Move away from crontabs

.github/workflows/release.yml

@@ -51,5 +51,4 @@ jobs:
  labels: ${{ steps.meta.outputs.labels }}
  build-args: |
  GO_DNSCOLLECTOR_VERSION=0.35.0
- SUPERCRONIC_VERSION=v0.2.26
  PDNSSOC_CLI_VERSION=0.0.2.dev5

.github/workflows/release_rolling.yml

@@ -43,5 +43,4 @@ jobs:
  labels: ${{ steps.meta.outputs.labels }}
  build-args: |
  GO_DNSCOLLECTOR_VERSION=0.35.0
- SUPERCRONIC_VERSION=v0.2.26
- PDNSSOC_CLI_VERSION=0.0.2.dev7
+ PDNSSOC_CLI_VERSION=0.0.2.dev8

README.md

@@ -152,8 +152,7 @@ All of the previous steps for the server part can be automated using the dockeri
 In case you need to re-build the image, please use the following (after adjusting the tags to match the latest dependency versions):
 ```sh
 cd files/docker
-docker build . -t pdnssoc --build-arg GO_DNSCOLLECTOR_VERSION="0.35.0" --build-arg PDNSSOC_CLI_VERSION="v0.0.2" --build-arg SUPERCRONIC_VERSION=
-"v0.2.26"
+docker build . -t pdnssoc --build-arg GO_DNSCOLLECTOR_VERSION="0.35.0" --build-arg PDNSSOC_CLI_VERSION="v0.0.2"
 ```
 
 

files/configuration/pdnssoccli/pdnssoccli.yml

@@ -3,10 +3,21 @@ logging_level: "INFO"
 misp_servers:
  - domain: "https://misp1.myserver.org/"
  api_key: "API_KEY_1"
- args: {}
+ args:
+ enforce_warninglist: True
 
 correlation:
+ input_dir: /var/dnscollector/queries
  output_dir: /var/dnscollector/alerts
  malicious_domains_file: /var/dnscollector/misp_domains.txt
  malicious_ips_file: /var/dnscollector/misp_ips.txt
- last_correlation_pointer_file: /var/dnscollector/correlation.last
+ last_correlation_pointer_file: /var/dnscollector/correlation.last
+ last_retro_pointer_file: /var/dnscollector/repo.last
+
+schedules:
+ fetch_iocs:
+ interval: 10 # minutes
+ correlation:
+ interval: 1 # minutes
+ retro:
+ interval: 1440 # minutes

files/docker/Dockerfile

@@ -2,11 +2,6 @@ FROM python:3.11-alpine
 
 ARG GO_DNSCOLLECTOR_VERSION
 ARG PDNSSOC_CLI_VERSION
-ARG SUPERCRONIC_VERSION
-
-ENV SUPERCRONIC_URL="https://github.com/aptible/supercronic/releases/download/$SUPERCRONIC_VERSION/supercronic-linux-amd64" \
- SUPERCRONIC=supercronic-linux-amd64 \
- SUPERCRONIC_SHA1SUM=7a79496cf8ad899b99a719355d4db27422396735
 
 RUN apk add --no-cache --update \
  bash \
@@ -36,13 +31,6 @@ RUN curl -LO "https://github.com/dmachard/go-dnscollector/releases/download/v${
 
 RUN mkdir /etc/dnscollector
 
-# Install supercronic
-RUN curl -fsSLO "$SUPERCRONIC_URL" \
- && echo "${SUPERCRONIC_SHA1SUM} ${SUPERCRONIC}" | sha1sum -c - \
- && chmod +x "$SUPERCRONIC" \
- && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
- && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
-
 RUN pip install superfsmon
 
 # Setup supervisord

files/docker/docker-compose.yml

@@ -11,5 +11,4 @@ services:
  - "6000:6000"
  volumes:
  - ./logs:/var/dnscollector/ # Logging destination
- - ./crontab:/etc/crontab
  - ./pdnssoccli.yml:/etc/pdnssoccli.yml

files/docker/pdnssoccli.yml

@@ -6,7 +6,17 @@ misp_servers:
  args: {}
 
 correlation:
+ input_dir: /var/dnscollector/queries
  output_dir: /var/dnscollector/alerts
  malicious_domains_file: /var/dnscollector/misp_domains.txt
  malicious_ips_file: /var/dnscollector/misp_ips.txt
- last_correlation_pointer_file: /var/dnscollector/correlation.last
+ last_correlation_pointer_file: /var/dnscollector/correlation.last
+ last_retro_pointer_file: /var/dnscollector/repo.last
+
+schedules:
+ fetch_iocs:
+ interval: 10 # minutes
+ correlation:
+ interval: 1 # minutes
+ retro:
+ interval: 1440 # minutes

files/docker/supervisord.conf

@@ -15,11 +15,11 @@ stdout_logfile_maxbytes=0
 redirect_stderr=true
 command=/bin/bash -c "go-dnscollector -config /etc/dnscollector/config.yml"
 
-[program:supercronic]
+[program:pdnssoccli]
 stdout_logfile=/dev/fd/1
 stdout_logfile_maxbytes=0
 redirect_stderr=true
-command=/bin/bash -c "supercronic /etc/crontab"
+command=/bin/bash -c "pdnssoc-cli -c /etc/pdnssoccli.yml daemonize"
 
 [program:superfsmon]
 command=/bin/bash -c "superfsmon /var/dnscollector dnscollector -r *.txt"