THIS IS A SUPER EARLY PRE-ALPHA PROOF OF CONCEPT. IT IS FULL OF BUGS, HALF COMPLETED FEATURES, AND SECURITY HOLES. PLEASE DO NOT USE IN A PRODUCTION ENVIRONMENT AND ESPECIALLY DONT OPEN THE WEB INTERFACE DIRECTLY TO THE INTERNET!!! Hopefully this project will be fully featured and secure some day but right now it is not.
- This application is intended to be installed on home or small business networks to help identify all of the devices on the network and help keep them organized. It can also be used for detecting new unauthorized devices on a network.
- This application stores its information in a mysql database, uses the ubuntu package arp-scan to detect network devices, and lets you interact with the information by using a nodejs web server.
- This app has only been tested on Ubuntu server 16.04 and Ubuntu workstation 17.10. I want to test it working on Raspbian as well when it's closer to being complete
- See below for installation and usage instructions
- The install.sh script sets up a service user account named MacMon which is used to run the node application. It is given sudo rights ONLY to arp-scan since it is require.
- git clone https://github.com/hackern0v1c3/MacMon.git
- cd MacMon
- sudo ./install.sh
- The installer script will install some packages and ask a series of questions. If at any point you want to cancel the installation because you mistyped something, or just want to back out use Ctrl+c. Most of the answers will be saved in /var/www/MacMon/private/config.js and can be manually edited at any time.
- The install.sh script also runs mysql_secure_installation after mysql is installed. Most of the defaults can be selected during this wizard.
- Once the install is complete all of the required files will be in /var/www/MacMon. You can delete the folder that was created during the git clone.
- Browse to the web interface by browsing to your Ubuntu machine using https. Example: https://192.168.1.50
- Login using the username "admin" and password "admin". I haven't added the change password form yet so this can't easily be changed in this version.
- By default every 300 seconds (5 minutes) the network will be scanned for devices. If new devices are detected you should receive an email.
- Currently the application does not do a scan when it first starts so nothing will appear for 5 minutes. I'll change that soon.
- After a scan is complete you will have a list of devices on the "New Detected Devices" tab.
- Ideally you would track down each device on the New Devices list and identify them. You should then add a name and notes to the device and click save. Once a device is identified and labeled click the "Approve" button to move the device to the "Approved Devices" tab. That list will act as your approved network device inventory.
- Devices can be deleted from either list by clicking the "Delete" button. However during the next scan if the deviec is detected again you will be notified and the device will appear again on the New Devices tab. This is intentional. Devices should only be deleted if you think they are gone for good. Otherwise they should be approved. If you don't approve of a device on your network you should remove it from your network!
- The "Last Updated" column should show the last time any device was detected on your network. This can be handy for identifying old or powered off devices.
- The application will be installed to /var/www/MacMon. Most of the applications configuration is stored in /var/www/MacMon/private/config.js and can be manually edited.
- The application runs as a systemd service. To view the application logs use this command "journalctl -u macmon". The loggin level can be set to "production" or "development" in the config.js file using the environment property.
- The application generates a self signed certificate for HTTPS during installation. If you want to use your own certificate you can replace the files in /var/www/MacMon/private/certificates
The current version is a very basic proof of concept. Currently it just scans the network and saves the results in the database. Then the results can be viewed and slightly modified in the web interface.
The following list are features that I will be working on in the rough order that I plan on adding them
- Ability to reset admin password.
- Fix access denied logic. Right now the redirects and access denied messages are a mess...
- Get the Asset Type column working. Right now it doesn't do anything. You will eventually be able to select asset types like laptop, computer, etc and add your own asset types.
- Ability to sort and filter tables so it's easier to find what you are looking for.
- Add another tab for guest devices. This way you can approve things like gues cell phones without cluttering up your own asset inventory.
- Impliment the settings menu so application settings can be set from the web interface.
- Add a manual way to check a devices vendor using macvendors.com API. The arp-scan vendor list is pretty spotty but I don't want to rely 100% on macvendors.com
- Add a button to do nmap scanning against any device to collect more information
- Add a button to block devices on the network. This could be useful if a rogue device is detected and you want to block it from the network while you identify and remove it.
- Better CSS look and feel
- Impliment better security
The are other things to do as well but this is a list of items that are on my mind.
- Brian at 7ms.us for coming up with the project idea.
- All of the cool people that wrote the npm modules that I use in this app.