From 53c9ec73480692628bc0ab38c33fae8b62322b74 Mon Sep 17 00:00:00 2001 From: Shreya Date: Wed, 12 May 2021 16:49:11 +0530 Subject: [PATCH 01/15] Update the documentation for resetting password --- docs/content/FAQ/_index.md | 2 +- docs/content/setup/accounts-and-security.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index 74ef6dcd5..3499eebd6 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -40,7 +40,7 @@ The Infection Monkey agent shuts off either when it can't find new victims or it When you first access the Monkey Island server, you'll be prompted to create an account. If you forget the credentials you entered, or just want to change them, you need to alter the `server_config.json` file manually. -On Linux, this file is located at `/var/monkey/monkey_island/cc/server_config.json`. On Windows, it's based on your install directory (typically it is `C:\Program Files\Guardicore\Monkey Island\monkey_island\cc\server_config.json`). Reset the contents of this file leaving the **deployment option unchanged** (it might be "VMware" or "Linux" in your case): +This file is located in your specified data directory. On Linux, the default data directory is `$HOME/.monkey_island`, and on Windows, it is `%AppData%\monkey_island`. Reset the contents of this file leaving the **deployment option unchanged** (it might be "VMware" or "Linux" in your case): ```json { diff --git a/docs/content/setup/accounts-and-security.md b/docs/content/setup/accounts-and-security.md index b5cd81ab9..cd87c2f19 100644 --- a/docs/content/setup/accounts-and-security.md +++ b/docs/content/setup/accounts-and-security.md @@ -15,4 +15,4 @@ If you want an island to be accessible without credentials, press *I want anyone ## Resetting your account credentials -This procedure is documented in [the FAQ.]({{< ref "/faq/#how-do-i-reset-the-monkey-island-password" >}}) +This procedure is documented in [the FAQ]({{< ref "/faq/#how-do-i-reset-the-monkey-island-password" >}}). From 3798fac6c11d398dd38e5032c6ff832f7c5878ed Mon Sep 17 00:00:00 2001 From: Shreya Date: Wed, 12 May 2021 17:27:28 +0530 Subject: [PATCH 02/15] Add instructions for changing the Monkey Island logger log level to docs --- docs/content/FAQ/_index.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index 3499eebd6..4fd6b8ba2 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -14,6 +14,7 @@ Below are some of the most common questions we receive about the Infection Monke - [Which queries does the Infection Monkey perform to the internet exactly?](#which-queries-does-the-infection-monkey-perform-to-the-internet-exactly) - [Where can I find the log files of the Infection Monkey agent and the Monkey Island server, and how can I read them?](#where-can-i-find-the-log-files-of-the-infection-monkey-agent-and-the-monkey-island-and-how-can-i-read-them) - [Monkey Island server](#monkey-island-server) + - [How do I change the log level of the Monkey Island logger?](#how-do-i-change-the-log-level-of-the-monkey-island-logger) - [Infection Monkey agent](#infection-monkey-agent) - [Running the Infection Monkey in a production environment](#running-the-infection-monkey-in-a-production-environment) - [How much of a footprint does the Infection Monkey leave?](#how-much-of-a-footprint-does-the-infection-monkey-leave) @@ -48,7 +49,7 @@ This file is located in your specified data directory. On Linux, the default dat "deployment": "windows" } ``` - Then, reset the Monkey Island process. Use `sudo systemctl restart monkey-island.service` on Linux or, on Windows, restart program. + Then, reset the Monkey Island process. Use `sudo systemctl restart monkey-island.service` on Linux, or on Windows, restart program. Finally, go to the Monkey Island's URL and create a new account. ## Should I run the Infection Monkey continuously? @@ -89,6 +90,12 @@ The log enables you to see which requests were requested from the server and ext 2019-07-23 10:52:24,027 - report.py:580 - get_domain_issues() - INFO - Domain issues generated for reporting ``` +#### How do I change the log level of the Monkey Island logger? + +The log level of the Monkey Island logger is set in the `log_level` field in the `server_config.json` file which is present in your specified data directory. On Linux, the default data directory is `$HOME/.monkey_island`, and on Windows, it is `%AppData%\monkey_island`. Make sure you leave everything else in `server_config.json` unchanged. + +To apply the changes, reset the Monkey Island process. Use `sudo systemctl restart monkey-island.service` on Linux, or on Windows, restart the program. Now, any logging in the program will be done according to the new log level. + ### Infection Monkey agent The Infection Monkey agent log file can be found in the following paths on machines where it was executed: From 717edc6fb0c3e112e9574782aed45fa05d6d6282 Mon Sep 17 00:00:00 2001 From: Shreya Date: Wed, 12 May 2021 18:10:59 +0530 Subject: [PATCH 03/15] Add FAQ about the data directory to docs --- docs/content/FAQ/_index.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index 4fd6b8ba2..dc7b5f633 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -9,6 +9,7 @@ Below are some of the most common questions we receive about the Infection Monke - [Where can I get the latest version of the Infection Monkey?](#where-can-i-get-the-latest-version-of-the-infection-monkey) - [How long does a single Infection Monkey agent run? Is there a time limit?](#how-long-does-a-single-infection-monkey-agent-run-is-there-a-time-limit) +- [Where does Infection Monkey store runtime artifacts?](#where-does-infection-monkey-store-runtime-artifacts) - [How do I reset the Monkey Island password?](#how-do-i-reset-the-monkey-island-password) - [Should I run the Infection Monkey continuously?](#should-i-run-the-infection-monkey-continuously) - [Which queries does the Infection Monkey perform to the internet exactly?](#which-queries-does-the-infection-monkey-perform-to-the-internet-exactly) @@ -37,6 +38,14 @@ If you want to see what has changed between versions, refer to the [releases pag The Infection Monkey agent shuts off either when it can't find new victims or it has exceeded the quota of victims as defined in the configuration. +## Where does Infection Monkey store runtime artifacts? + +The Infection Monkey agent may need to access or create some files on systems while running, such as during the execution of custom post-breach actions or when attempting the Zerologon exploit. + +For this, it uses a "data directory" which can be configured in the `data_dir` field in the `server_config.json` file. The default data directory on Linux is `$HOME/.monkey_island`, and on Windows is `%AppData%\monkey_island`. + +Any runtime artifacts will be stored in the data directory. + ## How do I reset the Monkey Island password? When you first access the Monkey Island server, you'll be prompted to create an account. If you forget the credentials you entered, or just want to change them, you need to alter the `server_config.json` file manually. From ffb329c277b9fe0a04b9b269a10f370db295581e Mon Sep 17 00:00:00 2001 From: Shreya Date: Thu, 13 May 2021 13:40:51 +0530 Subject: [PATCH 04/15] CR changes: modify/add server_config.json related examples to FAQ in docs --- docs/content/FAQ/_index.md | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index dc7b5f633..5f1b17fe8 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -54,8 +54,10 @@ This file is located in your specified data directory. On Linux, the default dat ```json { - "server_config": "password", - "deployment": "windows" + "environment": { + "server_config": "password", + "deployment": "windows" + } } ``` Then, reset the Monkey Island process. Use `sudo systemctl restart monkey-island.service` on Linux, or on Windows, restart program. @@ -101,8 +103,17 @@ The log enables you to see which requests were requested from the server and ext #### How do I change the log level of the Monkey Island logger? -The log level of the Monkey Island logger is set in the `log_level` field in the `server_config.json` file which is present in your specified data directory. On Linux, the default data directory is `$HOME/.monkey_island`, and on Windows, it is `%AppData%\monkey_island`. Make sure you leave everything else in `server_config.json` unchanged. +The log level of the Monkey Island logger is set in the `log_level` field in the `server_config.json` file which is present in your specified data directory. On Linux, the default data directory is `$HOME/.monkey_island`, and on Windows, it is `%AppData%\monkey_island`. Make sure you leave everything else in `server_config.json` unchanged: +```json +{ + "log_level": "DEBUG", + "environment": { + "server_config": "password", + "deployment": "linux" + } +} +``` To apply the changes, reset the Monkey Island process. Use `sudo systemctl restart monkey-island.service` on Linux, or on Windows, restart the program. Now, any logging in the program will be done according to the new log level. ### Infection Monkey agent From 515ce72791d11cd5399ba43771a4a3021f270656 Mon Sep 17 00:00:00 2001 From: Shreya Date: Fri, 14 May 2021 15:58:32 +0530 Subject: [PATCH 05/15] Add two separate sections for server and agent runtime artifacts in docs FAQ --- docs/content/FAQ/_index.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index 5f1b17fe8..2e435a308 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -10,6 +10,8 @@ Below are some of the most common questions we receive about the Infection Monke - [Where can I get the latest version of the Infection Monkey?](#where-can-i-get-the-latest-version-of-the-infection-monkey) - [How long does a single Infection Monkey agent run? Is there a time limit?](#how-long-does-a-single-infection-monkey-agent-run-is-there-a-time-limit) - [Where does Infection Monkey store runtime artifacts?](#where-does-infection-monkey-store-runtime-artifacts) + - [Monkey Island server](#monkey-island-server) + - [Infection Monkey agent](#infection-monkey-agent) - [How do I reset the Monkey Island password?](#how-do-i-reset-the-monkey-island-password) - [Should I run the Infection Monkey continuously?](#should-i-run-the-infection-monkey-continuously) - [Which queries does the Infection Monkey perform to the internet exactly?](#which-queries-does-the-infection-monkey-perform-to-the-internet-exactly) @@ -40,11 +42,17 @@ The Infection Monkey agent shuts off either when it can't find new victims or it ## Where does Infection Monkey store runtime artifacts? -The Infection Monkey agent may need to access or create some files on systems while running, such as during the execution of custom post-breach actions or when attempting the Zerologon exploit. +### Monkey Island server + +The Island server will need to store some files on the system on which it is running, such as the Island logs and any custom post-breach action files. For this, it uses a "data directory" which can be configured in the `data_dir` field in the `server_config.json` file. The default data directory on Linux is `$HOME/.monkey_island`, and on Windows is `%AppData%\monkey_island`. -Any runtime artifacts will be stored in the data directory. +### Infection Monkey agent + +The Monkey agent will need to store or create some files on the system on which it is running. This includes the agent binaries, logs, and any files needed for the execution of custom post-breach actions or when attempting the Zerologon exploit. + +It does so by creating temporary directories on the system and storing the data there. ## How do I reset the Monkey Island password? From 476063ec567d1cfdea45c4d8c8d4eef62292b278 Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Fri, 14 May 2021 16:21:01 +0300 Subject: [PATCH 06/15] Renamed logging FAQ section title to be shorter and to the point --- docs/content/FAQ/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index 2e435a308..a39d88135 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -15,7 +15,7 @@ Below are some of the most common questions we receive about the Infection Monke - [How do I reset the Monkey Island password?](#how-do-i-reset-the-monkey-island-password) - [Should I run the Infection Monkey continuously?](#should-i-run-the-infection-monkey-continuously) - [Which queries does the Infection Monkey perform to the internet exactly?](#which-queries-does-the-infection-monkey-perform-to-the-internet-exactly) -- [Where can I find the log files of the Infection Monkey agent and the Monkey Island server, and how can I read them?](#where-can-i-find-the-log-files-of-the-infection-monkey-agent-and-the-monkey-island-and-how-can-i-read-them) +- [Logging and how to find logs](#logging-and-how-to-find-logs) - [Monkey Island server](#monkey-island-server) - [How do I change the log level of the Monkey Island logger?](#how-do-i-change-the-log-level-of-the-monkey-island-logger) - [Infection Monkey agent](#infection-monkey-agent) @@ -91,7 +91,7 @@ The Monkey performs queries out to the Internet on two separate occasions: 1. The Infection Monkey agent checks if it has internet access by performing requests to pre-configured domains. By default, these domains are `updates.infectionmonkey.com` and `www.google.com.` The request doesn't include any extra information - it's a GET request with no extra parameters. Since the Infection Monkey is 100% open-source, you can find the domains in the configuration [here](https://github.com/guardicore/monkey/blob/85c70a3e7125217c45c751d89205e95985b279eb/monkey/infection_monkey/config.py#L152) and the code that performs the internet check [here](https://github.com/guardicore/monkey/blob/85c70a3e7125217c45c751d89205e95985b279eb/monkey/infection_monkey/network/info.py#L123). This **IS NOT** used for statistics collection. 1. After installing the Monkey Island, it sends a request to check for updates. The request doesn't include any PII other than the IP address of the request. It also includes the server's deployment type (e.g., Windows Server, Debian Package, AWS Marketplace) and the server's version (e.g., "1.6.3"), so we can check if we have an update available for this type of deployment. Since the Infection Monkey is 100% open-source, you can inspect the code that performs this [here](https://github.com/guardicore/monkey/blob/85c70a3e7125217c45c751d89205e95985b279eb/monkey/monkey_island/cc/services/version_update.py#L37). This **IS** used for statistics collection. However, due to this data's anonymous nature, we use this to get an aggregate assumption of how many deployments we see over a specific time period - it's not used for "personal" tracking. -## Where can I find the log files of the Infection Monkey agent and the Monkey Island, and how can I read them? +## Logging and how to find logs ### Monkey Island server From 193061b82a19563eb9a1911c8f65a4b54b2899b3 Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Fri, 14 May 2021 16:30:10 +0300 Subject: [PATCH 07/15] Moved "How do I change the log level of the Monkey Island logger?" as the last section in FAQ of logging --- docs/content/FAQ/_index.md | 44 +++++++++++++++++++++++--------------- 1 file changed, 27 insertions(+), 17 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index a39d88135..381161e73 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -17,8 +17,8 @@ Below are some of the most common questions we receive about the Infection Monke - [Which queries does the Infection Monkey perform to the internet exactly?](#which-queries-does-the-infection-monkey-perform-to-the-internet-exactly) - [Logging and how to find logs](#logging-and-how-to-find-logs) - [Monkey Island server](#monkey-island-server) - - [How do I change the log level of the Monkey Island logger?](#how-do-i-change-the-log-level-of-the-monkey-island-logger) - [Infection Monkey agent](#infection-monkey-agent) + - [How do I change the log level of the Monkey Island logger?](#how-do-i-change-the-log-level-of-the-monkey-island-logger) - [Running the Infection Monkey in a production environment](#running-the-infection-monkey-in-a-production-environment) - [How much of a footprint does the Infection Monkey leave?](#how-much-of-a-footprint-does-the-infection-monkey-leave) - [What's the Infection Monkey's impact on system resources usage?](#whats-the-infection-monkeys-impact-on-system-resources-usage) @@ -109,22 +109,7 @@ The log enables you to see which requests were requested from the server and ext 2019-07-23 10:52:24,027 - report.py:580 - get_domain_issues() - INFO - Domain issues generated for reporting ``` -#### How do I change the log level of the Monkey Island logger? - -The log level of the Monkey Island logger is set in the `log_level` field in the `server_config.json` file which is present in your specified data directory. On Linux, the default data directory is `$HOME/.monkey_island`, and on Windows, it is `%AppData%\monkey_island`. Make sure you leave everything else in `server_config.json` unchanged: - -```json -{ - "log_level": "DEBUG", - "environment": { - "server_config": "password", - "deployment": "linux" - } -} -``` -To apply the changes, reset the Monkey Island process. Use `sudo systemctl restart monkey-island.service` on Linux, or on Windows, restart the program. Now, any logging in the program will be done according to the new log level. - -### Infection Monkey agent +### Infection Monkey agent logs The Infection Monkey agent log file can be found in the following paths on machines where it was executed: @@ -147,6 +132,31 @@ The logs contain information about the internals of the Infection Monkey agent's 2019-07-22 19:16:45,013 [77598:140654230214464:DEBUG] connectionpool._make_request.396: https://updates.infectionmonkey.com:443 "GET / HTTP/1.1" 200 61 ``` +### How do I change the log level of the Monkey Island logger? + +The log level of the Monkey Island logger is set in the `log_level` field +in the `server_config.json` file. +On Linux, the default path of `server_config.json` file +is `$HOME/.monkey_island/server_config.json`. +On Windows, it's `%AppData%\monkey_island\server_config.json`. +Make sure to leave everything else in `server_config.json` unchanged: + +```json +{ + "log_level": "DEBUG", + "environment": { + "server_config": "password", + "deployment": "linux" + } +} +``` + +Logging levels correspond to [the logging level constants in python](https://docs.python.org/3.7/library/logging.html#logging-levels). + +To apply the changes, reset the Monkey Island process. +On Linux use `sudo systemctl restart monkey-island.service`. +On Windows, restart the program. + ## Running the Infection Monkey in a production environment ### How much of a footprint does the Infection Monkey leave? From 84559efffb7cf9dbc95f317527f1e883740b8c21 Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Fri, 14 May 2021 16:33:07 +0300 Subject: [PATCH 08/15] Improved password reset section in documentation hub FAQ --- docs/content/FAQ/_index.md | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index 381161e73..be5e28a16 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -56,9 +56,14 @@ It does so by creating temporary directories on the system and storing the data ## How do I reset the Monkey Island password? -When you first access the Monkey Island server, you'll be prompted to create an account. If you forget the credentials you entered, or just want to change them, you need to alter the `server_config.json` file manually. +When you first access the Monkey Island server, you'll be prompted to create an account. +If you forget the credentials you entered, or just want to change them, you need to alter +the `server_config.json` file manually. -This file is located in your specified data directory. On Linux, the default data directory is `$HOME/.monkey_island`, and on Windows, it is `%AppData%\monkey_island`. Reset the contents of this file leaving the **deployment option unchanged** (it might be "VMware" or "Linux" in your case): +On Linux, the default path to `server_config.json` is `$HOME/.monkey_island/server_config.json`. +On Windows, it is `%AppData%\monkey_island\server_config.json`. +Reset the contents of this file leaving the **deployment option unchanged** +(it might be "VMware" or "Linux" in your case): ```json { @@ -68,7 +73,9 @@ This file is located in your specified data directory. On Linux, the default dat } } ``` - Then, reset the Monkey Island process. Use `sudo systemctl restart monkey-island.service` on Linux, or on Windows, restart program. + Then, reset the Monkey Island process. + On Linux, use `sudo systemctl restart monkey-island.service`. + On Windows, restart the program. Finally, go to the Monkey Island's URL and create a new account. ## Should I run the Infection Monkey continuously? From a67a03d712616978ea0d221f5241553790db7aee Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Fri, 14 May 2021 16:35:23 +0300 Subject: [PATCH 09/15] Specified Island logs path in the FAQ section of documentation hub --- docs/content/FAQ/_index.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index be5e28a16..e3b21e668 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -100,13 +100,15 @@ The Monkey performs queries out to the Internet on two separate occasions: ## Logging and how to find logs -### Monkey Island server +### Monkey Island server logs You can download the Monkey Island's log file directly from the UI. Click the "log" section and choose **Download Monkey Island internal logfile**, like so: ![How to download Monkey Island internal log file](/images/faq/download_log_monkey_island.png "How to download Monkey Island internal log file") -It can also be found as a local file on the Monkey Island server, where the Monkey Island was executed, called `info.log`. +It can also be found as a local file on the Monkey Island server system. + By default, on Linux it's `$HOME/.monkey_island/info.log`, + on Windows it's `%AppData%\monkey_island\info.log` The log enables you to see which requests were requested from the server and extra logs from the backend logic. The log will contain entries like these: From 68f821370c9b1cac479a4d5b119fb77ef9d9e49c Mon Sep 17 00:00:00 2001 From: Shreya Date: Mon, 17 May 2021 14:23:36 +0530 Subject: [PATCH 10/15] Change Island's log file path in FAQ docs (and change sentence wording) --- docs/content/FAQ/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index e3b21e668..7ff1fe8cf 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -106,9 +106,9 @@ You can download the Monkey Island's log file directly from the UI. Click the "l ![How to download Monkey Island internal log file](/images/faq/download_log_monkey_island.png "How to download Monkey Island internal log file") -It can also be found as a local file on the Monkey Island server system. - By default, on Linux it's `$HOME/.monkey_island/info.log`, - on Windows it's `%AppData%\monkey_island\info.log` +It can also be found as a local file on the Monkey Island server system in the specified data directory. +On Linux, the default path of the log file is `$HOME/.monkey_island/monkey_island.log`. +On Windows, it's `%AppData%\monkey_island\monkey_island.log`. The log enables you to see which requests were requested from the server and extra logs from the backend logic. The log will contain entries like these: From 883b7b04647ab61bc805c7d31e1b8c2848fbdbcc Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Fri, 14 May 2021 16:19:52 +0300 Subject: [PATCH 11/15] Removed "Where does Infection Monkey store runtime artifacts?" section from FAQ. This talks about monkey internals, which is not a FAQ topic. --- docs/content/FAQ/_index.md | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index 7ff1fe8cf..55ff5b681 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -9,9 +9,6 @@ Below are some of the most common questions we receive about the Infection Monke - [Where can I get the latest version of the Infection Monkey?](#where-can-i-get-the-latest-version-of-the-infection-monkey) - [How long does a single Infection Monkey agent run? Is there a time limit?](#how-long-does-a-single-infection-monkey-agent-run-is-there-a-time-limit) -- [Where does Infection Monkey store runtime artifacts?](#where-does-infection-monkey-store-runtime-artifacts) - - [Monkey Island server](#monkey-island-server) - - [Infection Monkey agent](#infection-monkey-agent) - [How do I reset the Monkey Island password?](#how-do-i-reset-the-monkey-island-password) - [Should I run the Infection Monkey continuously?](#should-i-run-the-infection-monkey-continuously) - [Which queries does the Infection Monkey perform to the internet exactly?](#which-queries-does-the-infection-monkey-perform-to-the-internet-exactly) @@ -40,20 +37,6 @@ If you want to see what has changed between versions, refer to the [releases pag The Infection Monkey agent shuts off either when it can't find new victims or it has exceeded the quota of victims as defined in the configuration. -## Where does Infection Monkey store runtime artifacts? - -### Monkey Island server - -The Island server will need to store some files on the system on which it is running, such as the Island logs and any custom post-breach action files. - -For this, it uses a "data directory" which can be configured in the `data_dir` field in the `server_config.json` file. The default data directory on Linux is `$HOME/.monkey_island`, and on Windows is `%AppData%\monkey_island`. - -### Infection Monkey agent - -The Monkey agent will need to store or create some files on the system on which it is running. This includes the agent binaries, logs, and any files needed for the execution of custom post-breach actions or when attempting the Zerologon exploit. - -It does so by creating temporary directories on the system and storing the data there. - ## How do I reset the Monkey Island password? When you first access the Monkey Island server, you'll be prompted to create an account. From ec946d0ad8ccdc0f970736ad0513d952228ed119 Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Tue, 18 May 2021 09:34:25 +0300 Subject: [PATCH 12/15] Added a separate page for data directory in references --- docs/content/reference/data_directory.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 docs/content/reference/data_directory.md diff --git a/docs/content/reference/data_directory.md b/docs/content/reference/data_directory.md new file mode 100644 index 000000000..83fe03116 --- /dev/null +++ b/docs/content/reference/data_directory.md @@ -0,0 +1,19 @@ +--- +title: "Data directory" +date: 2021-05-18T08:49:59+03:00 +draft: false +pre: ' ' +weight: 9 +--- + +## About data directory + +Data directory is where the Island server stores runtime artifacts. +Those arfifacts include the Island logs, any custom post-breach action files, +configuration files, etc. + +## Where is data directory + +On **Linux** it's in `$HOME/.monkey_island`. + +On **Windows** it's in `%AppData%\monkey_island`. From 4ce937fbb241b0302d4586e298e29088bb007a7b Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Tue, 18 May 2021 09:36:50 +0300 Subject: [PATCH 13/15] Improved the documentation of password reset by stating required modifications to server config file, rather than suggesting to copy-paste the whole file. --- docs/content/FAQ/_index.md | 38 +++++++++++++++++++++++++++----------- 1 file changed, 27 insertions(+), 11 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index 55ff5b681..26a890692 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -9,7 +9,7 @@ Below are some of the most common questions we receive about the Infection Monke - [Where can I get the latest version of the Infection Monkey?](#where-can-i-get-the-latest-version-of-the-infection-monkey) - [How long does a single Infection Monkey agent run? Is there a time limit?](#how-long-does-a-single-infection-monkey-agent-run-is-there-a-time-limit) -- [How do I reset the Monkey Island password?](#how-do-i-reset-the-monkey-island-password) +- [Reset/enable the Monkey Island password](#resetenable-the-monkey-island-password) - [Should I run the Infection Monkey continuously?](#should-i-run-the-infection-monkey-continuously) - [Which queries does the Infection Monkey perform to the internet exactly?](#which-queries-does-the-infection-monkey-perform-to-the-internet-exactly) - [Logging and how to find logs](#logging-and-how-to-find-logs) @@ -37,23 +37,39 @@ If you want to see what has changed between versions, refer to the [releases pag The Infection Monkey agent shuts off either when it can't find new victims or it has exceeded the quota of victims as defined in the configuration. -## How do I reset the Monkey Island password? +## Reset/enable the Monkey Island password When you first access the Monkey Island server, you'll be prompted to create an account. -If you forget the credentials you entered, or just want to change them, you need to alter -the `server_config.json` file manually. - -On Linux, the default path to `server_config.json` is `$HOME/.monkey_island/server_config.json`. -On Windows, it is `%AppData%\monkey_island\server_config.json`. -Reset the contents of this file leaving the **deployment option unchanged** -(it might be "VMware" or "Linux" in your case): +To reset the credentials or enable/disable the authentication, +edit the `server_config.json` file manually +(located in [data directory](/reference/data_directory)). +The following edits need to be made: +1. Delete the `user` field if one exists. It will look like this: ```json { + ... + "user": "username", + ... +} +``` +1. Delete `password_hash` field if one exist. It will look like this: +```json +{ + ... + "password_hash": "$2b$12$d050I/MsR5.F5E15Sm7EkunmmwMkUKaZE0P0tJXG.M9tF.Kmkd342", + ... +} +``` +1. Set `server_config` to `password`. It should look like this: +```json +{ + ... "environment": { "server_config": "password", - "deployment": "windows" - } + ... + }, + ... } ``` Then, reset the Monkey Island process. From cef91aa428ae2cbee979d8fa94eb3fa5e42d30d4 Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Tue, 18 May 2021 09:37:20 +0300 Subject: [PATCH 14/15] Improved the documentation by adding links to data directory --- docs/content/FAQ/_index.md | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index 26a890692..d01958f79 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -105,9 +105,8 @@ You can download the Monkey Island's log file directly from the UI. Click the "l ![How to download Monkey Island internal log file](/images/faq/download_log_monkey_island.png "How to download Monkey Island internal log file") -It can also be found as a local file on the Monkey Island server system in the specified data directory. -On Linux, the default path of the log file is `$HOME/.monkey_island/monkey_island.log`. -On Windows, it's `%AppData%\monkey_island\monkey_island.log`. +It can also be found as a local file on the Monkey Island server system in the specified +[data directory](/reference/data_directory). The log enables you to see which requests were requested from the server and extra logs from the backend logic. The log will contain entries like these: @@ -143,19 +142,16 @@ The logs contain information about the internals of the Infection Monkey agent's ### How do I change the log level of the Monkey Island logger? The log level of the Monkey Island logger is set in the `log_level` field -in the `server_config.json` file. -On Linux, the default path of `server_config.json` file -is `$HOME/.monkey_island/server_config.json`. -On Windows, it's `%AppData%\monkey_island\server_config.json`. +in the `server_config.json` file (located in [data directory](/reference/data_directory)). Make sure to leave everything else in `server_config.json` unchanged: ```json { "log_level": "DEBUG", "environment": { - "server_config": "password", - "deployment": "linux" - } + ... + }, + ... } ``` From a1014489efeb6d32b6e5fe6f188b99040a681f3b Mon Sep 17 00:00:00 2001 From: shreyamalviya Date: Wed, 19 May 2021 00:20:39 +0530 Subject: [PATCH 15/15] Tiny grammar/formatting changes in docs --- docs/content/FAQ/_index.md | 15 +++++++-------- docs/content/reference/data_directory.md | 13 ++++++------- 2 files changed, 13 insertions(+), 15 deletions(-) diff --git a/docs/content/FAQ/_index.md b/docs/content/FAQ/_index.md index d01958f79..9284e2c32 100644 --- a/docs/content/FAQ/_index.md +++ b/docs/content/FAQ/_index.md @@ -42,9 +42,9 @@ The Infection Monkey agent shuts off either when it can't find new victims or it When you first access the Monkey Island server, you'll be prompted to create an account. To reset the credentials or enable/disable the authentication, edit the `server_config.json` file manually -(located in [data directory](/reference/data_directory)). +(located in the [data directory](/reference/data_directory)). -The following edits need to be made: +In order to reset the credentials, the following edits need to be made: 1. Delete the `user` field if one exists. It will look like this: ```json { @@ -53,7 +53,7 @@ The following edits need to be made: ... } ``` -1. Delete `password_hash` field if one exist. It will look like this: +1. Delete the `password_hash` field if one exists. It will look like this: ```json { ... @@ -66,6 +66,7 @@ The following edits need to be made: { ... "environment": { + ... "server_config": "password", ... }, @@ -142,15 +143,13 @@ The logs contain information about the internals of the Infection Monkey agent's ### How do I change the log level of the Monkey Island logger? The log level of the Monkey Island logger is set in the `log_level` field -in the `server_config.json` file (located in [data directory](/reference/data_directory)). +in the `server_config.json` file (located in the [data directory](/reference/data_directory)). Make sure to leave everything else in `server_config.json` unchanged: ```json { + ... "log_level": "DEBUG", - "environment": { - ... - }, ... } ``` @@ -158,7 +157,7 @@ Make sure to leave everything else in `server_config.json` unchanged: Logging levels correspond to [the logging level constants in python](https://docs.python.org/3.7/library/logging.html#logging-levels). To apply the changes, reset the Monkey Island process. -On Linux use `sudo systemctl restart monkey-island.service`. +On Linux, use `sudo systemctl restart monkey-island.service`. On Windows, restart the program. ## Running the Infection Monkey in a production environment diff --git a/docs/content/reference/data_directory.md b/docs/content/reference/data_directory.md index 83fe03116..418c320fa 100644 --- a/docs/content/reference/data_directory.md +++ b/docs/content/reference/data_directory.md @@ -6,14 +6,13 @@ pre: ' ' weight: 9 --- -## About data directory +## What is the data directory? -Data directory is where the Island server stores runtime artifacts. -Those arfifacts include the Island logs, any custom post-breach action files, +The data directory is where the Island server stores runtime artifacts. +These include the Island logs, any custom post-breach action files, configuration files, etc. -## Where is data directory +## Where is it located? -On **Linux** it's in `$HOME/.monkey_island`. - -On **Windows** it's in `%AppData%\monkey_island`. +On Linux, the default path is `$HOME/.monkey_island`. +On Windows, the default path is `%AppData%\monkey_island`.