oliverdrechsler/madwas

(M)onitor (A)RP queries and (D)NS queries to (w)akeup (a) (S)erver

MADwaS - Monitor ARP queries and DNS queries to wakeup a Server

• MADwaS - Monitor ARP queries and DNS queries to wakeup a Server
  • Intro
  • UseCase
  • minimum requirements
  • first time setup
  • run script as a systemd service
  • config.yaml parameters should be self explained

Intro

MADwaS - (M)onitor (A)RP queries and (D)NS queries to (w)akeup one or more (S)ervers

This script sniffs on a network interface for:

• for one or multiple specific DNS Name query request (specified in config file) and
• for one or multiple specific ARP (who has) IPAddress requests (also specified in config yaml file)

It checks if a destination ip (server) is alive via icmp.
If not it sends a wake on lan magic packet and waits for a defined time period for the next check.
If a wakeup paket is send, it sends via local available mail service a notification mail about the wake up event.

UseCase

I run at home a VDR home theater pc.
This computer also acts as my file server (samba).
To save power consumption, this PC is often powered of.
It powers it self on for recording TV shows and powers off it self.
For that i use some plugins like EPGSearch and ACPIWakeup.
So, mostly when i want to access my files the VDR is often powered off and my
File Server is not accessable.
To power on my VDR via LAN, i use the wake on lan feature.
But there's no independend place who does it automatically for my.
Okay, you can maybe run a wake on lan script on your client PC.
But i want automaticylly power on my VDR File Server when i come at home.
I use the PhotoSync App on my smartphone
to automatically tranfer all new photos to the VDR Server.
This is done via GeoFencing and when my smartphone connects into my WLAN.
So, i must nothing do, magic things happens and i have every time my fotos backuped.

For that use case i need a independend third instance.
I have a Raspberry Pi running in my LAN which permanently powered on.
PIHOLE runs on this one, but this does not play a role for my program/script.
It just has to run permanently somewhere.

minimum requirements

• sudo / root permissions to run dns_wol.py script
• min. Python 3.6
• Python pip installed
• sendmail or other mail daemon running on host to send a mail i case of a wake up event occured
• LAN interface must be in the same LAN/VLAN or WLAN as File Server

LAN Device dependend capability:

• connected to a LAN Switch Device - only ARP (who has) queries will work
• connected to a LAN HUB Device - DNS queries will work
• connected to a LAN Switch Device - but script runs on a DNS Server or PiHole, DNS queries will also work
• connected to WLAN - WLAN Router must allow communication between WLAN Device - otherwise nothing will work.

Host:

• must be every time powered on

first time setup

clone repo and configure settings

git clone https://github.com/od2017/MADwaS.git
cd MADwaS
cp dns_wol.py /usr/local/bin
cp config_template.yaml /usr/bin/local/config.yaml
cp log_config /usr/bin/local
vi /usr/local/bin/config.yaml  # modify config.yaml to your needs

install python dependencies

pip install -r requirements
python3 dns_wol.py  # run first time - test and watch console output

run script as a systemd service

The file dns_wol.service is a example file for systemd and must be adjusted to
your personal needs. Copy the file to /etc/systemd/system.
And run bash systemctl enable dns_wol.service command to enable this new service.
To start service run systemctl start dns_wol.service

config.yaml parameters should be self explained

Create a copy config.yal out of file config_template.yaml and customize it to your needs

madwas's Issues

harden logging load of log_config.yaml because of possible arbitrary code execution

pyyaml is a YAML parser and emitter for Python.
Affected versions of this package are vulnerable to Arbitrary Code Execution. It processes untrusted YAML files through the full_load method or with the FullLoader loader. This is due to an incomplete fix for CVE-2020-1747
Remediation
There is no fixed version for pyyaml.

Configuring loggers is security-sensitive. It has led in the past to the following vulnerabilities:
CVE-2018-0285
CVE-2000-1127
CVE-2017-15113
CVE-2015-5742
Sensitive Code Example

import logging
from logging import Logger, Handler, Filter
from logging.config import fileConfig, dictConfig

logging.basicConfig()  # Sensitive
logging.disable()  # Sensitive


def update_logging(logger_class):
    logging.setLoggerClass(logger_class)  # Sensitive


def set_last_resort(last_resort):
    logging.lastResort = last_resort  # Sensitive


class CustomLogger(Logger):  # Sensitive
    pass


class CustomHandler(Handler):  # Sensitive
    pass


class CustomFilter(Filter):  # Sensitive
    pass


def update_config(path, config):
    fileConfig(path)  # Sensitive
    dictConfig(config)  # Sensitive