Skynet New Skynet 7.5.9 Release

[danlat1415]

Read this post:

Skynet - Skynet - Router Firewall & Security Enhancements

For support requests and questions please use the Github Issue Tracker where this script is actively maintained Skynet - Router Firewall & Security Enhancements Elevate your home network security with Skynet, a robust firewall and security tool meticulously crafted for ASUS routers running...

www.snbforums.com

Found it.
Worked great to add to whitelist.
All working fine now - thanks

 

[karateca]

HI, 2 days ago start to dont show the stats, i think cuz uninstall and install again. But all time sayed "give this time to generate" and past hours and nothing. In GUI sayed no data to display.

 

[Ubimo]

I just noticed something strange.
I was bored and decided to enable logging and watch the logging in debug mode (All IPs)
When I stopped watching (Ctrl+c) and disabled logging again, I saw that +12 IPs where added:
Before I watched the log, I did a manual update of the blocklist at 20:18:09:

Feb 18 20:18:09 Skynet: [#] 449379 IPs (+498) -- 18428 Ranges Banned (-179) || 15485 Inbound -- 3458 Outbound Connections Blocked! [banmalware] [65s]
Feb 18 20:19:27 Skynet: [#] 449379 IPs (+0) -- 18428 Ranges Banned (+0) || 15488 Inbound -- 3458 Outbound Connections Blocked! [settings] [2s]
Feb 18 20:25:22 Diversion: restarted Dnsmasq to apply settings
Feb 18 20:25:58 Skynet: [#] 449391 IPs (+12) -- 18428 Ranges Banned (+0) || 15519 Inbound -- 3458 Outbound Connections Blocked! [banmalware] [58s]
Feb 18 20:25:59 Skynet: [#] 449391 IPs (+12) -- 18428 Ranges Banned (+0) || 15519 Inbound -- 3458 Outbound Connections Blocked! [debug] [372s]
Feb 18 20:26:35 Skynet: [#] 449391 IPs (+0) -- 18428 Ranges Banned (+0) || 15522 Inbound -- 3458 Outbound Connections Blocked! [settings] [2s]

So, why were +12 IPs added just from watching the log?

 

[dave14305]

So, why were +12 IPs added just from watching the log?

It is just coincidence that you were watching the logs at the same time as your daily Skynet list update.

 

[karateca]

Hi, anyone can say me why dont show data in the ghaphics. I cant found a solution for this, thx.

 

[Ubimo]

Have you enabled logging in Skynet settings? I guess logging is disabled.

 

[karateca]

Have you enabled logging in Skynet settings? I guess logging is disabled.

Hi, yes its enable, but nothing dont show anythink. Even i try to disable and enable again and wont show nothing.

 

[dave14305]

Hi, yes its enable, but nothing dont show anythink. Even i try to disable and enable again and wont show nothing.

Run these commands and post the output.

grep -ow "skynetloc=.* # Skynet" /jffs/scripts/firewall-start 2>/dev/null | grep -vE "^#" | awk '{print $1}' | cut -c 11-
ls -l /tmp/mnt/*/skynet/skynet.log
head -n 5 /tmp/mnt/*/skynet/skynet.log
tail -5 /tmp/mnt/*/skynet/skynet.log
ps ww | grep logd
nvram get message_loglevel
nvram get log_level

 

[karateca]

Run these commands and post the output.

grep -ow "skynetloc=.* # Skynet" /jffs/scripts/firewall-start 2>/dev/null | grep -vE "^#" | awk '{print $1}' | cut -c 11-
ls -l /tmp/mnt/*/skynet/skynet.log
head -n 5 /tmp/mnt/*/skynet/skynet.log
tail -5 /tmp/mnt/*/skynet/skynet.log
ps ww | grep logd
nvram get message_loglevel
nvram get log_level

hi, this show me.

stolker@GT-AXE11000:/tmp/home/root# ls -l /tmp/mnt/*/skynet/skynet.log
-rw-rw-rw-    1 stolker  root             0 Feb 17 16:18 /tmp/mnt/stolker/skynet/skynet.log
stolker@GT-AXE11000:/tmp/home/root# head -n 5 /tmp/mnt/*/skynet/skynet.log
stolker@GT-AXE11000:/tmp/home/root# tail -5 /tmp/mnt/*/skynet/skynet.log
stolker@GT-AXE11000:/tmp/home/root# ps ww | grep logd
 1173 stolker   3424 S    /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 512 -l 3
 1175 stolker   3424 S    /sbin/klogd -c 5
530463 stolker   5972 S    grep logd
stolker@GT-AXE11000:/tmp/home/root# nvram get message_loglevel
2
stolker@GT-AXE11000:/tmp/home/root# nvram get log_level

 

[dave14305]

hi, this show me.

stolker@GT-AXE11000:/tmp/home/root# ls -l /tmp/mnt/*/skynet/skynet.log
-rw-rw-rw-    1 stolker  root             0 Feb 17 16:18 /tmp/mnt/stolker/skynet/skynet.log
stolker@GT-AXE11000:/tmp/home/root# head -n 5 /tmp/mnt/*/skynet/skynet.log
stolker@GT-AXE11000:/tmp/home/root# tail -5 /tmp/mnt/*/skynet/skynet.log
stolker@GT-AXE11000:/tmp/home/root# ps ww | grep logd
 1173 stolker   3424 S    /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 512 -l 3
 1175 stolker   3424 S    /sbin/klogd -c 5
530463 stolker   5972 S    grep logd
stolker@GT-AXE11000:/tmp/home/root# nvram get message_loglevel
2
stolker@GT-AXE11000:/tmp/home/root# nvram get log_level

Set your syslog levels back to “notice“ and “debug” on the System Log page.

 

[karateca]

Set your syslog levels back to “notice“ and “debug” on the System Log page.

Sorry but where i must do that?, in the options settings in skynet?

OMG, sorry i was blind hahaha, i do it and now report. I dont know it is for the logs in the asusrouter option. Thx for the help!! x1000

 

[dave14305]

Sorry but where i must do that?, in the options settings in skynet?

In the router Syslog GUI.

 

[John Fitzgerald]

Edit New Release 7.5.9

v7.5.9 · Adamm00/IPSet_ASUS@a57fe83

Increase blacklist ipset maxelem to 1,048,576 #145 Remove alientcault list as its no longer maintained #144

github.com

 

[John Fitzgerald]

For those using PuTTY, CRITICAL UPDATE : please use the new version 0.81.

CVE-2024-31497: PuTTY vulnerability vuln-p521-bias

Every version of the PuTTY tools from 0.68 to 0.80 inclusive has a critical vulnerability in the code that generates signatures from ECDSA private keys which use the NIST P521 curve. (PuTTY, or Pageant, generates a signature from a key when using it to authenticate you to an SSH server.)...

www.snbforums.com

News - Cisco warns of large-scale brute-force attacks against VPN and SSH services

Cisco warns of large-scale brute-force attacks against VPN and SSH services. Cisco Talos researchers warn of large-scale credential brute-force attacks targeting multiple targets, including Virtual Private Network (VPN) services, web application authentication interfaces and SSH services since...

www.snbforums.com

 

[HorseCalledHorse]

Not sure what happened, but my RT-AX86U Pro went a little haywire after updating Skynet through AMTM. The SSH terminal shell became unresponsive when I tried to quit out of AMTM, so I quit the shell and tried again but couldn't log in. The router's GUI also became unresponsive. Solved by turning the router off and on, and the Skynet update appears to be working just fine.

 

[ukrainer]

Hello everybody, I faced strange issue and can't find out the reason or fixing method. Do anybody have an idea where to dig and how to fix that?

The Skynet installed on new system after reseting router, changing pluged to the router hdd, formating it and reinstalled Entware, amtm etc.

[1-5]: 2

Input Custom Filter List URL:

[URL]: https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/filter.list

[$] /jffs/scripts/firewall banmalware https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/filter.list

=============================================================================================================

killall: syslog-ng: no process killed

[i] Custom Filter Detected: https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/filter.list

[i] Downloading filter.list | [0s]

[i] Refreshing Whitelists | [7s]

[i] Consolidating Blacklist | [0s]

[*] List Content Error Detected - Stopping Banmalware

=============================================================================================================

[#] 1 IPs (+0) -- 0 Ranges Banned (+0) || 0 Inbound -- 0 Outbound Connections Blocked! [banmalware] [7s]

[i] Press Enter To Continue...

P.s. any other links (ViktorJp or Somewhere Over The Raibow) are not working too

 

[Viktor Jaep]

Hello everybody, I faced strange issue and can't find out the reason or fixing method. Do anybody have an idea where to dig and how to fix that?

The Skynet installed on new system after reseting router, changing pluged to the router hdd, formating it and reinstalled Entware, amtm etc.

[1-5]: 2

Input Custom Filter List URL:

[URL]: https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/filter.list

[$] /jffs/scripts/firewall banmalware https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/filter.list

=============================================================================================================

killall: syslog-ng: no process killed

[i] Custom Filter Detected: https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/filter.list

[i] Downloading filter.list | [0s]

[i] Refreshing Whitelists | [7s]

[i] Consolidating Blacklist | [0s]

[*] List Content Error Detected - Stopping Banmalware

=============================================================================================================

[#] 1 IPs (+0) -- 0 Ranges Banned (+0) || 0 Inbound -- 0 Outbound Connections Blocked! [banmalware] [7s]

[i] Press Enter To Continue...

P.s. any other links (ViktorJp or Somewhere Over The Raibow) are not working too

This is what it's getting hung on in the script... if anyone has any reasoning why it's doing this for @ukrainer here, but nobody else?

if ! grep -qE '^(((25[0-5]|(2[0-4]|1[0-9]|[1-9]|)[0-9])\.){3}(25[0-5]|(2[0-4]|1[0-9]|[1-9]|)[0-9])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$' "${skynetloc}"/lists/* 2>/dev/null; then
  result="$(Red "[$(($(date +%s) - btime))s]")"
  printf '%-8s\n' "$result"
  printf '%-35s\n' "[*] List Content Error Detected - Stopping Banmalware"
  nocfg="1"
  result="1"
fi

 

[ukrainer]

This is what it's getting hung on in the script... if anyone has any reasoning why it's doing this for @ukrainer here, but nobody else?

if ! grep -qE '^(((25[0-5]|(2[0-4]|1[0-9]|[1-9]|)[0-9])\.){3}(25[0-5]|(2[0-4]|1[0-9]|[1-9]|)[0-9])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$' "${skynetloc}"/lists/* 2>/dev/null; then
  result="$(Red "[$(($(date +%s) - btime))s]")"
  printf '%-8s\n' "$result"
  printf '%-35s\n' "[*] List Content Error Detected - Stopping Banmalware"
  nocfg="1"
  result="1"
fi

I saw the same problem reports on different threads here but didn't see any working solution. As I understood this issue happens during years on different devices with different versions of software and firmware. So it should have some relation to temp files/caches/settings etc or any old libs, not changed during years scripts/algorithms etc.

 

[Ubimo]

Clicking on "Adaptives QoS" in router main menu and then switching to Syslog causes Skynet to restart.
Can someone confirm?
And is that a normal behaviour?

 

[Quoc Huynh]

This is what it's getting hung on in the script... if anyone has any reasoning why it's doing this for @ukrainer here, but nobody else?

if ! grep -qE '^(((25[0-5]|(2[0-4]|1[0-9]|[1-9]|)[0-9])\.){3}(25[0-5]|(2[0-4]|1[0-9]|[1-9]|)[0-9])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$' "${skynetloc}"/lists/* 2>/dev/null; then
  result="$(Red "[$(($(date +%s) - btime))s]")"
  printf '%-8s\n' "$result"
  printf '%-35s\n' "[*] List Content Error Detected - Stopping Banmalware"
  nocfg="1"
  result="1"
fi

I have the same problem with Skynet on an RT-AX88U like him as well. It is quite interesting that Skynet is working fine with Adamm default filter list, or list imported years before. However, when trying to import your list or Somewhere Over The Rainbow, the script shows a "List Content Error" message, and refused to use the new firewall list.
I was succeed with importing Somewhere Over The Rainbow list about 2 weeks ago, but now it may not work anymore. Therefore, I supposed the cause would be either Skynet itself, or the way Github formats their file storage @@