',
166 |                 'timestamp': 'bar',
167 |                 'columns': {'boo': 'baz', 'kung': 'bloo'},
168 |             }
169 |         )
170 | 
171 |         resp = MockResponse(ok=True, content='blah')
172 |         with mock.patch('requests.post', return_value=resp) as pmock:
173 |             alerter = SlackAlerter(self.config)
174 |             alerter.handle_alert(node.to_dict(), match)
175 | 
176 |         assert pmock.called
177 | 
178 |         args, kwargs = pmock.call_args
179 |         assert args[0] == 'https://hooks.slack.com/services/foo'
180 | 
181 |         assert rule.name in kwargs['data']
182 |         assert 'boo' in kwargs['data']
183 |         assert 'baz' in kwargs['data']
184 | 


--------------------------------------------------------------------------------
/tests/test_celery.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | from doorman.tasks import example_task
3 | 
4 | 
5 | class TestCelery:
6 |     def test_celery_simple(self):
7 |         res = example_task.delay(1, 2)
8 |         assert res.get() == 3
9 | 


--------------------------------------------------------------------------------
/tests/test_forms.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | 
 3 | from doorman.manage.forms import (
 4 |     CreateQueryForm,
 5 |     UpdateQueryForm,
 6 |     UploadPackForm,
 7 |     CreateTagForm,
 8 | )
 9 | 
10 | from .factories import QueryFactory
11 | 
12 | 
13 | class TestCreateTagForm:
14 | 
15 |     def test_tag_validate_failure(self, testapp):
16 |         form = CreateTagForm()
17 |         assert form.validate() is False
18 | 
19 |     def test_tag_validate_success(self, testapp):
20 |         form = CreateTagForm(value='foo')
21 |         assert form.validate() is True
22 | 
23 | 
24 | class TestCreateQueryForm:
25 | 
26 |     def test_sql_validate_failure(self, testapp, db):
27 |         form = CreateQueryForm(
28 |             name='foobar',
29 |             sql='select * from foobar;'
30 |         )
31 |         assert form.validate() is False
32 |         assert 'sql' in form.errors
33 |         assert 'name' not in form.errors
34 | 
35 |     def test_sql_validate_success(self, testapp, db):
36 |         form = CreateQueryForm(
37 |             name='foobar',
38 |             sql='select * from osquery_info;',
39 |         )
40 |         assert form.validate() is True
41 | 
42 | 
43 | class TestUpdateQueryForm:
44 | 
45 |     def test_sql_validate_failure(self, testapp, db):
46 |         query = QueryFactory(
47 |             name='foobar',
48 |             sql='select * from osquery_info;'
49 |         )
50 |         form = UpdateQueryForm(
51 |             name=query.name,
52 |             sql='select * from foobar;'
53 |         )
54 |         assert form.validate() is False
55 |         assert 'sql' in form.errors
56 |         assert 'name' not in form.errors
57 | 
58 |     def test_sql_validate_success(self, testapp, db):
59 |         query = QueryFactory(
60 |             name='foobar',
61 |             sql='select * from osquery_info;'
62 |         )
63 |         form = UpdateQueryForm(
64 |             name=query.name,
65 |             sql='select * from platform_info;'
66 |         )
67 |         assert form.validate() is True
68 | 


--------------------------------------------------------------------------------
/tests/test_integration.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import pytest
 3 | 
 4 | from flask import url_for
 5 | from flask_login import current_user
 6 | from werkzeug.routing import BuildError
 7 | 
 8 | from doorman.users.mixins import NoAuthUserMixin
 9 | 
10 | 
11 | class TestStandaloneApi:
12 | 
13 |     def test_no_manager(self, testapi):
14 |         with pytest.raises(BuildError):
15 |             url_for('manage.index')
16 | 
17 |         resp = testapi.get(url_for('api.index'))
18 |         assert resp.status_code == 204
19 | 
20 |         resp = testapi.get('/path/does/not/exist', expect_errors=True)
21 |         assert resp.status_code == 400
22 | 
23 | 
24 | class TestNoAuth:
25 | 
26 |     def test_noauth_user_mixin_is_authenticated(self, testapp):
27 | 
28 |         assert current_user is not None
29 |         assert current_user.is_authenticated
30 |         assert current_user.is_active
31 |         assert not current_user.username  # no username for this faux user
32 | 
33 | 
34 | class TestDoormanAuth:
35 |     pass
36 | 
37 | 
38 | class TestGoogleAuth:
39 |     pass
40 | 


--------------------------------------------------------------------------------
/tests/test_models.py:
--------------------------------------------------------------------------------
  1 | # -*- coding: utf-8 -*-
  2 | import datetime as dt
  3 | import pytest
  4 | 
  5 | from doorman.models import Node, Pack, Query, Tag, FilePath
  6 | 
  7 | from .factories import NodeFactory, PackFactory, QueryFactory, TagFactory
  8 | 
  9 | 
 10 | @pytest.mark.usefixtures('db')
 11 | class TestNode:
 12 | 
 13 |     def test_factory(self, db):
 14 |         node = NodeFactory(host_identifier='foo')
 15 |         db.session.commit()
 16 |         assert node.node_key is not None
 17 |         assert node.host_identifier == 'foo'
 18 | 
 19 |     def test_tags(self):
 20 |         tag = Tag.create(value='foo')
 21 |         node = NodeFactory(host_identifier='foo')
 22 |         node.tags.append(tag)
 23 |         node.save()
 24 |         assert tag in node.tags
 25 | 
 26 |     def test_config(self):
 27 |         node = NodeFactory(host_identifier='foo')
 28 |         tag = Tag.create(value='foo')
 29 |         node.tags.append(tag)
 30 |         node.save()
 31 | 
 32 |         query1 = Query.create(name='bar', sql='select * from osquery_info;')
 33 |         query2 = Query.create(name='foobar', sql='select * from system_info;')
 34 |         query2.tags.append(tag)
 35 |         query2.save()
 36 | 
 37 |         pack = Pack.create(name='baz')
 38 |         pack.queries.append(query1)
 39 |         pack.tags.append(tag)
 40 |         pack.save()
 41 | 
 42 |         file_path = FilePath.create(category='foobar', target_paths=[
 43 |             '/home/foobar/%%',
 44 |         ])
 45 |         file_path.tags.append(tag)
 46 |         file_path.save()
 47 | 
 48 |         assert tag in pack.tags
 49 |         assert tag in query2.tags
 50 |         assert tag in file_path.tags
 51 |         assert tag not in query1.tags
 52 |         assert query1 in pack.queries
 53 |         assert query2 not in pack.queries
 54 | 
 55 |         assert pack in node.packs
 56 |         assert query2 in node.queries
 57 |         assert query1 not in node.queries
 58 | 
 59 |         config = node.get_config()
 60 | 
 61 |         assert pack.name in config['packs']
 62 |         assert query1.name in config['packs'][pack.name]['queries']
 63 |         assert query1.sql == config['packs'][pack.name]['queries'][query1.name]['query']
 64 | 
 65 |         assert query2.name not in config['packs']
 66 |         assert query2.name in config['schedule']
 67 |         assert query2.sql == config['schedule'][query2.name]['query']
 68 | 
 69 |         assert file_path.category in config['file_paths']
 70 | 
 71 | 
 72 | @pytest.mark.usefixtures('db')
 73 | class TestQuery:
 74 | 
 75 |     def test_factory(self, db):
 76 |         query = QueryFactory(name='foobar', query='select * from foobar;')
 77 |         db.session.commit()
 78 | 
 79 |         assert query.name == 'foobar'
 80 |         assert query.sql == 'select * from foobar;'
 81 | 
 82 | 
 83 | @pytest.mark.usefixtures('db')
 84 | class TestFilePath:
 85 |     def test_create(self):
 86 |         target_paths = [
 87 |             '/root/.ssh/%%',
 88 |             '/home/.ssh/%%',
 89 |         ]
 90 | 
 91 |         file_path = FilePath.create(category='foobar', target_paths=target_paths)
 92 |         assert file_path.to_dict() == {'foobar': target_paths}
 93 | 
 94 |     def test_update(self):
 95 |         target_paths = [
 96 |             '/root/.ssh/%%',
 97 |             '/home/.ssh/%%',
 98 |         ]
 99 | 
100 |         file_path = FilePath.create(category='foobar', target_paths=target_paths)
101 |         assert file_path.to_dict() == {'foobar': target_paths}
102 | 
103 |         target_paths.append('/etc/%%')
104 |         file_path.set_paths(*target_paths)
105 |         file_path.save()
106 |         assert file_path.to_dict() == {'foobar': target_paths}
107 | 


--------------------------------------------------------------------------------
/tests/test_utils.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import json
 3 | import datetime as dt
 4 | 
 5 | import pytest
 6 | from flask import current_app
 7 | 
 8 | from doorman.utils import (
 9 |     DateTimeEncoder,
10 |     osquery_mock_db,
11 |     quote,
12 |     validate_osquery_query,
13 | )
14 | 
15 | 
16 | class TestValidate:
17 | 
18 |     def test_simple_validate(self):
19 |         query = 'SELECT * FROM osquery_info;'
20 |         assert validate_osquery_query(query) is True
21 | 
22 |     def test_complex_validate(self):
23 |         # From Facebook's blog post: https://code.facebook.com/posts/844436395567983/introducing-osquery/
24 |         query = 'SELECT DISTINCT process.name, listening.port, listening.address, process.pid FROM processes AS process JOIN listening_ports AS listening ON process.pid = listening.pid;'
25 |         assert validate_osquery_query(query) is True
26 | 
27 |     def test_syntax_error(self):
28 |         query = 'SELECT * FROM'
29 |         assert validate_osquery_query(query) is False
30 | 
31 |     def test_bad_table(self):
32 |         query = 'SELECT * FROM a_table_that_does_not_exist;'
33 |         assert validate_osquery_query(query) is False
34 | 
35 |     def test_custom_schema(self):
36 |         query = 'SELECT * FROM custom_table;'
37 |         assert validate_osquery_query(query) is False
38 | 
39 |         try:
40 |             # This is a bit hacky, but it clears the mock DB so the next call
41 |             # will re-create it.
42 |             osquery_mock_db.db = None
43 | 
44 |             current_app.config['DOORMAN_EXTRA_SCHEMA'].append(
45 |                 'CREATE TABLE custom_table (id INTEGER);'
46 |             )
47 |             assert validate_osquery_query(query) is True
48 |         finally:
49 |             # Remove final entry from the config.
50 |             current_app.config['DOORMAN_EXTRA_SCHEMA'] = \
51 |                 current_app.config['DOORMAN_EXTRA_SCHEMA'][:-1]
52 | 
53 | 
54 | class TestQuote:
55 | 
56 |     def test_will_quote_string(self):
57 |         assert quote('foobar') == '"foobar"'
58 |         assert quote('foo bar baz') == '"foo bar baz"'
59 |         assert quote('foobar', quote='`') == '`foobar`'
60 | 
61 |     def test_will_escape(self):
62 |         assert quote(r'foo"bar') == r'"foo\"bar"'
63 |         assert quote(r'foo\bar') == r'"foo\\bar"'
64 | 
65 |     def test_quote_control_characters(self):
66 |         assert quote("\r\n\t") == r'"\r\n\t"'
67 | 
68 |     def test_quote_unprintable_chars(self):
69 |         assert quote('\x8Ffoo\xA3bar').lower() == r'"\x8Ffoo\xA3bar"'.lower()
70 | 
71 | 
72 | class TestDateTimeEncoder:
73 | 
74 |     def test_will_serialize_datetime(self):
75 |         time = dt.datetime(year=2016, month=5, day=16, hour=11, minute=11, second=11)
76 |         data = {'foo': time}
77 | 
78 |         s = json.dumps(data, cls=DateTimeEncoder)
79 |         assert s == '{"foo": "2016-05-16T11:11:11"}'
80 | 


--------------------------------------------------------------------------------
/tools/lib.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | 
  3 | # doorman: Functions for provisioning scripts in Ubuntu/CentOS
  4 | #
  5 | 
  6 | function log() {
  7 |   echo "[+] - $1"
  8 | }
  9 | 
 10 | function error() {
 11 |   echo "[!] - $1"
 12 |   exit 1
 13 | }
 14 | 
 15 | function set_motd() {
 16 |   python -mplatform | grep -qi "Ubuntu" && set_motd_ubuntu || log "Not ready for CentOS"
 17 | }
 18 | 
 19 | function set_motd_ubuntu() {
 20 |   # If the cloudguest MOTD exists, disable it
 21 |   if [[ -f /etc/update-motd.d/51/cloudguest ]]; then
 22 |     sudo chmod -x /etc/update-motd.d/51-cloudguest
 23 |   fi
 24 |   sudo cp /vagrant/tools/motd-doorman.sh /etc/update-motd.d/10-help-text
 25 | }
 26 | 
 27 | function activate_repos() {
 28 |   python -mplatform | grep -qi "Ubuntu" && sudo apt-get update || log "No apt-get for CentOS"
 29 | }
 30 | 
 31 | function package() {
 32 |   python -mplatform | grep -qi "Ubuntu" && package_ubuntu $1 || package_centos $1
 33 | }
 34 | 
 35 | function package_ubuntu() {
 36 |   if [[ -n "$(dpkg --get-selections | grep -w "^$1$")" ]]; then
 37 |     log "$1 is already installed. skipping."
 38 |   else
 39 |     log "Installing $1"
 40 |     sudo DEBIAN_FRONTEND=noninteractive apt-get install $1 -y --no-install-recommends
 41 |   fi
 42 | }
 43 | 
 44 | function package_centos() {
 45 |   if [[ -n "$(rpm -qa | grep -w "^$1$")" ]]; then
 46 |     log "$1 is already installed. skipping."
 47 |   else
 48 |     log "Installing $1"
 49 |     sudo yum -y install $1
 50 |   fi
 51 | }
 52 | 
 53 | function repo_osquery() {
 54 |   python -mplatform | grep -qi "Ubuntu" && repo_osquery_ubuntu $1 || repo_osquery_centos $1
 55 | }
 56 | 
 57 | function repo_osquery_ubuntu() {
 58 |   log "Adding osquery repository keys"
 59 |   sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B
 60 |   log "Adding osquery repository"
 61 |   sudo add-apt-repository "deb [arch=amd64] https://osquery-packages.s3.amazonaws.com/trusty trusty main"
 62 | }
 63 | 
 64 | function repo_osquery_centos() {
 65 |   log "Adding osquery repository"
 66 |   sudo rpm -ivh https://osquery-packages.s3.amazonaws.com/centos7/noarch/osquery-s3-centos7-repo-1-0.0.noarch.rpm
 67 | }
 68 | 
 69 | function repo_postgresql_ubuntu() {
 70 |   log "Adding PostgreSQL repository keys"
 71 |   wget --quiet -O - https://postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
 72 |   log "Adding PostgreSQL repository"
 73 |   sudo add-apt-repository "deb https://apt.postgresql.org/pub/repos/apt/ trusty-pgdg main" -y
 74 | }
 75 | 
 76 | function self_signed_cert() {
 77 |   local __dir=$1
 78 |   local __cert="$__dir/certificate.crt"
 79 |   local __key="$__dir/private.key"
 80 |   local __subj="/C=US/O=doorman/CN=localhost"
 81 | 
 82 |   log "Setting up server SSL certificates"
 83 |   sudo mkdir -p $__dir
 84 |   log "Generating doorman key: $__key"
 85 |   sudo openssl genrsa -out $__key 2048
 86 |   log "Generating doorman certificate: $__cert"
 87 |   sudo openssl req -x509 -new -nodes -key $__key -days 365 -out $__cert -subj $__subj
 88 | }
 89 | 
 90 | function own_cert() {
 91 |   local __cert=$1
 92 |   local __key=$2
 93 |   local __dir=$3
 94 | 
 95 |   log "Using own certificate ($__cert) and key ($__key)"
 96 |   sudo cp "$__cert" "$__dir/certificate.crt"
 97 |   sudo cp "$__key" "$__dir/private.key"
 98 | }
 99 | 
100 | function letsencrypt_cert() {
101 |   local __email=$1
102 |   local __domain=$2
103 |   local __dir=$3
104 | 
105 |   dl "https://dl.eff.org/certbot-auto" /usr/bin/certbot-auto
106 |   sudo chmod a+x /usr/bin/certbot-auto
107 |   /usr/bin/certbot-auto certonly -n --agree-tos --standalone --standalone-supported-challenges tls-sni-01 -m "$__email" -d "$__domain"
108 |   sudo ln -s "/etc/letsencrypt/live/$__domain/cert.pem" "$__cert"
109 |   sudo ln -s "/etc/letsencrypt/live/$__domain/privkey.pem" "$__key"
110 | }
111 | 
112 | function setup_postgresql() {
113 |   local __path=$1
114 |   local __port=$2
115 |   local __owner=$3
116 | 
117 |   log "PostgreSQL permissions"
118 |   sudo cp tools/pg_hba.conf /etc/postgresql/9.4/main/pg_hba.conf
119 |   sudo su - $__owner -c 'service postgresql restart'
120 |   log "Setting up PostgreSQL in $__path, on port $__port"
121 |   sudo mkdir -p $__path
122 |   sudo chown $__owner.$__owner $__path
123 |   sudo su - $__owner -c "/usr/lib/postgresql/9.4/bin/initdb $__path"
124 |   sudo su - $__owner -c "/usr/lib/postgresql/9.4/bin/pg_ctl -D $__path -l $__path/pg.log -o -p$__port start"
125 |   sudo su - $__owner -c "/usr/lib/postgresql/9.4/bin/createdb -h localhost -p $__port doorman"
126 | }
127 | 
128 | function setup_nginx() {
129 |   log "Setting up nginx as proxy"
130 |   sudo cp /vagrant/tools/nginx.conf /etc/nginx/sites-available/default
131 |   sudo service nginx restart
132 | }
133 | 


--------------------------------------------------------------------------------
/tools/motd-doorman.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | printf "      _                                         \n"
 4 | printf "     | |                                        \n"
 5 | printf "   __| | ___   ___  _ __ _ __ ___   __ _ _ __   \n"
 6 | printf "  / _\` |/ _ \\ / _ \\| '__| '_ \` _ \\ / _\` | '_ \\  \n"
 7 | printf " | (_| | (_) | (_) | |  | | | | | | (_| | | | | \n"
 8 | printf "  \\__,_|\\___/ \\___/|_|  |_| |_| |_|\\__,_|_| |_| \n"
 9 | printf "                                                \n"
10 | printf "                                                \n"
11 | 


--------------------------------------------------------------------------------
/tools/nginx.conf:
--------------------------------------------------------------------------------
 1 | server {
 2 |   listen 80;
 3 | 
 4 |   location / {
 5 |     proxy_pass https://127.0.0.1:5000;
 6 |     proxy_http_version 1.1;
 7 |     proxy_set_header Upgrade $http_upgrade;
 8 |     proxy_set_header Connection 'upgrade';
 9 |     proxy_set_header Host $host;
10 |     proxy_cache_bypass $http_upgrade;
11 |   }
12 | }
13 | 


--------------------------------------------------------------------------------
/tools/osquery.flags:
--------------------------------------------------------------------------------
 1 | --pidfile=/tmp/osquery.pid
 2 | --host_identifier=uuid
 3 | --database_path=/tmp/osquery.db
 4 | --config_plugin=tls
 5 | --config_tls_endpoint=/config
 6 | --config_tls_refresh=10
 7 | --config_tls_max_attempts=3
 8 | --enroll_tls_endpoint=/enroll
 9 | --enroll_secret_env=ENROLL_SECRET
10 | --disable_distributed=false
11 | --distributed_plugin=tls
12 | --distributed_interval=10
13 | --distributed_tls_max_attempts=3
14 | --distributed_tls_read_endpoint=/distributed/read
15 | --distributed_tls_write_endpoint=/distributed/write
16 | --logger_plugin=tls
17 | --logger_tls_endpoint=/log
18 | --logger_tls_period=5
19 | --tls_hostname=localhost:5000
20 | --tls_server_certs=/opt/doorman/certificate.crt
21 | --log_result_events=false
22 | --pack_delimiter=/
23 | --utc
24 | --verbose
25 | --tls_dump=true
26 | 


--------------------------------------------------------------------------------
/tools/pg_hba.conf:
--------------------------------------------------------------------------------
 1 | # PostgreSQL Client Authentication Configuration File
 2 | # ===================================================
 3 | #
 4 | # Database administrative login by Unix domain socket
 5 | local   all             postgres                                trust
 6 | # TYPE  DATABASE        USER            ADDRESS                 METHOD
 7 | # "local" is for Unix domain socket connections only
 8 | local   all             all                                     trust
 9 | # IPv4 local connections:
10 | host    all             all             127.0.0.1/32            trust
11 | # IPv6 local connections:
12 | host    all             all             ::1/128                 trust
13 | 


--------------------------------------------------------------------------------