CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 01:32:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

implement selective rate limiting

Browse Source
This commit is contained in:
Jason Ertel
2023-05-08 12:18:46 -04:00
parent c6c3cc82e4
commit bd23d1ab7b
8 changed files with 34 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/nginx/defaults.yaml
View File

@@ -1,3 +1,5 @@
nginx: nginx:
config: config:
replace_cert: False replace_cert: False
throttle_login_burst: 6
throttle_login_rate: 10

23
salt/nginx/etc/nginx.conf
View File

@@ -33,6 +33,8 @@ http {
include /etc/nginx/mime.types; include /etc/nginx/mime.types;
default_type application/octet-stream; default_type application/octet-stream;
limit_req_zone $binary_remote_addr zone=auth_throttle:10m rate={{ NGMERGED.config.login_throttle_rate }}r/m;
include /etc/nginx/conf.d/*.conf; include /etc/nginx/conf.d/*.conf;
{%- if role in ['eval', 'managersearch', 'manager', 'standalone', 'import'] %} {%- if role in ['eval', 'managersearch', 'manager', 'standalone', 'import'] %}
@@ -143,7 +145,21 @@ http {
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
} }
location ~ ^/auth/.*?(whoami|login|logout|settings) { location ~ ^/auth/.*?(login) {
rewrite /auth/(.*) /$1 break;
limit_req zone=auth_throttle burst={{ NGMERGED.config.login_throttle_burst }} nodelay;
limit_req_status 429;
proxy_pass http://{{ GLOBALS.manager }}:4433;
proxy_read_timeout 90;
proxy_connect_timeout 90;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Proxy "";
proxy_set_header X-Forwarded-Proto $scheme;
}
location ~ ^/auth/.*?(whoami|logout|settings) {
rewrite /auth/(.*) /$1 break; rewrite /auth/(.*) /$1 break;
proxy_pass http://{{ GLOBALS.manager }}:4433; proxy_pass http://{{ GLOBALS.manager }}:4433;
proxy_read_timeout 90; proxy_read_timeout 90;
@@ -276,6 +292,7 @@ http {
error_page 401 = @error401; error_page 401 = @error401;
error_page 403 = @error403; error_page 403 = @error403;
error_page 429 = @error429;
location @error401 { location @error401 {
add_header Set-Cookie "AUTH_REDIRECT=$request_uri;Path=/;Max-Age=14400"; add_header Set-Cookie "AUTH_REDIRECT=$request_uri;Path=/;Max-Age=14400";
@@ -287,6 +304,10 @@ http {
return 302 /auth/self-service/login/browser; return 302 /auth/self-service/login/browser;
} }
location @error429 {
return 302 /login?thr={{ (120 / NGMERGED.config.login_throttle_rate) | round | int }};
}
error_page 500 502 503 504 /50x.html; error_page 500 502 503 504 /50x.html;
location = /usr/share/nginx/html/50x.html { location = /usr/share/nginx/html/50x.html {
} }

BIN
salt/nginx/html/favicon-16x16.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 948 B

BIN
salt/nginx/html/favicon-32x32.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 3.0 KiB

BIN
salt/nginx/html/favicon.ico
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 5.3 KiB

13
salt/nginx/html/index.html
View File

@@ -1,13 +0,0 @@
<!DOCTYPE html>
<html lang="en">
<head>
<title>Security Onion - Hybrid Hunter</title>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/png" href="favicon-32x32.png" sizes="32x32" />
<link rel="icon" type="image/png" href="favicon-16x16.png" sizes="16x16" />
</head>
<body>
Security Onion
</body>
</html>

1
salt/nginx/init.sls
View File

@@ -2,6 +2,7 @@
{% from 'allowed_states.map.jinja' import allowed_states %} {% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls in allowed_states %} {% if sls in allowed_states %}
{% from 'docker/docker.map.jinja' import DOCKER %} {% from 'docker/docker.map.jinja' import DOCKER %}
{% from 'nginx/config.map.jinja' import NGMERGED %}
include: include:
- ssl - ssl

8
salt/nginx/soc_nginx.yaml
View File

@@ -20,3 +20,11 @@ nginx:
advanced: True advanced: True
global: True global: True
helpLink: nginx.html helpLink: nginx.html
throttle_login_burst:
description: Number of login requests that can burst without triggering request throttling. Higher values allow more repeated login attempts. Values greater than zero are required in order to provide a usable login flow.
global: True
helpLink: nginx.html
throttle_login_rate:
description: Number of login requests per minute that can be processed without triggering a rate limit. Higher values allow more repeated login attempts. Requests are counted by unique client IP and averaged over time.
global: True
helpLink: nginx.html