Skip to content
forked from k4yt3x/scutum

Linux Automatic ARP (TCP / UDP / ICMP) Firewall

License

Notifications You must be signed in to change notification settings

heikipikker/SCUTUM

 
 

Repository files navigation

Join the chat at https://gitter.im/K4YT3X-DEV/SCUTUM status

SCUTUM Firewall

Current Version: 2.6.1

It is now recommended to upgrade scutum with --upgrade parameter (since 2.5.2)
Never mind. Please run the installation below again manually.


Quick Install

Prerequisites

  • Designed for Linux OS
  • curl or wget is required for quick install
  • git should be installed

SCUTUM Dependencies can be found in DEPENDENCIES.md

via curl

$ sudo sh -c "$(curl -fsSL https://raw.githubusercontent.com/K4YT3X/SCUTUM/master/quickinstall.sh)"

via wget

$ sudo sh -c "$(wget https://raw.githubusercontent.com/K4YT3X/SCUTUM/master/quickinstall.sh -O -)"

Current Version Change log:

  1. UFW can now be managed with SCUTUM
  2. Fixed some logger issues
  3. A LOT of other small improvements (eg. documentations)
  4. Fixed & Improved the Installation Mathod
  5. Changed TCP/UDP/ICMP Firewall to UFW
  6. Added new logger
  7. Added Easy TCP port manager
  8. Created different class for adapter controller
  9. Created different class for Installer
  10. Registers SCUTUM as a systemd system service
  11. Changed the way configurations are being stored (configparser)

scutum_gui

TODO:

  1. Fix self-upgrade feature
  2. Create 2.6.1 Release for Debian

Recent Changes:

  1. Added Self-Upgrading Function, now users can execute self-upgrading with $ sudo scutum --upgrade
  2. Added AVALON Framework Self-Upgrading function (included when using "--upgrade" parameter)
  3. Interfaces are now controlled by a new interface controller class
  4. SCUTUM GUI is now avaliable for testing
  5. Added option to choose whether to delete the installer file after installation
  6. Fixed arptables detection errors on some Linux distributions

What is SCUTUM?

Long story short, ARP firewall. It automatically adds gateways to the whitelist on connect and blocks everthing else to avoid potential threat.

SCUTUM is an ARP firewall that prevents your computer from being ARP-spoofed by other computers on LAN. SCUTUM controls "arptables" in your computer so it accepts ARP packets only from the gateway. This way, when people with malicious intentions cannot spoof your arp table. SCUTUM also prevents other people from detecting your device on LAN if SCUTUM is used with properly configured TCP/UDP firewall.

SCUTUM is also capable of handling tcp/udp/icmp traffic with iptables. You can choose to enable this feature during installation. However, a more professional firewall controller like UFW is recommended. They can handle traffic with more precision.


Usage & Installation

You should run a installation before running it for the first time for setting up configuration files. I am not sure if portable version is necessary. If you think this should be changed, raise an issue and I will change it.

Installation

Quick install above is recommended

git clone https://github.com/K4YT3X/SCUTUM.git
cd SCUTUM/
sudo python3 scutum.py --install

GUI Usage (Currently not working)

ENABLE: Enable SCUTUM (Start spontaneously)
DISABLE: Disable SCUTUM (Never start spontaneously)
DISABLE (Temporarily): Disable SCUTUM until the next time connected to a network

Usage

This should be easy SCUTUM starts automatically by itself after installation

$ sudo service scutum start     # Start scutum service
$ sudo service scutum stop      # Stop scutum service
$ sudo systemctl enable scutum  # Start SCUTUM with system
$ sudo systemctl disable scutum # Don't start SCUTUM with system
$ sudo scutum                   # Start SCUTUM Normally
$ sudo scutum --start           # Start SCUTUM Manually for once even it it's disabled
$ sudo scutum --enable          # Enable SCUTUM (Start automatically on connect)
$ sudo scutum --disable         # Disable SCUTUM (Don't start automatically on connect)
$ sudo scutum --reset           # Reset SCUTUM (Allow ALL ARP packages temporarily)
$ sudo scutum --purgelog        # Purge SCUTUM logs
$ sudo scutum --install         # Run scutum installation wizard and install SCUTUM into system
$ sudo scutum --uninstall       # Remove SCUTUM from system completely 
$ sudo scutum --upgrade         # Upgrade SCUTUM and AVALON Framework

SCUTUM Workflow:

postconnect

  1. Connect to Wi-Fi
  2. Accept all ARP packets
  3. Cache gateway MAC address by establishing a socket connection with a timeout of 0
  4. Add Gateway MAC to exception
  5. DROP all ARP packets

[Finished]

postdisconnect

  1. Accept all ARP packets

[Finished]

About

Linux Automatic ARP (TCP / UDP / ICMP) Firewall

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • Python 65.7%
  • C++ 17.7%
  • Makefile 14.4%
  • QMake 1.6%
  • Shell 0.6%