Skip to content

Commit 4c4fa55

Browse files
carmstrongcarmstrong
committed
ref(router): clean up firewall addition
1 parent 1017388 commit 4c4fa55

5 files changed

Lines changed: 14 additions & 22 deletions

File tree

‎docs/customizing_deis/router_settings.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ setting description
4545
/deis/router/controller/timeout/connect proxy_connect_timeout for deis-controller (default: 10m)
4646
/deis/router/controller/timeout/read proxy_read_timeout for deis-controller (default: 20m)
4747
/deis/router/controller/timeout/send proxy_send_timeout for deis-controller (default: 20m)
48-
/deis/router/firewall/enabled nginx naxsi firewall (default: false)
48+
/deis/router/firewall/enabled nginx naxsi firewall enabled (default: false)
4949
/deis/router/firewall/errorCode nginx default firewall error code (default: 400)
5050
/deis/router/gzip nginx gzip setting (default: on)
5151
/deis/router/gzipCompLevel nginx gzipCompLevel setting (default: 5)

‎router/README.md‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,23 +27,20 @@ install, and start **deis/router**.
2727

2828
## Firewall
2929

30-
Why a firewall in deis-router?
31-
[Shellshock](https://shellshocker.net) exposed that some apps (mostly CGI based) inside a web server can be exploited like is explained here [Inside Shellshock: How hackers are using it to exploit systems](https://blog.cloudflare.com/inside-shellshock) allowing the arbitrary execution of commands.
30+
[Shellshock](https://shellshocker.net) exposed that some apps (mostly CGI based) inside a web server can be exploited, allowing the arbitrary execution of commands.
3231

33-
To reduce the contact surface of this attack and others (like sql injection and cross site scripting) is possible to enable the naxsi firewall (disabled by default). [**NAXSI**](https://github.com/nbs-system/naxsi) is an open-source, high performance, low rules maintenance WAF for NGINX.
32+
To reduce the contact surface of this attack and others (like SQL injection and cross site scripting), it's possible to enable the naxsi firewall (which is disabled by default). [**NAXSI**](https://github.com/nbs-system/naxsi) is an open-source, high performance, low rules maintenance WAF for NGINX.
3433
The rules included are from this project [doxi-rules](https://bitbucket.org/lazy_dogtown/doxi-rules)
3534

36-
Only this modules are enabled:
35+
Only these modules are enabled:
3736

3837
|--|--|
3938
|File| |
4039
|web_app.rules |detect exploit/misuse-attempts againts web-applications
41-
|web_server.rules |generic rules to protect a webserver from misconfiguration and known mistakes / exploit-vectors
40+
|web_server.rules |generic rules to protect a webserver from misconfiguration and known mistakes / exploit-vectors
4241
|active-mode.rules |rules to configure active-mode (block)
4342
|naxsi_core |core naxsi rules
4443

45-
46-
4744
## License
4845

4946
© 2014 OpDemand LLC

‎router/parent/firewall/active-mode.rules‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ SecRulesEnabled;
33
#SecRulesDisabled;
44
DeniedUrl "/RequestDenied";
55

6-
7-
86
## check rules
97
CheckRule "$SQL >= 8" BLOCK;
108
CheckRule "$RFI >= 8" BLOCK;

‎router/parent/firewall/naxsi_core.rules‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,9 @@ MainRule "str:php://" "msg:php:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:
4545
MainRule "str:ftps://" "msg:ftps:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1104;
4646
MainRule "str:phps://" "msg:phps:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1105;
4747

48-
4948
#######################################
5049
## Directory traversal IDs:1200-1299 ##
51-
#######################################
50+
#######################################
5251
MainRule "str:.." "msg:double dot" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1200;
5352
MainRule "str:/etc/passwd" "msg:obvious probe" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1202;
5453
MainRule "str:c:\\" "msg:obvious windows path" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1203;

‎router/templates/nginx.conf‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ http {
3434
gzip_vary {{ or .deis_router_gzipVary "on" }};
3535
{{ end }}
3636

37-
{{ $useFirewall := or .deis_router_firewall_enabled "true" }}{{ if eq $useFirewall "true" }}# include naxsi rules
37+
{{ $useFirewall := or .deis_router_firewall_enabled "false" }}{{ if eq $useFirewall "true" }}# include naxsi rules
3838
include /opt/nginx/firewall/naxsi_core.rules;
3939
include /opt/nginx/firewall/naxsi_core.rules;
4040
include /opt/nginx/firewall/web_apps.rules;
@@ -68,7 +68,7 @@ http {
6868

6969
{{ if .deis_controller_host }}
7070
location / {
71-
{{ if eq $useFirewall "true" }}include /opt/nginx/firewall/active-mode.rules;{{ end }}
71+
{{ if eq $useFirewall "true" }}include /opt/nginx/firewall/active-mode.rules;{{ end }}
7272
proxy_buffering off;
7373
proxy_set_header Host $host;
7474
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -87,8 +87,8 @@ http {
8787

8888
{{ if eq $useFirewall "true" }}location /RequestDenied {
8989
return {{ $firewallErrorCode }};
90-
}{{ end }}
91-
}{{ end }}
90+
}{{ end }}
91+
}
9292
## end deis-controller
9393

9494
## start deis-store-gateway
@@ -106,7 +106,7 @@ http {
106106

107107
{{ if .deis_store_gateway_host }}
108108
location / {
109-
{{ if eq $useFirewall "true" }}include /opt/nginx/firewall/active-mode.rules;{{ end }}
109+
{{ if eq $useFirewall "true" }}include /opt/nginx/firewall/active-mode.rules;{{ end }}
110110
proxy_buffering off;
111111
proxy_set_header Host $host;
112112
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -140,7 +140,7 @@ http {
140140

141141
{{ if $service.Nodes }}
142142
location / {
143-
{{ if eq $useFirewall "true" }}include /opt/nginx/firewall/active-mode.rules;{{ end }}
143+
{{ if eq $useFirewall "true" }}include /opt/nginx/firewall/active-mode.rules;{{ end }}
144144
proxy_buffering off;
145145
proxy_set_header Host $host;
146146
{{ if ne $useSSL "false" }}
@@ -161,16 +161,14 @@ http {
161161

162162
proxy_pass http://{{ Base $service.Key }};
163163
}
164-
165164
{{ else }}
166165
location / {
167166
return 503;
168167
}
169168
{{ end }}
170-
171169
{{ if eq $useFirewall "true" }}location /RequestDenied {
172170
return {{ $firewallErrorCode }};
173-
}{{ end }}
171+
}{{ end }}
174172
}
175173
{{ end }}
176174
## end service definitions for each application
@@ -207,4 +205,4 @@ tcp {
207205
proxy_pass builder;
208206
}
209207
}{{ end }}
210-
## end builder
208+
## end builder

0 commit comments

Comments
 (0)