Reaction

Daemon that scans program outputs for repeated patterns, and takes action

Declared in: projects/Reaction/default.nix

1. Install Nix
   Debian

   Bash

   $ apt install --yes curl git jq nix

   Ubuntu

   Bash

   $ apt install --yes curl git jq nix

   Arch

   Bash

   $ pacman --sync --refresh --noconfirm curl git jq nix

2. Download a configuration file

   # default.nix
   {
     ngipkgs ? import (fetchTarball "https://github.com/ngi-nix/ngipkgs/tarball/main") { },
   }:
   ngipkgs.demo-vm (
     { pkgs, ... }:
     {
       services.reaction = {
         enable = true;
         settingsFiles = [ ./example-ssh.jsonnet ];
         # Prefer `runAsRoot` to `false` in a production deployment, this is just for the demo
         runAsRoot = true;
         # and give the reaction user and service the proper permissions (see the non-root example, below).
       };
     }
   )
   

   Download
3. Enable binary substituters

   Bash

   $ export NIX_CONFIG='substituters = https://cache.nixos.org/ https://ngi.cachix.org/
   trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= ngi.cachix.org-1:n+CAL72ROC3qQuLxIHpV+Tw5t42WhXmMhprAGkRSrOw='

4. Build and run a virtual machine
   Debian Sid/Trixie

   Bash

   $ nix-build ./default.nix && ./result

   Ubuntu 25.04 and newer

   Bash

   $ nix-build ./default.nix && ./result

   Ubuntu 24.04/24.10

   Bash

   $ rev=$(nix-instantiate --eval --attr sources.nixpkgs.rev https://github.com/ngi-nix/ngipkgs/archive/master.tar.gz | jq --raw-output)

   $ nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz --packages nix --run "nix-build ./default.nix && ./result"

   Arch

   Bash

   $ nix-build ./default.nix && ./result

5. Usage Instructions

   1. Reaction is a very powerful rules based engine.

      A common usecase is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors.

      Provide a configuration file for reaction, for example: example.jsonnet.

   2. Run the demo vm, it runs an ssh server at port 10022, a user nixos with password nixos exists.

      Run journalctl -f inside the demo vm.

   3. Open a new terminal in your host system and run this ssh command:

      ssh -p 10022 nixos@localhost -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

      Attempt login to the demo vm with wrong passwords thrice.

   4. Go back to the demo vm terminal, and notice that you've been banned in the last line.

   5. To unban yourself, go to the vm terminal and run: sudo reaction flush

   6. Attempt to login with the correct password.

{ pkgs, ... }:
{
  config = {
    services.reaction = {
      enable = true;
      stopForFirewall = true;
      # example.jsonnet/example.yml can be copied and modified from ${pkgs.reaction}/share/examples
      settingsFiles = [ "${pkgs.reaction}/share/examples/example.jsonnet" ];
      runAsRoot = false;
    };
    services.openssh.enable = true;
    # If not running as root you need to give the reaction user and service the proper permissions

    # allows reading journal logs of processess
    users.users.reaction.extraGroups = [ "systemd-journal" ];

    # allows modifying ip firewall rules
    systemd.services.reaction.unitConfig.ConditionCapability = "CAP_NET_ADMIN";
    systemd.services.reaction.serviceConfig = {
      CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
      AmbientCapabilities = [ "CAP_NET_ADMIN" ];
    };
  };
}

{ pkgs, ... }:
{
  config = {
    services.reaction = {
      enable = true;
      stopForFirewall = true; # with this enabled restarting firewall will restart reaction
      settingsFiles = [
        # supports jsonnet as well as yml config formats
        "${pkgs.reaction}/share/examples/example.jsonnet"
        # "${pkgs.reaction}/share/examples/example.yml"
      ];
      runAsRoot = true;
    };
    networking.firewall.enable = true;
  };
}

This project is funded by NLnet through these subgrants:

Core

Reaction

Related links:

• Usage examples
• Homepage
• Source repository