CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 18:22:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add firewall listhogroups and listportgroups commands; Change AMI test defaults to use a custom hostname for cypress access

Browse Source
This commit is contained in:
Jason Ertel
2020-12-22 17:59:59 -05:00
parent f6a199156b
commit cfe5019f51
2 changed files with 108 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

150
salt/common/tools/sbin/so-firewall
View File

@@ -21,25 +21,33 @@ import yaml
hostgroupsFilename = "/opt/so/saltstack/local/salt/firewall/hostgroups.local.yaml" hostgroupsFilename = "/opt/so/saltstack/local/salt/firewall/hostgroups.local.yaml"
portgroupsFilename = "/opt/so/saltstack/local/salt/firewall/portgroups.local.yaml" portgroupsFilename = "/opt/so/saltstack/local/salt/firewall/portgroups.local.yaml"
defaultPortgroupsFilename = "/opt/so/saltstack/default/salt/firewall/portgroups.yaml"
supportedProtocols = ['tcp', 'udp'] supportedProtocols = ['tcp', 'udp']
def showUsage(args): def showUsage(options, args):
print('Usage: {} [OPTIONS] <COMMAND> [ARGS...]'.format(sys.argv[0])) print('Usage: {} [OPTIONS] <COMMAND> [ARGS...]'.format(sys.argv[0]))
print(' Options:') print(' Options:')
print(' --apply - After updating the firewall configuration files, apply the new firewall state') print(' --apply - After updating the firewall configuration files, apply the new firewall state')
print(' --defaultports - Read port groups from default configuration files instead of local configuration.')
print('') print('')
print(' Available commands:') print(' General commands:')
print(' help - Prints this usage information.') print(' help - Prints this usage information.')
print(' includedhosts - Lists the IPs included in the given group. Args: <GROUP_NAME>') print('')
print(' excludedhosts - Lists the IPs excluded from the given group. Args: <GROUP_NAME>') print(' Host commands:')
print(' includehost - Includes the given IP in the given group. Args: <GROUP_NAME> <IP>') print(' listhostgroups - Lists the known host groups.')
print(' excludehost - Excludes the given IP from the given group. Args: <GROUP_NAME> <IP>') print(' includedhosts - Lists the IPs included in the given group. Args: <GROUP_NAME>')
print(' removehost - Removes an excluded IP from the given group. Args: <GROUP_NAME> <IP>') print(' excludedhosts - Lists the IPs excluded from the given group. Args: <GROUP_NAME>')
print(' addhostgroup - Adds a new, custom host group. Args: <GROUP_NAME>') print(' includehost - Includes the given IP in the given group. Args: <GROUP_NAME> <IP>')
print(' listports - Lists ports in the given group and protocol. Args: <GROUP_NAME> <PORT_PROTOCOL>') print(' excludehost - Excludes the given IP from the given group. Args: <GROUP_NAME> <IP>')
print(' addport - Adds a PORT to the given group. Args: <GROUP_NAME> <PORT_PROTOCOL> <PORT>') print(' removehost - Removes an excluded IP from the given group. Args: <GROUP_NAME> <IP>')
print(' removeport - Removes a PORT from the given group. Args: <GROUP_NAME> <PORT_PROTOCOL> <PORT>') print(' addhostgroup - Adds a new, custom host group. Args: <GROUP_NAME>')
print(' addportgroup - Adds a new, custom port group. Args: <GROUP_NAME>') print('')
print(' Port commands:')
print(' listportgroups - Lists the known port groups.')
print(' listports - Lists ports in the given group and protocol. Args: <GROUP_NAME> <PORT_PROTOCOL>')
print(' addport - Adds a PORT to the given group. Args: <GROUP_NAME> <PORT_PROTOCOL> <PORT>')
print(' removeport - Removes a PORT from the given group. Args: <GROUP_NAME> <PORT_PROTOCOL> <PORT>')
print(' addportgroup - Adds a new, custom port group. Args: <GROUP_NAME>')
print('') print('')
print(' Where:') print(' Where:')
print(' GROUP_NAME - The name of an alias group (Ex: analyst)') print(' GROUP_NAME - The name of an alias group (Ex: analyst)')
@@ -48,6 +56,15 @@ def showUsage(args):
print(' PORT - Either a single numeric port (Ex: 443), or a port range (Ex: 8000:8002).') print(' PORT - Either a single numeric port (Ex: 443), or a port range (Ex: 8000:8002).')
sys.exit(1) sys.exit(1)
def checkDefaultPortsOption(options):
global portgroupsFilename
if "--defaultports" in options:
portgroupsFilename = defaultPortgroupsFilename
def checkApplyOption(options):
if "--apply" in options:
return apply()
def loadYaml(filename): def loadYaml(filename):
file = open(filename, "r") file = open(filename, "r")
return yaml.load(file.read()) return yaml.load(file.read())
@@ -56,6 +73,14 @@ def writeYaml(filename, content):
file = open(filename, "w") file = open(filename, "w")
return yaml.dump(content, file) return yaml.dump(content, file)
def listHostGroups():
content = loadYaml(hostgroupsFilename)
hostgroups = content['firewall']['hostgroups']
if hostgroups is not None:
for group in hostgroups:
print(group)
return 0
def listIps(name, mode): def listIps(name, mode):
content = loadYaml(hostgroupsFilename) content = loadYaml(hostgroupsFilename)
if name not in content['firewall']['hostgroups']: if name not in content['firewall']['hostgroups']:
@@ -111,10 +136,18 @@ def createProtocolMap():
map[protocol] = [] map[protocol] = []
return map return map
def addhostgroup(args): def listPortGroups():
content = loadYaml(portgroupsFilename)
portgroups = content['firewall']['aliases']['ports']
if portgroups is not None:
for group in portgroups:
print(group)
return 0
def addhostgroup(options, args):
if len(args) != 1: if len(args) != 1:
print('Missing host group name argument', file=sys.stderr) print('Missing host group name argument', file=sys.stderr)
showUsage(args) showUsage(options, args)
name = args[0] name = args[0]
content = loadYaml(hostgroupsFilename) content = loadYaml(hostgroupsFilename)
@@ -125,10 +158,17 @@ def addhostgroup(args):
writeYaml(hostgroupsFilename, content) writeYaml(hostgroupsFilename, content)
return 0 return 0
def addportgroup(args): def listportgroups(options, args):
if len(args) != 0:
print('Unexpected arguments', file=sys.stderr)
showUsage(options, args)
checkDefaultPortsOption(options)
return listPortGroups()
def addportgroup(options, args):
if len(args) != 1: if len(args) != 1:
print('Missing port group name argument', file=sys.stderr) print('Missing port group name argument', file=sys.stderr)
showUsage(args) showUsage(options, args)
name = args[0] name = args[0]
content = loadYaml(portgroupsFilename) content = loadYaml(portgroupsFilename)
@@ -143,11 +183,12 @@ def addportgroup(args):
writeYaml(portgroupsFilename, content) writeYaml(portgroupsFilename, content)
return 0 return 0
def listports(args): def listports(options, args):
if len(args) != 2: if len(args) != 2:
print('Missing port group name or port protocol', file=sys.stderr) print('Missing port group name or port protocol', file=sys.stderr)
showUsage(args) showUsage(options, args)
checkDefaultPortsOption(options)
name = args[0] name = args[0]
protocol = args[1] protocol = args[1]
if protocol not in supportedProtocols: if protocol not in supportedProtocols:
@@ -162,16 +203,19 @@ def listports(args):
if name not in ports: if name not in ports:
print('Port group does not exist', file=sys.stderr) print('Port group does not exist', file=sys.stderr)
return 3 return 3
if protocol not in ports[name]:
print('Port group does not contain protocol', file=sys.stderr)
return 3
ports = ports[name][protocol] ports = ports[name][protocol]
if ports is not None: if ports is not None:
for port in ports: for port in ports:
print(port) print(port)
return 0 return 0
def addport(args): def addport(options, args):
if len(args) != 3: if len(args) != 3:
print('Missing port group name or port protocol, or port argument', file=sys.stderr) print('Missing port group name or port protocol, or port argument', file=sys.stderr)
showUsage(args) showUsage(options, args)
name = args[0] name = args[0]
protocol = args[1] protocol = args[1]
@@ -197,12 +241,13 @@ def addport(args):
return 3 return 3
ports.append(port) ports.append(port)
writeYaml(portgroupsFilename, content) writeYaml(portgroupsFilename, content)
return 0 code = checkApplyOption(options)
return code
def removeport(args): def removeport(options, args):
if len(args) != 3: if len(args) != 3:
print('Missing port group name or port protocol, or port argument', file=sys.stderr) print('Missing port group name or port protocol, or port argument', file=sys.stderr)
showUsage(args) showUsage(options, args)
name = args[0] name = args[0]
protocol = args[1] protocol = args[1]
@@ -225,43 +270,60 @@ def removeport(args):
return 3 return 3
ports.remove(port) ports.remove(port)
writeYaml(portgroupsFilename, content) writeYaml(portgroupsFilename, content)
return 0 code = checkApplyOption(options)
return code
def includedhosts(args):
def listhostgroups(options, args):
if len(args) != 0:
print('Unexpected arguments', file=sys.stderr)
showUsage(options, args)
return listHostGroups()
def includedhosts(options, args):
if len(args) != 1: if len(args) != 1:
print('Missing host group name argument', file=sys.stderr) print('Missing host group name argument', file=sys.stderr)
showUsage(args) showUsage(options, args)
return listIps(args[0], 'insert') return listIps(args[0], 'insert')
def excludedhosts(args): def excludedhosts(options, args):
if len(args) != 1: if len(args) != 1:
print('Missing host group name argument', file=sys.stderr) print('Missing host group name argument', file=sys.stderr)
showUsage(args) showUsage(options, args)
return listIps(args[0], 'delete') return listIps(args[0], 'delete')
def includehost(args): def includehost(options, args):
if len(args) != 2: if len(args) != 2:
print('Missing host group name or ip argument', file=sys.stderr) print('Missing host group name or ip argument', file=sys.stderr)
showUsage(args) showUsage(options, args)
result = addIp(args[0], args[1], 'insert') result = addIp(args[0], args[1], 'insert')
if result == 0: if result == 0:
removeIp(args[0], args[1], 'delete', True) removeIp(args[0], args[1], 'delete', True)
return result code = result
if code == 0:
code = checkApplyOption(options)
return code
def excludehost(args): def excludehost(options, args):
if len(args) != 2: if len(args) != 2:
print('Missing host group name or ip argument', file=sys.stderr) print('Missing host group name or ip argument', file=sys.stderr)
showUsage(args) showUsage(options, args)
result = addIp(args[0], args[1], 'delete') result = addIp(args[0], args[1], 'delete')
if result == 0: if result == 0:
removeIp(args[0], args[1], 'insert', True) removeIp(args[0], args[1], 'insert', True)
return result code = result
if code == 0:
code = checkApplyOption(options)
return code
def removehost(args): def removehost(options, args):
if len(args) != 2: if len(args) != 2:
print('Missing host group name or ip argument', file=sys.stderr) print('Missing host group name or ip argument', file=sys.stderr)
showUsage(args) showUsage(options, args)
return removeIp(args[0], args[1], 'delete') code = removeIp(args[0], args[1], 'delete')
if code == 0:
code = checkApplyOption(options)
return code
def apply(): def apply():
proc = subprocess.run(['salt-call', 'state.apply', 'firewall', 'queue=True']) proc = subprocess.run(['salt-call', 'state.apply', 'firewall', 'queue=True'])
@@ -276,15 +338,17 @@ def main():
args.remove(option) args.remove(option)
if len(args) == 0: if len(args) == 0:
showUsage(None) showUsage(options, None)
commands = { commands = {
"help": showUsage, "help": showUsage,
"listhostgroups": listhostgroups,
"includedhosts": includedhosts, "includedhosts": includedhosts,
"excludedhosts": excludedhosts, "excludedhosts": excludedhosts,
"includehost": includehost, "includehost": includehost,
"excludehost": excludehost, "excludehost": excludehost,
"removehost": removehost, "removehost": removehost,
"listportgroups": listportgroups,
"listports": listports, "listports": listports,
"addport": addport, "addport": addport,
"removeport": removeport, "removeport": removeport,
@@ -293,11 +357,7 @@ def main():
} }
cmd = commands.get(args[0], showUsage) cmd = commands.get(args[0], showUsage)
code = cmd(args[1:]) code = cmd(options, args[1:])
if code == 0 and "--apply" in options:
code = apply()
sys.exit(code) sys.exit(code)

4
setup/automation/aws_standalone_defaults
View File

@@ -62,8 +62,8 @@ OSQUERY=1
# PATCHSCHEDULEHOURS= # PATCHSCHEDULEHOURS=
PATCHSCHEDULENAME=auto PATCHSCHEDULENAME=auto
PLAYBOOK=1 PLAYBOOK=1
# REDIRECTHOST= REDIRECTHOST=securityonion
REDIRECTINFO=HOSTNAME REDIRECTINFO=OTHER
RULESETUP=ETOPEN RULESETUP=ETOPEN
# SHARDCOUNT= # SHARDCOUNT=
SKIP_REBOOT=0 SKIP_REBOOT=0