Skip to content

Commit 1017388

Browse files
aledbfcarmstrong
aledbf
authored and
carmstrong
committed
feat(router): include a firewall to mitigate security problems.
1 parent 9653bfe commit 1017388

11 files changed

Lines changed: 2553 additions & 2 deletions

File tree

‎docs/customizing_deis/router_settings.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ setting description
4545
/deis/router/controller/timeout/connect proxy_connect_timeout for deis-controller (default: 10m)
4646
/deis/router/controller/timeout/read proxy_read_timeout for deis-controller (default: 20m)
4747
/deis/router/controller/timeout/send proxy_send_timeout for deis-controller (default: 20m)
48+
/deis/router/firewall/enabled nginx naxsi firewall (default: false)
49+
/deis/router/firewall/errorCode nginx default firewall error code (default: 400)
4850
/deis/router/gzip nginx gzip setting (default: on)
4951
/deis/router/gzipCompLevel nginx gzipCompLevel setting (default: 5)
5052
/deis/router/gzipDisable nginx gzipDisable setting (default: "msie6")

‎router/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,25 @@ install, and start **deis/router**.
2525
* **PORT** sets the TCP port on which the router listens (default: *80*)
2626

2727

28+
## Firewall
29+
30+
Why a firewall in deis-router?
31+
[Shellshock](https://shellshocker.net) exposed that some apps (mostly CGI based) inside a web server can be exploited like is explained here [Inside Shellshock: How hackers are using it to exploit systems](https://blog.cloudflare.com/inside-shellshock) allowing the arbitrary execution of commands.
32+
33+
To reduce the contact surface of this attack and others (like sql injection and cross site scripting) is possible to enable the naxsi firewall (disabled by default). [**NAXSI**](https://github.com/nbs-system/naxsi) is an open-source, high performance, low rules maintenance WAF for NGINX.
34+
The rules included are from this project [doxi-rules](https://bitbucket.org/lazy_dogtown/doxi-rules)
35+
36+
Only this modules are enabled:
37+
38+
|--|--|
39+
|File| |
40+
|web_app.rules |detect exploit/misuse-attempts againts web-applications
41+
|web_server.rules |generic rules to protect a webserver from misconfiguration and known mistakes / exploit-vectors
42+
|active-mode.rules |rules to configure active-mode (block)
43+
|naxsi_core |core naxsi rules
44+
45+
46+
2847
## License
2948

3049
© 2014 OpDemand LLC

‎router/parent/Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
FROM golang:1.3
22

3+
ADD firewall /tmp/firewall
4+
35
ADD build.sh /go/src/github.com/deis/deis/router/build.sh
46

57
WORKDIR /go/src/github.com/deis/deis/router

‎router/parent/build.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ fi
1212

1313
export VERSION_NGINX=nginx-1.6.2
1414
export VERSION_TCP_PROXY=0.4.5
15+
export VERSION_NAXSI=0d53a64ed856e694fcb4038748c8cf6d5551a603
1516

1617
export BUILD_PATH=/tmp/build
1718

@@ -32,10 +33,12 @@ apt-get update \
3233
# grab the source files
3334
curl -sSL http://nginx.org/download/$VERSION_NGINX.tar.gz -o $BUILD_PATH/$VERSION_NGINX.tar.gz
3435
curl -sSL https://github.com/yaoweibin/nginx_tcp_proxy_module/archive/v$VERSION_TCP_PROXY.tar.gz -o $BUILD_PATH/$VERSION_TCP_PROXY.tar.gz
36+
curl -sSL https://github.com/nbs-system/naxsi/archive/$VERSION_NAXSI.tar.gz -o $BUILD_PATH/$VERSION_NAXSI.tar.gz
3537

3638
# expand the source files
3739
tar xzf $VERSION_NGINX.tar.gz
3840
tar xzf $VERSION_TCP_PROXY.tar.gz
41+
tar xzf $VERSION_NAXSI.tar.gz
3942

4043
# build nginx
4144
cd $BUILD_PATH/$VERSION_NGINX
@@ -61,4 +64,7 @@ patch -p1 < $BUILD_PATH/nginx_tcp_proxy_module-$VERSION_TCP_PROXY/tcp.patch
6164
--with-mail \
6265
--with-mail_ssl_module \
6366
--add-module=$BUILD_PATH/nginx_tcp_proxy_module-$VERSION_TCP_PROXY \
67+
--add-module=$BUILD_PATH/naxsi-$VERSION_NAXSI/naxsi_src \
6468
&& make && make install
69+
70+
mv /tmp/firewall /opt/nginx/firewall

‎router/parent/firewall/README.md‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
2+
3+
# README.rulesets for doxi / dogtown-naxi-rules
4+
5+
- Readme-Version: 2014-04-04
6+
- [latest ruleset-commits](https://bitbucket.org/lazy_dogtown/doxi-rules/src)
7+
- [Doxi-News Blog](http://blog.dorvakt.org/)
8+
9+
these rulesets are now available as independent git-repo @
10+
[bitbucket.org/lazy_dogtown/doxi-rules](https://bitbucket.org/lazy_dogtown/doxi-rules)
11+
12+
for tools to manage your doxi-rules you might want to install doxi-tools
13+
[bitbucket.org/lazy_dogtown/doxi](https://bitbucket.org/lazy_dogtown/doxi)
14+
15+
to keep track of changes and ruleset-updates you could either
16+
subscribe to the [doxi-news - blog](http://blog.dorvakt.org/) ([rss-feed](http://blog.dorvakt.org/feeds/posts/default)),
17+
subscribe to the naxsi-mailinglist
18+
https://groups.google.com/forum/?fromgroups#!forum/naxsi-discuss or
19+
subscribe to the [ruleset-commit-feed](https://bitbucket.org/lazy_dogtown/doxi-rules/rss)
20+
or follow that project on Bitbucket
21+
22+
License: see License.txt
23+
24+
25+
26+
all not-mentioned files here are part of naxsi/nginx - default-configuration
27+
28+
29+
# configuration rules
30+
31+
please note: due to changes in naxsi after 0.49 this file-layout might get
32+
obsolete.
33+
34+
### rules.conf
35+
36+
- your global includes-file; you might setup different rules.con - files,
37+
- maybe tuned for each virtualhost.
38+
39+
40+
### learning-mode.rules
41+
42+
- rules to configure/enable learning-mode
43+
44+
### active-mode.rules
45+
46+
- rules to configure active-mode (block)
47+
48+
49+
# detection rules
50+
51+
### app_server.rules
52+
53+
- rules you might want to enable when running nginx as lb/proxy
54+
for app-servers like tomcat / rails etc and you're shure to
55+
have no php/asp/cgi - files lying around
56+
57+
### malware.rules
58+
59+
**NOTE: for a better coverage you might want to try a real ids
60+
like snort or suricata with et-rulesets rules to detect malicious
61+
content in- and outbound. **
62+
63+
- this ruleset is designed to detect malicious request that give a
64+
hint for hacked / misused / C&C-servers and tries to detect
65+
web-backdoors, webshells and other malicious access to unwanted
66+
files/services.
67+
68+
- **CAUTION:** these rules are quite noise, so if included you might want to
69+
tune and create whitelists for your applications
70+
71+
### scanner.rules
72+
73+
- detect scanners (WebAppScanners/Testing-Tools
74+
- detetc vuln-scanning-bots or attack-tools) by UA or by certain requests.
75+
- some of these rules could be included into web_[app|server].rules,
76+
like scanners for certain webapp/server-vulns, but when there's a
77+
clear sign for an automated scanning-process the sigs are include here
78+
- **CAUTION:** these rules are quite noise, so if included you might want to
79+
tune and create whitelists for your applications
80+
81+
82+
### web_app.rules
83+
84+
- detect exploit/misuse-attempts againts web-applications; please see
85+
scanner.rules for some details on webapp-based scanners
86+
87+
### web_server.rules
88+
89+
- generic rules to protect a webserver from misconfiguration
90+
and known mistakes / exploit-vectors
91+
92+
93+
# misc. rules (obsolete, not maintained after jan 2014)
94+
95+
# misc_whitelisting.rules
96+
97+
- whitelistings for different webapps/actions that are known to fail
98+
on certain parameters
99+

‎router/parent/firewall/active-mode.rules‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#LearningMode; #Enables learning mode
2+
SecRulesEnabled;
3+
#SecRulesDisabled;
4+
DeniedUrl "/RequestDenied";
5+
6+
7+
8+
## check rules
9+
CheckRule "$SQL >= 8" BLOCK;
10+
CheckRule "$RFI >= 8" BLOCK;
11+
CheckRule "$TRAVERSAL >= 4" BLOCK;
12+
CheckRule "$EVADE >= 4" BLOCK;
13+
CheckRule "$XSS >= 8" BLOCK;
14+
15+
# UnWantedAccess -> see app-server.rules
16+
CheckRule "$UWA >= 8" BLOCK;
17+
18+
# Identified Attacks
19+
CheckRule "$ATTACK >= 8" BLOCK;

‎router/parent/firewall/naxsi_core.rules‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
##################################
2+
## INTERNAL RULES IDS:1-10 ##
3+
##################################
4+
#weird_request : 1
5+
#big_body : 2
6+
#no_content_type : 3
7+
8+
#@MainRule "msg:weird/incorrect request" id:1;
9+
#@MainRule "msg:big request, unparsed" id:2;
10+
#@MainRule "msg:uncommon hex encoding (%00 etc.)" id:10;
11+
MainRule "msg:uncommon/empty content-type in POST" id:11;
12+
MainRule "msg:uncommon/malformed URL" id:12;
13+
14+
#MainRule "str:123FREETEXT" "msg:exemple learning test pattern" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:BLOCK" id:0;
15+
16+
##################################
17+
## SQL Injections IDs:1000-1099 ##
18+
##################################
19+
MainRule "rx:select|union|update|delete|insert|table|from|ascii|hex|unhex|drop" "msg:sql keywords" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1000;
20+
# matches /config in controller
21+
# MainRule "str:\"" "msg:double quote" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8,$XSS:8" id:1001;
22+
MainRule "str:0x" "msg:0x, possible hex encoding" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:2" id:1002;
23+
## Hardcore rules
24+
MainRule "str:/*" "msg:mysql comment (/*)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1003;
25+
MainRule "str:*/" "msg:mysql comment (*/)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1004;
26+
#MainRule "str:|" "msg:mysql keyword (|)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1005;
27+
MainRule "str:&&" "msg:mysql keyword (&&)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1006;
28+
## end of hardcore rules
29+
MainRule "str:--" "msg:mysql comment (--)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1007;
30+
MainRule "str:;" "msg:; in stuff" "mz:BODY|URL|ARGS" "s:$SQL:4,$XSS:8" id:1008;
31+
MainRule "str:=" "msg:equal in var, probable sql/xss" "mz:ARGS|BODY" "s:$SQL:2" id:1009;
32+
#MainRule "str:(" "msg:parenthesis, probable sql/xss" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1010;
33+
#MainRule "str:)" "msg:parenthesis, probable sql/xss" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1011;
34+
MainRule "str:'" "msg:simple quote" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1013;
35+
MainRule "str:," "msg:, in stuff" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;
36+
MainRule "str:#" "msg:mysql comment (#)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1016;
37+
38+
###############################
39+
## OBVIOUS RFI IDs:1100-1199 ##
40+
###############################
41+
MainRule "str:http://" "msg:http:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1100;
42+
MainRule "str:https://" "msg:https:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1101;
43+
MainRule "str:ftp://" "msg:ftp:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1102;
44+
MainRule "str:php://" "msg:php:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1103;
45+
MainRule "str:ftps://" "msg:ftps:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1104;
46+
MainRule "str:phps://" "msg:phps:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1105;
47+
48+
49+
#######################################
50+
## Directory traversal IDs:1200-1299 ##
51+
#######################################
52+
MainRule "str:.." "msg:double dot" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1200;
53+
MainRule "str:/etc/passwd" "msg:obvious probe" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1202;
54+
MainRule "str:c:\\" "msg:obvious windows path" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1203;
55+
MainRule "str:cmd.exe" "msg:obvious probe" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1204;
56+
#MainRule "str:\\" "msg:backslash" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1205;
57+
#MainRule "str:/" "msg:slash in args" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:2" id:1206;
58+
59+
########################################
60+
## Cross Site Scripting IDs:1300-1399 ##
61+
########################################
62+
MainRule "str:<" "msg:html open tag" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1302;
63+
MainRule "str:>" "msg:html close tag" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1303;
64+
MainRule "str:[" "msg:[, possible js" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1310;
65+
MainRule "str:]" "msg:], possible js" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1311;
66+
MainRule "str:~" "msg:~ character" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1312;
67+
MainRule "str:`" "msg:grave accent !" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1314;
68+
#MainRule "rx:%[2|3]." "msg:double encoding !" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1315;
69+
70+
####################################
71+
## Evading tricks IDs: 1400-1500 ##
72+
####################################
73+
MainRule "str:&#" "msg: utf7/8 encoding" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1400;
74+
MainRule "str:%U" "msg: M$ encoding" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1401;
75+
#@MainRule negative "rx:multipart/form-data|application/x-www-form-urlencoded" "msg:Content is neither mulipart/x-www-form.." "mz:$HEADERS_VAR:Content-type" "s:$EVADE:4" id:1402;
76+
77+
#############################
78+
## File uploads: 1500-1600 ##
79+
#############################
80+
#@MainRule "rx:.ph*|.asp*" "msg:asp/php file upload!" "mz:FILE_EXT" "s:$UPLOAD:8" id:1500;

0 commit comments

Comments
 (0)