CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-02-21 22:45:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

Formatting and add setting

Browse Source
This commit is contained in:
Mike Reeves
2024-09-09 18:39:19 -04:00
parent e7a7a8609a
commit eab7828bfe
4 changed files with 45 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
salt/nginx/defaults.yaml
View File

@@ -1,5 +1,6 @@
nginx: nginx:
enabled: False enabled: False
external_suricata: False
ssl: ssl:
replace_cert: False replace_cert: False
config: config:

3
salt/nginx/enabled.sls
View File

@@ -130,6 +130,9 @@ so-nginx:
- /opt/so/conf/navigator/config.json:/opt/socore/html/navigator/assets/config.json:ro - /opt/so/conf/navigator/config.json:/opt/socore/html/navigator/assets/config.json:ro
- /nsm/repo:/opt/socore/html/repo:ro - /nsm/repo:/opt/socore/html/repo:ro
- /nsm/rules:/nsm/rules:ro - /nsm/rules:/nsm/rules:ro
{% if NGINXMERGED.external_suricata %}
- /opt/so/rules/nids/suri:/surirules:ro
{% endif %}
{% endif %} {% endif %}
{% if DOCKER.containers[container_config].custom_bind_mounts %} {% if DOCKER.containers[container_config].custom_bind_mounts %}
{% for BIND in DOCKER.containers[container_config].custom_bind_mounts %} {% for BIND in DOCKER.containers[container_config].custom_bind_mounts %}

49
salt/nginx/etc/nginx.conf
View File

@@ -116,6 +116,29 @@ http {
autoindex_localtime on; autoindex_localtime on;
} }
} }
{%- if NGINXMERGED.external_suricata %}
server {
listen 7789 ssl http2;
server_name {{ GLOBALS.url_base }};
root /surirules;
location / {
allow all;
sendfile on;
sendfile_max_chunk 1m;
autoindex on;
autoindex_exact_size off;
autoindex_format html;
autoindex_localtime on;
ssl_certificate "/etc/pki/nginx/server.crt";
ssl_certificate_key "/etc/pki/nginx/server.key";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.2;
}
}
{%- endif %}
server { server {
listen 443 ssl http2; listen 443 ssl http2;
@@ -251,20 +274,20 @@ http {
proxy_cookie_path /api/ /influxdb/api/; proxy_cookie_path /api/ /influxdb/api/;
} }
location /app/dashboards/ { location /app/dashboards/ {
auth_request /auth/sessions/whoami; auth_request /auth/sessions/whoami;
rewrite /app/dashboards/(.*) /app/dashboards/$1 break; rewrite /app/dashboards/(.*) /app/dashboards/$1 break;
proxy_pass http://{{ GLOBALS.manager }}:5601/app/; proxy_pass http://{{ GLOBALS.manager }}:5601/app/;
proxy_read_timeout 300; proxy_read_timeout 300;
proxy_connect_timeout 300; proxy_connect_timeout 300;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Proxy ""; proxy_set_header Proxy "";
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
} }
location /kibana/ { location /kibana/ {
auth_request /auth/sessions/whoami; auth_request /auth/sessions/whoami;
rewrite /kibana/(.*) /$1 break; rewrite /kibana/(.*) /$1 break;
proxy_pass http://{{ GLOBALS.manager }}:5601/; proxy_pass http://{{ GLOBALS.manager }}:5601/;

5
salt/nginx/soc_nginx.yaml
View File

@@ -3,6 +3,11 @@ nginx:
description: You can enable or disable Nginx. description: You can enable or disable Nginx.
advanced: True advanced: True
helpLink: nginx.html helpLink: nginx.html
external_suricata:
description: Enable this to allow external access to Suricata Rulesets managed by Detections.
advanced: True
helplink: nginx.html
forcedType: bool
ssl: ssl:
replace_cert: replace_cert:
description: Enable this if you would like to replace the Security Onion Certificate with your own. description: Enable this if you would like to replace the Security Onion Certificate with your own.