Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/olmax99/sftppush
#+TITLE: Sftppush Event Pipeline #+SETUPFILE: ~/s3olmax/org/conf/setup.config #+FILETAGS: :sftpush:golang:go-channels:cobra:viper:
The sftppush is a mini pipeline for =file write-close event > decompress > s3 archive=.
Initially, it was intended to replace i.e. low-compute serverless functions that would simply push files from the Sftp server into an S3 Bucket location. Instead of mounting an Sftp server's file system directly onto S3 FUSE this solution seems to be more fit for production use cases.
#+CAPTION: concurrency #+attr_html: :width 100% [[file:images/sftppush_concurrency_design.png][file:./images/sftppush_concurrency_design.png]]
Most likely you want to run this project inside an Sftp server, which receives a constant stream of data files.
The sftppush project is intended to run in a Linux (Ubuntu/Debian) VM. It captures WRITE_CLOSE events for files on the file system based on a single or multiple source directories.
The =watch --source= flag can read a single directory as well as a configuration file containing multiple directories. In case of multiple directory targets there will be a separate =go watch process= spawned for each target directory, respectively.
*** Ubuntu/Debian #+begin_src bash $ git clone https://github.com/olmax99/sftppush.git $ cd sftppush
$ make build $ ./bin/sftppush-0.1.0-linux_amd64 help #+end_src
This will create a new binary in =./bin/sftppush-0.2.2-linux_amd64=.
** 2. Create a configuration file Recommended: Create =config.yaml= in project root and set flag =--config= or =-c=.
#+BEGIN_EXAMPLE All source directories for fsnotify are determined by: <defaults.userpath> + <watch.source.name> + <watch.source.paths> #+END_EXAMPLE
=./config.yaml= #+BEGIN_SRC yaml defaults: userpath: # Set by default, can be overwritten here or with environment variable s3target: olmax-test-sftppush-126912 awsprofile: *** awsregion: ***
watch: source: - name: sftpuser1 paths: - /path/to/source/directory1 - /path/to/source/directory2 # - name: sftpuser2 # paths: # - path/to/source/directory1 # s3target: olmax-test-sftppush-126912 #+END_SRC
By default (without =log:=) =Sftppush= will try to use =~/.sftppush/sftppush.log=.
** 3. Run the event watcher on a single local directory If a config files is created there is no need to set the =--source= flags. Flags will overwrite config file values.
Running it should be as simple as: #+BEGIN_SRC bash $ ./bin/sftppush-0.2.0-linux_amd64 --config config.yaml watch
$ SFTPPUSH_DEFAULTS_S3TARGET=*** SFTPPUSH_DEFAULTS_AWSPROFILE=***
./bin/sftppush-0.2.0-linux_amd64 watch
--source="name=sftpuser1,paths=/device1/data /device2/data"
--source="name=sftpuser2,paths=/device1/data /device2/data"
$ SFTPPUSH_DEFAULTS_USERPATH="/home/my_test_dir/" ./bin/sftppush-0.2.0-linux_amd64 -c config.yaml #+END_SRC
#+END_SRC
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.31.0 #+END_SRC
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.