mirror of
https://github.com/EFForg/rayhunter.git
synced 2026-05-30 14:29:26 -07:00
54de3b3a38
https://github.com/EFForg/rayhunter/pull/888 contained an entire set of iptables rules to ensure that no traffic leaked. We know that many of these devices are fairly insecure, that's how we get rayhunter installed on most of them. But if an attacker already is able to run commands on this device, they are most likely going to be able to run iptables -F too. We should discuss real threatmodels before adding stuff like this, because messing with iptables also just makes accidental bricking more likely (see the moxee disk space fiasco)
83 lines
3.2 KiB
TOML
83 lines
3.2 KiB
TOML
# cat config.toml
|
|
qmdl_store_path = "/data/rayhunter/qmdl"
|
|
port = 8080
|
|
debug_mode = false
|
|
colorblind_mode = false
|
|
# Device selection. This will be overwritten by the installer. Defaults to "orbic".
|
|
#device = "orbic"
|
|
# UI Levels:
|
|
#
|
|
# Orbic and TP-Link with color display:
|
|
# 0 = invisible mode, no indicator that rayhunter is running
|
|
# 1 = Subtle mode, display a colored line at the top of the screen when rayhunter is running (green=running, white=paused, red=warnings)
|
|
# 2 = Demo Mode, display a fun orca gif
|
|
# 3 = display the EFF logo
|
|
# 4 = High Visibility mode, fill the entire screen with the status color (green=running, white=paused, red=warnings)
|
|
#
|
|
# TP-Link with one-bit display:
|
|
# 0 = invisible mode
|
|
# 1..3 = show emoji for status. :) for running, ! for warnings, no mouth for paused.
|
|
ui_level = 1
|
|
|
|
# 0 = rayhunter does not read button presses
|
|
# 1 = double-tapping the power button starts new recording
|
|
key_input_mode = 0
|
|
|
|
# If set, attempts to send a notification to the url when a new warning is triggered
|
|
# ntfy_url = "https://ntfy.sh/your-topic"
|
|
# What notification types to enable. Does nothing if the above ntfy_url is not set.
|
|
enabled_notifications = ["Warning", "LowBattery"]
|
|
|
|
# Disk Space Management
|
|
# Minimum free space (MB) required to start recording
|
|
min_space_to_start_recording_mb = 1
|
|
# Minimum free space (MB) to continue recording (stops if below this)
|
|
min_space_to_continue_recording_mb = 1
|
|
|
|
# WiFi Client Mode
|
|
# Toggle wifi_enabled to connect the device to an existing WiFi network.
|
|
# Credentials are stored separately in wpa_sta.conf and managed via the web UI.
|
|
wifi_enabled = false
|
|
|
|
# DNS servers to use when WiFi client mode is active.
|
|
# Defaults to ["9.9.9.9", "149.112.112.112"] (Quad9) if not specified.
|
|
# dns_servers = ["9.9.9.9", "149.112.112.112"]
|
|
|
|
# WebDAV Upload
|
|
# If a [webdav] section is present, finished recordings (both the raw .qmdl file
|
|
# and its .ndjson analysis output) are uploaded in the background to a WebDAV
|
|
# server once they've been closed for at least min_age_secs. After a successful
|
|
# upload the entry is either marked as uploaded in the manifest, or deleted
|
|
# locally if delete_on_upload = true. With no [webdav] section, no upload
|
|
# worker runs.
|
|
#
|
|
# [webdav]
|
|
# host = "https://dav.example.com"
|
|
# remote_path = "/rayhunter"
|
|
# # HTTP Basic auth. Both fields are optional; a password without a username is
|
|
# # rejected and the request is sent unauthenticated.
|
|
# username = "user"
|
|
# password = "pass"
|
|
# # Timeout in seconds for each upload request (default 300).
|
|
# upload_timeout_secs = 300
|
|
# # How often the worker scans for eligible entries (default 3600).
|
|
# poll_interval_secs = 3600
|
|
# # Minimum age in seconds before an entry becomes eligible for upload
|
|
# # (default 86400 = 1 day).
|
|
# min_age_secs = 86400
|
|
# # Delete the entry locally after a successful upload (default false).
|
|
# delete_on_upload = false
|
|
|
|
# Analyzer Configuration
|
|
# Enable/disable specific IMSI catcher detection heuristics
|
|
# See https://github.com/EFForg/rayhunter/blob/main/doc/heuristics.md for details
|
|
[analyzers]
|
|
imsi_requested = true
|
|
connection_redirect_2g_downgrade = true
|
|
lte_sib6_and_7_downgrade = true
|
|
null_cipher = true
|
|
nas_null_cipher = true
|
|
incomplete_sib = true
|
|
test_analyzer = false
|
|
diagnostic_analyzer = true
|