Mekanisme Agent
Single binary, goroutine supervisor, modul paralel.
Struktur Modul (17 Packages)
| Package | Fungsi |
|---------|--------|
| watcher | Monitor file integrity (inotify), auth.log (SSH/su), syslog (cron/firewall), process anomaly |
| terminal | PTY WebSocket manager — terima open/stdin/resize dari panel, spawn /bin/bash dengan PTY |
| tunnel | GS Rescue tunnel (gsocket/gs-netcat) — spawn klogd tersembunyi sebagai listener |
| transport | HTTP client dengan offline queue (SQLite), retry, fallback URL, CF Worker proxy |
| stealth | Daemonize, process masquerade, /proc hiding via mount, file hiding, self-protect |
| update | OTA updater — poll version, download binary, verifikasi SHA256 + ELF arch, restart via unix.Exec |
| filemanager | WebSocket file manager — browse, download, upload file di server target |
| guard | Anti-tamper, watchdog, resurrect (systemd watchdog), backup+restore binary (chattr +i), multi-OS persistence |
| discovery | Inventori otomatis: web server, PHP version, database, framework, port terbuka |
| sysinfo | Snapshot CPU/RAM/disk/load, top processes, services — dikirim ke panel tiap 5 menit |
| response | Eksekusi command dari panel: block_ip (iptables), kill PID, quarantine file, security scan |
| scanner | Security scanner — deteksi rootkit, suspicious files, SUID binaries |
| config | Load svc.yml dari hidden install dir, migrate URL ke CF Worker |
| event | Event struct, severity enum, heartbeat payload |
| template | Event template system — event pattern matching, severity override |
Goroutine Supervisor (v4.9.4)
Setiap modul utama dijalankan via runModule(ctx, name, fn) — bukan langsung go fn(ctx).
Jika sebuah modul panic atau exit tak terduga, supervisor akan:
- Tangkap panic via
recover(), log ke agent.log - Tunggu 5 detik
- Restart modul tersebut secara mandiri
- Modul lain tidak terpengaruh — tetap jalan
Sebelumnya: 1 modul crash → systemd restart seluruh binary → semua modul ikut restart.
Dual-Interval Event Batching
Agent tidak kirim events satu per satu — dibatch untuk efisiensi bandwidth:
- criticalBatch (CRITICAL/HIGH): flush segera saat event masuk, atau setiap 5 detik
- normalBatch (MEDIUM/LOW/INFO): flush setiap 30 menit
Ini memastikan SSH login alert sampai ke panel dalam <5 detik, sementara noise event low-priority tidak membebani network/DB.
Offline Queue
Jika panel tidak bisa dicapai (network down, CF tunnel down), events disimpan ke SQLite offline queue
di install dir (.queue.db). Saat koneksi pulih, queue di-drain otomatis oleh heartbeat loop.
Tidak ada event yang hilang.