mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-07-21 11:38:59 +02:00
Exemples -> Examples (#116)
* Exemples -> Examples * Exemples -> Examples * Uppercase * Uppercase v2 * Uppercase v3 * Uppercases * Another one * Add whoami because .gitignore is ignoring conf folder
This commit is contained in:
Rasmus
@@ -0,0 +1,21 @@
|
||||
# Example
|
||||
## Behind another proxy service (ex: clouflare)
|
||||
|
||||
You need to configure your Traefik to trust Forwarded headers by your front proxy
|
||||
In the example we use another instance of traefik with the container named cloudflare to simulate a front proxy
|
||||
|
||||
The "internal" Traefik instance is configured to trust the cloudflare forward headers
|
||||
This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
|
||||
```yaml
|
||||
- "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
We configure the middleware to trust as well the IP:
|
||||
```yaml
|
||||
- "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_behindproxy
|
||||
```
|
||||
@@ -0,0 +1,4 @@
|
||||
filenames:
|
||||
- /var/log/traefik/access.log
|
||||
labels:
|
||||
type: traefik
|
||||
@@ -0,0 +1,15 @@
|
||||
http:
|
||||
# Add the router
|
||||
routers:
|
||||
router0:
|
||||
entryPoints:
|
||||
- web
|
||||
service: service-foo
|
||||
rule: Path(`/foo`)
|
||||
|
||||
# Add the service
|
||||
services:
|
||||
service-foo:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: http://traefik/foo:80
|
||||
@@ -0,0 +1,107 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
cloudflare:
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "cloudflare"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--api.insecure=true"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--providers.file.filename=/cloud.yaml"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./cloudflare-example.yaml:/cloud.yaml:ro
|
||||
- logs-cloudflare:/var/log/traefik
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
|
||||
traefik:
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-traefik:/var/log/traefik
|
||||
ports:
|
||||
- 90:80
|
||||
- 9080:8080
|
||||
depends_on:
|
||||
- crowdsec
|
||||
|
||||
whoami-foo:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-foo"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router-foo.rule=Path(`/foo`)"
|
||||
- "traefik.http.routers.router-foo.entrypoints=web"
|
||||
- "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecmode=live"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
whoami-bar:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-bar"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router-bar.rule=Path(`/bar`)"
|
||||
- "traefik.http.routers.router-bar.entrypoints=web"
|
||||
- "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecmode=live"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.5.2
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK_DEV: 40796d93c2958f9e58345514e67740e5
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs-cloudflare:/var/log/traefik:ro
|
||||
- crowdsec-db-cloudflare:/var/lib/crowdsec/data/
|
||||
- crowdsec-config-cloudflare:/etc/crowdsec/
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
volumes:
|
||||
logs-traefik:
|
||||
logs-cloudflare:
|
||||
crowdsec-db-cloudflare:
|
||||
crowdsec-config-cloudflare:
|
||||
@@ -0,0 +1 @@
|
||||
.vagrant/
|
||||
@@ -0,0 +1,62 @@
|
||||
# Example
|
||||
|
||||
### Install vagrant
|
||||
|
||||
##### On linux
|
||||
|
||||
```bash
|
||||
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.asc
|
||||
echo "deb [ signed-by=/usr/share/keyrings/hashicorp-archive-keyring.asc ] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
|
||||
sudo apt-get update && sudo apt-get install vagrant
|
||||
```
|
||||
|
||||
### Install libvirt
|
||||
|
||||
```bash
|
||||
sudo apt install -y qemu-kvm virt-manager libvirt-daemon-system virtinst libvirt-clients bridge-utils
|
||||
sudo systemctl enable --now libvirtd
|
||||
sudo systemctl start libvirtd
|
||||
sudo usermod -aG kvm $USER
|
||||
sudo usermod -aG libvirt $USER
|
||||
```
|
||||
|
||||
### Install the plugin vagrant-libvirt
|
||||
|
||||
```bash
|
||||
vagrant plugin install vagrant-libvirt
|
||||
```
|
||||
|
||||
#### Start the VM
|
||||
|
||||
```bash
|
||||
sudo vagrant up --provider=libvirt
|
||||
```
|
||||
|
||||
#### Destroy the VM
|
||||
|
||||
```bash
|
||||
sudo vagrant destroy -f
|
||||
```
|
||||
|
||||
#### SSH in the VM
|
||||
|
||||
```bash
|
||||
sudo vagrant ssh
|
||||
```
|
||||
|
||||
### Context
|
||||
|
||||
Traefik is installed as a systemd service.
|
||||
It is configured with the dashboard activated and listening on port 8081 and port 80 for the web
|
||||
|
||||
Crowdsec is started and listening on port 8080.
|
||||
Certificates are generated on the provision step of vagrant.
|
||||
|
||||
Whoami is installed as a systemd service.
|
||||
It is configured to listen on port 9000.
|
||||
|
||||
Whoami is accessible from traefik on port 80 at any domain and path
|
||||
|
||||
For example: curl http://localhost:80/test
|
||||
|
||||
The Plugin / Bouncer use certificates to validate the server certificates and authenticates with the Crowdsec local api.
|
||||
Vendored
+83
@@ -0,0 +1,83 @@
|
||||
# -*- mode: ruby -*-
|
||||
# vi: set ft=ruby :
|
||||
|
||||
# All Vagrant configuration is done below. The "2" in Vagrant.configure
|
||||
# configures the configuration version (we support older styles for
|
||||
# backwards compatibility). Please don't change it unless you know what
|
||||
# you're doing.
|
||||
Vagrant.configure("2") do |config|
|
||||
# The most common configuration options are documented and commented below.
|
||||
# For a complete reference, please see the online documentation at
|
||||
# https://docs.vagrantup.com.
|
||||
|
||||
# Every Vagrant development environment requires a box. You can search for
|
||||
# boxes at https://vagrantcloud.com/search.
|
||||
config.vm.box = "generic/debian11"
|
||||
|
||||
# Disable automatic box update checking. If you disable this, then
|
||||
# boxes will only be checked for updates when the user runs
|
||||
# `vagrant box outdated`. This is not recommended.
|
||||
# config.vm.box_check_update = false
|
||||
|
||||
# Create a forwarded port mapping which allows access to a specific port
|
||||
# within the machine from a port on the host machine. In the example below,
|
||||
# accessing "localhost:8080" will access port 80 on the guest machine.
|
||||
# NOTE: This will enable public access to the opened port
|
||||
# config.vm.network "forwarded_port", guest: 80, host: 8080
|
||||
|
||||
# Create a forwarded port mapping which allows access to a specific port
|
||||
# within the machine from a port on the host machine and only allow access
|
||||
# via 127.0.0.1 to disable public access
|
||||
# config.vm.network "forwarded_port", guest: 80, host: 8080, host_ip: "127.0.0.1"
|
||||
config.vm.network "forwarded_port", guest: 8081, host: 8081
|
||||
config.vm.network "forwarded_port", guest: 80, host: 80
|
||||
|
||||
|
||||
# Create a private network, which allows host-only access to the machine
|
||||
# using a specific IP.
|
||||
# config.vm.network "private_network", ip: "192.168.33.10"
|
||||
|
||||
# Create a public network, which generally matched to bridged network.
|
||||
# Bridged networks make the machine appear as another physical device on
|
||||
# your network.
|
||||
# config.vm.network "public_network"
|
||||
|
||||
# Share an additional folder to the guest VM. The first argument is
|
||||
# the path on the host to the actual folder. The second argument is
|
||||
# the path on the guest to mount the folder. And the optional third
|
||||
# argument is a set of non-required options.
|
||||
# Provider-specific configuration so you can fine-tune various
|
||||
# backing providers for Vagrant. These expose provider-specific options.
|
||||
# Example for VirtualBox:
|
||||
#
|
||||
|
||||
config.vm.provider "libvirt" do |lv|
|
||||
graphics_type = "none"
|
||||
lv.cpus = 1
|
||||
# lv.vm.network :private_network, :ip => "10.20.30.40"
|
||||
# Customize the amount of memory on the VM:
|
||||
lv.memory = "2048"
|
||||
end
|
||||
|
||||
# config.vm.provider "virtualbox" do |vb|
|
||||
# vb.gui = false
|
||||
# vb.cpus = 1
|
||||
# # vb.vm.network :private_network, :ip => "10.20.30.40"
|
||||
# # Customize the amount of memory on the VM:
|
||||
# vb.memory = "2048"
|
||||
# end
|
||||
config.vm.provision "file", source: "./files", destination: "/home/vagrant/vagrant_data"
|
||||
config.vm.provision "file", source: "./scripts", destination: "/home/vagrant/scripts"
|
||||
# config.vm.provision "file", source: "../../", destination: "/home/vagrant/plugin"
|
||||
|
||||
config.vm.provision "shell", path: "scripts/install_traefik.sh"
|
||||
config.vm.provision "shell", path: "scripts/configure_traefik.sh"
|
||||
|
||||
config.vm.provision "shell", path: "scripts/install_whoami.sh"
|
||||
|
||||
config.vm.provision "shell", path: "scripts/install_crowdsec.sh"
|
||||
|
||||
config.vm.provision "shell", path: "scripts/configure_crowdsec_certs.sh"
|
||||
|
||||
|
||||
end
|
||||
@@ -0,0 +1,4 @@
|
||||
filenames:
|
||||
- /var/log/traefik/access.log
|
||||
labels:
|
||||
type: traefik
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"CN": "myagent",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "agent-ou",
|
||||
"ST": "France"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
{
|
||||
"CN": "whoami",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "bouncer-ou",
|
||||
"ST": "France"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"CN": "CrowdSec Test CA",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "Crowdsec",
|
||||
"ST": "France"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"CN": "CrowdSec Test CA Intermediate",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "Crowdsec Intermediate",
|
||||
"ST": "France"
|
||||
}
|
||||
],
|
||||
"ca": {
|
||||
"expiry": "42720h"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{
|
||||
"signing": {
|
||||
"default": {
|
||||
"expiry": "8760h"
|
||||
},
|
||||
"profiles": {
|
||||
"intermediate_ca": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"key encipherment",
|
||||
"cert sign",
|
||||
"crl sign",
|
||||
"server auth",
|
||||
"client auth"
|
||||
],
|
||||
"expiry": "8760h",
|
||||
"ca_constraint": {
|
||||
"is_ca": true,
|
||||
"max_path_len": 0,
|
||||
"max_path_len_zero": true
|
||||
}
|
||||
},
|
||||
"server": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signing",
|
||||
"key encipherment",
|
||||
"server auth"
|
||||
],
|
||||
"expiry": "8760h"
|
||||
},
|
||||
"client": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"key encipherment",
|
||||
"client auth"
|
||||
],
|
||||
"expiry": "8760h"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"CN": "localhost",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "Crowdsec Server",
|
||||
"ST": "France"
|
||||
}
|
||||
],
|
||||
"hosts": [
|
||||
"127.0.0.1",
|
||||
"localhost"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
common:
|
||||
daemonize: true
|
||||
pid_dir: /var/run/
|
||||
log_media: file
|
||||
log_level: debug
|
||||
log_dir: /var/log/
|
||||
log_max_size: 20
|
||||
compress_logs: true
|
||||
log_max_files: 10
|
||||
working_dir: .
|
||||
config_paths:
|
||||
config_dir: /etc/crowdsec/
|
||||
data_dir: /var/lib/crowdsec/data/
|
||||
simulation_path: /etc/crowdsec/simulation.yaml
|
||||
hub_dir: /etc/crowdsec/hub/
|
||||
index_path: /etc/crowdsec/hub/.index.json
|
||||
notification_dir: /etc/crowdsec/notifications/
|
||||
plugin_dir: /usr/lib/crowdsec/plugins/
|
||||
crowdsec_service:
|
||||
acquisition_path: /etc/crowdsec/acquis.yaml
|
||||
acquisition_dir: /etc/crowdsec/acquis.d
|
||||
parser_routines: 1
|
||||
cscli:
|
||||
output: human
|
||||
color: auto
|
||||
db_config:
|
||||
log_level: info
|
||||
type: sqlite
|
||||
db_path: /var/lib/crowdsec/data/crowdsec.db
|
||||
#max_open_conns: 100
|
||||
#user:
|
||||
#password:
|
||||
#db_name:
|
||||
#host:
|
||||
#port:
|
||||
flush:
|
||||
max_items: 5000
|
||||
max_age: 7d
|
||||
plugin_config:
|
||||
user: nobody # plugin process would be ran on behalf of this user
|
||||
group: nogroup # plugin process would be ran on behalf of this group
|
||||
api:
|
||||
client:
|
||||
insecure_skip_verify: false
|
||||
credentials_path: /etc/crowdsec/local_api_credentials.yaml
|
||||
server:
|
||||
log_level: debug
|
||||
listen_uri: 127.0.0.1:8080
|
||||
profiles_path: /etc/crowdsec/profiles.yaml
|
||||
console_path: /etc/crowdsec/console.yaml
|
||||
online_client: # Central API credentials (to push signals and receive bad IPs)
|
||||
credentials_path: /etc/crowdsec/online_api_credentials.yaml
|
||||
trusted_ips: # IP ranges, or IPs which can have admin API access
|
||||
- 127.0.0.1
|
||||
tls:
|
||||
cert_file: /etc/crowdsec/certs/server.pem #Server side cert
|
||||
key_file: /etc/crowdsec/certs/server-key.pem #Server side key
|
||||
ca_cert_path: /etc/crowdsec/certs/inter.pem #CA used to verify the client certs
|
||||
bouncers_allowed_ou: #OU allowed for bouncers
|
||||
- bouncer-ou
|
||||
agents_allowed_ou: #OU allowed for agents
|
||||
- agent-ou
|
||||
@@ -0,0 +1,4 @@
|
||||
url: https://localhost:8080
|
||||
ca_cert_path: /etc/crowdsec/certs/inter.pem #CA to trust the server certificate
|
||||
key_path: /etc/crowdsec/certs/agent-key.pem #Client key
|
||||
cert_path: /etc/crowdsec/certs/agent.pem #Client cert
|
||||
@@ -0,0 +1,31 @@
|
||||
http:
|
||||
routers:
|
||||
to-whoami-http-service:
|
||||
rule: "PathPrefix(`/`)"
|
||||
service: whoami-service
|
||||
middlewares:
|
||||
- "crowdsec-whoami"
|
||||
entryPoints:
|
||||
- web
|
||||
|
||||
services:
|
||||
whoami-service:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://localhost:9000/"
|
||||
|
||||
middlewares:
|
||||
crowdsec-whoami:
|
||||
plugin:
|
||||
bouncer:
|
||||
enabled: true
|
||||
crowdseclapikey: "whoami-demo"
|
||||
updateintervalseconds: 60
|
||||
crowdsecmode: live
|
||||
loglevel: "DEBUG"
|
||||
crowdsecLapiScheme: https
|
||||
crowdsecLapiHost: localhost:8080
|
||||
crowdsecLapiTLSInsecureVerify: false
|
||||
crowdsecLapiTLSCertificateAuthorityFile: /etc/traefik/crowdsec-certs/inter.pem
|
||||
crowdsecLapiTLSCertificateBouncerFile: /etc/traefik/crowdsec-certs/bouncer.pem
|
||||
crowdsecLapiTLSCertificateBouncerKeyFile: /etc/traefik/crowdsec-certs/bouncer-key.pem
|
||||
@@ -0,0 +1,40 @@
|
||||
[Unit]
|
||||
Description=traefik proxy
|
||||
After=network-online.target
|
||||
Wants=network-online.target systemd-networkd-wait-online.service
|
||||
|
||||
[Service]
|
||||
Restart=on-abnormal
|
||||
|
||||
; User and group the process will run as.
|
||||
User=traefik
|
||||
Group=traefik
|
||||
|
||||
; Always set "-root" to something safe in case it gets forgotten in the traefikfile.
|
||||
ExecStart=/usr/local/bin/traefik --configfile=/etc/traefik/traefik.yml
|
||||
WorkingDirectory=/etc/traefik
|
||||
; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
|
||||
LimitNOFILE=1048576
|
||||
|
||||
; Use private /tmp and /var/tmp, which are discarded after traefik stops.
|
||||
PrivateTmp=true
|
||||
; Use a minimal /dev (May bring additional security if switched to 'true', but it may not work on Raspberry Pi's or other devices, so it has been disabled in this dist.)
|
||||
PrivateDevices=false
|
||||
; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
|
||||
ProtectHome=true
|
||||
; Make /usr, /boot, /etc and possibly some more folders read-only.
|
||||
;ProtectSystem=full
|
||||
; … except /etc/ssl/traefik, because we want Letsencrypt-certificates there.
|
||||
; This merely retains r/w access rights, it does not add any new. Must still be writable on the host!
|
||||
;ReadWriteDirectories=/etc/traefik/acme
|
||||
;ReadWriteDirectories=/etc/traefik/plugins-storage
|
||||
|
||||
; The following additional security directives only work with systemd v229 or later.
|
||||
; They further restrict privileges that can be gained by traefik. Uncomment if you like.
|
||||
; Note that you may have to add capabilities required by any plugins in use.
|
||||
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||
NoNewPrivileges=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,100 @@
|
||||
################################################################
|
||||
# Global configuration
|
||||
################################################################
|
||||
global:
|
||||
checkNewVersion: false
|
||||
sendAnonymousUsage: false
|
||||
|
||||
################################################################
|
||||
# EntryPoints configuration
|
||||
################################################################
|
||||
|
||||
entryPoints:
|
||||
web:
|
||||
address: :80
|
||||
traefik:
|
||||
address: :8081
|
||||
|
||||
################################################################
|
||||
# Provider file configuration
|
||||
################################################################
|
||||
|
||||
providers:
|
||||
file:
|
||||
directory: "/etc/traefik/conf"
|
||||
|
||||
################################################################
|
||||
# Plugin configuration
|
||||
################################################################
|
||||
|
||||
experimental:
|
||||
plugins:
|
||||
bouncer:
|
||||
moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
version: v1.1.6
|
||||
|
||||
################################################################
|
||||
# Certificate Resolver
|
||||
################################################################
|
||||
|
||||
serversTransport:
|
||||
insecureSkipVerify: false
|
||||
|
||||
################################################################
|
||||
# Traefik logs configuration
|
||||
################################################################
|
||||
|
||||
# Traefik logs
|
||||
# Enabled by default and log to stdout
|
||||
log:
|
||||
filePath: /var/log/traefik/traefik.log
|
||||
level: DEBUG
|
||||
# format: json
|
||||
|
||||
################################################################
|
||||
# Access logs configuration
|
||||
################################################################
|
||||
|
||||
# Enable access logs
|
||||
# By default it will write to stdout and produce logs in the textual
|
||||
# Common Log Format (CLF), extended with additional fields.
|
||||
accessLog:
|
||||
# Sets the file path for the access log. If not specified, stdout will be used.
|
||||
# Intermediate directories are created if necessary.
|
||||
filePath: /var/log/traefik/access.log
|
||||
fields:
|
||||
defaultMode: keep
|
||||
names:
|
||||
ClientUsername: keep
|
||||
headers:
|
||||
defaultMode: keep
|
||||
|
||||
# Format is either "json" or "common".
|
||||
#
|
||||
# Optional
|
||||
# Default: "common"
|
||||
#
|
||||
# format: json
|
||||
|
||||
################################################################
|
||||
# API and dashboard configuration
|
||||
################################################################
|
||||
|
||||
# Enable API and dashboard
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
api:
|
||||
# Enable the API in insecure mode
|
||||
#
|
||||
# Optional
|
||||
# Default: false
|
||||
#
|
||||
insecure: true
|
||||
|
||||
# Enabled Dashboard
|
||||
#
|
||||
# Optional
|
||||
# Default: true
|
||||
#
|
||||
dashboard: true
|
||||
@@ -0,0 +1,31 @@
|
||||
[Unit]
|
||||
Description=whoami web server
|
||||
After=network-online.target
|
||||
Wants=network-online.target systemd-networkd-wait-online.service
|
||||
|
||||
[Service]
|
||||
Restart=on-abnormal
|
||||
|
||||
; User and group the process will run as.
|
||||
User=whoami
|
||||
Group=whoami
|
||||
|
||||
; Always set "-root" to something safe in case it gets forgotten in the traefikfile.
|
||||
ExecStart=/usr/local/bin/whoami --port=9000
|
||||
|
||||
; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
|
||||
LimitNOFILE=1048576
|
||||
|
||||
; Use private /tmp and /var/tmp, which are discarded after traefik stops.
|
||||
PrivateTmp=true
|
||||
; Use a minimal /dev (May bring additional security if switched to 'true', but it may not work on Raspberry Pi's or other devices, so it has been disabled in this dist.)
|
||||
PrivateDevices=false
|
||||
; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
|
||||
ProtectHome=true
|
||||
; Make /usr, /boot, /etc and possibly some more folders read-only.
|
||||
ProtectSystem=full
|
||||
|
||||
NoNewPrivileges=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,46 @@
|
||||
#!/bin/bash
|
||||
|
||||
basepath="/home/vagrant/vagrant_data/crowdsec/certs"
|
||||
|
||||
VERSION=$(curl --silent "https://api.github.com/repos/cloudflare/cfssl/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
|
||||
VNUMBER=${VERSION#"v"}
|
||||
wget https://github.com/cloudflare/cfssl/releases/download/${VERSION}/cfssl_${VNUMBER}_linux_amd64 -O cfssl
|
||||
chmod +x cfssl
|
||||
sudo mv cfssl /usr/local/bin
|
||||
|
||||
VERSION=$(curl --silent "https://api.github.com/repos/cloudflare/cfssl/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
|
||||
VNUMBER=${VERSION#"v"}
|
||||
wget https://github.com/cloudflare/cfssl/releases/download/${VERSION}/cfssljson_${VNUMBER}_linux_amd64 -O cfssljson
|
||||
chmod +x cfssljson
|
||||
sudo mv cfssljson /usr/local/bin
|
||||
cfssljson -version
|
||||
|
||||
mkdir -p /etc/crowdsec/certs
|
||||
|
||||
# Generate the CA
|
||||
cfssl gencert --initca ${basepath}/ca.json 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/ca"
|
||||
# Generate an intermediate certificate that will be used to sign the client certificates
|
||||
cfssl gencert --initca ${basepath}/intermediate.json 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/inter"
|
||||
cfssl sign -ca "/etc/crowdsec/certs/ca.pem" -ca-key "/etc/crowdsec/certs/ca-key.pem" -config ${basepath}/profiles.json -profile intermediate_ca "/etc/crowdsec/certs/inter.csr" 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/inter"
|
||||
# Generate a server side certificate
|
||||
cfssl gencert -ca "/etc/crowdsec/certs/inter.pem" -ca-key "/etc/crowdsec/certs/inter-key.pem" -config ${basepath}/profiles.json -profile=server ${basepath}/server.json 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/server"
|
||||
# Generate a client certificate for the bouncer whoami
|
||||
cfssl gencert -ca "/etc/crowdsec/certs/inter.pem" -ca-key "/etc/crowdsec/certs/inter-key.pem" -config ${basepath}/profiles.json -profile=client ${basepath}/bouncer.json 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/bouncer"
|
||||
# Generate a client certificate for the agent
|
||||
cfssl gencert -ca "/etc/crowdsec/certs/inter.pem" -ca-key "/etc/crowdsec/certs/inter-key.pem" -config ${basepath}/profiles.json -profile=client ${basepath}/agent.json 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/agent"
|
||||
|
||||
|
||||
cp /home/vagrant/vagrant_data/crowdsec/config/config.yaml /etc/crowdsec/config.yaml.local
|
||||
cp /home/vagrant/vagrant_data/crowdsec/config/local_api_credentials.yaml /etc/crowdsec/
|
||||
chmod +r /etc/crowdsec/config.yaml
|
||||
chmod +r /etc/crowdsec/local_api_credentials.yaml
|
||||
|
||||
systemctl restart crowdsec
|
||||
|
||||
mkdir /etc/traefik/crowdsec-certs
|
||||
cp /etc/crowdsec/certs/inter.pem /etc/traefik/crowdsec-certs/inter.pem
|
||||
cp /etc/crowdsec/certs/bouncer.pem /etc/traefik/crowdsec-certs/bouncer.pem
|
||||
cp /etc/crowdsec/certs/bouncer-key.pem /etc/traefik/crowdsec-certs/bouncer-key.pem
|
||||
chown -R traefik:traefik /etc/traefik/crowdsec-certs/
|
||||
|
||||
systemctl restart traefik
|
||||
@@ -0,0 +1,11 @@
|
||||
#!/bin/bash
|
||||
|
||||
|
||||
sudo cp /home/vagrant/vagrant_data/traefik/traefik.yml /etc/traefik/traefik.yml
|
||||
sudo cp -a /home/vagrant/vagrant_data/traefik/conf /etc/traefik/
|
||||
sudo chown -R traefik:traefik /etc/traefik
|
||||
sudo mkdir /var/log/traefik
|
||||
sudo chown -R traefik:traefik /var/log/traefik
|
||||
|
||||
sudo systemctl restart traefik.service
|
||||
sudo systemctl status traefik.service
|
||||
@@ -0,0 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
|
||||
DEBIAN_FRONTEND=noninteractive sudo apt install crowdsec -y
|
||||
sudo cp /home/vagrant/vagrant_data/crowdsec/acquis.yaml /etc/crowdsec/acquis.yaml
|
||||
@@ -0,0 +1,32 @@
|
||||
#!/bin/bash
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive sudo apt-get update && sudo apt-get install wget -y
|
||||
# DEBIAN_FRONTEND=noninteractive sudo apt-get upgrade -y --assume-yes
|
||||
wget -O traefik.tar.gz "https://github.com/traefik/traefik/releases/download/v2.10.4/traefik_v2.10.4_linux_amd64.tar.gz"
|
||||
tar -zxvf traefik.tar.gz
|
||||
# inspired from https://gist.github.com/ubergesundheit/7c9d875befc2d7bfd0bf43d8b3862d85
|
||||
sudo mv ./traefik /usr/local/bin/
|
||||
sudo chown root:root /usr/local/bin/traefik
|
||||
sudo chmod 755 /usr/local/bin/traefik
|
||||
sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/traefik
|
||||
|
||||
sudo groupadd -g 321 traefik
|
||||
sudo useradd \
|
||||
-g traefik --no-user-group \
|
||||
--home-dir /var/www --no-create-home \
|
||||
--shell /usr/sbin/nologin \
|
||||
--system --uid 321 traefik
|
||||
|
||||
sudo mkdir /etc/traefik
|
||||
sudo mkdir /etc/traefik/acme
|
||||
sudo mkdir /etc/traefik/plugins-storage
|
||||
sudo chown -R root:root /etc/traefik
|
||||
sudo chown -R traefik:traefik /etc/traefik/acme
|
||||
sudo chown -R traefik:traefik /etc/traefik/plugins-storage
|
||||
|
||||
sudo cp /home/vagrant/vagrant_data/traefik/traefik.service /etc/systemd/system/
|
||||
sudo chown root:root /etc/systemd/system/traefik.service
|
||||
sudo chmod 644 /etc/systemd/system/traefik.service
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl start traefik.service
|
||||
sudo systemctl enable traefik.service
|
||||
@@ -0,0 +1,23 @@
|
||||
#!/bin/bash
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive sudo apt-get update && apt-get install wget -y
|
||||
wget -O whoami.tar.gz "https://github.com/traefik/whoami/releases/download/v1.9.0/whoami_v1.9.0_linux_amd64.tar.gz"
|
||||
tar -zxvf whoami.tar.gz
|
||||
# inspired from https://gist.github.com/ubergesundheit/7c9d875befc2d7bfd0bf43d8b3862d85
|
||||
sudo mv ./whoami /usr/local/bin/
|
||||
sudo chown root:root /usr/local/bin/whoami
|
||||
sudo chmod 755 /usr/local/bin/whoami
|
||||
|
||||
sudo groupadd -g 322 whoami
|
||||
sudo useradd \
|
||||
-g whoami --no-user-group \
|
||||
--home-dir /var/www --no-create-home \
|
||||
--shell /usr/sbin/nologin \
|
||||
--system --uid 322 whoami
|
||||
|
||||
sudo cp /home/vagrant/vagrant_data/whoami.service /etc/systemd/system/
|
||||
sudo chown root:root /etc/systemd/system/whoami.service
|
||||
sudo chmod 644 /etc/systemd/system/whoami.service
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl start whoami.service
|
||||
sudo systemctl enable whoami.service
|
||||
@@ -0,0 +1,91 @@
|
||||
### Kubernetes Example
|
||||
|
||||
#### Official docs
|
||||
|
||||
##### Install Kubernetes on Docker Desktop
|
||||
|
||||
Install Docker Desktop
|
||||
|
||||
[https://www.docker.com/products/docker-desktop/](https://www.docker.com/products/docker-desktop/)
|
||||
|
||||
In settings, click on `Kubernetes` menu, and click `Enable Kubernetes`, then `Apply and Restart`.
|
||||
In case of any issue, you can reset the cluster from this menu and the button `Reset Kubernetes Cluster`.
|
||||
|
||||
##### Install Traefik
|
||||
|
||||
[getting-started/install-traefik/#use-the-helm-chart](https://doc.traefik.io/traefik/getting-started/install-traefik/#use-the-helm-chart)
|
||||
|
||||
```bash
|
||||
helm repo add traefik https://traefik.github.io/charts
|
||||
helm repo update
|
||||
kubectl create ns traefik
|
||||
helm upgrade --install --namespace=traefik \
|
||||
--values=./traefik/values.yml \
|
||||
traefik traefik/traefik
|
||||
```
|
||||
|
||||
#### View the Traefik dashboard
|
||||
|
||||
> Port forward the dashboard:
|
||||
|
||||
```bash
|
||||
kubectl --namespace=traefik port-forward $(kubectl get pods --namespace=traefik --selector "app.kubernetes.io/name=traefik" --output=name) 9000:9000
|
||||
```
|
||||
|
||||
Access the dashboard with: [localhost:9000/dashboard/#/](http://localhost:9000/dashboard/#/)
|
||||
|
||||
#### Install the plugin
|
||||
|
||||
```bash
|
||||
kubectl apply -f traefik/plugin.yml
|
||||
```
|
||||
|
||||
#### Install Whoami
|
||||
```bash
|
||||
kubectl apply -f whoami/whoami.yml
|
||||
kubectl apply -f whoami/whoami-services.yml
|
||||
kubectl apply -f whoami/whoami-ingress.yml
|
||||
```
|
||||
|
||||
#### Access Whoami
|
||||
|
||||
> Port forward web port of Traefik
|
||||
|
||||
```bash
|
||||
kubectl --namespace=traefik port-forward $(kubectl get pods --namespace=traefik --selector "app.kubernetes.io/name=traefik" --output=name) 8000:8000
|
||||
```
|
||||
|
||||
Access the whoami with: [localhost:8000/](http://localhost:8000/)
|
||||
|
||||
#### Install Crowdsec
|
||||
|
||||
[helm/crowdsec/crowdsec](https://artifacthub.io/packages/helm/crowdsec/crowdsec)
|
||||
|
||||
```bash
|
||||
helm repo add crowdsec https://crowdsecurity.github.io/helm-charts
|
||||
helm repo update
|
||||
kubectl create ns crowdsec
|
||||
helm upgrade --install --namespace=crowdsec \
|
||||
--values=./crowdsec/values.yml \
|
||||
crowdsec crowdsec/crowdsec
|
||||
```
|
||||
|
||||
#### Read Traefik Logs
|
||||
|
||||
```bash
|
||||
kubectl get pod --namespace traefik
|
||||
kubectl logs $(kubectl get pods --namespace=traefik --selector "app.kubernetes.io/name=traefik" --output=name) --namespace traefik -f
|
||||
```
|
||||
|
||||
#### Use CSCLI in Crowdsec container
|
||||
|
||||
```bash
|
||||
kubectl -n crowdsec exec -it $(kubectl get pods -n crowdsec --selector "k8s-app=crowdsec,type=lapi" --output=name) bash
|
||||
```
|
||||
|
||||
|
||||
#### Shell in Traefik container
|
||||
|
||||
```bash
|
||||
kubectl -n traefik exec -it $(kubectl get pods -n traefik --selector "app.kubernetes.io/name=traefik" --output=name) sh
|
||||
```
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: crowdsec
|
||||
namespace: crowdsec
|
||||
|
||||
spec:
|
||||
ports:
|
||||
- name: web
|
||||
port: 8080
|
||||
targetPort: web
|
||||
|
||||
selector:
|
||||
app: crowdsec
|
||||
@@ -0,0 +1,25 @@
|
||||
image:
|
||||
tag: v1.5.2
|
||||
|
||||
agent:
|
||||
acquisition:
|
||||
- namespace: traefik
|
||||
podName: traefik-*
|
||||
program: traefik
|
||||
env:
|
||||
- name: COLLECTIONS
|
||||
value: "crowdsecurity/traefik"
|
||||
|
||||
lapi:
|
||||
dashboard:
|
||||
enabled: false
|
||||
env:
|
||||
- name: ENROLL_KEY
|
||||
value: 40796d93c2958f9e58345514e67740e5
|
||||
- name: ENROLL_INSTANCE_NAME
|
||||
value: k8s_cluster
|
||||
- name: ENROLL_TAGS
|
||||
value: "k8s linux test"
|
||||
# If it's a test, we don't want to share signals with CrowdSec so disable the Online API.
|
||||
- name: DISABLE_ONLINE_API
|
||||
value: "true"
|
||||
@@ -0,0 +1,14 @@
|
||||
# dashboard.yaml
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: dashboard
|
||||
spec:
|
||||
entryPoints:
|
||||
- web
|
||||
routes:
|
||||
- match: Host(`traefik.localhost`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
|
||||
kind: Rule
|
||||
services:
|
||||
- name: api@internal
|
||||
kind: TraefikService
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: bouncer
|
||||
namespace: traefik
|
||||
spec:
|
||||
plugin:
|
||||
bouncer:
|
||||
CrowdsecLapiKey: 40796d93c2958f9e58345514e67740e5
|
||||
Enabled: "true"
|
||||
logLevel: DEBUG
|
||||
crowdsecMode: live
|
||||
crowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080
|
||||
crowdsecLapiScheme: http
|
||||
@@ -0,0 +1,19 @@
|
||||
image:
|
||||
tag: v2.10.4
|
||||
|
||||
logs:
|
||||
general:
|
||||
level: DEBUG
|
||||
access:
|
||||
enabled: true
|
||||
fields:
|
||||
headers:
|
||||
defaultmode: keep
|
||||
|
||||
experimental:
|
||||
plugins:
|
||||
enabled: true
|
||||
|
||||
additionalArguments:
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: whoami
|
||||
namespace: traefik
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.middlewares: traefik-bouncer@kubernetescrd
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: web
|
||||
|
||||
spec:
|
||||
rules:
|
||||
- http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: whoami
|
||||
port:
|
||||
name: web
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: whoami
|
||||
namespace: traefik
|
||||
|
||||
spec:
|
||||
ports:
|
||||
- name: web
|
||||
port: 80
|
||||
targetPort: web
|
||||
|
||||
selector:
|
||||
app: whoami
|
||||
@@ -0,0 +1,24 @@
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: whoami
|
||||
namespace: traefik
|
||||
labels:
|
||||
app: whoami
|
||||
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: whoami
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
containers:
|
||||
- name: whoami
|
||||
image: traefik/whoami
|
||||
ports:
|
||||
- name: web
|
||||
containerPort: 80
|
||||
@@ -0,0 +1,13 @@
|
||||
# Example
|
||||
## With Redis as an external shared cache
|
||||
|
||||
The plugin must be configured to connect to a redis instance
|
||||
```yaml
|
||||
redisCacheHost: "redis:6379"
|
||||
```
|
||||
Here **redis** is the hostname of a container located in the same network as Traefik and **6379** is the default port of redis
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_cacheredis
|
||||
```
|
||||
@@ -0,0 +1,4 @@
|
||||
filenames:
|
||||
- /var/log/traefik/access.log
|
||||
labels:
|
||||
type: traefik
|
||||
@@ -0,0 +1,114 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-redis:/var/log/traefik
|
||||
# - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
depends_on:
|
||||
- crowdsec
|
||||
# - redis-insecure
|
||||
- redis-secure
|
||||
|
||||
# Either use secure, or insecure but do not mix both
|
||||
# whoami-redis-insecure:
|
||||
# image: traefik/whoami
|
||||
# container_name: "simple-service-foo"
|
||||
# restart: unless-stopped
|
||||
# labels:
|
||||
# - "traefik.enable=true"
|
||||
# # Definition of the router
|
||||
# - "traefik.http.routers.router-foo.rule=Path(`/redis-insecure`)"
|
||||
# - "traefik.http.routers.router-foo.entrypoints=web"
|
||||
# - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
# # Definition of the service
|
||||
# - "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
# # Definition of the middleware
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscacheenabled=true"
|
||||
# # Contact redis-unsecure without a password
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscachehost=redis-insecure:6379"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
whoami-redis-secure:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-bar"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router-bar.rule=Path(`/redis-secure`)"
|
||||
- "traefik.http.routers.router-bar.entrypoints=web"
|
||||
- "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscacheenabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscachepassword=FIXME"
|
||||
# Contact redis-secure with password
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscachehost=redis-secure:6379"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.5.2
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK_DEV: 40796d93c2958f9e58345514e67740e5
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs-redis:/var/log/traefik:ro
|
||||
- crowdsec-db-redis:/var/lib/crowdsec/data/
|
||||
- crowdsec-config-redis:/etc/crowdsec/
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
redis-secure:
|
||||
image: "redis:7.0.12-alpine"
|
||||
container_name: "redis-secure"
|
||||
hostname: redis-secure
|
||||
restart: unless-stopped
|
||||
command: "redis-server --save 60 1 --loglevel debug --requirepass FIXME"
|
||||
volumes:
|
||||
- redis-secure-data:/data
|
||||
|
||||
# redis-insecure:
|
||||
# image: "redis:7.0.12-alpine"
|
||||
# container_name: "redis-insecure"
|
||||
# hostname: redis-unsecure
|
||||
# restart: unless-stopped
|
||||
# command: "redis-server --save 60 1 --loglevel debug"
|
||||
# volumes:
|
||||
# - redis-unsecure-data:/data
|
||||
|
||||
volumes:
|
||||
logs-redis:
|
||||
crowdsec-db-redis:
|
||||
crowdsec-config-redis:
|
||||
redis-unsecure-data:
|
||||
redis-secure-data:
|
||||
@@ -0,0 +1,24 @@
|
||||
#### Generate CAPI credentials (only for `alone` mode)
|
||||
You need to create a crowdsec API credentials for the CAPI.
|
||||
You can follow the documentation here: https://docs.crowdsec.net/docs/central_api/intro
|
||||
|
||||
```bash
|
||||
curl -X POST "https://api.crowdsec.net/v2/watchers" -H "accept: application/json" -H "Content-Type: application/json" -d "{ \"password\": \"PASSWORD\", \"machine_id\": \"LOGIN\"}"
|
||||
```
|
||||
|
||||
These CAPI credentials must be set in your docker-compose.yml or in your config files
|
||||
```yaml
|
||||
...
|
||||
whoami:
|
||||
labels:
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecMode=alone"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecCapiMachineId=LOGIN"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecCapiPassword=PASSWORD"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecCapiScenarios=crowdsecurity/http-generic-bf,crowdsecurity/http-xss-probing,..."
|
||||
```
|
||||
|
||||
You can then run all the containers:
|
||||
```bash
|
||||
docker-compose up -d
|
||||
```
|
||||
@@ -0,0 +1,45 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
|
||||
whoami-foo:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-foo"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.router-foo.rule=Path(`/foo`)"
|
||||
- "traefik.http.routers.router-foo.entrypoints=web"
|
||||
- "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
- "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
|
||||
# - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecmode=alone"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.CrowdsecCapiMachineId=logincacacalfkrjebfreifgzfblezgyfoerxsqxsqxsqxsr"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.CrowdsecCapiPassword=Password2"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseccapiscenarios=crowdsecurity/sshd,crowdsecurity/asterisk_bf,crowdsecurity/asterisk_user_enum,crowdsecurity/base-http-scenarios"
|
||||
|
||||
volumes:
|
||||
logs-local:
|
||||
@@ -0,0 +1,16 @@
|
||||
FROM ubuntu:22.04
|
||||
|
||||
RUN apt-get update && apt-get install -y curl wget
|
||||
RUN VERSION=$(curl --silent "https://api.github.com/repos/cloudflare/cfssl/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/') && VNUMBER=${VERSION#"v"} && wget https://github.com/cloudflare/cfssl/releases/download/${VERSION}/cfssl_${VNUMBER}_linux_amd64 -O cfssl && chmod +x cfssl && mv cfssl /usr/local/bin
|
||||
|
||||
RUN VERSION=$(curl --silent "https://api.github.com/repos/cloudflare/cfssl/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/') && \
|
||||
VNUMBER=${VERSION#"v"} && \
|
||||
wget https://github.com/cloudflare/cfssl/releases/download/${VERSION}/cfssljson_${VNUMBER}_linux_amd64 -O cfssljson && \
|
||||
chmod +x cfssljson && \
|
||||
mv cfssljson /usr/local/bin && \
|
||||
cfssljson -version
|
||||
|
||||
COPY gencerts.sh /gencerts.sh
|
||||
RUN chmod +x /gencerts.sh
|
||||
|
||||
CMD [ "/gencerts.sh" ]
|
||||
@@ -0,0 +1,93 @@
|
||||
# Example
|
||||
## Using https communication and tls authentication with Crowdsec
|
||||
|
||||
##### Summary
|
||||
This example demonstrates the use of https between the Traefik plugin and the Crowdsec LAPI.
|
||||
|
||||
It is possible to communicate with the LAPI in https and still authenticate with API key.
|
||||
You can add the client TLS certificate generated to authenticate without any Token in the plugin.
|
||||
|
||||
However, note that it is not possible to authenticate with TLS client certificate without https setup for the LAPI.
|
||||
|
||||
##### Details
|
||||
|
||||
Simple HTTPS communication: It is possible to talk to Crowdsec LAPI which is configured with a self-signed certificate
|
||||
In that case the setting **crowdsecLapiTLSInsecureVerify** must be set to true.
|
||||
|
||||
It is recommended to validate the certificate presented by Crowdsec LAPI using the Certificate Authority which created it.
|
||||
|
||||
You can provide the Certificate Authority using:
|
||||
* A file path readable by Traefik
|
||||
```yaml
|
||||
http:
|
||||
middlewares:
|
||||
crowdsec:
|
||||
plugin:
|
||||
bouncer:
|
||||
crowdsecLapiTlsCertificateAuthorityFile: /etc/traefik/certs/crowdsecCA.pem
|
||||
```
|
||||
* The PEM encoded certificate as a text variable
|
||||
|
||||
In the static file configuration of Traefik
|
||||
```yaml
|
||||
http:
|
||||
middlewares:
|
||||
crowdsec:
|
||||
plugin:
|
||||
bouncer:
|
||||
crowdsecLapiTlsCertificateAuthority: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
MRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMSIwIAYDVQQK
|
||||
...
|
||||
C6qNieSwcvWL7C03ri0DefTQMY54r5wP33QU5hJ71JoaZI3YTeT0Nf+NRL4hM++w
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
In a dynamic configuration of a provider (ex docker) as a Label
|
||||
```yaml
|
||||
services:
|
||||
whoami-foo:
|
||||
image: traefik/whoami
|
||||
labels:
|
||||
- |
|
||||
traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecLapiTlsCertificateAuthority=
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
MRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMSIwIAYDVQQK
|
||||
...
|
||||
C6qNieSwcvWL7C03ri0DefTQMY54r5wP33QU5hJ71JoaZI3YTeT0Nf+NRL4hM++w
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
The example tls-auth presents 2 services, foo and bar which comes with the bouncer.
|
||||
At startup, certificates are created in a shared docker volume by a sidecar container which exits after.
|
||||
|
||||
Traefik will use client and CA certificates.
|
||||
The Bouncer will use server and CA certificates.
|
||||
|
||||
The service `whoami-foo` will authenticate with an **API key** over HTTPS after verifying the server certificate with CA.
|
||||
The service `whoami-bar` will authenticate with a **client certificate** signed by the CA.
|
||||
|
||||
Access to a route that communicate via https and authenticate with API-key:
|
||||
```
|
||||
curl http://localhost:80/foo
|
||||
```
|
||||
Access to a route that communicate via https and authenticate with a client certificate:
|
||||
```
|
||||
curl http://localhost:80/bar
|
||||
```
|
||||
Access to the traefik dashboard
|
||||
```
|
||||
curl http://localhost:8080/dashboard/#/
|
||||
```
|
||||
|
||||
To play the demo environnement run:
|
||||
```bash
|
||||
make run_tlsauth
|
||||
```
|
||||
|
||||
Note:
|
||||
> This example is still in Beta and use a new version of Crowdsec (v1.4.3) at time of writing
|
||||
A functionnality has been disabled in Crowdsec in order to make the example work DISABLE_AGENT: "true"
|
||||
@@ -0,0 +1,4 @@
|
||||
filenames:
|
||||
- /var/log/traefik/access.log
|
||||
labels:
|
||||
type: traefik
|
||||
@@ -0,0 +1,62 @@
|
||||
common:
|
||||
daemonize: false
|
||||
pid_dir: /var/run/
|
||||
log_media: stdout
|
||||
log_level: info
|
||||
log_dir: /var/log/
|
||||
working_dir: .
|
||||
config_paths:
|
||||
config_dir: /etc/crowdsec/
|
||||
data_dir: /var/lib/crowdsec/data/
|
||||
simulation_path: /etc/crowdsec/simulation.yaml
|
||||
hub_dir: /etc/crowdsec/hub/
|
||||
index_path: /etc/crowdsec/hub/.index.json
|
||||
notification_dir: /etc/crowdsec/notifications/
|
||||
plugin_dir: /usr/local/lib/crowdsec/plugins/
|
||||
crowdsec_service:
|
||||
acquisition_path: /etc/crowdsec/acquis.yaml
|
||||
parser_routines: 1
|
||||
plugin_config:
|
||||
user: nobody
|
||||
group: nobody
|
||||
cscli:
|
||||
output: human
|
||||
db_config:
|
||||
log_level: info
|
||||
type: sqlite
|
||||
db_path: /var/lib/crowdsec/data/crowdsec.db
|
||||
#user:
|
||||
#password:
|
||||
#db_name:
|
||||
#host:
|
||||
#port:
|
||||
flush:
|
||||
max_items: 5000
|
||||
max_age: 7d
|
||||
api:
|
||||
client:
|
||||
insecure_skip_verify: false
|
||||
credentials_path: /etc/crowdsec/local_api_credentials.yaml
|
||||
server:
|
||||
log_level: info
|
||||
listen_uri: 0.0.0.0:8080
|
||||
profiles_path: /etc/crowdsec/profiles.yaml
|
||||
trusted_ips: # IP ranges, or IPs which can have admin API access
|
||||
- 127.0.0.1
|
||||
- ::1
|
||||
online_client: # Central API credentials (to push signals and receive bad IPs)
|
||||
#credentials_path: /etc/crowdsec/online_api_credentials.yaml
|
||||
tls:
|
||||
cert_file: /etc/crowdsec/certs/server.pem #Server side cert
|
||||
key_file: /etc/crowdsec/certs/server-key.pem #Server side key
|
||||
ca_cert_path: /etc/crowdsec/certs/inter.pem #CA used to verify the client certs
|
||||
bouncers_allowed_ou: #OU allowed for bouncers
|
||||
- bouncer-ou
|
||||
agents_allowed_ou: #OU allowed for agents
|
||||
- agent-ou
|
||||
|
||||
prometheus:
|
||||
enabled: true
|
||||
level: full
|
||||
listen_addr: 0.0.0.0
|
||||
listen_port: 6060
|
||||
@@ -0,0 +1,4 @@
|
||||
url: https://localhost:8080
|
||||
ca_cert_path: /etc/crowdsec/certs/inter.pem #CA to trust the server certificate
|
||||
key_path: /etc/crowdsec/certs/agent-key.pem #Client key
|
||||
cert_path: /etc/crowdsec/certs/agent.pem #Client cert
|
||||
@@ -0,0 +1,111 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./LAPIKEY:/etc/traefik/LAPIKEY:ro
|
||||
- logs-tls-auth:/var/log/traefik
|
||||
- crowdsec-certs-tls-auth:/etc/traefik/crowdsec-certs
|
||||
# - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
depends_on:
|
||||
- crowdsec
|
||||
|
||||
# Use HTTPS scheme but with lapikey authentication
|
||||
# whoami-foo:
|
||||
# image: traefik/whoami
|
||||
# container_name: "simple-service-foo"
|
||||
# restart: unless-stopped
|
||||
# labels:
|
||||
# - "traefik.enable=true"
|
||||
# - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
|
||||
# - "traefik.http.routers.router-foo.entrypoints=web"
|
||||
# - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
# - "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=https"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
|
||||
|
||||
# Use HTTPS scheme with TLS cert authentication
|
||||
whoami-bar:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-bar"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.router-bar.rule=Path(`/bar`)"
|
||||
- "traefik.http.routers.router-bar.entrypoints=web"
|
||||
- "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=https"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateBouncerFile=/etc/traefik/crowdsec-certs/bouncer.pem"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateBouncerKeyFile=/etc/traefik/crowdsec-certs/bouncer-key.pem"
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.5.2
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
# whoami-foo is authenticating with api key over https
|
||||
# whoami-bar is authenticating with tls cert over https
|
||||
BOUNCER_KEY_TRAEFIK_FOO: 40796d93c2958f9e58345514e67740e5
|
||||
LOCAL_API_URL: https://127.0.0.1:8080
|
||||
USE_TLS: "true"
|
||||
CERT_FILE: "/etc/crowdsec/certs/server.pem"
|
||||
KEY_FILE: "/etc/crowdsec/certs/server-key.pem"
|
||||
CACERT_FILE: "/etc/crowdsec/certs/inter.pem"
|
||||
AGENTS_ALLOWED_OU: "agent-ou"
|
||||
BOUNCERS_ALLOWED_OU: "bouncer-ou"
|
||||
LEVEL_DEBUG: "true"
|
||||
# Disabled because it restart in loop otherwise
|
||||
DISABLE_AGENT: "true"
|
||||
# Disabled for the examples
|
||||
DISABLE_ONLINE_API: "true"
|
||||
volumes:
|
||||
- ./config/acquis.yaml:/etc/crowdsec/acquis.yaml
|
||||
# - ./config/config.yaml:/etc/crowdsec/config_local.yaml
|
||||
# - ./config/local_api_credentials.yaml:/etc/crowdsec/local_api_credentials.yaml:ro
|
||||
- crowdsec-certs-tls-auth:/etc/crowdsec/certs/:ro
|
||||
- logs-tls-auth:/var/log/traefik:ro
|
||||
- crowdsec-db-tls-auth:/var/lib/crowdsec/data/
|
||||
- crowdsec-config-tls-auth:/etc/crowdsec/
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
gencert:
|
||||
build: .
|
||||
volumes:
|
||||
- crowdsec-certs-tls-auth:/out
|
||||
- ./in:/in:ro
|
||||
|
||||
volumes:
|
||||
logs-tls-auth:
|
||||
crowdsec-db-tls-auth:
|
||||
crowdsec-config-tls-auth:
|
||||
crowdsec-certs-tls-auth:
|
||||
@@ -0,0 +1,13 @@
|
||||
#!/bin/bash
|
||||
|
||||
stdout=/out/res.log
|
||||
cfssl gencert --initca /in/ca.json 2>${stdout} | cfssljson --bare "/out/ca" && \
|
||||
# Generate an intermediate certificate that will be used to sign the client certificates
|
||||
cfssl gencert --initca /in/intermediate.json 2>${stdout} | cfssljson --bare "/out/inter" && \
|
||||
cfssl sign -ca "/out/ca.pem" -ca-key "/out/ca-key.pem" -config /in/profiles.json -profile intermediate_ca "/out/inter.csr" 2>${stdout} | cfssljson --bare "/out/inter" && \
|
||||
# Generate a server side certificate
|
||||
cfssl gencert -ca "/out/inter.pem" -ca-key "/out/inter-key.pem" -config /in/profiles.json -profile=server /in/server.json 2>${stdout} | cfssljson --bare "/out/server" && \
|
||||
# Generate a client certificate for the bouncer whoami
|
||||
cfssl gencert -ca "/out/inter.pem" -ca-key "/out/inter-key.pem" -config /in/profiles.json -profile=client /in/bouncer.json 2>${stdout} | cfssljson --bare "/out/bouncer" && \
|
||||
# Generate a client certificate for the agent
|
||||
cfssl gencert -ca "/out/inter.pem" -ca-key "/out/inter-key.pem" -config /in/profiles.json -profile=client /in/agent.json 2>${stdout} | cfssljson --bare "/out/agent"
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"CN": "myagent",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "agent-ou",
|
||||
"ST": "France"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"CN": "crowdsec",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "bouncer-ou",
|
||||
"ST": "France"
|
||||
}
|
||||
],
|
||||
"hosts": [
|
||||
"127.0.0.1",
|
||||
"localhost",
|
||||
"crowdsec"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"CN": "CrowdSec Test CA",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "Crowdsec",
|
||||
"ST": "France"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"CN": "CrowdSec Test CA Intermediate",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "Crowdsec Intermediate",
|
||||
"ST": "France"
|
||||
}
|
||||
],
|
||||
"ca": {
|
||||
"expiry": "42720h"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{
|
||||
"signing": {
|
||||
"default": {
|
||||
"expiry": "8760h"
|
||||
},
|
||||
"profiles": {
|
||||
"intermediate_ca": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"key encipherment",
|
||||
"cert sign",
|
||||
"crl sign",
|
||||
"server auth",
|
||||
"client auth"
|
||||
],
|
||||
"expiry": "8760h",
|
||||
"ca_constraint": {
|
||||
"is_ca": true,
|
||||
"max_path_len": 0,
|
||||
"max_path_len_zero": true
|
||||
}
|
||||
},
|
||||
"server": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signing",
|
||||
"key encipherment",
|
||||
"server auth"
|
||||
],
|
||||
"expiry": "8760h"
|
||||
},
|
||||
"client": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"key encipherment",
|
||||
"client auth"
|
||||
],
|
||||
"expiry": "8760h"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"CN": "crowdsec",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "Crowdsec Server",
|
||||
"ST": "France"
|
||||
}
|
||||
],
|
||||
"hosts": [
|
||||
"127.0.0.1",
|
||||
"localhost",
|
||||
"crowdsec"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
# Example
|
||||
## Using Trusted IP (ex: LAN OR VPN) that won't get filtered by crowdsec
|
||||
|
||||
You need to configure your Traefik to trust Forwarded headers by your front proxy
|
||||
In the example we use a whoami container protected by crowdsec, and we ban our IP before allowing using TrustedIPs
|
||||
|
||||
If you are using another proxy in front, you need to add its IP in the trusted IP for the forwarded headers.
|
||||
This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
|
||||
The "internal" Traefik instance is configured to trust the forward headers
|
||||
```yaml
|
||||
- "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
We configure the middleware to trust as well as the IP of the intermediate proxy if needed:
|
||||
```yaml
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
Add your IP to the ban list
|
||||
```bash
|
||||
docker exec crowdsec cscli decisions add --ip 10.0.10.30 -d 10m
|
||||
```
|
||||
You should get a 403 on http://localhost/foo
|
||||
|
||||
> Replace *10.0.10.30* by your IP
|
||||
|
||||
Add the IPs that will not be filtered by the plugin
|
||||
```yaml
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.clientTrustedips=10.0.10.30/32"
|
||||
```
|
||||
|
||||
> Replace *10.0.10.30/32* by your IP or IP range, so it's not getting checked against ban cache of crowdsec
|
||||
|
||||
You should get a 200 on http://localhost/foo even if you are on the ban cache
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_trustedips
|
||||
```
|
||||
@@ -0,0 +1,4 @@
|
||||
filenames:
|
||||
- /var/log/traefik/access.log
|
||||
labels:
|
||||
type: traefik
|
||||
@@ -0,0 +1,88 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-trustedips:/var/log/traefik
|
||||
# - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
depends_on:
|
||||
- crowdsec
|
||||
|
||||
whoami1:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-foo"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router-foo.rule=Path(`/foo`)"
|
||||
- "traefik.http.routers.router-foo.entrypoints=web"
|
||||
- "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
# Replace 10.0.10.30/32 by your IP range which is "trusted"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.clienttrustedips=10.0.10.30/32"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
whoami2:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-bar"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router-bar.rule=Path(`/bar`)"
|
||||
- "traefik.http.routers.router-bar.entrypoints=web"
|
||||
- "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
# Replace 10.0.10.30/32 by your IP range which is "trusted"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.clienttrustedips=10.0.10.30/32"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.5.2
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK_DEV: 40796d93c2958f9e58345514e67740e5
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs-trustedips:/var/log/traefik:ro
|
||||
- crowdsec-db-trustedips:/var/lib/crowdsec/data/
|
||||
- crowdsec-config-trustedips:/etc/crowdsec/
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
volumes:
|
||||
logs-trustedips:
|
||||
crowdsec-db-trustedips:
|
||||
crowdsec-config-trustedips:
|
||||
Reference in New Issue
Block a user