From d906a89ad153f7fa21d73e5982a0ab427208c539 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Wed, 8 Apr 2020 10:35:29 -0400 Subject: [PATCH 1/4] Continued auth improvements --- salt/common/nginx/nginx.conf.so-eval | 4 ++-- salt/common/nginx/nginx.conf.so-master | 4 ++-- salt/common/nginx/nginx.conf.so-mastersearch | 4 ++-- salt/soc/files/kratos/schema.json | 12 ++++++++++++ 4 files changed, 18 insertions(+), 6 deletions(-) diff --git a/salt/common/nginx/nginx.conf.so-eval b/salt/common/nginx/nginx.conf.so-eval index 19ddf0c5f..8e27bcce3 100644 --- a/salt/common/nginx/nginx.conf.so-eval +++ b/salt/common/nginx/nginx.conf.so-eval @@ -132,9 +132,9 @@ http { proxy_set_header Connection "Upgrade"; } - location /auth/ { + location ~ ^/auth/.*?(whoami|login|logout) { rewrite /auth/(.*) /$1 break; - proxy_pass http://{{ masterip }}:4433/; + proxy_pass http://{{ masterip }}:4433; proxy_read_timeout 90; proxy_connect_timeout 90; proxy_set_header Host $host; diff --git a/salt/common/nginx/nginx.conf.so-master b/salt/common/nginx/nginx.conf.so-master index 19ddf0c5f..8e27bcce3 100644 --- a/salt/common/nginx/nginx.conf.so-master +++ b/salt/common/nginx/nginx.conf.so-master @@ -132,9 +132,9 @@ http { proxy_set_header Connection "Upgrade"; } - location /auth/ { + location ~ ^/auth/.*?(whoami|login|logout) { rewrite /auth/(.*) /$1 break; - proxy_pass http://{{ masterip }}:4433/; + proxy_pass http://{{ masterip }}:4433; proxy_read_timeout 90; proxy_connect_timeout 90; proxy_set_header Host $host; diff --git a/salt/common/nginx/nginx.conf.so-mastersearch b/salt/common/nginx/nginx.conf.so-mastersearch index 19ddf0c5f..8e27bcce3 100644 --- a/salt/common/nginx/nginx.conf.so-mastersearch +++ b/salt/common/nginx/nginx.conf.so-mastersearch @@ -132,9 +132,9 @@ http { proxy_set_header Connection "Upgrade"; } - location /auth/ { + location ~ ^/auth/.*?(whoami|login|logout) { rewrite /auth/(.*) /$1 break; - proxy_pass http://{{ masterip }}:4433/; + proxy_pass http://{{ masterip }}:4433; proxy_read_timeout 90; proxy_connect_timeout 90; proxy_set_header Host $host; diff --git a/salt/soc/files/kratos/schema.json b/salt/soc/files/kratos/schema.json index 28e630a8f..4e0d7ac02 100644 --- a/salt/soc/files/kratos/schema.json +++ b/salt/soc/files/kratos/schema.json @@ -18,6 +18,18 @@ "verification": { "via": "email" } + }, + "firstName": { + "type": "string", + "title": "First Name" + }, + "lastName": { + "type": "string", + "title": "Last Name" + }, + "role": { + "type": "string", + "title": "Role" } } }, From 7a7fcce1e1678d7d887c50d051b6e5d1db1c7d5b Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Wed, 8 Apr 2020 12:39:37 -0400 Subject: [PATCH 2/4] Added config changes needed for new admin pages in SOC --- salt/soc/files/kratos/schema.json | 24 ++++++++++++------------ salt/soc/files/soc/soc.json | 3 +++ 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/salt/soc/files/kratos/schema.json b/salt/soc/files/kratos/schema.json index 4e0d7ac02..a22a9fef6 100644 --- a/salt/soc/files/kratos/schema.json +++ b/salt/soc/files/kratos/schema.json @@ -18,19 +18,19 @@ "verification": { "via": "email" } - }, - "firstName": { - "type": "string", - "title": "First Name" - }, - "lastName": { - "type": "string", - "title": "Last Name" - }, - "role": { - "type": "string", - "title": "Role" } + }, + "firstName": { + "type": "string", + "title": "First Name" + }, + "lastName": { + "type": "string", + "title": "Last Name" + }, + "role": { + "type": "string", + "title": "Role" } }, "required": [ diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json index f69a66117..af739a3ef 100644 --- a/salt/soc/files/soc/soc.json +++ b/salt/soc/files/soc/soc.json @@ -11,6 +11,9 @@ "filedatastore": { "jobDir": "jobs" }, + "kratos": { + "hostUrl": "http://{{ MASTERIP }}:4434/" + }, "securityonion": { "elasticsearchHost": "http://{{ MASTERIP }}:9200", "elasticsearchUsername": "", From bb470be4e6828f80360bbe20e1530903f2f32117 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Thu, 9 Apr 2020 17:37:03 -0400 Subject: [PATCH 3/4] support auto redirect on login --- salt/common/nginx/nginx.conf.so-eval | 2 +- salt/common/nginx/nginx.conf.so-master | 2 +- salt/common/nginx/nginx.conf.so-mastersearch | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/common/nginx/nginx.conf.so-eval b/salt/common/nginx/nginx.conf.so-eval index 8e27bcce3..4c01f7a6d 100644 --- a/salt/common/nginx/nginx.conf.so-eval +++ b/salt/common/nginx/nginx.conf.so-eval @@ -288,7 +288,7 @@ http { error_page 401 = @error401; location @error401 { - add_header Set-Cookie "NSREDIRECT=http://{{ masterip }}$request_uri;Domain={{ masterip }};Path=/;Max-Age=60000"; + add_header Set-Cookie "AUTH_REDIRECT=$request_uri;Max-Age=14400"; return 302 /auth/self-service/browser/flows/login; } diff --git a/salt/common/nginx/nginx.conf.so-master b/salt/common/nginx/nginx.conf.so-master index 8e27bcce3..698f0c35f 100644 --- a/salt/common/nginx/nginx.conf.so-master +++ b/salt/common/nginx/nginx.conf.so-master @@ -288,7 +288,7 @@ http { error_page 401 = @error401; location @error401 { - add_header Set-Cookie "NSREDIRECT=http://{{ masterip }}$request_uri;Domain={{ masterip }};Path=/;Max-Age=60000"; + add_header Set-Cookie "AUTH_REDIRECT=$request_uri;Path=/;Max-Age=14400"; return 302 /auth/self-service/browser/flows/login; } diff --git a/salt/common/nginx/nginx.conf.so-mastersearch b/salt/common/nginx/nginx.conf.so-mastersearch index 8e27bcce3..698f0c35f 100644 --- a/salt/common/nginx/nginx.conf.so-mastersearch +++ b/salt/common/nginx/nginx.conf.so-mastersearch @@ -288,7 +288,7 @@ http { error_page 401 = @error401; location @error401 { - add_header Set-Cookie "NSREDIRECT=http://{{ masterip }}$request_uri;Domain={{ masterip }};Path=/;Max-Age=60000"; + add_header Set-Cookie "AUTH_REDIRECT=$request_uri;Path=/;Max-Age=14400"; return 302 /auth/self-service/browser/flows/login; } From 8d8bde36e8973d9a6ceeee0428efad3000fb32f9 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Fri, 10 Apr 2020 12:46:28 +0000 Subject: [PATCH 4/4] migrate Zeek clean script from Bro --- salt/zeek/cron/zeek_clean | 62 +++++++++++++++++++++++++++++++++++++++ salt/zeek/init.sls | 15 ++++++++++ 2 files changed, 77 insertions(+) create mode 100644 salt/zeek/cron/zeek_clean diff --git a/salt/zeek/cron/zeek_clean b/salt/zeek/cron/zeek_clean new file mode 100644 index 000000000..533ef8a4e --- /dev/null +++ b/salt/zeek/cron/zeek_clean @@ -0,0 +1,62 @@ +#!/bin/bash + +# Delete Zeek Logs based on defined CRIT_DISK_USAGE value + +# Copyright 2014,2015,2016,2017,2018, 2019 Security Onion Solutions, LLC + +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +clean () { + +SENSOR_DIR='/nsm' +CRIT_DISK_USAGE=90 +CUR_USAGE=$(df -P $SENSOR_DIR | tail -1 | awk '{print $5}' | tr -d %) +LOG="/nsm/zeek/logs/zeek_clean.log" + +if [ "$CUR_USAGE" -gt "$CRIT_DISK_USAGE" ]; then + while [ "$CUR_USAGE" -gt "$CRIT_DISK_USAGE" ]; + do + TODAY=$(date -u "+%Y-%m-%d") + + # find the oldest Zeek logs directory and exclude today + OLDEST_DIR=$(ls /nsm/zeek/logs/ | grep -v "current" | grep -v "stats" | grep -v "packetloss" | grep -v "zeek_clean" | sort | grep -v $TODAY | head -n 1) + if [ -z "$OLDEST_DIR" -o "$OLDEST_DIR" == ".." -o "$OLDEST_DIR" == "." ] + then + echo "$(date) - No old Zeek logs available to clean up in /nsm/zeek/logs/" >> $LOG + exit 0 + else + echo "$(date) - Removing directory: /nsm/zeek/logs/$OLDEST_DIR" >> $LOG + rm -rf /nsm/zeek/logs/"$OLDEST_DIR" + fi + + # find oldest files in extracted directory and exclude today + OLDEST_EXTRACT=$(find /nsm/zeek/extracted/complete -type f -printf '%T+ %p\n' 2>/dev/null | sort | grep -v $TODAY | head -n 1) + if [ -z "$OLDEST_EXTRACT" -o "$OLDEST_EXTRACT" == ".." -o "$OLDEST_EXTRACT" == "." ] + then + echo "$(date) - No old extracted files available to clean up in /nsm/zeek/extracted/complete" >> $LOG + else + OLDEST_EXTRACT_DATE=`echo $OLDEST_EXTRACT | awk '{print $1}' | cut -d+ -f1` + OLDEST_EXTRACT_FILE=`echo $OLDEST_EXTRACT | awk '{print $2}'` + echo "$(date) - Removing extracted files for $OLDEST_EXTRACT_DATE" >> $LOG + find /nsm/zeek/extracted/complete -type f -printf '%T+ %p\n' | grep $OLDEST_EXTRACT_DATE | awk '{print $2}' |while read FILE + do + echo "$(date) - Removing extracted file: $FILE" >> $LOG + rm -f "$FILE" + done + fi + done +else + echo "$(date) - CRIT_DISK_USAGE value of $CRIT_DISK_USAGE not greater than current usage of $CUR_USAGE..." >> $LOG +fi +} diff --git a/salt/zeek/init.sls b/salt/zeek/init.sls index dfc101cc7..1b0542900 100644 --- a/salt/zeek/init.sls +++ b/salt/zeek/init.sls @@ -87,6 +87,21 @@ nodecfgsync: - group: 939 - template: jinja +zeekcleanscript: + file.managed: + - name: /usr/local/bin/zeek_clean + - source: salt://zeek/cron/zeek_clean + - mode: 755 + +/usr/local/bin/zeek_clean: + cron.present: + - user: root + - minute: '*' + - hour: '*' + - daymonth: '*' + - month: '*' + - dayweek: '*' + plcronscript: file.managed: - name: /usr/local/bin/packetloss.sh