mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-07-20 11:09:00 +02:00
51 feature support tls connections to crowdsec not signed by a public ca (#53)
* ✨ Add support for insecure tls connections to LAPI * 📝 Add documentation for the TLS insecure parameter * 🚧 Add tls authority certificate and checks for params * 📝 Add example for tls communication in readme and folder * 📝 Update documentation and example for tls * 🚨 Fix easy lint errors * 🦺 logic to fetch certificates * 🚨 Fix lint on readme * ♻️ Refactor validate to fix lint and clean * 🚧 Add doc, cert gen for crowdsec example * 🚧 Progress on setting up Crowdsec with tls * 🚧 Update certs validation for example * ♻️ Add load variable from file or value and get client cert * ♻️ Refactor getting variables * 🚨 Fix lint, no new line on new files * 🐛 Fix bug on condition check lapi key cert * ♻️ Update after review * ♻️ Update after review * 🍱 fix mathieu code * ♻️ Refactor logic of loading tls certificates * 🍱 clean code * 🍱 last fix * 🍱 fix lint * ♻️ Add documentation in readme, fix lint, remove unfinished tests * 🐛 Fix conditions logics * 🚨 Fix Lint * ♻️ simplify code on getVariable Co-authored-by: Max Lerebourg <maxlerebourg@gmail.com>
This commit is contained in:
mathieuHa
co-authored by
Max Lerebourg
Max Lerebourg
parent
b2ed600d5e
commit
a2fe60c621
+2
-2
@@ -1,6 +1,6 @@
|
||||
.idea/
|
||||
.DS_Store
|
||||
config
|
||||
conf
|
||||
db
|
||||
logs
|
||||
docker-compose.dev.yml
|
||||
docker-compose.dev.yml
|
||||
|
||||
+3
-2
@@ -11,7 +11,7 @@ linters-settings:
|
||||
golint:
|
||||
min-confidence: 0
|
||||
gocyclo:
|
||||
min-complexity: 12
|
||||
min-complexity: 15
|
||||
goconst:
|
||||
min-len: 5
|
||||
min-occurrences: 4
|
||||
@@ -69,7 +69,8 @@ issues:
|
||||
exclude-use-default: false
|
||||
max-per-linter: 0
|
||||
max-same-issues: 0
|
||||
exclude: []
|
||||
exclude:
|
||||
- "G402: TLS InsecureSkipVerify may be true."
|
||||
exclude-rules:
|
||||
- path: (.+)_test.go
|
||||
linters:
|
||||
|
||||
@@ -34,6 +34,9 @@ run_cacheredis:
|
||||
run_trustedips:
|
||||
docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml up -d --remove-orphans
|
||||
|
||||
run_tlsauth:
|
||||
docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml down && docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml up -d && docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml restart && docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml logs -f
|
||||
|
||||
run:
|
||||
docker-compose -f docker-compose.yml up -d --remove-orphans
|
||||
|
||||
@@ -55,6 +58,9 @@ restart_cacheredis:
|
||||
restart_trustedips:
|
||||
docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml restart
|
||||
|
||||
restart_tlsauth:
|
||||
docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml
|
||||
|
||||
show_logs:
|
||||
docker-compose -f docker-compose.yml restart
|
||||
|
||||
@@ -68,6 +74,7 @@ clean_all_docker:
|
||||
docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml down --remove-orphans
|
||||
docker-compose -f exemples/redis-cache/docker-compose.redis.yml down --remove-orphans
|
||||
docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml down --remove-orphans
|
||||
docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml down --remove-orphans
|
||||
docker-compose -f docker-compose.local.yml down --remove-orphans
|
||||
docker-compose -f docker-compose.yml down --remove-orphans
|
||||
|
||||
|
||||
@@ -64,11 +64,44 @@ make run
|
||||
- Crowdsec LAPI available on which host and port.
|
||||
- CrowdsecLapiKey
|
||||
- string
|
||||
- Crowdsec LAPI generated key for the bouncer : **must be unique by service**.
|
||||
- default: ""
|
||||
- Crowdsec LAPI key for the bouncer : **must be unique by service**.
|
||||
- CrowdsecLapiKeyFile
|
||||
- string
|
||||
- default: ""
|
||||
- Crowdsec File path of the LAPI key for the bouncer : **must be unique by service**.
|
||||
- CrowdsecLapiTLSInsecureVerify
|
||||
- bool
|
||||
- default: false
|
||||
- Disable verification of certificate presented by Crowdsec LAPI
|
||||
- CrowdsecLapiTlsCertificateAuthority
|
||||
- string
|
||||
- default: ""
|
||||
- PEM-encoded Certificate Authority of the Crowdsec LAPI
|
||||
- CrowdsecLapiTlsCertificateAuthorityFile
|
||||
- string
|
||||
- default: ""
|
||||
- File path of the Certificate Authority of the Crowdsec LAPI
|
||||
- CrowdsecLapiTlsCertificateBouncer
|
||||
- string
|
||||
- default: ""
|
||||
- PEM-encoded client Certificate of the Bouncer
|
||||
- CrowdsecLapiTlsCertificateBouncerFile
|
||||
- string
|
||||
- default: ""
|
||||
- File path of the client Certificate of the Bouncer
|
||||
- CrowdsecLapiTlsCertificateBouncerKey
|
||||
- string
|
||||
- default: ""
|
||||
- PEM-encoded client private key of the Bouncer
|
||||
- CrowdsecLapiTlsCertificateBouncerKeyFile
|
||||
- string
|
||||
- default: ""
|
||||
- File path of the client private key of the Bouncer
|
||||
- UpdateIntervalSeconds
|
||||
- int64
|
||||
- default: 60
|
||||
- Used only in `stream` mode, interval between fetching blacklisted IPs from LAPI
|
||||
- Used only in `stream` mode, interval between requests to fetch blacklisted IPs from LAPI
|
||||
- DefaultDecisionSeconds
|
||||
- int64
|
||||
- default: 60
|
||||
@@ -133,12 +166,15 @@ http:
|
||||
plugin:
|
||||
bouncer:
|
||||
enabled: false
|
||||
logLevel: DEBUG
|
||||
updateIntervalSeconds: 60
|
||||
defaultDecisionSeconds: 60
|
||||
crowdsecMode: live
|
||||
crowdsecLapiKey: privateKey
|
||||
crowdsecLapiKey: privateKey-foo
|
||||
crowdsecLapiKeyFile: /etc/traefik/cs-privateKey-foo
|
||||
crowdsecLapiHost: crowdsec:8080
|
||||
crowdsecLapiScheme: http
|
||||
crowdsecLapiTLSInsecureVerify: false
|
||||
forwardedHeadersTrustedIPs:
|
||||
- 10.0.10.23/32
|
||||
- 10.0.20.0/24
|
||||
@@ -147,11 +183,39 @@ http:
|
||||
forwardedHeadersCustomName: X-Custom-Header
|
||||
redisCacheEnabled: false
|
||||
redisCacheHost: "redis:6379"
|
||||
crowdsecLapiTLSCertificateAuthority: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
...
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
crowdsecLapiTLSCertificateAuthorityFile: /etc/traefik/crowdsec-certs/ca.pem
|
||||
crowdsecLapiTLSCertificateBouncer: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEHjCCAwagAwIBAgIUOBTs1eqkaAUcPplztUr2xRapvNAwDQYJKoZIhvcNAQEL
|
||||
...
|
||||
RaXAnYYUVRblS1jmePemh388hFxbmrpG2pITx8B5FMULqHoj11o2Rl0gSV6tHIHz
|
||||
N2U=
|
||||
-----END CERTIFICATE-----
|
||||
crowdsecLapiTLSCertificateBouncerFile: /etc/traefik/crowdsec-certs/bouncer.pem
|
||||
crowdsecLapiTLSCertificateBouncerKey: |-
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEAtYQnbJqifH+ZymePylDxGGLIuxzcAUU4/ajNj+qRAdI/Ux3d
|
||||
...
|
||||
ic5cDRo6/VD3CS3MYzyBcibaGaV34nr0G/pI+KEqkYChzk/PZRA=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
crowdsecLapiTLSCertificateBouncerKeyFile: /etc/traefik/crowdsec-certs/bouncer-key.pem
|
||||
|
||||
```
|
||||
These are the default values of the plugin except for LapiKey.
|
||||
These are the default values for the plugin except for LapiKey.
|
||||
|
||||
#### Authenticate with LAPI
|
||||
|
||||
You can either authenticate with LAPIKEY to the LAPI or using client certificates.
|
||||
Please see below for more detail on each option.
|
||||
|
||||
#### Generate LAPI KEY
|
||||
You need to generate a crowdsec API key for the LAPI.
|
||||
You can generate a crowdsec API key for the LAPI.
|
||||
You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
|
||||
|
||||
```bash
|
||||
@@ -159,7 +223,7 @@ docker-compose -f docker-compose-local.yml up -d crowdsec
|
||||
docker exec crowdsec cscli bouncers add crowdsecBouncer
|
||||
```
|
||||
|
||||
This LAPI key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml
|
||||
This LAPI key must be set where is noted FIXME-LAPI-KEY in the docker-compose.yml
|
||||
```yaml
|
||||
...
|
||||
whoami:
|
||||
@@ -174,11 +238,37 @@ crowdsec:
|
||||
...
|
||||
```
|
||||
|
||||
Note:
|
||||
> Crowdsec does not require a specific format for la LAPI-key, you may use something like FIXME-LAPI-KEY but that is not recommanded for obvious reasons
|
||||
|
||||
You can then run all the containers:
|
||||
```bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
#### Use certificates to authenticate with Crowdsec
|
||||
|
||||
You can follow the example in exemples/tls-auth to view how to authenticate with client certificates with the LAPI.
|
||||
In that case communications with the LAPI must go through HTTPS.
|
||||
|
||||
A script is available to generate certificates in exemples/tls-auth/gencerts.sh and must be colocated with the in directory which contains the inputs for the PKI creation.
|
||||
|
||||
#### Use HTTPS to communicate with the LAPI
|
||||
|
||||
To communicate with the LAPI in HTTPS you need to either accept any certificates setting the crowdsecLapiTLSInsecureVerify to true or add the CA used to by the server certificate of Crowdsec using crowdsecLapiTLSCertificateAuthority or crowdsecLapiTLSCertificateAuthorityFile.
|
||||
Set the crowdsecLapiScheme to https.
|
||||
|
||||
Crowdsec must be listening in HTTPS for this to work.
|
||||
Please see the tls-auth exemple or the official documentation: [https://docs.crowdsec.net/docs/local_api/tls_auth/](https://docs.crowdsec.net/docs/local_api/tls_auth/)
|
||||
|
||||
#### Fill variable with value of file
|
||||
|
||||
Every sensitive variable or file based can be provided with the content as raw or through a file path that Traefik can read.
|
||||
The file variable will be used as preference if both content and file are provided for the same variable.
|
||||
Format is:
|
||||
- Content: VARIABLE_NAME: XXX
|
||||
- FILE : VARIABLE_NAME_FILE: /path
|
||||
|
||||
#### Add manually an IP to the blocklist (testing purpose)
|
||||
|
||||
```bash
|
||||
@@ -296,6 +386,102 @@ To play the demo environnement run:
|
||||
make run_trustedips
|
||||
```
|
||||
|
||||
5. Using https communication and tls authentication with Crowdsec
|
||||
|
||||
##### Summary
|
||||
This example demonstrate the use of https between the Traefik plugin and the Crowdsec LAPI.
|
||||
|
||||
It is possible to communicate with the LAPI in https and still authenticate with API key.
|
||||
You can add the client TLS certificate generated to authenticate without any Token in the plugin.
|
||||
|
||||
However note that it is not possible to authenticate with TLS client certificate without https setup for the LAPI.
|
||||
|
||||
The example is detailed below and will be place in the `examples/tls-auth/README.md` file.
|
||||
|
||||
##### Details
|
||||
|
||||
Simple HTTPS communication: It is possible to talk to Crowdsec LAPI which is configured with a self-signed certificate
|
||||
In that case the setting **crowdsecLapiTLSInsecureVerify** must be set to true.
|
||||
|
||||
It is recommanded to validate the certificate presented by Crowdsec LAPI using the Certificate Authority which created it.
|
||||
|
||||
You can provide the Certificate Authority using:
|
||||
* A file path readable by Traefik
|
||||
```yaml
|
||||
http:
|
||||
middlewares:
|
||||
crowdsec:
|
||||
plugin:
|
||||
bouncer:
|
||||
crowdsecLapiTlsCertificateAuthorityFile: /etc/traefik/certs/crowdsecCA.pem
|
||||
```
|
||||
* The PEM encoded certificate as a text variable
|
||||
|
||||
In the static file configuration of Traefik
|
||||
```yaml
|
||||
http:
|
||||
middlewares:
|
||||
crowdsec:
|
||||
plugin:
|
||||
bouncer:
|
||||
crowdsecLapiTlsCertificateAuthority: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
MRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMSIwIAYDVQQK
|
||||
...
|
||||
C6qNieSwcvWL7C03ri0DefTQMY54r5wP33QU5hJ71JoaZI3YTeT0Nf+NRL4hM++w
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
In a dynamic configuration of a provider (ex docker) as a Label
|
||||
```yaml
|
||||
services:
|
||||
whoami-foo:
|
||||
image: traefik/whoami
|
||||
labels:
|
||||
- |
|
||||
traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecLapiTlsCertificateAuthority=
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
MRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMSIwIAYDVQQK
|
||||
...
|
||||
C6qNieSwcvWL7C03ri0DefTQMY54r5wP33QU5hJ71JoaZI3YTeT0Nf+NRL4hM++w
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
The example tls-auth presents 2 services, foo and bar which comes with the bouncer.
|
||||
At startup, certificates are created in a shared docker volume by a sidecar container which exits after.
|
||||
|
||||
Traefik will use client and CA certificates.
|
||||
The Bouncer will use server and CA certificates.
|
||||
|
||||
The service `whoami-foo` will authenticate with an **API key** over HTTPS after verifying the server certificate with CA.
|
||||
The service `whoami-bar` will authenticate with a **client certificate** signed by the CA.
|
||||
|
||||
Access to a route that communicate via https and authenticate with API-key:
|
||||
```
|
||||
curl http://localhost:80/foo
|
||||
```
|
||||
Access to a route that communicate via https and authenticate with a client certificate:
|
||||
```
|
||||
curl http://localhost:80/bar
|
||||
```
|
||||
Access to the traefik dashboard
|
||||
```
|
||||
curl http://localhost:8080/dashboard/#/
|
||||
```
|
||||
|
||||
To play the demo environnement run:
|
||||
```bash
|
||||
make run_tlsauth
|
||||
```
|
||||
|
||||
Note:
|
||||
> This example is still in Beta and use a new version of Crowdsec (v1.4.3) at time of writing
|
||||
A functionnality has been disabled in Crowdsec in order to make the example work DISABLE_AGENT: "true"
|
||||
|
||||
|
||||
### About
|
||||
|
||||
Me and [mathieuHa](https://github.com/mathieuHa) have been using traefik since 2020 at [Primadviz](https://primadviz.com).
|
||||
|
||||
+203
-54
@@ -5,11 +5,17 @@ package crowdsec_bouncer_traefik_plugin //nolint:revive,stylecheck
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"reflect"
|
||||
"text/template"
|
||||
"time"
|
||||
|
||||
@@ -37,37 +43,46 @@ var (
|
||||
|
||||
// Config the plugin configuration.
|
||||
type Config struct {
|
||||
Enabled bool `json:"enabled,omitempty"`
|
||||
LogLevel string `json:"logLevel,omitempty"`
|
||||
CrowdsecMode string `json:"crowdsecMode,omitempty"`
|
||||
CrowdsecLapiScheme string `json:"crowdsecLapiScheme,omitempty"`
|
||||
CrowdsecLapiHost string `json:"crowdsecLapiHost,omitempty"`
|
||||
CrowdsecLapiKey string `json:"crowdsecLapiKey,omitempty"`
|
||||
UpdateIntervalSeconds int64 `json:"updateIntervalSeconds,omitempty"`
|
||||
DefaultDecisionSeconds int64 `json:"defaultDecisionSeconds,omitempty"`
|
||||
ForwardedHeadersCustomName string `json:"forwardedheaderscustomheader,omitempty"`
|
||||
ForwardedHeadersTrustedIPs []string `json:"forwardedHeadersTrustedIps,omitempty"`
|
||||
ClientTrustedIPs []string `json:"clientTrustedIps,omitempty"`
|
||||
RedisCacheEnabled bool `json:"redisCacheEnabled,omitempty"`
|
||||
RedisCacheHost string `json:"redisCacheHost,omitempty"`
|
||||
Enabled bool `json:"enabled,omitempty"`
|
||||
LogLevel string `json:"logLevel,omitempty"`
|
||||
CrowdsecMode string `json:"crowdsecMode,omitempty"`
|
||||
CrowdsecLapiScheme string `json:"crowdsecLapiScheme,omitempty"`
|
||||
CrowdsecLapiHost string `json:"crowdsecLapiHost,omitempty"`
|
||||
CrowdsecLapiKey string `json:"crowdsecLapiKey,omitempty"`
|
||||
CrowdsecLapiKeyFile string `json:"crowdsecLapiKeyFile,omitempty"`
|
||||
CrowdsecLapiTLSInsecureVerify bool `json:"crowdsecLapiTlsInsecureVerify,omitempty"`
|
||||
CrowdsecLapiTLSCertificateAuthority string `json:"crowdsecLapiTlsCertificateAuthority,omitempty"`
|
||||
CrowdsecLapiTLSCertificateAuthorityFile string `json:"crowdsecLapiTlsCertificateAuthorityFile,omitempty"`
|
||||
CrowdsecLapiTLSCertificateBouncer string `json:"crowdsecLapiTlsCertificateBouncer,omitempty"`
|
||||
CrowdsecLapiTLSCertificateBouncerFile string `json:"crowdsecLapiTlsCertificateBouncerFile,omitempty"`
|
||||
CrowdsecLapiTLSCertificateBouncerKey string `json:"crowdsecLapiTlsCertificateBouncerKey,omitempty"`
|
||||
CrowdsecLapiTLSCertificateBouncerKeyFile string `json:"crowdsecLapiTlsCertificateBouncerKeyFile,omitempty"`
|
||||
UpdateIntervalSeconds int64 `json:"updateIntervalSeconds,omitempty"`
|
||||
DefaultDecisionSeconds int64 `json:"defaultDecisionSeconds,omitempty"`
|
||||
ForwardedHeadersCustomName string `json:"forwardedheaderscustomheader,omitempty"`
|
||||
ForwardedHeadersTrustedIPs []string `json:"forwardedHeadersTrustedIps,omitempty"`
|
||||
ClientTrustedIPs []string `json:"clientTrustedIps,omitempty"`
|
||||
RedisCacheEnabled bool `json:"redisCacheEnabled,omitempty"`
|
||||
RedisCacheHost string `json:"redisCacheHost,omitempty"`
|
||||
}
|
||||
|
||||
// CreateConfig creates the default plugin configuration.
|
||||
func CreateConfig() *Config {
|
||||
return &Config{
|
||||
Enabled: false,
|
||||
LogLevel: "INFO",
|
||||
CrowdsecMode: liveMode,
|
||||
CrowdsecLapiScheme: "http",
|
||||
CrowdsecLapiHost: "crowdsec:8080",
|
||||
CrowdsecLapiKey: "",
|
||||
UpdateIntervalSeconds: 60,
|
||||
DefaultDecisionSeconds: 60,
|
||||
ClientTrustedIPs: []string{},
|
||||
ForwardedHeadersTrustedIPs: []string{},
|
||||
ForwardedHeadersCustomName: "X-Forwarded-For",
|
||||
RedisCacheEnabled: false,
|
||||
RedisCacheHost: "redis:6379",
|
||||
Enabled: false,
|
||||
LogLevel: "INFO",
|
||||
CrowdsecMode: liveMode,
|
||||
CrowdsecLapiScheme: "http",
|
||||
CrowdsecLapiHost: "crowdsec:8080",
|
||||
CrowdsecLapiKey: "",
|
||||
CrowdsecLapiTLSInsecureVerify: false,
|
||||
UpdateIntervalSeconds: 60,
|
||||
DefaultDecisionSeconds: 60,
|
||||
ForwardedHeadersCustomName: "X-Forwarded-For",
|
||||
ForwardedHeadersTrustedIPs: []string{},
|
||||
ClientTrustedIPs: []string{},
|
||||
RedisCacheEnabled: false,
|
||||
RedisCacheHost: "redis:6379",
|
||||
}
|
||||
}
|
||||
|
||||
@@ -95,13 +110,24 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
|
||||
logger.Init(config.LogLevel)
|
||||
err := validateParams(config)
|
||||
if err != nil {
|
||||
logger.Info(err.Error())
|
||||
logger.Info(fmt.Sprintf("New:validateParams %s", err.Error()))
|
||||
return nil, err
|
||||
}
|
||||
|
||||
serverChecker, _ := ip.NewChecker(config.ForwardedHeadersTrustedIPs)
|
||||
clientChecker, _ := ip.NewChecker(config.ClientTrustedIPs)
|
||||
|
||||
tlsConfig, err := getTLSConfigCrowdsec(config)
|
||||
if err != nil {
|
||||
logger.Error(fmt.Sprintf("New:getTLSConfigCrowdsec fail to get tlsConfig %s", err.Error()))
|
||||
return nil, err
|
||||
}
|
||||
apiKey, err := getVariable(config, "CrowdsecLapiKey")
|
||||
if err != nil && len(tlsConfig.Certificates) == 0 {
|
||||
logger.Error(fmt.Sprintf("New:crowdsecLapiKey fail to get CrowdsecLapiKey and no client certificate setup %s", err.Error()))
|
||||
return nil, err
|
||||
}
|
||||
|
||||
bouncer := &Bouncer{
|
||||
next: next,
|
||||
name: name,
|
||||
@@ -111,7 +137,7 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
|
||||
crowdsecMode: config.CrowdsecMode,
|
||||
crowdsecScheme: config.CrowdsecLapiScheme,
|
||||
crowdsecHost: config.CrowdsecLapiHost,
|
||||
crowdsecKey: config.CrowdsecLapiKey,
|
||||
crowdsecKey: apiKey,
|
||||
updateInterval: config.UpdateIntervalSeconds,
|
||||
customHeader: config.ForwardedHeadersCustomName,
|
||||
defaultDecisionTimeout: config.DefaultDecisionSeconds,
|
||||
@@ -125,6 +151,7 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
|
||||
Transport: &http.Transport{
|
||||
MaxIdleConns: 10,
|
||||
IdleConnTimeout: 30 * time.Second,
|
||||
TLSClientConfig: tlsConfig,
|
||||
},
|
||||
Timeout: 2 * time.Second,
|
||||
},
|
||||
@@ -365,11 +392,158 @@ func crowdsecQuery(bouncer *Bouncer, stringURL string) ([]byte, error) {
|
||||
return body, nil
|
||||
}
|
||||
|
||||
func getTLSConfigCrowdsec(config *Config) (*tls.Config, error) {
|
||||
tlsConfig := new(tls.Config)
|
||||
tlsConfig.RootCAs = x509.NewCertPool()
|
||||
//nolint:gocritic
|
||||
if config.CrowdsecLapiScheme != "https" {
|
||||
logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiScheme not https")
|
||||
return tlsConfig, nil
|
||||
} else if config.CrowdsecLapiTLSInsecureVerify {
|
||||
logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiTLSInsecureVerify is true")
|
||||
tlsConfig.InsecureSkipVerify = true
|
||||
// If we return here and still want to use client auth this won't work
|
||||
// return tlsConfig, nil
|
||||
} else {
|
||||
certAuthority, err := getVariable(config, "CrowdsecLapiTLSCertificateAuthority")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
cert := []byte(certAuthority)
|
||||
if !tlsConfig.RootCAs.AppendCertsFromPEM(cert) {
|
||||
logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiTLSCertificateAuthority read cert failed")
|
||||
// here we return because if CrowdsecLapiTLSInsecureVerify is false
|
||||
// and CA not load, we can't communicate with https
|
||||
return nil, errors.New("getTLSConfigCrowdsec:cannot load CA and verify cert is enabled")
|
||||
}
|
||||
}
|
||||
|
||||
certBouncer, err := getVariable(config, "CrowdsecLapiTLSCertificateBouncer")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
certBouncerKey, err := getVariable(config, "CrowdsecLapiTLSCertificateBouncerKey")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if certBouncer == "" || certBouncerKey == "" {
|
||||
return tlsConfig, nil
|
||||
}
|
||||
clientCert, err := tls.X509KeyPair([]byte(certBouncer), []byte(certBouncerKey))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("getTLSClientConfigCrowdsec impossible to generate ClientCert %w", err)
|
||||
}
|
||||
tlsConfig.Certificates = append(tlsConfig.Certificates, clientCert)
|
||||
|
||||
return tlsConfig, nil
|
||||
}
|
||||
|
||||
func getVariable(config *Config, key string) (string, error) {
|
||||
value := ""
|
||||
object := reflect.Indirect(reflect.ValueOf(config))
|
||||
field := object.FieldByName(fmt.Sprintf("%sFile", key))
|
||||
// Here linter say you should simplify this code, but lets not, performance is important not clarity and complexity
|
||||
fp := field.String()
|
||||
if fp != "" {
|
||||
file, err := os.Stat(fp)
|
||||
if err != nil {
|
||||
return value, fmt.Errorf("%s:%s invalid path %w", key, fp, err)
|
||||
}
|
||||
if file.IsDir() {
|
||||
return value, fmt.Errorf("%s:%s path must be a file", key, fp)
|
||||
}
|
||||
fileValue, err := os.ReadFile(filepath.Clean(fp))
|
||||
if err != nil {
|
||||
return value, fmt.Errorf("%s:%s read file path failed %w", key, fp, err)
|
||||
}
|
||||
value = string(fileValue)
|
||||
return value, nil
|
||||
}
|
||||
field = object.FieldByName(key)
|
||||
value = field.String()
|
||||
return value, nil
|
||||
}
|
||||
|
||||
func validateParams(config *Config) error {
|
||||
if err := validateParamsRequired(config); err != nil {
|
||||
return err
|
||||
}
|
||||
testURL := url.URL{
|
||||
Scheme: config.CrowdsecLapiScheme,
|
||||
Host: config.CrowdsecLapiHost,
|
||||
}
|
||||
// This only check that the format of the URL scheme:// is correct and do not make requests
|
||||
|
||||
if _, err := http.NewRequest(http.MethodGet, testURL.String(), nil); err != nil {
|
||||
return fmt.Errorf("CrowdsecLapiScheme://CrowdsecLapiHost: '%v://%v' must be an URL", config.CrowdsecLapiScheme, config.CrowdsecLapiHost)
|
||||
}
|
||||
|
||||
if err := validateParamsIPs(config.ForwardedHeadersTrustedIPs, "ForwardedHeadersTrustedIPs"); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := validateParamsIPs(config.ClientTrustedIPs, "ClientTrustedIPs"); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
lapiKey, err := getVariable(config, "CrowdsecLapiKey")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
certBouncer, err := getVariable(config, "CrowdsecLapiTLSCertificateBouncer")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
certBouncerKey, err := getVariable(config, "CrowdsecLapiTLSCertificateBouncerKey")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
// We need to either have crowdsecLapiKey defined or the BouncerCert and Bouncerkey
|
||||
if lapiKey == "" && (certBouncer == "" || certBouncerKey == "") {
|
||||
return fmt.Errorf("CrowdsecLapiKey || (CrowdsecLapiTLSCertificateBouncer && CrowdsecLapiTLSCertificateBouncerKey): cannot be both empty")
|
||||
}
|
||||
|
||||
// Case https to contact Crowdsec LAPI and certificate must be provided
|
||||
if config.CrowdsecLapiScheme == "https" && !config.CrowdsecLapiTLSInsecureVerify {
|
||||
err = validateParamsTLS(config)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateParamsTLS(config *Config) error {
|
||||
certAuth, err := getVariable(config, "CrowdsecLapiTLSCertificateAuthority")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if certAuth == "" {
|
||||
return fmt.Errorf("CrowdsecLapiTLSCertificateAuthority must be specified when CrowdsecLapiScheme='https' and CrowdsecLapiTLSInsecureVerify=false")
|
||||
}
|
||||
tlsConfig := new(tls.Config)
|
||||
tlsConfig.RootCAs = x509.NewCertPool()
|
||||
if !tlsConfig.RootCAs.AppendCertsFromPEM([]byte(certAuth)) {
|
||||
return fmt.Errorf("failed parsing pem file")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateParamsIPs(listIP []string, key string) error {
|
||||
if len(listIP) > 0 {
|
||||
if _, err := ip.NewChecker(listIP); err != nil {
|
||||
return fmt.Errorf("%s must be a list of IP/CIDR :%w", key, err)
|
||||
}
|
||||
} else {
|
||||
logger.Debug(fmt.Sprintf("No IP provided for %s", key))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateParamsRequired(config *Config) error {
|
||||
requiredStrings := map[string]string{
|
||||
"CrowdsecLapiScheme": config.CrowdsecLapiScheme,
|
||||
"CrowdsecLapiHost": config.CrowdsecLapiHost,
|
||||
"CrowdsecLapiKey": config.CrowdsecLapiKey,
|
||||
"CrowdsecMode": config.CrowdsecMode,
|
||||
}
|
||||
requiredInt := map[string]int64{
|
||||
@@ -392,30 +566,5 @@ func validateParams(config *Config) error {
|
||||
if !contains([]string{"http", "https"}, config.CrowdsecLapiScheme) {
|
||||
return fmt.Errorf("CrowdsecLapiScheme: must be one of 'http' or 'https'")
|
||||
}
|
||||
testURL := url.URL{
|
||||
Scheme: config.CrowdsecLapiScheme,
|
||||
Host: config.CrowdsecLapiHost,
|
||||
}
|
||||
_, err := http.NewRequest(http.MethodGet, testURL.String(), nil)
|
||||
if err != nil {
|
||||
return fmt.Errorf("CrowdsecLapiScheme://CrowdsecLapiHost: '%v://%v' must be an URL", config.CrowdsecLapiScheme, config.CrowdsecLapiHost)
|
||||
}
|
||||
if len(config.ForwardedHeadersTrustedIPs) > 0 {
|
||||
_, err = ip.NewChecker(config.ForwardedHeadersTrustedIPs)
|
||||
if err != nil {
|
||||
return fmt.Errorf("ForwardedHeadersTrustedIPs must be a list of IP/CIDR :%w", err)
|
||||
}
|
||||
} else {
|
||||
logger.Debug("No IP provided for ForwardedHeadersTrustedIPs")
|
||||
}
|
||||
if len(config.ClientTrustedIPs) > 0 {
|
||||
_, err = ip.NewChecker(config.ClientTrustedIPs)
|
||||
if err != nil {
|
||||
return fmt.Errorf("TrustedIPs must be a list of IP/CIDR :%w", err)
|
||||
}
|
||||
} else {
|
||||
logger.Debug("No IP provided for TrustedIPs")
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
+64
-2
@@ -7,7 +7,70 @@ import (
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestCrowdSec(t *testing.T) {
|
||||
func TestCreation(t *testing.T) {
|
||||
cfg := CreateConfig()
|
||||
cfg.CrowdsecLapiKey = "test"
|
||||
|
||||
ctx := context.Background()
|
||||
next := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {})
|
||||
|
||||
handler, err := New(ctx, next, cfg, "demo-plugin")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
recorder := httptest.NewRecorder()
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://localhost", nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
handler.ServeHTTP(recorder, req)
|
||||
}
|
||||
|
||||
// func TestValidateParamsCrowdsecLapiKey(t *testing.T) {
|
||||
// cfg := CreateConfig()
|
||||
// err := validateParams(cfg)
|
||||
// fmt.Println(err.Error())
|
||||
// if err == nil {
|
||||
// t.Errorf("Need error here %s", err.Error())
|
||||
// }
|
||||
// }
|
||||
|
||||
// func TestValidateParamsCrowdsecLapiScheme(t *testing.T) {
|
||||
// cfg := CreateConfig()
|
||||
// cfg.CrowdsecLapiKey = "test"
|
||||
// cfg.CrowdsecLapiScheme = "bad"
|
||||
// err := validateParams(cfg)
|
||||
// fmt.Println(err.Error())
|
||||
// if err == nil {
|
||||
// t.Errorf("Need error here %s", err.Error())
|
||||
// }
|
||||
// }
|
||||
|
||||
// func TestValidateParamsCrowdsecMode(t *testing.T) {
|
||||
// cfg := CreateConfig()
|
||||
// cfg.CrowdsecLapiKey = "test"
|
||||
// cfg.CrowdsecMode = "bad"
|
||||
// err := validateParams(cfg)
|
||||
// fmt.Println(err.Error())
|
||||
// if err == nil {
|
||||
// t.Errorf("Need error here %s", err.Error())
|
||||
// }
|
||||
// }
|
||||
|
||||
// func TestValidateParamsUpdateIntervalSeconds(t *testing.T) {
|
||||
// cfg := CreateConfig()
|
||||
// cfg.CrowdsecLapiKey = "test"
|
||||
// cfg.UpdateIntervalSeconds = 0
|
||||
// err := validateParams(cfg)
|
||||
// fmt.Println(err.Error())
|
||||
// if err == nil {
|
||||
// t.Errorf("Need error here %s", err.Error())
|
||||
// }
|
||||
// }
|
||||
|
||||
func TestServeHTTP(t *testing.T) {
|
||||
cfg := CreateConfig()
|
||||
cfg.CrowdsecLapiKey = "test"
|
||||
|
||||
@@ -20,7 +83,6 @@ func TestCrowdSec(t *testing.T) {
|
||||
}
|
||||
|
||||
recorder := httptest.NewRecorder()
|
||||
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://localhost", nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
|
||||
@@ -15,12 +15,12 @@ services:
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.3"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.4"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-redis:/var/log/traefik
|
||||
- ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
# - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
FROM ubuntu:22.04
|
||||
|
||||
RUN apt-get update && apt-get install -y curl wget
|
||||
RUN VERSION=$(curl --silent "https://api.github.com/repos/cloudflare/cfssl/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/') && VNUMBER=${VERSION#"v"} && wget https://github.com/cloudflare/cfssl/releases/download/${VERSION}/cfssl_${VNUMBER}_linux_amd64 -O cfssl && chmod +x cfssl && mv cfssl /usr/local/bin
|
||||
|
||||
RUN VERSION=$(curl --silent "https://api.github.com/repos/cloudflare/cfssl/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/') && \
|
||||
VNUMBER=${VERSION#"v"} && \
|
||||
wget https://github.com/cloudflare/cfssl/releases/download/${VERSION}/cfssljson_${VNUMBER}_linux_amd64 -O cfssljson && \
|
||||
chmod +x cfssljson && \
|
||||
mv cfssljson /usr/local/bin && \
|
||||
cfssljson -version
|
||||
|
||||
COPY gencerts.sh /gencerts.sh
|
||||
RUN chmod +x /gencerts.sh
|
||||
|
||||
CMD [ "/gencerts.sh" ]
|
||||
@@ -0,0 +1,4 @@
|
||||
filenames:
|
||||
- /var/log/traefik/access.log
|
||||
labels:
|
||||
type: traefik
|
||||
@@ -0,0 +1,62 @@
|
||||
common:
|
||||
daemonize: false
|
||||
pid_dir: /var/run/
|
||||
log_media: stdout
|
||||
log_level: info
|
||||
log_dir: /var/log/
|
||||
working_dir: .
|
||||
config_paths:
|
||||
config_dir: /etc/crowdsec/
|
||||
data_dir: /var/lib/crowdsec/data/
|
||||
simulation_path: /etc/crowdsec/simulation.yaml
|
||||
hub_dir: /etc/crowdsec/hub/
|
||||
index_path: /etc/crowdsec/hub/.index.json
|
||||
notification_dir: /etc/crowdsec/notifications/
|
||||
plugin_dir: /usr/local/lib/crowdsec/plugins/
|
||||
crowdsec_service:
|
||||
acquisition_path: /etc/crowdsec/acquis.yaml
|
||||
parser_routines: 1
|
||||
plugin_config:
|
||||
user: nobody
|
||||
group: nobody
|
||||
cscli:
|
||||
output: human
|
||||
db_config:
|
||||
log_level: info
|
||||
type: sqlite
|
||||
db_path: /var/lib/crowdsec/data/crowdsec.db
|
||||
#user:
|
||||
#password:
|
||||
#db_name:
|
||||
#host:
|
||||
#port:
|
||||
flush:
|
||||
max_items: 5000
|
||||
max_age: 7d
|
||||
api:
|
||||
client:
|
||||
insecure_skip_verify: false
|
||||
credentials_path: /etc/crowdsec/local_api_credentials.yaml
|
||||
server:
|
||||
log_level: info
|
||||
listen_uri: 0.0.0.0:8080
|
||||
profiles_path: /etc/crowdsec/profiles.yaml
|
||||
trusted_ips: # IP ranges, or IPs which can have admin API access
|
||||
- 127.0.0.1
|
||||
- ::1
|
||||
online_client: # Central API credentials (to push signals and receive bad IPs)
|
||||
#credentials_path: /etc/crowdsec/online_api_credentials.yaml
|
||||
tls:
|
||||
cert_file: /etc/crowdsec/certs/server.pem #Server side cert
|
||||
key_file: /etc/crowdsec/certs/server-key.pem #Server side key
|
||||
ca_cert_path: /etc/crowdsec/certs/inter.pem #CA used to verify the client certs
|
||||
bouncers_allowed_ou: #OU allowed for bouncers
|
||||
- bouncer-ou
|
||||
agents_allowed_ou: #OU allowed for agents
|
||||
- agent-ou
|
||||
|
||||
prometheus:
|
||||
enabled: true
|
||||
level: full
|
||||
listen_addr: 0.0.0.0
|
||||
listen_port: 6060
|
||||
@@ -0,0 +1,4 @@
|
||||
url: https://localhost:8080
|
||||
ca_cert_path: /etc/crowdsec/certs/inter.pem #CA to trust the server certificate
|
||||
key_path: /etc/crowdsec/certs/agent-key.pem #Client key
|
||||
cert_path: /etc/crowdsec/certs/agent.pem #Client cert
|
||||
@@ -0,0 +1,108 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.9.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
- "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
# - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
# - "--experimental.plugins.bouncer.version=v1.1.5"
|
||||
- "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-tls-auth:/var/log/traefik
|
||||
- crowdsec-certs-tls-auth:/etc/traefik/crowdsec-certs
|
||||
- ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
depends_on:
|
||||
- crowdsec
|
||||
|
||||
whoami-foo:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-foo"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.router-foo.rule=Path(`/foo`)"
|
||||
- "traefik.http.routers.router-foo.entrypoints=web"
|
||||
- "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
- "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapischeme=https"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
|
||||
|
||||
whoami-bar:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-bar"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.router-bar.rule=Path(`/bar`)"
|
||||
- "traefik.http.routers.router-bar.entrypoints=web"
|
||||
- "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapischeme=https"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiTLSCertificateBouncerFile=/etc/traefik/crowdsec-certs/bouncer.pem"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiTLSCertificateBouncerKeyFile=/etc/traefik/crowdsec-certs/bouncer-key.pem"
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.3
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
# whoami-foo is authenticating with api key over https
|
||||
# whoami-bar is authenticating with tls cert over https
|
||||
BOUNCER_KEY_TRAEFIK_FOO: 40796d93c2958f9e58345514e67740e5
|
||||
LOCAL_API_URL: https://127.0.0.1:8080
|
||||
USE_TLS: "true"
|
||||
CERT_FILE: "/etc/crowdsec/certs/server.pem"
|
||||
KEY_FILE: "/etc/crowdsec/certs/server-key.pem"
|
||||
CACERT_FILE: "/etc/crowdsec/certs/inter.pem"
|
||||
AGENTS_ALLOWED_OU: "agent-ou"
|
||||
BOUNCERS_ALLOWED_OU: "bouncer-ou"
|
||||
LEVEL_DEBUG: "true"
|
||||
# Disabled because it restart in loop otherwise
|
||||
DISABLE_AGENT: "true"
|
||||
# Disabled for the examples
|
||||
DISABLE_ONLINE_API: "true"
|
||||
volumes:
|
||||
- ./config/acquis.yaml:/etc/crowdsec/acquis.yaml
|
||||
# - ./config/config.yaml:/etc/crowdsec/config_local.yaml
|
||||
# - ./config/local_api_credentials.yaml:/etc/crowdsec/local_api_credentials.yaml:ro
|
||||
- crowdsec-certs-tls-auth:/etc/crowdsec/certs/:ro
|
||||
- logs-tls-auth:/var/log/traefik:ro
|
||||
- crowdsec-db-tls-auth:/var/lib/crowdsec/data/
|
||||
- crowdsec-config-tls-auth:/etc/crowdsec/
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
gencert:
|
||||
build: .
|
||||
volumes:
|
||||
- crowdsec-certs-tls-auth:/out
|
||||
- ./in:/in:ro
|
||||
|
||||
volumes:
|
||||
logs-tls-auth:
|
||||
crowdsec-db-tls-auth:
|
||||
crowdsec-config-tls-auth:
|
||||
crowdsec-certs-tls-auth:
|
||||
@@ -0,0 +1,13 @@
|
||||
#!/bin/bash
|
||||
|
||||
stdout=/out/res.log
|
||||
cfssl gencert --initca /in/ca.json 2>${stdout} | cfssljson --bare "/out/ca" && \
|
||||
# Generate an intermediate certificate that will be used to sign the client certificates
|
||||
cfssl gencert --initca /in/intermediate.json 2>${stdout} | cfssljson --bare "/out/inter" && \
|
||||
cfssl sign -ca "/out/ca.pem" -ca-key "/out/ca-key.pem" -config /in/profiles.json -profile intermediate_ca "/out/inter.csr" 2>${stdout} | cfssljson --bare "/out/inter" && \
|
||||
# Generate a server side certificate
|
||||
cfssl gencert -ca "/out/inter.pem" -ca-key "/out/inter-key.pem" -config /in/profiles.json -profile=server /in/server.json 2>${stdout} | cfssljson --bare "/out/server" && \
|
||||
# Generate a client certificate for the bouncer whoami
|
||||
cfssl gencert -ca "/out/inter.pem" -ca-key "/out/inter-key.pem" -config /in/profiles.json -profile=client /in/bouncer.json 2>${stdout} | cfssljson --bare "/out/bouncer" && \
|
||||
# Generate a client certificate for the agent
|
||||
cfssl gencert -ca "/out/inter.pem" -ca-key "/out/inter-key.pem" -config /in/profiles.json -profile=client /in/agent.json 2>${stdout} | cfssljson --bare "/out/agent"
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"CN": "myagent",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "agent-ou",
|
||||
"ST": "France"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"CN": "crowdsec",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "bouncer-ou",
|
||||
"ST": "France"
|
||||
}
|
||||
],
|
||||
"hosts": [
|
||||
"127.0.0.1",
|
||||
"localhost",
|
||||
"crowdsec"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"CN": "CrowdSec Test CA",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "Crowdsec",
|
||||
"ST": "France"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"CN": "CrowdSec Test CA Intermediate",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "Crowdsec Intermediate",
|
||||
"ST": "France"
|
||||
}
|
||||
],
|
||||
"ca": {
|
||||
"expiry": "42720h"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{
|
||||
"signing": {
|
||||
"default": {
|
||||
"expiry": "8760h"
|
||||
},
|
||||
"profiles": {
|
||||
"intermediate_ca": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"key encipherment",
|
||||
"cert sign",
|
||||
"crl sign",
|
||||
"server auth",
|
||||
"client auth"
|
||||
],
|
||||
"expiry": "8760h",
|
||||
"ca_constraint": {
|
||||
"is_ca": true,
|
||||
"max_path_len": 0,
|
||||
"max_path_len_zero": true
|
||||
}
|
||||
},
|
||||
"server": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signing",
|
||||
"key encipherment",
|
||||
"server auth"
|
||||
],
|
||||
"expiry": "8760h"
|
||||
},
|
||||
"client": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"key encipherment",
|
||||
"client auth"
|
||||
],
|
||||
"expiry": "8760h"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"CN": "crowdsec",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "FR",
|
||||
"L": "Paris",
|
||||
"O": "Crowdsec",
|
||||
"OU": "Crowdsec Server",
|
||||
"ST": "France"
|
||||
}
|
||||
],
|
||||
"hosts": [
|
||||
"127.0.0.1",
|
||||
"localhost",
|
||||
"crowdsec"
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user