mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-09-20 14:49:38 +02:00
Mike Reeves
cf3a4ebc27
The Kratos admin API is unauthenticated by design and relies on network isolation, but so-kratos published 0.0.0.0:4434:4434 and daemon.json leaves userland-proxy at its default of true. Docker therefore ran a proxy listener on the host, and any container reached the admin API through the manager IP or the bridge gateway regardless of its docker network. so-kratos now sits alone on a new soauth network and no longer publishes 4434. 4433 is still published, so nginx is unchanged. so-soc is dual homed and reaches the admin API over soauth, with publicHostUrl set explicitly. so-user reaches it through docker exec, and wait_for_kratos polls the container address instead of the host port. firewall/iptables.jinja hardcoded sobridge in every generated DNAT, ACCEPT, masquerade and isolation rule, so it is now driven by a docker:networks map and a per-container networks list. Containers that do not declare one default to sobridge, and .ip still resolves to the primary network's address. soauth is only created on the roles that run so-kratos. Setup already allows a custom docker range, so it now also prompts for the auth network range and writes it to the docker pillar. Grids on the default range need no decision during soup, since they get the same 172.17.2.0/24 a fresh install would. Grids that set a custom range are prompted, defaulting to the adjacent /24, and unattended upgrades take that default with a notice rather than blocking. so-kratos and so-soc are removed in up_to_3.4.0 so the highstate recreates them with the correct network membership.
90 lines
2.6 KiB
YAML+Jinja
90 lines
2.6 KiB
YAML+Jinja
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
{% from 'docker/docker.map.jinja' import DOCKERMERGED %}
|
|
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
|
|
|
# docker service requires the ca.crt
|
|
include:
|
|
- ca
|
|
|
|
dockergroup:
|
|
group.present:
|
|
- name: docker
|
|
- gid: 920
|
|
|
|
dockerheldpackages:
|
|
pkg.installed:
|
|
- pkgs:
|
|
- containerd.io: 2.2.1-1.el9
|
|
- docker-ce: 3:29.2.1-1.el9
|
|
- docker-ce-cli: 1:29.2.1-1.el9
|
|
- docker-ce-rootless-extras: 29.2.1-1.el9
|
|
- hold: True
|
|
- update_holds: True
|
|
|
|
#disable docker from managing iptables
|
|
iptables_disabled:
|
|
file.managed:
|
|
- name: /etc/systemd/system/docker.service.d/iptables-disabled.conf
|
|
- source: salt://docker/files/iptables-disabled.conf
|
|
- makedirs: True
|
|
cmd.run:
|
|
- name: systemctl daemon-reload
|
|
- onchanges:
|
|
- file: iptables_disabled
|
|
|
|
# Make sure etc/docker exists
|
|
dockeretc:
|
|
file.directory:
|
|
- name: /etc/docker
|
|
|
|
docker_daemon:
|
|
file.managed:
|
|
- source: salt://docker/files/daemon.json.jinja
|
|
- name: /etc/docker/daemon.json
|
|
- template: jinja
|
|
|
|
# Make sure Docker is always running
|
|
docker_running:
|
|
service.running:
|
|
- name: docker
|
|
- enable: True
|
|
- watch:
|
|
- file: docker_daemon
|
|
- require:
|
|
- file: docker_daemon
|
|
- file: trusttheca
|
|
|
|
|
|
# Reserve OS ports for Docker proxy in case boot settings are not already applied/present
|
|
# 57314 = Strelka, 47760-47860 = Zeek
|
|
dockerapplyports:
|
|
cmd.run:
|
|
- name: if [ ! -s /etc/sysctl.d/99-reserved-ports.conf ]; then sysctl -w net.ipv4.ip_local_reserved_ports="57314,47760-47860"; fi
|
|
|
|
# Reserve OS ports for Docker proxy
|
|
dockerreserveports:
|
|
file.managed:
|
|
- source: salt://common/files/99-reserved-ports.conf
|
|
- name: /etc/sysctl.d/99-reserved-ports.conf
|
|
|
|
{% for NETNAME, NETWORK in DOCKERMERGED.networks.items() %}
|
|
{% if not NETWORK.get('manager_only') or GLOBALS.get('is_manager', False) %}
|
|
sos_docker_net_{{ NETNAME }}:
|
|
docker_network.present:
|
|
- name: {{ NETNAME }}
|
|
- subnet: {{ NETWORK.range }}
|
|
- gateway: {{ NETWORK.gateway }}
|
|
- options:
|
|
com.docker.network.bridge.name: '{{ NETNAME }}'
|
|
com.docker.network.driver.mtu: '1500'
|
|
com.docker.network.bridge.enable_ip_masquerade: 'true'
|
|
com.docker.network.bridge.enable_icc: 'true'
|
|
com.docker.network.bridge.host_binding_ipv4: '0.0.0.0'
|
|
- unless: ip l | grep {{ NETNAME }}
|
|
{% endif %}
|
|
{% endfor %}
|