andy/pilens
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 4: authorised HTTPS interception (Mode B)

Browse Source 
Toggleable transparent interception via mitmdump in a venv. Own RSA CA generated
in-app, downloadable (public cert only, key never leaves the box), with per-OS
install guide and fingerprint. nftables redirect accepts only dnat'd connections
(never an open proxy). HTTP Explorer with headers and opt-in body viewers (JSON/
text/hex/image, sandboxed). Honest status: pinned/untrusting = reported errors,
excluded hosts pass through, bodies off by default. Helper op + systemd unit +
installer venv build + boot restore.
This commit is contained in:
Andy Dixon
2026-10-10 08:05:42 +01:00
parent 4320428f41
commit 5dbf85f84e
25 changed files with 1460 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/install.sh
+19
View File
@@ -169,14 +169,33 @@ usermod -aG wireshark pilens
systemctl stop pilens 2>/dev/null || true
mkdir -p "$PREFIX"
install -m 0755 "$SRC/bin/pilens" "$SRC/bin/pilens-helper" -D -t "$PREFIX/bin"
install -m 0755 "$SRC/proxy-run.sh" "$PREFIX/proxy-run.sh"
install -m 0644 "$SRC/mitm_addon.py" "$PREFIX/mitm_addon.py"
for f in install.sh uninstall.sh repair.sh diagnose.sh setup.example.yaml VERSION README.md LICENSE; do install -m 0644 "$SRC/$f" "$PREFIX/$f"; done
chmod 0755 "$PREFIX"/*.sh
rm -rf "$PREFIX/docs"; cp -r "$SRC/docs" "$PREFIX/docs"
install -d -o pilens -g pilens -m 0750 "$DATA"
install -d -o pilens -g pilens -m 0750 "$DATA/proxy"
install -d -o root -g root -m 0700 /var/lib/pilens-helper
install -m 0644 "$SRC"/systemd/*.service /etc/systemd/system/
systemctl daemon-reload
# ---------------------------------------------------------------- 16. optional TLS proxy deps
say "Preparing optional HTTPS-interception proxy (mitmproxy)"
VENV="$PREFIX/proxy-venv"
if [ -x "$VENV/bin/mitmdump" ]; then
echo " mitmproxy venv already present"
elif apt-get install -y -qq --no-install-recommends python3-venv >>"$LOG" 2>&1 && python3 -m venv "$VENV" >>"$LOG" 2>&1; then
if "$VENV/bin/pip" install --quiet --only-binary=:all: --upgrade pip >>"$LOG" 2>&1 && "$VENV/bin/pip" install --quiet --only-binary=:all: mitmproxy >>"$LOG" 2>&1; then
chown -R pilens:pilens "$VENV"
echo " mitmproxy installed ($("$VENV/bin/mitmdump" --version 2>/dev/null | head -1))"
else
warn "mitmproxy install failed (needs internet + arm64 wheels). HTTPS interception will be unavailable until you run: sudo $PREFIX/repair.sh"
fi
else
warn "could not create the proxy virtualenv; HTTPS interception will be unavailable (optional feature)"
fi
# ---------------------------------------------------------------- 15. initialise data
say "Initialising database and management certificate"
INIT=$(runuser -u pilens -- "$PREFIX/bin/pilens" init -data "$DATA" -mgmt-iface "$MGMT_IF" -mgmt-subnet "$MGMT_NET")