evilsocket/opensnitch
Opensnitch
Opensnitch is a host-based application firewall for Linux that monitors and intercepts outbound network connections in real time. By hooking into kernel-level interfaces, it tracks system-wide network activity and maps connection attempts to specific local processes, allowing users to explicitly permit or deny traffic on a per-application basis.
The project distinguishes itself through its ability to manage security policies across multiple distributed nodes from a single, unified dashboard. This centralized management is secured via encrypted socket communication, enabling consistent rule enforcement and monitoring across remote machines. It further supports granular control by validating executable integrity, filtering based on environment variables, and isolating process network access to prevent unauthorized data transmission.
Beyond basic filtering, the system provides comprehensive observability tools, including real-time connection inspection, traffic logging, and the ability to export security events to external management systems. Users can define complex, prioritized rule sets that incorporate blocklists, temporary access durations, and path-based restrictions to secure their environment against unauthorized communication.
Features
- Firewalls - Monitors and intercepts outbound network connections, prompting users to allow or deny traffic per process.
- Application Access Controls - Prompts for user approval before allowing applications to establish network connections.
- Network Access Control - Restricts network access for specific processes by prompting for user approval or applying rules based on executable paths.
- Outbound Network Blockers - Hooks kernel functions to monitor and capture connection details for all processes to prevent unauthorized data transmission.
- Traffic Filtering - Configures granular filtering for network connections by specifying executable paths, destination hosts, and ports.
- Traffic Monitoring Tools - Provides real-time monitoring and logging of outbound network traffic mapped to specific local processes.
- Distributed Firewall Orchestration - Enables centralized management and monitoring of security policies across multiple distributed network nodes.
- Distributed Policy Management - Manages security policies across multiple distributed nodes from a single, unified dashboard.
- Firewall Configurations - Provides a graphical interface to list, edit, and perform batch operations on traffic filtering rules.
- Firewall Policies - Manages and monitors network security rules across multiple distributed nodes from a single unified dashboard.
- Kernel Networking Hooks - Hooks into kernel-level interfaces to intercept and capture system-wide network connection attempts in real time.
- Secure Node Networking - Encrypts network traffic between distributed nodes using security certificates to prevent unauthorized interception.
- Security Policy Management - Provides a centralized dashboard for managing firewall rules and security policies across multiple distributed network nodes.
- Alerting Systems - Alerts users to new or unauthorized connection attempts in real time.
- Real Time Process Monitors - Tracks and displays real-time system events and network behavior associated with specific running applications.
- Security Logging and SIEM - Application firewall for GNU/Linux systems.
- Network Security and Proxies - Interactive application firewall for Linux.
- Security And Forensics - Application firewall for monitoring network connections.
- Traffic Filtering Rules - Matches network connection requests against prioritized user-defined policies based on process paths and destination endpoints.
- Runtime and Process Isolation - Requires individual authorization for every process and subprocess to prevent unauthorized network permission inheritance.
- Domain Blocklists - Supports blocking outbound connections based on external lists of domains, IP addresses, and file hashes.
- Binary Integrity Verification - Validates the checksum of an application to prevent unauthorized or modified binaries from establishing connections.
- Network Traffic Analyzers - Tracks and logs real-time system-wide network activity, mapping connection attempts to specific local processes.
- System Activity Monitoring - Observes and logs real-time network socket activity and process behavior to identify suspicious communication patterns.
- Client Connection Inspections - Provides a real-time view of current network sockets and associated node activity to offer visibility into communication states.
- Temporary Access Rules - Allows setting expiration durations for rules to permit specific network connections only for a limited time.
- Process Environment Filtering - Prevents or permits network connections based on process environment variables to mitigate malicious activity like library injection.
- Path Access Restrictions - Restricts network access for executables running from temporary directories or other untrusted locations.
- Event Monitoring Systems - Streams intercepted network connection events to external logging systems for centralized security analysis.
- Security Audit Logs - Streams intercepted network connection events to external management systems for centralized analysis and auditing.
- Network Policy Enforcement - Applies global allow or deny actions to handle network requests when no specific rule matches.
- Log Querying - Enables filtering and searching of connection logs using criteria based on process metadata and network endpoints.
- Background Daemons - Runs a background service that evaluates intercepted connection events against persistent rule sets to determine traffic access.
- Rule Priority Logic - Evaluates network access policies based on explicit priority flags to determine whether to permit or reject connection attempts.
