CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-09-30 03:27:18 +02:00
Code Issues Packages Projects Releases Wiki Activity
18,722 Commits 47 Branches 130 Tags
65e261475d4d35fd52ed01ac6111dd900c69c5ac
Commit Graph
17 Commits
Author SHA1 Message Date
Mike Reeves cf3a4ebc27 Isolate the Kratos admin API on a dedicated soauth docker network 
The Kratos admin API is unauthenticated by design and relies on network
isolation, but so-kratos published 0.0.0.0:4434:4434 and daemon.json leaves
userland-proxy at its default of true. Docker therefore ran a proxy listener
on the host, and any container reached the admin API through the manager IP
or the bridge gateway regardless of its docker network.

so-kratos now sits alone on a new soauth network and no longer publishes
4434. 4433 is still published, so nginx is unchanged. so-soc is dual homed
and reaches the admin API over soauth, with publicHostUrl set explicitly.
so-user reaches it through docker exec, and wait_for_kratos polls the
container address instead of the host port.

firewall/iptables.jinja hardcoded sobridge in every generated DNAT, ACCEPT,
masquerade and isolation rule, so it is now driven by a docker:networks map
and a per-container networks list. Containers that do not declare one
default to sobridge, and .ip still resolves to the primary network's
address. soauth is only created on the roles that run so-kratos.

Setup already allows a custom docker range, so it now also prompts for the
auth network range and writes it to the docker pillar. Grids on the default
range need no decision during soup, since they get the same 172.17.2.0/24 a
fresh install would. Grids that set a custom range are prompted, defaulting
to the adjacent /24, and unattended upgrades take that default with a notice
rather than blocking.

so-kratos and so-soc are removed in up_to_3.4.0 so the highstate recreates
them with the correct network membership.
 2026-09-09 16:09:00 -04:00
Josh Patterson e775299480 so-user target minions with pillar elasticsearch:enabled:true 2025-09-26 15:43:49 -04:00
Jason Ertel 5ecb483596 excluded harmless log error; suppress so-user grep output 2025-04-29 09:35:36 -04:00
Jason Ertel bd96b5d722 invalidate user sessions when an admin changes the user's password 2025-01-06 17:23:10 -05:00
Jason Ertel e8ab7bce0c connect 2024-11-04 10:49:30 -05:00
Jason Ertel 825dbb36dd connect 2024-11-01 15:37:59 -04:00
Jason Ertel 7c405ff9d7 connect 2024-10-24 08:47:52 -04:00
Jason Ertel 5e6dd2e8b3 connect 2024-10-23 16:49:02 -04:00
Jason Ertel 073fb16e20 lowercase email when looking up ID; allow uppercase emails when modifying existing users but not when adding new users 2024-09-25 10:26:26 -04:00
Jason Ertel ebcef8adbd fix issue with reset pw and mfa 2024-08-12 13:35:06 -04:00
Jason Ertel 9f17bd2255 lks/fps 2024-01-24 11:17:32 -05:00
Jason Ertel aa36e9a785 oidc 2023-07-27 08:40:27 -04:00
Jason Ertel 6d56deb2e4 oidc 1 2023-07-25 08:12:45 -04:00
Jason Ertel 21a7b76352 webauthn 2023-06-14 13:33:31 -04:00
Mike Reeves f6dcefe0f8 Update so-user 2023-05-05 09:34:33 -04:00
Mike Reeves d5a1406095 Update so-user 2023-05-05 09:15:52 -04:00
Mike Reeves e60e21d9ff Move files out of common 2023-05-02 09:40:02 -04:00