diff --git a/scripts/check_current_clients.py b/scripts/check_current_clients.py new file mode 100644 index 0000000..0f8997c --- /dev/null +++ b/scripts/check_current_clients.py @@ -0,0 +1,12 @@ +import paramiko + +client = paramiko.SSHClient() +client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) +client.connect("140.44.4.11", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) + +cmd = 'k3s kubectl exec -n dns deploy/pihole -c pihole -- tail -n 25 /var/log/pihole/pihole.log' +stdin, stdout, stderr = client.exec_command(cmd) +print("Queries by client on Aerodrome in last 15 min:") +print(stdout.read().decode()) +print("Stderr:", stderr.read().decode()) +client.close() diff --git a/scripts/check_pihole_queries.py b/scripts/check_pihole_queries.py new file mode 100644 index 0000000..2944e58 --- /dev/null +++ b/scripts/check_pihole_queries.py @@ -0,0 +1,34 @@ +import sys +import paramiko + +SSH_KEY = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet" + +def run_ssh_cmd(host, user, cmd, timeout=10): + client = paramiko.SSHClient() + client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) + try: + client.connect(host, username=user, key_filename=SSH_KEY, timeout=timeout) + stdin, stdout, stderr = client.exec_command(cmd, timeout=timeout) + out = stdout.read().decode('utf-8', errors='replace') + err = stderr.read().decode('utf-8', errors='replace') + client.close() + return True, out, err + except Exception as e: + return False, "", str(e) + +print("=== 1. Aerodrome Pi-hole Query Flow ===") +ok, out, err = run_ssh_cmd("140.44.4.11", "root", "k3s kubectl exec -n dns deploy/pihole -c pihole -- pihole status") +print(out.strip()) +ok, out, err = run_ssh_cmd("140.44.4.11", "root", "k3s kubectl exec -n dns deploy/pihole -c pihole -- sqlite3 /etc/pihole/pihole-FTL.db 'SELECT count(*) FROM queries WHERE timestamp > strftime(\"%s\",\"now\",\"-30 minutes\");'") +print(f"Queries in last 30 min: {out.strip()}") +ok, out, err = run_ssh_cmd("140.44.4.11", "root", "k3s kubectl exec -n dns deploy/pihole -c pihole -- sqlite3 /etc/pihole/pihole-FTL.db 'SELECT client, count(*) FROM queries WHERE timestamp > strftime(\"%s\",\"now\",\"-30 minutes\") GROUP BY client ORDER BY count(*) DESC LIMIT 5;'") +print(f"Top clients (last 30m):\n{out.strip()}") + +print("\n=== 2. Spaceport Pi-hole Query Flow ===") +ok, out, err = run_ssh_cmd("140.44.4.41", "root", "k3s kubectl exec -n dns deploy/pihole -c pihole -- pihole status") +print(out.strip()) +ok, out, err = run_ssh_cmd("140.44.4.41", "root", "k3s kubectl exec -n dns deploy/pihole -c pihole -- sqlite3 /etc/pihole/pihole-FTL.db 'SELECT count(*) FROM queries WHERE timestamp > strftime(\"%s\",\"now\",\"-30 minutes\");'") +print(f"Queries in last 30 min: {out.strip()}") +ok, out, err = run_ssh_cmd("140.44.4.41", "root", "k3s kubectl exec -n dns deploy/pihole -c pihole -- sqlite3 /etc/pihole/pihole-FTL.db 'SELECT client, count(*) FROM queries WHERE timestamp > strftime(\"%s\",\"now\",\"-30 minutes\") GROUP BY client ORDER BY count(*) DESC LIMIT 5;'") +print(f"Top clients (last 30m):\n{out.strip()}") + diff --git a/scripts/patch_traffic_policy.py b/scripts/patch_traffic_policy.py new file mode 100644 index 0000000..6f78b86 --- /dev/null +++ b/scripts/patch_traffic_policy.py @@ -0,0 +1,13 @@ +import paramiko + +client = paramiko.SSHClient() +client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) +client.connect("140.44.4.11", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) + +cmd = 'k3s kubectl patch svc -n dns pihole-dns-vip --type=merge -p "{\\"spec\\":{\\"externalTrafficPolicy\\":\\"Local\\"}}"' +stdin, stdout, stderr = client.exec_command(cmd) +print("Patch Aerodrome:") +print(stdout.read().decode()) +print(stderr.read().decode()) +client.close() + diff --git a/scripts/restore_traffic_policy.py b/scripts/restore_traffic_policy.py new file mode 100644 index 0000000..052185b --- /dev/null +++ b/scripts/restore_traffic_policy.py @@ -0,0 +1,13 @@ +import paramiko + +client = paramiko.SSHClient() +client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) +client.connect("140.44.4.11", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) + +cmd = 'k3s kubectl patch svc -n dns pihole-dns-vip --type=merge -p "{\\"spec\\":{\\"externalTrafficPolicy\\":\\"Cluster\\"}}"' +stdin, stdout, stderr = client.exec_command(cmd) +print("Restore Aerodrome:") +print(stdout.read().decode()) +print(stderr.read().decode()) +client.close() + diff --git a/scripts/test_dns_and_pihole_live.py b/scripts/test_dns_and_pihole_live.py new file mode 100644 index 0000000..b43150a --- /dev/null +++ b/scripts/test_dns_and_pihole_live.py @@ -0,0 +1,38 @@ +import paramiko + +SSH_KEY = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet" + +def run_ssh_cmd(host, user, cmd, timeout=10): + client = paramiko.SSHClient() + client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) + try: + client.connect(host, username=user, key_filename=SSH_KEY, timeout=timeout) + stdin, stdout, stderr = client.exec_command(cmd, timeout=timeout) + out = stdout.read().decode('utf-8', errors='replace') + err = stderr.read().decode('utf-8', errors='replace') + client.close() + return True, out, err + except Exception as e: + return False, "", str(e) + +print("=== 1. Testing DNS resolution from nutserver (14.4.4.44, VLAN 50) ===") +for vip, name in [("140.44.4.36", "Aerodrome"), ("140.44.4.65", "Spaceport")]: + ok, out, err = run_ssh_cmd("14.4.4.44", "root", f"nslookup snarfhome.snarfnet.net {vip}") + print(f"[{name} - {vip}]:\n{out.strip()}\n") + +print("=== 2. Testing NTP Peer status from nutserver (14.4.4.44, VLAN 50) ===") +ok, out, err = run_ssh_cmd("14.4.4.44", "root", "chronyc sources") +print(out.strip()) + +print("\n=== 3. Checking Pi-hole Live Query Flow (Aerodrome pod) ===") +ok, out, err = run_ssh_cmd("140.44.4.11", "root", "k3s kubectl exec -n dns deploy/pihole -c pihole -- pihole status") +print(f"Aerodrome Pi-hole Status:\n{out.strip()}") +ok, out, err = run_ssh_cmd("140.44.4.11", "root", "k3s kubectl exec -n dns deploy/pihole -c pihole -- sqlite3 /etc/pihole/pihole-FTL.db 'SELECT client, count(*) FROM queries WHERE timestamp > strftime(\"%s\",\"now\",\"-10 minutes\") GROUP BY client ORDER BY count(*) DESC LIMIT 5;'") +print(f"Top recent clients on Aerodrome (last 10m):\n{out.strip()}") + +print("\n=== 4. Checking Pi-hole Live Query Flow (Spaceport pod) ===") +ok, out, err = run_ssh_cmd("140.44.4.41", "root", "k3s kubectl exec -n dns deploy/pihole -c pihole -- pihole status") +print(f"Spaceport Pi-hole Status:\n{out.strip()}") +ok, out, err = run_ssh_cmd("140.44.4.41", "root", "k3s kubectl exec -n dns deploy/pihole -c pihole -- sqlite3 /etc/pihole/pihole-FTL.db 'SELECT client, count(*) FROM queries WHERE timestamp > strftime(\"%s\",\"now\",\"-10 minutes\") GROUP BY client ORDER BY count(*) DESC LIMIT 5;'") +print(f"Top recent clients on Spaceport (last 10m):\n{out.strip()}") + diff --git a/scripts/test_firewall_and_dns.py b/scripts/test_firewall_and_dns.py new file mode 100644 index 0000000..6c9aa2a --- /dev/null +++ b/scripts/test_firewall_and_dns.py @@ -0,0 +1,47 @@ +import paramiko +import time +import socket + +SSH_KEY = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet" + +def run_ssh_cmd(host, user, cmd, timeout=10): + client = paramiko.SSHClient() + client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) + try: + client.connect(host, username=user, key_filename=SSH_KEY, timeout=timeout) + stdin, stdout, stderr = client.exec_command(cmd, timeout=timeout) + out = stdout.read().decode('utf-8', errors='replace') + err = stderr.read().decode('utf-8', errors='replace') + client.close() + return True, out, err + except Exception as e: + return False, "", str(e) + +print("=== 1. Testing from nutserver (14.4.4.44, VLAN 50 Smart Home) ===") + +# Test DNS resolution to Aerodrome VIP (140.44.4.36) +ok, out, err = run_ssh_cmd("14.4.4.44", "root", "dig @140.44.4.36 snarfhome.snarfnet.net +short +time=2 +tries=1") +print(f"DNS query to 140.44.4.36: {'SUCCESS: ' + out.strip() if ok and out.strip() else 'FAILED: ' + err}") + +# Test DNS resolution to Spaceport VIP (140.44.4.65) +ok, out, err = run_ssh_cmd("14.4.4.44", "root", "dig @140.44.4.65 snarfhome.snarfnet.net +short +time=2 +tries=1") +print(f"DNS query to 140.44.4.65: {'SUCCESS: ' + out.strip() if ok and out.strip() else 'FAILED: ' + err}") + +# Test NTP connectivity to Aerodrome Master (140.44.4.11) +ok, out, err = run_ssh_cmd("14.4.4.44", "root", "chronyc sources -v 2>&1") +print(f"NTP query to 140.44.4.11:\n{out.strip()[:300]}") + +# Test BLOCKING: nutserver (VLAN 50) -> Compute (140.44.4.11:22) +print("\n=== 2. Testing Firewall Drop: Smart Home (14.4.4.44) -> Compute (140.44.4.11:22) ===") +ok, out, err = run_ssh_cmd("14.4.4.44", "root", "nc -z -w 3 140.44.4.11 22; echo ExitCode=$?") +print(f"Connection test 140.44.4.11:22: {out.strip() or err.strip()}") + +# Test BLOCKING: nutserver (VLAN 50) -> Compute (140.44.4.71:22) +print("=== 3. Testing Firewall Drop: Smart Home (14.4.4.44) -> Compute (140.44.4.71:22) ===") +ok, out, err = run_ssh_cmd("14.4.4.44", "root", "nc -z -w 3 140.44.4.71 22; echo ExitCode=$?") +print(f"Connection test 140.44.4.71:22: {out.strip() or err.strip()}") + +# Test ALLOW: nutserver (VLAN 50) -> OpenCanary Honeypot (14.4.4.99:22) (Intra-VLAN 50) +print("\n=== 4. Testing Honeypot reachable from Smart Home: 14.4.4.44 -> 14.4.4.99:22 ===") +ok, out, err = run_ssh_cmd("14.4.4.44", "root", "nc -z -w 3 14.4.4.99 22; echo ExitCode=$?") +print(f"Honeypot reachability test: {out.strip() or err.strip()}")