From a37f0fd0c0e5ea8b7c50e752310477247ca37d4b Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Fri, 3 Feb 2023 10:07:07 -0500 Subject: [PATCH] rename sosbridge to sobridge --- salt/curator/init.sls | 2 +- salt/docker/init.sls | 6 ++--- salt/elastalert/init.sls | 2 +- salt/elastic-fleet-package-registry/init.sls | 2 +- salt/elastic-fleet/init.sls | 2 +- salt/elasticsearch/init.sls | 2 +- salt/filebeat/init.sls | 2 +- salt/firewall/iptables.jinja | 26 ++++++++++---------- salt/grafana/init.sls | 2 +- salt/idstools/init.sls | 2 +- salt/influxdb/init.sls | 2 +- salt/kibana/init.sls | 2 +- salt/kratos/init.sls | 2 +- salt/logstash/init.sls | 2 +- salt/mysql/init.sls | 2 +- salt/nginx/init.sls | 2 +- salt/playbook/init.sls | 2 +- salt/redis/init.sls | 2 +- salt/registry/init.sls | 2 +- salt/soc/init.sls | 2 +- salt/soctopus/init.sls | 2 +- salt/strelka/init.sls | 12 ++++----- 22 files changed, 41 insertions(+), 41 deletions(-) diff --git a/salt/curator/init.sls b/salt/curator/init.sls index 293475187..e62304bce 100644 --- a/salt/curator/init.sls +++ b/salt/curator/init.sls @@ -130,7 +130,7 @@ so-curator: - name: so-curator - user: curator - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-curator'].ip }} - interactive: True - tty: True diff --git a/salt/docker/init.sls b/salt/docker/init.sls index 405a75938..687836aef 100644 --- a/salt/docker/init.sls +++ b/salt/docker/init.sls @@ -79,13 +79,13 @@ dockerreserveports: sos_docker_net: docker_network.present: - - name: sosbridge + - name: sobridge - subnet: {{ DOCKER.sosrange }} - gateway: {{ DOCKER.sosbip }} - options: - com.docker.network.bridge.name: 'sosbridge' + com.docker.network.bridge.name: 'sobridge' com.docker.network.driver.mtu: '1500' com.docker.network.bridge.enable_ip_masquerade: 'true' com.docker.network.bridge.enable_icc: 'true' com.docker.network.bridge.host_binding_ipv4: '0.0.0.0' - - unless: 'docker network ls | grep sosbridge' + - unless: 'docker network ls | grep sobridge' diff --git a/salt/elastalert/init.sls b/salt/elastalert/init.sls index 1db789935..37d749223 100644 --- a/salt/elastalert/init.sls +++ b/salt/elastalert/init.sls @@ -88,7 +88,7 @@ so-elastalert: - name: so-elastalert - user: so-elastalert - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-elastalert'].ip }} - detach: True - binds: diff --git a/salt/elastic-fleet-package-registry/init.sls b/salt/elastic-fleet-package-registry/init.sls index 2a72a417d..b4cea6542 100644 --- a/salt/elastic-fleet-package-registry/init.sls +++ b/salt/elastic-fleet-package-registry/init.sls @@ -29,7 +29,7 @@ so-elastic-fleet-package-registry: - detach: True - user: 948 - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-elastic-fleet-package-registry'].ip }} - extra_hosts: - {{ GLOBALS.hostname }}:{{ GLOBALS.node_ip }} diff --git a/salt/elastic-fleet/init.sls b/salt/elastic-fleet/init.sls index 1460fda38..be9bac96e 100644 --- a/salt/elastic-fleet/init.sls +++ b/salt/elastic-fleet/init.sls @@ -49,7 +49,7 @@ so-elastic-fleet: - detach: True - user: 947 - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-elastic-fleet'].ip }} - extra_hosts: - {{ GLOBALS.hostname }}:{{ GLOBALS.node_ip }} diff --git a/salt/elasticsearch/init.sls b/salt/elasticsearch/init.sls index 857a3a558..43e8d9f72 100644 --- a/salt/elasticsearch/init.sls +++ b/salt/elasticsearch/init.sls @@ -291,7 +291,7 @@ so-elasticsearch: - name: so-elasticsearch - user: elasticsearch - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-elasticsearch'].ip }} - extra_hosts: {{ LOGSTASH_NODES }} - environment: diff --git a/salt/filebeat/init.sls b/salt/filebeat/init.sls index 0bb1eaf34..988807f82 100644 --- a/salt/filebeat/init.sls +++ b/salt/filebeat/init.sls @@ -99,7 +99,7 @@ so-filebeat: - hostname: so-filebeat - user: root - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-filebeat'].ip }} - extra_hosts: {{ FILEBEAT_EXTRA_HOSTS }} - binds: diff --git a/salt/firewall/iptables.jinja b/salt/firewall/iptables.jinja index 77f6ef012..fe40b69a9 100644 --- a/salt/firewall/iptables.jinja +++ b/salt/firewall/iptables.jinja @@ -33,11 +33,11 @@ {%- endif %} {%- do PR.append("-A POSTROUTING -s " ~ DOCKER.containers[container].ip ~ "/32 -d " ~ DOCKER.containers[container].ip ~ "/32 -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ containerPort ~ " -j MASQUERADE") %} {%- if bindip | length and bindip != '0.0.0.0' %} -{%- do D1.append("-A DOCKER -d " ~ bindip ~ "/32 ! -i sosbridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ hostPort ~ " -j DNAT --to-destination " ~ DOCKER.containers[container].ip ~ ":" ~ containerPort) %} +{%- do D1.append("-A DOCKER -d " ~ bindip ~ "/32 ! -i sobridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ hostPort ~ " -j DNAT --to-destination " ~ DOCKER.containers[container].ip ~ ":" ~ containerPort) %} {%- else %} -{%- do D1.append("-A DOCKER ! -i sosbridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ hostPort ~ " -j DNAT --to-destination " ~ DOCKER.containers[container].ip ~ ":" ~ containerPort) %} +{%- do D1.append("-A DOCKER ! -i sobridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ hostPort ~ " -j DNAT --to-destination " ~ DOCKER.containers[container].ip ~ ":" ~ containerPort) %} {%- endif %} -{%- do D2.append("-A DOCKER -d " ~ DOCKER.containers[container].ip ~ "/32 ! -i sosbridge -o sosbridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ containerPort ~ " -j ACCEPT") %} +{%- do D2.append("-A DOCKER -d " ~ DOCKER.containers[container].ip ~ "/32 ! -i sobridge -o sobridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ containerPort ~ " -j ACCEPT") %} {%- endfor %} {%- endif %} {%- endfor %} @@ -50,11 +50,11 @@ :DOCKER - [0:0] -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER --A POSTROUTING -s {{DOCKER.sosrange}} ! -o sosbridge -j MASQUERADE +-A POSTROUTING -s {{DOCKER.sosrange}} ! -o sobridge -j MASQUERADE {%- for rule in PR %} {{ rule }} {%- endfor %} --A DOCKER -i sosbridge -j RETURN +-A DOCKER -i sobridge -j RETURN {%- for rule in D1 %} {{ rule }} {%- endfor %} @@ -98,10 +98,10 @@ COMMIT -A INPUT -j LOGGING -A FORWARD -j DOCKER-USER -A FORWARD -j DOCKER-ISOLATION-STAGE-1 --A FORWARD -o sosbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT --A FORWARD -o sosbridge -j DOCKER --A FORWARD -i sosbridge ! -o sosbridge -j ACCEPT --A FORWARD -i sosbridge -o sosbridge -j ACCEPT +-A FORWARD -o sobridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A FORWARD -o sobridge -j DOCKER +-A FORWARD -i sobridge ! -o sobridge -j ACCEPT +-A FORWARD -i sobridge -o sobridge -j ACCEPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i lo -j ACCEPT -A FORWARD -m conntrack --ctstate INVALID -j DROP @@ -113,12 +113,12 @@ COMMIT {{ rule }} {%- endfor %} --A DOCKER-ISOLATION-STAGE-1 -i sosbridge ! -o sosbridge -j DOCKER-ISOLATION-STAGE-2 +-A DOCKER-ISOLATION-STAGE-1 -i sobridge ! -o sobridge -j DOCKER-ISOLATION-STAGE-2 -A DOCKER-ISOLATION-STAGE-1 -j RETURN --A DOCKER-ISOLATION-STAGE-2 -o sosbridge -j DROP +-A DOCKER-ISOLATION-STAGE-2 -o sobridge -j DROP -A DOCKER-ISOLATION-STAGE-2 -j RETURN --A DOCKER-USER ! -i sosbridge -o sosbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT --A DOCKER-USER ! -i sosbridge -o sosbridge -j LOGGING +-A DOCKER-USER ! -i sobridge -o sobridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-USER ! -i sobridge -o sobridge -j LOGGING -A DOCKER-USER -j RETURN -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-dropped: " -A LOGGING -j DROP diff --git a/salt/grafana/init.sls b/salt/grafana/init.sls index 90bce30c6..1c5f30d5b 100644 --- a/salt/grafana/init.sls +++ b/salt/grafana/init.sls @@ -126,7 +126,7 @@ so-grafana: - hostname: grafana - user: socore - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-grafana'].ip }} - extra_hosts: - {{GLOBALS.influxdb_host}}:{{pillar.node_data[GLOBALS.influxdb_host].ip}} diff --git a/salt/idstools/init.sls b/salt/idstools/init.sls index 490cea3f7..78f6c2735 100644 --- a/salt/idstools/init.sls +++ b/salt/idstools/init.sls @@ -33,7 +33,7 @@ so-idstools: - hostname: so-idstools - user: socore - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-idstools'].ip }} {% if proxy %} - environment: diff --git a/salt/influxdb/init.sls b/salt/influxdb/init.sls index 1758f17ae..4fe625209 100644 --- a/salt/influxdb/init.sls +++ b/salt/influxdb/init.sls @@ -49,7 +49,7 @@ so-influxdb: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-influxdb:{{ GLOBALS.so_version }} - hostname: influxdb - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-influxdb'].ip }} - environment: - INFLUXDB_HTTP_LOG_ENABLED=false diff --git a/salt/kibana/init.sls b/salt/kibana/init.sls index c4222b0a3..19682e105 100644 --- a/salt/kibana/init.sls +++ b/salt/kibana/init.sls @@ -83,7 +83,7 @@ so-kibana: - hostname: kibana - user: kibana - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-kibana'].ip }} - environment: - ELASTICSEARCH_HOST={{ GLOBALS.manager }} diff --git a/salt/kratos/init.sls b/salt/kratos/init.sls index ef77951d9..c52ae15f8 100644 --- a/salt/kratos/init.sls +++ b/salt/kratos/init.sls @@ -69,7 +69,7 @@ so-kratos: - hostname: kratos - name: so-kratos - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-kratos'].ip }} - binds: - /opt/so/conf/kratos/schema.json:/kratos-conf/schema.json:ro diff --git a/salt/logstash/init.sls b/salt/logstash/init.sls index 05b184239..1b4aeb334 100644 --- a/salt/logstash/init.sls +++ b/salt/logstash/init.sls @@ -140,7 +140,7 @@ so-logstash: - hostname: so-logstash - name: so-logstash - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-logstash'].ip }} - user: logstash - extra_hosts: {{ REDIS_NODES }} diff --git a/salt/mysql/init.sls b/salt/mysql/init.sls index ebb9b09e7..b2c4a2119 100644 --- a/salt/mysql/init.sls +++ b/salt/mysql/init.sls @@ -85,7 +85,7 @@ so-mysql: - hostname: so-mysql - user: socore - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-mysql'].ip }} - port_bindings: {% for BINDING in DOCKER.containers['so-mysql'].port_bindings %} diff --git a/salt/nginx/init.sls b/salt/nginx/init.sls index 6547732df..eac0e9ac8 100644 --- a/salt/nginx/init.sls +++ b/salt/nginx/init.sls @@ -85,7 +85,7 @@ so-nginx: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-nginx:{{ GLOBALS.so_version }} - hostname: so-nginx - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-nginx'].ip }} - binds: - /opt/so/conf/nginx/nginx.conf:/etc/nginx/nginx.conf:ro diff --git a/salt/playbook/init.sls b/salt/playbook/init.sls index 237cc398b..799f46099 100644 --- a/salt/playbook/init.sls +++ b/salt/playbook/init.sls @@ -81,7 +81,7 @@ so-playbook: - hostname: playbook - name: so-playbook - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-playbook'].ip }} - binds: - /opt/so/log/playbook:/playbook/log:rw diff --git a/salt/redis/init.sls b/salt/redis/init.sls index dce00bd8b..ebaad842b 100644 --- a/salt/redis/init.sls +++ b/salt/redis/init.sls @@ -47,7 +47,7 @@ so-redis: - hostname: so-redis - user: socore - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-redis'].ip }} - port_bindings: {% for BINDING in DOCKER.containers['so-redis'].port_bindings %} diff --git a/salt/registry/init.sls b/salt/registry/init.sls index 321b1c3d2..428cfd81d 100644 --- a/salt/registry/init.sls +++ b/salt/registry/init.sls @@ -39,7 +39,7 @@ so-dockerregistry: - image: ghcr.io/security-onion-solutions/registry:latest - hostname: so-registry - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-dockerregistry'].ip }} - restart_policy: always - port_bindings: diff --git a/salt/soc/init.sls b/salt/soc/init.sls index 3c1000dee..502b47136 100644 --- a/salt/soc/init.sls +++ b/salt/soc/init.sls @@ -97,7 +97,7 @@ so-soc: - hostname: soc - name: so-soc - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-soc'].ip }} - binds: - /nsm/soc/jobs:/opt/sensoroni/jobs:rw diff --git a/salt/soctopus/init.sls b/salt/soctopus/init.sls index 5097ea112..fe9cb6d60 100644 --- a/salt/soctopus/init.sls +++ b/salt/soctopus/init.sls @@ -64,7 +64,7 @@ so-soctopus: - hostname: soctopus - name: so-soctopus - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-soctopus'].ip }} - binds: - /opt/so/conf/soctopus/SOCtopus.conf:/SOCtopus/SOCtopus.conf:ro diff --git a/salt/strelka/init.sls b/salt/strelka/init.sls index 76fdce509..796533c2d 100644 --- a/salt/strelka/init.sls +++ b/salt/strelka/init.sls @@ -169,7 +169,7 @@ strelka_coordinator: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-redis:{{ GLOBALS.so_version }} - name: so-strelka-coordinator - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-strelka-coordinator'].ip }} - entrypoint: redis-server --save "" --appendonly no - port_bindings: @@ -187,7 +187,7 @@ strelka_gatekeeper: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-redis:{{ GLOBALS.so_version }} - name: so-strelka-gatekeeper - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-strelka-gatekeeper'].ip }} - entrypoint: redis-server --save "" --appendonly no --maxmemory-policy allkeys-lru - port_bindings: @@ -209,7 +209,7 @@ strelka_frontend: - privileged: True - name: so-strelka-frontend - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-strelka-frontend'].ip }} - command: strelka-frontend - port_bindings: @@ -230,7 +230,7 @@ strelka_backend: - /opt/so/conf/strelka/rules/:/etc/yara/:ro - name: so-strelka-backend - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-strelka-backend'].ip }} - command: strelka-backend - restart_policy: on-failure @@ -247,7 +247,7 @@ strelka_manager: - /opt/so/conf/strelka/manager/:/etc/strelka/:ro - name: so-strelka-manager - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-strelka-manager'].ip }} - command: strelka-manager @@ -264,7 +264,7 @@ strelka_filestream: - /nsm/strelka:/nsm/strelka - name: so-strelka-filestream - networks: - - sosbridge: + - sobridge: - ipv4_address: {{ DOCKER.containers['so-strelka-filestream'].ip }} - command: strelka-filestream