Protect your privacy, see which processes make remote network connections
Project description
picosnitch
- An extremely simple, reliable, and lightweight program for linux to help protect your privacy
- It monitors your system and notifies you whenever it sees a new program that connects to the network
- Or when the sha256 changes for one of those programs (can also check VirusTotal)
- And features a curses based UI for browsing past connections
- For advanced users who know what should be running on their system and when they should be making network connections
- Only you can decide which programs to trust, so picosnitch leaves this decision up to you and just focusses on doing one thing well
- A program you can't trust to make network connections also can't be trusted not to negate any firewall rules, so blocking or sandboxing these programs is out of scope for picosnitch (also beware of programs running as root that may try to stop/modify picosnitch)
- Inspired by programs such as GlassWire, Little Snitch, and OpenSnitch
installation
PPA for Ubuntu and derivatives
sudo add-apt-repository ppa:elesiuta/picosnitch
sudo apt update
sudo apt install picosnitch
AUR for Arch and derivatives
- install
picosnitch
manually or using your preferred AUR helper
PyPI for any Linux distribution with Python >= 3.8
- install the BPF Compiler Collection python package for your distribution
- it should be called
python-bcc
orpython-bpfcc
- it should be called
- install picosnitch using pip
pip3 install "picosnitch[full]" --upgrade --user
- create a service file for systemd to run picosnitch (recommended)
picosnitch systemd
- optional dependencies (should already be installed or install automatically)
- for notifications:
dbus-python
,python-dbus
, orpython3-dbus
(name depends on your distro) - for VirusTotal:
python-requests
- for notifications:
usage
- running picosnitch
- enable/disable autostart on reboot with
systemctl enable|disable picosnitch
- start/stop/restart with
systemctl start|stop|restart picosnitch
- or if you don't use systemd
picosnitch start|stop|restart
- enable/disable autostart on reboot with
- user interface for browsing past connections
- start with
picosnitch view
space/enter
: filter on entrybackspace
: remove filterh/H
: cycle through historyt/T
: cycle time ranger
: refresh viewq
: quit
- start with
- show usage with
picosnitch help
configuration
- config is stored in
~/.config/picosnitch/config.json
- restart picosnitch if it is currently running for any changes to take effect
{
"DB retention (days)": 365, # How many days to keep connection logs
"DB write limit (seconds)": 1, # Minimum time between writing logs to snitch.db
# increasing it decreases disk writes by grouping connections into larger time windows
# reducing time precision, decreasing database size, and increasing hash latency
"Desktop notifications": true, # Try connecting to dbus for creating system notifications
"Log addresses": true, # Log remote addresses for each executable
"Log commands": true, # Log command line args for each executable
"Log ignore": [], # List of process names (str) or ports (int)
# will omit connections that match any of these from the connection log (snitch.db)
# the process and executable will still be recorded in summary.json
"Set RLIMIT_NOFILE": null, # Set the maximum number of open file descriptors (int)
# increasing it allows more processes to be cached (typical system default is 1024)
# this is good enough for most people since only one copy of each executable is cached
"VT API key": "", # API key for VirusTotal, leave blank to disable (str)
"VT file upload": false, # Upload file if hash not found, only hashes are used by default
"VT request limit (seconds)": 15 # Number of seconds between requests (free tier quota)
}
logging
- a short summary of seen processes is stored in
~/.config/picosnitch/summary.json
- this is used for determining whether to create a notification
{
"Latest Entries": [], # Log of entries by time
"Names": {}, # Log of processes by name containing respective executable(s)
"Processes": {}, # Log of processes by executable containing respective name(s)
"SHA256": {} # Log of processes by executable containing sha256 hash(es) and VirusTotal results
}
- the full connection log is stored in
~/.config/picosnitch/snitch.db
- this is used for
picosnitch view
- this is used for
- the error log is stored in
~/.config/picosnitch/error.log
- errors will also trigger a notification and are usually caused by far too many processes/connections
- for most people in most cases, this should raise suspicion that some other program may be misbehaving
building from source
- install dependencies listed under installation
- install
python-setuptools
- install picosnitch with
python setup.py install --user
- see other options with
python setup.py [build|install] --help
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
picosnitch-0.7.3.tar.gz
(33.4 kB
view hashes)
Built Distribution
picosnitch-0.7.3-py3-none-any.whl
(33.8 kB
view hashes)
Close
Hashes for picosnitch-0.7.3-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 314b492ae244d85fc3a8a9752d5a7d47973d3e2cd0574372d6e6a2199a777e50 |
|
MD5 | de7d2041cda839acf781e9043f6bab04 |
|
BLAKE2b-256 | 434109bc4032abcf16963578d39e036fae97cd29968d6293ddac9c3be114acd3 |