USB Scanning Station

[dbarzin]

Is there a plan to deploy Pandora in a USB scanning station ?

[Rafiot]

Not as we speak, but we could consider it for later this year or in 2023. If you could describe in details what you need and how it is expected to work, we can consider turning it into a work package.

[dbarzin]

Having an independant device that :

• when someone insert a USB key in it, scans all files present on the key with Pandora
• during the scanning process present the status to the user
• when malware is detected send file hash to syslog and propose to the user to remove the file
• send scan results to syslog with key-id, key size, number of files, total file size

Additional tasks :

• identify minimum hardware requirements
• provide a regular update process

[Rafiot]

Noted. My very rough estimation is that implementing these features will probably take between 2 and 4 months of dev in order to get to a usable beta version. That includes intermediary alpha versions to test the features and get feedback from users.

[dbarzin]

As we need it as the hospital, I would like to spend some time on it.
I could get back to you with an alpha version at end of August.

[Rafiot]

That would be great, thank you!

[dbarzin]

A first non-working version is available here : https://github.com/dbarzin/pandora-box
There is still blocking a problem. After reboot, Pandora does not start. I have no idea why.

[dbarzin]

The command poetry run stop does not end. I have to kill it and after reboot Pandora does not start.

[Rafiot]

alright, the stop command loops on the website? Somehow, the database is in a weird state.Try to remove cache/dump.rdb and reboot, that should solve the problem.

[dbarzin]

That does not work, after reboot the webserver is still not responding.

Reinstalling pandora is the only solution found :

git clone https://github.com/pandora-analysis/pandora.git
cd pandora
echo PANDORA_HOME="`pwd`" >> .env
poetry install
cp config/generic.json.sample config/generic.json
for file in pandora/workers/*.sample; do cp -i ${file} ${file%%.sample}; done
poetry run update --yes

but after two reboots, it goes back to the same state and need to be reinstalled to work.

[Rafiot]

ok, I do not use the systemd module, but will give it a try soon. The thing that definitely works is to manually trigger the start/stop scripts, so in the meantime, please use that.

If you want to keep debugging, start from a fresh install (or clear the redis cache db), and run systemctl pandora start and systemctl pandora stop multiple times. If the webserver keeps coming back up, it is definitely a timing issue: I'm pretty sure the issue is that the systemd module doesn't give enough time to the stop script to finish and the reboot just kills something it shouldn't.

[Rafiot]

And thinking about it, if somehow, you end-up having the start script launched multiple times, it might also cause issues (same for the stop script)

[FafnerKeyZee]

Looks like the website have some problems you need to remove the shutdown key in redis

…

Le 7 juil. 2022 à 20:44, Didier Barzin ***@***.***> a écrit :  Here are the informations : ***@***.***:~/pandora-box$ systemctl status pandora ● pandora.service - Pandora service Loaded: loaded (/etc/systemd/system/pandora.service; enabled; vendor preset: enabled) Active: active (running) since Thu 2022-07-07 17:51:26 UTC; 46min ago Tasks: 27 (limit: 2241) Memory: 36.6M CPU: 14.805s CGroup: /system.slice/pandora.service ├─670 /bin/bash ./run_kvrocks.sh ├─672 ../../kvrocks/src/kvrocks -c kvrocks.conf └─673 "../../redis/src/redis-server unixsocket:cache.sock" Jul 07 17:51:23 pandora-box99 systemd[1]: Starting Pandora service... Jul 07 17:51:26 pandora-box99 systemd[1]: Started Pandora service. ***@***.***:~/pandora-box$ tail -500f /var/log/pandora_message.log Version: 2.0.6 @7c23f2fe Waiting on cache to start Waiting on storage to start Start backend (redis)... done. Start unoserver... done. Start workers... done. Start IMAP fetcher... done. Start website... done. IMAP fetcher is disabled in config, quitting. XLMMacroDeobfuscator: pywin32 is not installed (only is required if you want to use MS Excel) ***@***.***:~/pandora-box$ tail -500f /var/log/pandora_error.log + ../../redis/src/redis-server ./cache.conf + ../../kvrocks/src/kvrocks -c kvrocks.conf 2022-07-07 17:51:27,558 Website INFO:Initializing Website 2022-07-07 17:51:27,583 UnoserverLauncher INFO:Initializing UnoserverLauncher 2022-07-07 17:51:27,586 Website INFO:Launching Website 2022-07-07 17:51:27,586 Website INFO:Sending 28 to 783. 2022-07-07 17:51:27,596 unoserver INFO:Starting unoserver. 2022-07-07 17:51:27,598 unoserver INFO:Command: libreoffice --headless --invisible --nocrashreport --nodefault --nologo --nofirststartwizard --norestore -env:UserInstallation=file:///tmp/tmp5_663tl1 --accept=socket,host=127.0.0.1,port=2002,tcpNoDelay=1;urp;StarOffice.ComponentContext 2022-07-07 17:51:27,630 UnoserverLauncher INFO:Launching UnoserverLauncher 2022-07-07 17:51:27,630 UnoserverLauncher INFO:Sending 28 to 784. 2022-07-07 17:51:28,587 Website INFO:Sending 15 to 783. 2022-07-07 17:51:28,631 UnoserverLauncher INFO:Sending 15 to 784. 2022-07-07 17:51:29,589 Website INFO:Shutting down Website 2022-07-07 17:51:29,633 UnoserverLauncher INFO:Shutting down UnoserverLauncher 2022-07-07 17:51:32,147 WorkersManager INFO:Initializing WorkersManager 2022-07-07 17:51:32,250 blocklists INFO:Initializing blocklists-1 2022-07-07 17:51:32,252 blocklists INFO:Initializing blocklists-2 2022-07-07 17:51:32,252 blocklists INFO:Initializing blocklists-3 2022-07-07 17:51:32,253 blocklists INFO:Initializing blocklists-4 2022-07-07 17:51:32,254 blocklists INFO:Initializing blocklists-5 2022-07-07 17:51:32,266 clamav INFO:Initializing clamav-1 2022-07-07 17:51:32,268 comodo INFO:Initializing comodo-1 2022-07-07 17:51:32,586 extractor INFO:Initializing extractor-1 2022-07-07 17:51:32,587 extractor INFO:Initializing extractor-2 2022-07-07 17:51:32,588 extractor INFO:Initializing extractor-3 2022-07-07 17:51:32,589 extractor INFO:Initializing extractor-4 2022-07-07 17:51:32,590 extractor INFO:Initializing extractor-5 2022-07-07 17:51:32,644 hashlookup INFO:Initializing hashlookup-1 2022-07-07 17:51:32,930 hashlookup INFO:Initializing hashlookup-2 2022-07-07 17:51:33,834 hashlookup INFO:Initializing hashlookup-3 2022-07-07 17:51:34,079 hashlookup INFO:Initializing hashlookup-4 2022-07-07 17:51:34,326 hashlookup INFO:Initializing hashlookup-5 2022-07-07 17:51:34,580 hybridanalysis INFO:Initializing hybridanalysis-1 2022-07-07 17:51:34,580 hybridanalysis WARNING:Disabled, missing apikey. 2022-07-07 17:51:34,934 irma INFO:Initializing irma-1 2022-07-07 17:51:34,935 irma WARNING:Disabled, missing apiurl. 2022-07-07 17:51:34,938 joesandbox INFO:Initializing joesandbox-1 2022-07-07 17:51:34,939 joesandbox WARNING:Disabled, missing apikey. 2022-07-07 17:51:34,943 malwarebazaar INFO:Initializing malwarebazaar-1 2022-07-07 17:51:34,944 malwarebazaar WARNING:Disabled, missing apikey. 2022-07-07 17:51:34,990 msodde INFO:Initializing msodde-1 2022-07-07 17:51:34,991 msodde INFO:Initializing msodde-2 2022-07-07 17:51:34,992 msodde INFO:Initializing msodde-3 2022-07-07 17:51:35,023 mwdb INFO:Initializing mwdb-1 2022-07-07 17:51:35,024 mwdb WARNING:Disabled, missing apikey. 2022-07-07 17:51:35,025 observables INFO:Initializing observables-1 2022-07-07 17:51:35,026 observables INFO:Initializing observables-2 2022-07-07 17:51:35,026 observables INFO:Initializing observables-3 2022-07-07 17:51:35,027 observables INFO:Initializing observables-4 2022-07-07 17:51:35,028 observables INFO:Initializing observables-5 2022-07-07 17:51:35,134 ole INFO:Initializing ole-1 2022-07-07 17:51:35,135 ole INFO:Initializing ole-2 2022-07-07 17:51:35,136 ole INFO:Initializing ole-3 2022-07-07 17:51:35,137 ole INFO:Initializing ole-4 2022-07-07 17:51:35,138 ole INFO:Initializing ole-5 2022-07-07 17:51:35,139 preview INFO:Initializing preview-1 2022-07-07 17:51:35,140 preview INFO:Initializing preview-2 2022-07-07 17:51:35,141 preview INFO:Initializing preview-3 2022-07-07 17:51:35,142 preview INFO:Initializing preview-4 2022-07-07 17:51:35,143 preview INFO:Initializing preview-5 2022-07-07 17:51:35,153 virustotal INFO:Initializing virustotal-1 2022-07-07 17:51:35,153 virustotal WARNING:Disabled, missing apikey. 2022-07-07 17:51:35,154 xmldeobfuscator INFO:Initializing xmldeobfuscator-1 2022-07-07 17:51:35,155 xmldeobfuscator INFO:Initializing xmldeobfuscator-2 2022-07-07 17:51:35,163 yara INFO:Initializing yara-1 2022-07-07 17:51:35,165 yara INFO:Initializing yara-2 2022-07-07 17:51:35,167 yara_signature_base INFO:Initializing yara_signature_base-1 2022-07-07 17:51:36,212 yara_signature_base INFO:Initializing yara_signature_base-2 2022-07-07 17:51:36,876 WorkersManager INFO:starting worker blocklists-1... 2022-07-07 17:51:36,920 WorkersManager INFO:starting worker blocklists-2... 2022-07-07 17:51:36,924 WorkersManager INFO:starting worker blocklists-3... 2022-07-07 17:51:36,925 blocklists INFO:Worker is running... 2022-07-07 17:51:36,928 WorkersManager INFO:starting worker blocklists-4... 2022-07-07 17:51:36,931 blocklists INFO:Worker is running... 2022-07-07 17:51:36,935 WorkersManager INFO:starting worker blocklists-5... 2022-07-07 17:51:36,939 blocklists INFO:Worker is running... 2022-07-07 17:51:36,943 blocklists INFO:Worker is running... 2022-07-07 17:51:36,943 WorkersManager INFO:starting worker clamav-1... 2022-07-07 17:51:36,947 WorkersManager INFO:starting worker comodo-1... 2022-07-07 17:51:36,951 blocklists INFO:Worker is running... 2022-07-07 17:51:36,954 WorkersManager INFO:starting worker extractor-1... 2022-07-07 17:51:36,958 WorkersManager INFO:starting worker extractor-2... 2022-07-07 17:51:36,962 comodo INFO:Worker is running... 2022-07-07 17:51:36,963 clamav INFO:Worker is running... 2022-07-07 17:51:36,966 extractor INFO:Worker is running... 2022-07-07 17:51:36,969 WorkersManager INFO:starting worker extractor-3... 2022-07-07 17:51:36,971 extractor INFO:Worker is running... 2022-07-07 17:51:36,975 extractor INFO:Worker is running... 2022-07-07 17:51:36,977 WorkersManager INFO:starting worker extractor-4... 2022-07-07 17:51:36,981 WorkersManager INFO:starting worker extractor-5... 2022-07-07 17:51:36,986 WorkersManager INFO:starting worker hashlookup-1... 2022-07-07 17:51:36,987 extractor INFO:Worker is running... 2022-07-07 17:51:36,990 WorkersManager INFO:starting worker hashlookup-2... 2022-07-07 17:51:36,995 extractor INFO:Worker is running... 2022-07-07 17:51:36,998 WorkersManager INFO:starting worker hashlookup-3... 2022-07-07 17:51:37,002 WorkersManager INFO:starting worker hashlookup-4... 2022-07-07 17:51:37,007 hashlookup INFO:Worker is running... 2022-07-07 17:51:37,007 hashlookup INFO:Worker is running... 2022-07-07 17:51:37,010 hashlookup INFO:Worker is running... 2022-07-07 17:51:37,014 WorkersManager INFO:starting worker hashlookup-5... 2022-07-07 17:51:37,018 WorkersManager INFO:starting worker hybridanalysis-1... 2022-07-07 17:51:37,022 WorkersManager INFO:starting worker irma-1... 2022-07-07 17:51:37,023 hashlookup INFO:Worker is running... 2022-07-07 17:51:37,027 hashlookup INFO:Worker is running... 2022-07-07 17:51:37,030 WorkersManager INFO:starting worker joesandbox-1... 2022-07-07 17:51:37,034 irma INFO:Worker is running... 2022-07-07 17:51:37,035 hybridanalysis INFO:Worker is running... 2022-07-07 17:51:37,038 WorkersManager INFO:starting worker malwarebazaar-1... 2022-07-07 17:51:37,043 WorkersManager INFO:starting worker msodde-1... 2022-07-07 17:51:37,047 joesandbox INFO:Worker is running... 2022-07-07 17:51:37,051 WorkersManager INFO:starting worker msodde-2... 2022-07-07 17:51:37,052 msodde INFO:Worker is running... 2022-07-07 17:51:37,055 malwarebazaar INFO:Worker is running... 2022-07-07 17:51:37,058 WorkersManager INFO:starting worker msodde-3... 2022-07-07 17:51:37,062 WorkersManager INFO:starting worker mwdb-1... 2022-07-07 17:51:37,067 msodde INFO:Worker is running... 2022-07-07 17:51:37,067 msodde INFO:Worker is running... 2022-07-07 17:51:37,070 WorkersManager INFO:starting worker observables-1... 2022-07-07 17:51:37,074 WorkersManager INFO:starting worker observables-2... 2022-07-07 17:51:37,078 mwdb INFO:Worker is running... 2022-07-07 17:51:37,082 observables INFO:Worker is running... 2022-07-07 17:51:37,085 WorkersManager INFO:starting worker observables-3... 2022-07-07 17:51:37,087 observables INFO:Worker is running... 2022-07-07 17:51:37,090 observables INFO:Worker is running... 2022-07-07 17:51:37,088 WorkersManager INFO:starting worker observables-4... 2022-07-07 17:51:37,096 WorkersManager INFO:starting worker observables-5... 2022-07-07 17:51:37,100 WorkersManager INFO:starting worker ole-1... 2022-07-07 17:51:37,107 observables INFO:Worker is running... 2022-07-07 17:51:37,110 observables INFO:Worker is running... 2022-07-07 17:51:37,113 ole INFO:Worker is running... 2022-07-07 17:51:37,105 WorkersManager INFO:starting worker ole-2... 2022-07-07 17:51:37,119 WorkersManager INFO:starting worker ole-3... 2022-07-07 17:51:37,123 WorkersManager INFO:starting worker ole-4... 2022-07-07 17:51:37,125 ole INFO:Worker is running... 2022-07-07 17:51:37,126 ole INFO:Worker is running... 2022-07-07 17:51:37,130 WorkersManager INFO:starting worker ole-5... 2022-07-07 17:51:37,134 WorkersManager INFO:starting worker preview-1... 2022-07-07 17:51:37,139 ole INFO:Worker is running... 2022-07-07 17:51:37,141 WorkersManager INFO:starting worker preview-2... 2022-07-07 17:51:37,147 ole INFO:Worker is running... 2022-07-07 17:51:37,147 preview INFO:Worker is running... 2022-07-07 17:51:37,150 preview INFO:Worker is running... 2022-07-07 17:51:37,152 WorkersManager INFO:starting worker preview-3... 2022-07-07 17:51:37,156 WorkersManager INFO:starting worker preview-4... 2022-07-07 17:51:37,162 preview INFO:Worker is running... 2022-07-07 17:51:37,162 preview INFO:Worker is running... 2022-07-07 17:51:37,161 WorkersManager INFO:starting worker preview-5... 2022-07-07 17:51:37,168 WorkersManager INFO:starting worker virustotal-1... 2022-07-07 17:51:37,172 WorkersManager INFO:starting worker xmldeobfuscator-1... 2022-07-07 17:51:37,174 virustotal INFO:Worker is running... 2022-07-07 17:51:37,174 preview INFO:Worker is running... 2022-07-07 17:51:37,180 WorkersManager INFO:starting worker xmldeobfuscator-2... 2022-07-07 17:51:37,184 WorkersManager INFO:starting worker yara-1... 2022-07-07 17:51:37,187 xmldeobfuscator INFO:Worker is running... 2022-07-07 17:51:37,187 xmldeobfuscator INFO:Worker is running... 2022-07-07 17:51:37,191 WorkersManager INFO:starting worker yara-2... 2022-07-07 17:51:37,195 WorkersManager INFO:starting worker yara_signature_base-1... 2022-07-07 17:51:37,197 yara INFO:Worker is running... 2022-07-07 17:51:37,198 yara INFO:Worker is running... 2022-07-07 17:51:37,203 WorkersManager INFO:starting worker yara_signature_base-2... 2022-07-07 17:51:37,207 WorkersManager INFO:Launching WorkersManager 2022-07-07 17:51:37,210 yara_signature_base INFO:Worker is running... 2022-07-07 17:51:37,213 yara_signature_base INFO:Worker is running... 2022-07-07 17:51:37,215 WorkersManager INFO:Shutting down WorkersManager tail -500f /var/log/pandora_error.log — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.

[dbarzin]

I have tried to comment a line in pyproject.toml but it has no effet. Pandora does not start after reboot.

[Rafiot]

No need to edit pyproject.toml, it is just the config for the installation, it has nothing to do with your issue.

[dbarzin]

So this is fixed, it is now working on VirtualBox and recycled ThinkCenter.

[FafnerKeyZee]

I use systemd to start and stop pandora, I do not have any issue… I’ll try your script and give some tests, by the way what is your hardware setup ? Ssd ? How many ram and cpu / thread ?

…

Le 8 juil. 2022 à 20:43, Raphaël Vinot ***@***.***> a écrit :  And thinking about it, if somehow, you end-up having the start script launched multiple times, it might also cause issues (same for the stop script) — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.

[dbarzin]

This issue seems to have disappeared.