# Collection of Tools, Scripts & Templates

## Ethereum-Specific

<table><thead><tr><th>Tools</th><th width="149">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Doppelbuster</td><td>SLS1<br>SLS14<br>SLS15</td><td>This tool operates independently from the Ethereum validator client, providing an extra layer of protection against double signing.</td><td>prevent double signing</td><td><a href="https://github.com/SimplyStaking/DoppelBuster">https://github.com/SimplyStaking/DoppelBuster</a></td></tr><tr><td>ethereum-validators-monitoring</td><td>GIR4</td><td>Ethereum validators monitoring bot aimed to keep track of the validators performance</td><td>monitoring + alerts</td><td><a href="https://github.com/lidofinance/ethereum-validators-monitoring">https://github.com/lidofinance/ethereum-validators-monitoring</a></td></tr><tr><td>eth-block-proposal-monitor</td><td>GIR4</td><td>Monitor block proposals and rewards of validators</td><td>monitoring + alerts</td><td><a href="https://github.com/SimplyStaking/eth-block-proposal-monitor">https://github.com/SimplyStaking/eth-block-proposal-monitor</a></td></tr><tr><td>esd</td><td>GIR4</td><td>Watches for slashing events included on the Ethereum beacon chain and runs a script when found</td><td>monitoring slashing</td><td><a href="https://github.com/attestantio/esd">https://github.com/attestantio/esd</a></td></tr><tr><td>vouch + dirk</td><td>SLS1<br>DOW1<br>DOW2<br>DOW6<br>DOW7</td><td>Splits your validator keys and replaces the standard validator client software.</td><td>multi-node validator client</td><td><a href="https://github.com/attestantio/vouch">https://github.com/attestantio/vouch</a><br><a href="https://github.com/attestantio/dirk">https://github.com/attestantio/dirk</a></td></tr><tr><td>web3signer</td><td><br>SLS1<br>DOW1<br>DOW2<br>DOW6<br>DOW7</td><td>Can sign on multiple platforms using private keys stored in an external vault, or encrypted on a disk</td><td>validator client</td><td><a href="https://github.com/Consensys/web3signer">https://github.com/Consensys/web3signer</a></td></tr></tbody></table>

## Monitoring

<table><thead><tr><th>Tools</th><th width="151">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Grafana</td><td>GIR4<br>DOW1<br>DOW2<br>DOW3<br>DOW7<br>DOW15</td><td>Observability and data visualization platform</td><td>monitoring + alerts</td><td><a href="https://grafana.com/docs/">https://grafana.com/docs/</a><a href="https://github.com/grafana/grafana">https://github.com/grafana/grafana</a></td></tr><tr><td>Prometheus</td><td>GIR4<br>DOW1<br>DOW2<br>DOW3<br>DOW7<br>DOW15</td><td>Monitoring system and time series database.</td><td>monitoring + alerts</td><td><a href="https://prometheus.io/docs/introduction/overview/">https://prometheus.io/docs/introduction/overview/</a><a href="https://github.com/prometheus/prometheus">https://github.com/prometheus/prometheus</a></td></tr></tbody></table>

## Inventory tracking

<table><thead><tr><th>Tools</th><th width="154">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Internal Wiki</td><td>KEC9</td><td>Keep an updated inventory list, including the server type, purpose, and responsible team.</td><td>tracking</td><td><a href="https://www.jetbrains.com/help/youtrack/server/knowledge-base.html">https://www.jetbrains.com/help/youtrack/server/knowledge-base.html</a></td></tr><tr><td>arp-scan, arpwatch</td><td>KEC4<br>KEC7<br>SLS12<br>SLS13</td><td>Use automation tools to detect and report any unauthorized machines</td><td>detecting</td><td><a href="https://man.archlinux.org/man/arp-scan.1.en">https://man.archlinux.org/man/arp-scan.1.en</a><br><a href="https://man.archlinux.org/man/arpwatch.8.en">https://man.archlinux.org/man/arpwatch.8.en</a></td></tr></tbody></table>

## Automation <a href="#automation" id="automation"></a>

<table><thead><tr><th>Tools</th><th width="146">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Ansible-Playbooks</td><td>GIR12<br>GIR21<br>GIR24<br>DOW6<br>DOW14<br></td><td>Leverage Ansible for automation of infrastructure deployment. Ensure consistency and reliability through version-controlled playbooks</td><td>automation of deployment</td><td><a href="https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_intro.html">https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_intro.html</a></td></tr><tr><td>Helm</td><td>GIR12<br>GIR21<br>GIR24<br>DOW6<br>DOW14</td><td>The package manager for Kubernetes. Helm helps you manage Kubernetes applications</td><td>automation of deployment</td><td><a href="https://helm.sh/">https://helm.sh/</a></td></tr><tr><td>AWS-Launch Templates</td><td>GIR12<br>GIR21<br>GIR24<br>DOW6<br>DOW14</td><td>Employ AWS Launch Templates for efficient and standardized instance provisioning. Push templates into a repository and ensure it is version-controlled. Leverage template parameters to customize instances as per specific requirements.</td><td>automation of deployment</td><td><a href="https://docs.aws.amazon.com/autoscaling/ec2/userguide/launch-templates.html">https://docs.aws.amazon.com/autoscaling/ec2/userguide/launch-templates.html</a></td></tr><tr><td>Terraform</td><td>GIR12<br>GIR21<br>GIR24<br>DOW6<br>DOW14</td><td>Automate infrastructure on any cloud</td><td>automation of deployment</td><td><a href="https://www.terraform.io/">https://www.terraform.io/</a></td></tr></tbody></table>

## MFA on Servers

<table><thead><tr><th width="152">Tools</th><th width="149">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Google Authenticator PAM module</td><td>GIR7<br>GIR14<br>KEC1<br>KEC7<br>KEC8<br>KEC9<br>KEC10<br>DOW16<br>DOW17<br>DOW18<br>SLS8<br>SLS9<br>SLS10</td><td>Implement MFA for all administrative access.</td><td>secure your server</td><td><a href="https://github.com/google/google-authenticator-libpam">https://github.com/google/google-authenticator-libpam</a></td></tr><tr><td>YubiHSM</td><td>GIR7<br>GIR14<br>KEC1<br>KEC7<br>KEC8<br>KEC9<br>KEC10<br>DOW16<br>DOW17<br>DOW18<br>SLS8<br>SLS9<br>SLS10</td><td>Hardware-based authentication methods</td><td>secure your server</td><td><a href="https://developers.yubico.com/YubiHSM2/Usage_Guides/">https://developers.yubico.com/YubiHSM2/Usage_Guides/</a></td></tr><tr><td>SSH Key rotation</td><td>GIR7<br>GIR14<br>KEC1<br>KEC7<br>KEC8<br>KEC9<br>KEC10<br>DOW16<br>DOW17<br>DOW18<br>SLS8<br>SLS9<br>SLS10</td><td>Use SSH Private Keys Instead of Passwords</td><td>secure your server</td><td><a href="https://docs.aws.amazon.com/secretsmanager/">https://docs.aws.amazon.com/secretsmanager/</a></td></tr></tbody></table>

## Key Security

<table><thead><tr><th>Tools</th><th width="147">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>Bitwarden</td><td>GIR1<br>GIR6<br>GIR7<br>GIR22<br>KEC1<br>KEC2<br>KEC4</td><td>Store keys securely in a key vault</td><td>secure your keys, access management</td><td><a href="https://bitwarden.com/">https://bitwarden.com/</a></td></tr><tr><td>Vault</td><td>GIR1<br>GIR6<br>GIR7<br>GIR22<br>KEC1<br>KEC2<br>KEC4</td><td>Another key management store that seamlessly integrates your keys into your infrastructure, such as within a Kubernetes environment</td><td>secure your keys, access management</td><td><a href="https://www.vaultproject.io/">https://www.vaultproject.io/</a><br><a href="https://github.com/hashicorp/vault">https://github.com/hashicorp/vault</a></td></tr></tbody></table>

## Firewall

<table><thead><tr><th>Tools</th><th width="149">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>UFW</td><td>GIR9</td><td>No direct SSH/RDP should be accessible from the internet.</td><td>protect servers</td><td><a href="https://wiki.archlinux.org/title/Uncomplicated_Firewall">https://wiki.archlinux.org/title/Uncomplicated_Firewall</a></td></tr><tr><td>AWS Security Groups</td><td>GIR9</td><td>Control traffic to your AWS resources using security groups. Access should be enabled through an MFA-enabled VPN.</td><td>protect servers</td><td><a href="https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html#security-group-rule-characteristics">https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html#security-group-rule-characteristics</a></td></tr></tbody></table>

## IP-based DDoS Mitigation

<table><thead><tr><th>Tools</th><th width="151">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>fail2ban</td><td>DOW10</td><td>Daemon to ban hosts that cause multiple authentication errors</td><td>DDoS protection</td><td><a href="https://github.com/fail2ban/fail2ban">https://github.com/fail2ban/fail2ban</a></td></tr><tr><td>AWS Shield</td><td>DOW1<br>DOW3<br>DOW7<br>DOW10</td><td>All AWS customers benefit from the automatic protections of AWS Shield.</td><td>DDoS protection</td><td><a href="https://aws.amazon.com/shield/">https://aws.amazon.com/shield/</a></td></tr><tr><td>Setup Nodeexporter for Grafana</td><td>GIR4</td><td>Setup Grafana Alerts with thresholds for incoming and outgoing Traffic.</td><td>Regularly monitor network traffic for anomalies.</td><td><a href="https://github.com/prometheus/node_exporter">https://github.com/prometheus/node_exporter</a></td></tr></tbody></table>

## Engine API Being Filtered + Auth for Engine API

<table><thead><tr><th width="124">Tools</th><th>Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>nginx, firewalls + your el/cl-configuration files</td><td>GIR9</td><td>Filter access to the Engine API or disable unnecessary API's in your Beacon/Execution-layer nodes configuration files.*</td><td>prevent api attacks</td><td><a href="https://www.nginx.com/">https://www.nginx.com/</a></td></tr></tbody></table>

\* Note \
By default, account unlocking is forbidden when HTTP or Websocket access is enabled (i.e. by passing --http or ws flag). This is because an attacker that manages to access the node via the externally-exposed HTTP/WS port can then control the unlocked account. It is possible to force account unlock by including the --allow-insecure-unlock flag but this is unsafe and not recommended except for expert users that completely understand how it can be used safely. This is not a hypothetical risk: there are bots that continually scan for http-enabled Ethereum nodes to attack

## VLAN Segmentation

<table><thead><tr><th>Tools</th><th width="148">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>mikrotik</td><td>GIR10</td><td>Group related servers and services into VLANs. Subnet and connect your network and cloud networks.</td><td>Limit inter-VLAN routing to only necessary services with Site to Site IPsec (IKEv2) tunnel</td><td><a href="https://mikrotik.com/download">https://mikrotik.com/download</a>, <a href="https://help.mikrotik.com/docs/display/ROS/IPsec#IPsec-SitetoSiteGREtunneloverIPsec(IKEv2)usingDNS">https://help.mikrotik.com/docs/display/ROS/IPsec#IPsec-SitetoSiteGREtunneloverIPsec(IKEv2)usingDNS</a></td></tr></tbody></table>

## OS Hardening

<table><thead><tr><th>Tools</th><th width="148">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>SELinux</td><td>GIR13<br>GIR14<br>GIR17<br>KEC7</td><td>Use hardening playbooks that automate many of these processes and activate SELinux.</td><td>OS security</td><td><a href="https://wiki.archlinux.org/title/Security">https://wiki.archlinux.org/title/Security</a>, <a href="https://wiki.archlinux.org/title/SELinux">https://wiki.archlinux.org/title/SELinux</a></td></tr></tbody></table>

## EDR, SIEM, NDR

<table><thead><tr><th>Tools</th><th width="151">Risk mitigation</th><th>Description</th><th>Purpose</th><th>Links</th></tr></thead><tbody><tr><td>EDR</td><td>GIR14</td><td>EDR for endpoint-level visibility</td><td>secure endpoint</td><td>multiple provider</td></tr><tr><td>SIEM</td><td>GIR15</td><td>SIEM for comprehensive security event management and reporting.</td><td>security events and reporting</td><td><a href="https://github.com/wazuh/wazuh">https://github.com/wazuh/wazuh</a></td></tr><tr><td>NDR</td><td>GIR10</td><td>NDR for network-level monitoring and response.</td><td>monitor network</td><td>multiple provider</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://duck-initiative.gitbook.io/d.u.c.k.-knowledge-base/mitigation-and-controls-library/collection-of-tools-scripts-and-templates.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.