> For the complete documentation index, see [llms.txt](https://duck-initiative.gitbook.io/d.u.c.k.-knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duck-initiative.gitbook.io/d.u.c.k.-knowledge-base/mitigation-and-controls-library/collection-of-tools-scripts-and-templates.md).

# Collection of Tools, Scripts & Templates

## Ethereum-Specific

<table><thead><tr><th>Tools</th><th width="149">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Doppelbuster</td><td>SLS1<br>SLS14<br>SLS15</td><td>This tool operates independently from the Ethereum validator client, providing an extra layer of protection against double signing.</td><td>prevent double signing</td><td><a href="https://github.com/SimplyStaking/DoppelBuster">https://github.com/SimplyStaking/DoppelBuster</a></td></tr><tr><td>ethereum-validators-monitoring</td><td>GIR4</td><td>Ethereum validators monitoring bot aimed to keep track of the validators performance</td><td>monitoring + alerts</td><td><a href="https://github.com/lidofinance/ethereum-validators-monitoring">https://github.com/lidofinance/ethereum-validators-monitoring</a></td></tr><tr><td>eth-block-proposal-monitor</td><td>GIR4</td><td>Monitor block proposals and rewards of validators</td><td>monitoring + alerts</td><td><a href="https://github.com/SimplyStaking/eth-block-proposal-monitor">https://github.com/SimplyStaking/eth-block-proposal-monitor</a></td></tr><tr><td>esd</td><td>GIR4</td><td>Watches for slashing events included on the Ethereum beacon chain and runs a script when found</td><td>monitoring slashing</td><td><a href="https://github.com/attestantio/esd">https://github.com/attestantio/esd</a></td></tr><tr><td>vouch + dirk</td><td>SLS1<br>DOW1<br>DOW2<br>DOW6<br>DOW7</td><td>Splits your validator keys and replaces the standard validator client software.</td><td>multi-node validator client</td><td><a href="https://github.com/attestantio/vouch">https://github.com/attestantio/vouch</a><br><a href="https://github.com/attestantio/dirk">https://github.com/attestantio/dirk</a></td></tr><tr><td>web3signer</td><td><br>SLS1<br>DOW1<br>DOW2<br>DOW6<br>DOW7</td><td>Can sign on multiple platforms using private keys stored in an external vault, or encrypted on a disk</td><td>validator client</td><td><a href="https://github.com/Consensys/web3signer">https://github.com/Consensys/web3signer</a></td></tr></tbody></table>

## Monitoring

<table><thead><tr><th>Tools</th><th width="151">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Grafana</td><td>GIR4<br>DOW1<br>DOW2<br>DOW3<br>DOW7<br>DOW15</td><td>Observability and data visualization platform</td><td>monitoring + alerts</td><td><a href="https://grafana.com/docs/">https://grafana.com/docs/</a><a href="https://github.com/grafana/grafana">https://github.com/grafana/grafana</a></td></tr><tr><td>Prometheus</td><td>GIR4<br>DOW1<br>DOW2<br>DOW3<br>DOW7<br>DOW15</td><td>Monitoring system and time series database.</td><td>monitoring + alerts</td><td><a href="https://prometheus.io/docs/introduction/overview/">https://prometheus.io/docs/introduction/overview/</a><a href="https://github.com/prometheus/prometheus">https://github.com/prometheus/prometheus</a></td></tr></tbody></table>

## Inventory tracking

<table><thead><tr><th>Tools</th><th width="154">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Internal Wiki</td><td>KEC9</td><td>Keep an updated inventory list, including the server type, purpose, and responsible team.</td><td>tracking</td><td><a href="https://www.jetbrains.com/help/youtrack/server/knowledge-base.html">https://www.jetbrains.com/help/youtrack/server/knowledge-base.html</a></td></tr><tr><td>arp-scan, arpwatch</td><td>KEC4<br>KEC7<br>SLS12<br>SLS13</td><td>Use automation tools to detect and report any unauthorized machines</td><td>detecting</td><td><a href="https://man.archlinux.org/man/arp-scan.1.en">https://man.archlinux.org/man/arp-scan.1.en</a><br><a href="https://man.archlinux.org/man/arpwatch.8.en">https://man.archlinux.org/man/arpwatch.8.en</a></td></tr></tbody></table>

## Automation <a href="#automation" id="automation"></a>

<table><thead><tr><th>Tools</th><th width="146">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Ansible-Playbooks</td><td>GIR12<br>GIR21<br>GIR24<br>DOW6<br>DOW14<br></td><td>Leverage Ansible for automation of infrastructure deployment. Ensure consistency and reliability through version-controlled playbooks</td><td>automation of deployment</td><td><a href="https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_intro.html">https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_intro.html</a></td></tr><tr><td>Helm</td><td>GIR12<br>GIR21<br>GIR24<br>DOW6<br>DOW14</td><td>The package manager for Kubernetes. Helm helps you manage Kubernetes applications</td><td>automation of deployment</td><td><a href="https://helm.sh/">https://helm.sh/</a></td></tr><tr><td>AWS-Launch Templates</td><td>GIR12<br>GIR21<br>GIR24<br>DOW6<br>DOW14</td><td>Employ AWS Launch Templates for efficient and standardized instance provisioning. Push templates into a repository and ensure it is version-controlled. Leverage template parameters to customize instances as per specific requirements.</td><td>automation of deployment</td><td><a href="https://docs.aws.amazon.com/autoscaling/ec2/userguide/launch-templates.html">https://docs.aws.amazon.com/autoscaling/ec2/userguide/launch-templates.html</a></td></tr><tr><td>Terraform</td><td>GIR12<br>GIR21<br>GIR24<br>DOW6<br>DOW14</td><td>Automate infrastructure on any cloud</td><td>automation of deployment</td><td><a href="https://www.terraform.io/">https://www.terraform.io/</a></td></tr></tbody></table>

## MFA on Servers

<table><thead><tr><th width="152">Tools</th><th width="149">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Google Authenticator PAM module</td><td>GIR7<br>GIR14<br>KEC1<br>KEC7<br>KEC8<br>KEC9<br>KEC10<br>DOW16<br>DOW17<br>DOW18<br>SLS8<br>SLS9<br>SLS10</td><td>Implement MFA for all administrative access.</td><td>secure your server</td><td><a href="https://github.com/google/google-authenticator-libpam">https://github.com/google/google-authenticator-libpam</a></td></tr><tr><td>YubiHSM</td><td>GIR7<br>GIR14<br>KEC1<br>KEC7<br>KEC8<br>KEC9<br>KEC10<br>DOW16<br>DOW17<br>DOW18<br>SLS8<br>SLS9<br>SLS10</td><td>Hardware-based authentication methods</td><td>secure your server</td><td><a href="https://developers.yubico.com/YubiHSM2/Usage_Guides/">https://developers.yubico.com/YubiHSM2/Usage_Guides/</a></td></tr><tr><td>SSH Key rotation</td><td>GIR7<br>GIR14<br>KEC1<br>KEC7<br>KEC8<br>KEC9<br>KEC10<br>DOW16<br>DOW17<br>DOW18<br>SLS8<br>SLS9<br>SLS10</td><td>Use SSH Private Keys Instead of Passwords</td><td>secure your server</td><td><a href="https://docs.aws.amazon.com/secretsmanager/">https://docs.aws.amazon.com/secretsmanager/</a></td></tr></tbody></table>

## Key Security

<table><thead><tr><th>Tools</th><th width="147">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Bitwarden</td><td>GIR1<br>GIR6<br>GIR7<br>GIR22<br>KEC1<br>KEC2<br>KEC4</td><td>Store keys securely in a key vault</td><td>secure your keys, access management</td><td><a href="https://bitwarden.com/">https://bitwarden.com/</a></td></tr><tr><td>Vault</td><td>GIR1<br>GIR6<br>GIR7<br>GIR22<br>KEC1<br>KEC2<br>KEC4</td><td>Another key management store that seamlessly integrates your keys into your infrastructure, such as within a Kubernetes environment</td><td>secure your keys, access management</td><td><a href="https://www.vaultproject.io/">https://www.vaultproject.io/</a><br><a href="https://github.com/hashicorp/vault">https://github.com/hashicorp/vault</a></td></tr></tbody></table>

## Firewall

<table><thead><tr><th>Tools</th><th width="149">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>UFW</td><td>GIR9</td><td>No direct SSH/RDP should be accessible from the internet.</td><td>protect servers</td><td><a href="https://wiki.archlinux.org/title/Uncomplicated_Firewall">https://wiki.archlinux.org/title/Uncomplicated_Firewall</a></td></tr><tr><td>AWS Security Groups</td><td>GIR9</td><td>Control traffic to your AWS resources using security groups. Access should be enabled through an MFA-enabled VPN.</td><td>protect servers</td><td><a href="https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html#security-group-rule-characteristics">https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html#security-group-rule-characteristics</a></td></tr></tbody></table>

## IP-based DDoS Mitigation

<table><thead><tr><th>Tools</th><th width="151">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>fail2ban</td><td>DOW10</td><td>Daemon to ban hosts that cause multiple authentication errors</td><td>DDoS protection</td><td><a href="https://github.com/fail2ban/fail2ban">https://github.com/fail2ban/fail2ban</a></td></tr><tr><td>AWS Shield</td><td>DOW1<br>DOW3<br>DOW7<br>DOW10</td><td>All AWS customers benefit from the automatic protections of AWS Shield.</td><td>DDoS protection</td><td><a href="https://aws.amazon.com/shield/">https://aws.amazon.com/shield/</a></td></tr><tr><td>Setup Nodeexporter for Grafana</td><td>GIR4</td><td>Setup Grafana Alerts with thresholds for incoming and outgoing Traffic.</td><td>Regularly monitor network traffic for anomalies.</td><td><a href="https://github.com/prometheus/node_exporter">https://github.com/prometheus/node_exporter</a></td></tr></tbody></table>

## Engine API Being Filtered + Auth for Engine API

<table><thead><tr><th width="124">Tools</th><th>Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>nginx, firewalls + your el/cl-configuration files</td><td>GIR9</td><td>Filter access to the Engine API or disable unnecessary API's in your Beacon/Execution-layer nodes configuration files.*</td><td>prevent api attacks</td><td><a href="https://www.nginx.com/">https://www.nginx.com/</a></td></tr></tbody></table>

\* Note \
By default, account unlocking is forbidden when HTTP or Websocket access is enabled (i.e. by passing --http or ws flag). This is because an attacker that manages to access the node via the externally-exposed HTTP/WS port can then control the unlocked account. It is possible to force account unlock by including the --allow-insecure-unlock flag but this is unsafe and not recommended except for expert users that completely understand how it can be used safely. This is not a hypothetical risk: there are bots that continually scan for http-enabled Ethereum nodes to attack

## VLAN Segmentation

<table><thead><tr><th>Tools</th><th width="148">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>mikrotik</td><td>GIR10</td><td>Group related servers and services into VLANs. Subnet and connect your network and cloud networks.</td><td>Limit inter-VLAN routing to only necessary services with Site to Site IPsec (IKEv2) tunnel</td><td><a href="https://mikrotik.com/download">https://mikrotik.com/download</a>, <a href="https://help.mikrotik.com/docs/display/ROS/IPsec#IPsec-SitetoSiteGREtunneloverIPsec(IKEv2)usingDNS">https://help.mikrotik.com/docs/display/ROS/IPsec#IPsec-SitetoSiteGREtunneloverIPsec(IKEv2)usingDNS</a></td></tr></tbody></table>

## OS Hardening

<table><thead><tr><th>Tools</th><th width="148">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>SELinux</td><td>GIR13<br>GIR14<br>GIR17<br>KEC7</td><td>Use hardening playbooks that automate many of these processes and activate SELinux.</td><td>OS security</td><td><a href="https://wiki.archlinux.org/title/Security">https://wiki.archlinux.org/title/Security</a>, <a href="https://wiki.archlinux.org/title/SELinux">https://wiki.archlinux.org/title/SELinux</a></td></tr></tbody></table>

## EDR, SIEM, NDR

<table><thead><tr><th>Tools</th><th width="151">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>EDR</td><td>GIR14</td><td>EDR for endpoint-level visibility</td><td>secure endpoint</td><td>multiple provider</td></tr><tr><td>SIEM</td><td>GIR15</td><td>SIEM for comprehensive security event management and reporting.</td><td>security events and reporting</td><td><a href="https://github.com/wazuh/wazuh">https://github.com/wazuh/wazuh</a></td></tr><tr><td>NDR</td><td>GIR10</td><td>NDR for network-level monitoring and response.</td><td>monitor network</td><td>multiple provider</td></tr></tbody></table>