erislite - A modular Linux security monitoring toolkit for an

项目说明

ErisLITE

<p align="center">
<img src="assets/images/erislite_banner.png" alt="ErisLITE" width="600"/>
</p>

!Python
!License
!Status
!

*A modular Linux security monitoring and triage toolkit for analysts, students, and system administrators.*

ErisLITE is a standalone CLI toolkit for interacti auditing, host triage, and competition-focused incident response on Linux systems.

Run threat sweeps, inspect system configuration, review historical findings, capture host snapshots, and perform rapid-response actions without requiring external infrastructure or cloud services.

ErisLITE is designed primarily for CCDC-style competition en, cybersecurity students, analysts, and administrators who need fast, readable, local-first host .

---

Features

Security Checks

| Module | What it checks |
|--------|----------------|
| Posture Snapshot | High-le posture and host exposure |
| Network Listeners | Active TCP/UDP listeners with contextual risk classification |
| User Account Scan | UID anomalies, shell configuration, suspicious accounts |
| Login / Auth Logs | Failed logins, interactive root shells, recent login activity |
| Kernel Modules | Known-bad, unresolved, or unusually located kernel modules |
| File Integrity | Profile-specific SHA-256 baselines with incomplete-scan and expected-absence handling |
| World-Writable Files | Writable execution and persistence paths in sensiti |
| SUID / SGID | Unexpected pri executables and risky locations |
| Cron / Timers | Suspicious cron jobs, periodic scripts, and systemd timer services |
| SSH Config Audit | Explicit sshd_config settings against the ErisLITE hardening baseline |
| SSH Key Check | Authorized key enumeration and pri key review |
| Hosts Tamper Check | Suspicious /etc/hosts redirects and hostname mappings |
| Process Anomaly Scan | Suspicious execution paths, deleted binaries, and process indicators |
| Docker Security | Pri containers, sensiti, and Docker socket exposure |
| Firewall Status | UFW, firewalld, nftables, and iptables state |
| C Check | Offline software- matching against the local C |
| Backdoor Detection | Shell init, profile, and LD_PRELOAD persistence indicators |

Threat Sweep

Threat Sweep combines selected modules into structured security profiles:

| Profile | Scope |
|---------|-------|
| quick | Listeners, users, authentication |
| standard | Integrity, listeners, users, authentication, C |
| full | Full host security and persistence assessment |

Threat Sweep provides:

Risk is displayed relative to the checks that actually ran. For example:

Odyssey Lite (Deception)

Odyssey Lite runs lightweight TCP canary listeners on ports that nothing legitimate should use. Any connection to a canary is recorded as an early-warning event: someone is scanning or probing the host.

Canaries accept a connection, record it and close it immediately. They never send data or emulate a service.

| Port | Decoy | Se |
|------|-------|----------|
| 2121 | FTP (alternate) | Medium |
| 2222 | SSH (alternate) | High |
| 2323 | Telnet (alternate) | High |
| 3389 | RDP | High |
| 8080 | HTTP (alternate) | Medium |

Odyssey Lite provides:

Additional Tools

| Tool | What it does |
|------|--------------|
| System Snapshot | Captures host, network, routing, and posture information to a timestamped log |
| Snapshot Log | Reviews pre captured system snapshots |
| Sweep Log | Browses recent Threat Sweeps and full per-module reports |
| SOC Mode | Repeated host posture collection for short-duration monitoring |
| Rapid Response | Triage, dry-run containment, li actions, firewall-aware IP blocking, and rollback support |
| Shell Console | Restricted analyst console with hardened command resolution and execution controls |
| C | Offline C against the local cache |

CLI

---

Requirements

---

Installation

---

Usage

Typical workflow:
1. Launch ErisLITE
2. Select Security Tools from the main menu
3. Run indi checks or select Run Threat Sweep
4. Review findings and risk score
5. Open View Recent Threat Sweeps to review past results

---

Project Structure

---

First Run Notes

Integrity baseline — File Integrity requires a baseline before it can detect changes. On first run, go to Security Tools → File Integrity → Create Integrity Baseline and choose the appropriate critical, system, or user profile. Runtime integrity data is stored under data/integrity/ and is gitignored by design.

ErisLITE v1.4 keeps separate baselines per profile, records files that were expected to be absent when the baseline was created, distinguishes changed files from incomplete inspection, and reports collection/read failures instead of treating them as clean results. Protected files may require root pri for complete co.

User profile — ErisLITE maintains user and host profile information used by portions of the CLI and snapshot tooling. Runtime user data is stored under ~/.erislite/.

Root access — some checks require elevated pri for complete results, including authentication logs, kernel modules, SUID/SGID inspection, protected integrity targets, process inspection, and portions of persistence scanning. Run with sudo when full host co is required.

C checker — performs offline matching against the local C. A match does not confirm a . frequently backport fixes without changing the upstream string. Always findings against ad.

Threat Sweep history — historical sweeps are stored under data/logs/threat_sweeps/. The latest sweep summary is also stored at ~/.erislite/last_sweep.json.

Odyssey Lite canaries — canaries bind on all interfaces. Before starting Odyssey in a competition en, confirm none of the default ports (2121, 2222, 2323, 3389, 8080) belong to a scored service. Ports 8080 and 3389 are the most likely conflicts. If a port is already in use, Odyssey starts the canaries it can and lists the una ports. The status panel keeps showing them, and Listener Status marks them FAILED. Canaries run until you stop them or exit ErisLITE. Repeat connections from the same source to the same canary within 5 seconds are not logged as separate events. Instead, ErisLITE writes a repeat_summary record with the count and the first and last times seen when the window closes, when you stop Odyssey or when you clear events, so the log accounts for every connection. Events are written to erislite/data/logs/odyssey/odyssey_events.jsonl, which rotates at 5 MB and keeps three backups. ErisLITE refuses to write the log if the directory or file is a symlink, a hard link or owned by another user, and the status panel shows Event log: FAILING with the reason. Clear Events only clears the in-session view, not the log file.

Rapid Response live mode — Rapid Response includes dry-run and li actions. Live mode can modify system state, terminate processes, change firewall behavior, and perform other containment actions. Review dry-run output before executing li.

---

De

ErisLITE uses a domain-oriented package structure. New modules should be placed in the appropriate package under erislite/.

A security check should support structured non-interacti:

---

License

MIT License — see LICENSE for details.

---

Author

Liam Piper-Brandon (Stackdefender)

---

Disclaimer

ErisLITE is intended for use on systems you own or ha written authorisation to audit. Unauthorised use against systems you do not own or ha to test is illegal and unethical. The author accepts no responsibility for misuse.

The C checker performs offline matching only. A match does not confirm a — frequently backport patches without changing the base number. Do not treat a match as a confirmed finding without against ad.

Rapid Response includes li functionality that can modify system state or disrupt services. Always review dry-run output first. Use li only on systems you are authorised to modify and only when you understand the actions being performed.

This software is provided as-is with no warranty of any kind. The author accepts no liability for damages, data loss, or service disruption resulting from its use.

项目信息

开发语言：Python

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A modular Linux security monitoring toolkit for analysts, students and system administrators.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。