[Feature Request] open-appsec-npm

[shedowe19]

Can you add open-appsec-npm this is new Secure Feature of NPM.

https://github.com/openappsec/open-appsec-npm
https://docs.openappsec.io/integrations/nginx-proxy-manager-integration
https://docs.openappsec.io/integrations/nginx-proxy-manager-integration/install-nginx-proxy-manager-with-open-appsec-managed-from-central-webui-saas
https://docs.openappsec.io/getting-started/using-the-advanced-machine-learning-model

[shedowe19]

https://github.com/openappsec/attachment

Here are the Building Process

Additional prerequisites for compiling against other NGINX Proxy Manager version

[Zoey2936]

Hello, if I understand it correctly, all requests will be handled externally, which would be a big No for me. Do you know if it is also possible to fully local host it?

[shedowe19]

https://docs.openappsec.io/integrations/nginx-proxy-manager-integration/install-nginx-proxy-manager-with-open-appsec-managed-from-npm-webui

Here are all Local ^^ and appsec can be integrated

[shedowe19]

https://github.com/openappsec/open-appsec-npm

And here are a list of Building Process for another Nginx Proxy manager version in the Readme

[Zoey2936]

they are copying binaries, where I'm not sure about if they are opensource: https://github.com/openappsec/open-appsec-npm/tree/main/docker/lib

[shedowe19]

https://github.com/openappsec/open-appsec-npm/blob/main/LICENSE

You can use this to Contribute or Comercial Use

[shedowe19]

This are WAF Files this is Open Source

[shedowe19]

And this Files are modified versions for opensec and have no Limitations

[Zoey2936]

I will see if I can compile it myself and how it needs to be configured, but if you want NPM with a good appsec ui, you should stay with appsecs fork

[shedowe19]

Thats very nicee Thanks, no i use your Repo generally.

[shedowe19]

Hii @Zoey2936 have you test it?

[Zoey2936]

not yeet

[Zoey2936]

will take some time, sorry

[shedowe19]

OkaY i hope this will add soon

[shedowe19]

Hii @Zoey2936 have you test it recently?

[Zoey2936]

still no time for this, sorry

[stathismes]

Hi I have used openappsec nginx fork, and it's pretty good for security, it works amazingly well. Your fork however @Zoey2936 is so much better. It really gives NPM some of the most important functionality that's missing from the main jc21 project. I would very like to have the ability to integrate the openappsec into your fork as well, and I believe your fork would take off like crazy! Can't imagine any better NPM instance at this point other than yours. I'd like to compile this as well but I'm not a developer.

I really hope you can test on your own and see the openappsec for what it is :) It's such great security for homelabbers.

[yurividal]

+1 for openappsec. It would be awesome if this image could integrate npm with oppenappsec and crowdsec.

ModSecurity is EOL, and openappsec is the future.

Please, @Zoey2936 consider this 🙂

[Zoey2936]

yes, but it takes some time, but why is modsecurity eol? the last commit was 5 days ago and the last release 4 months ago

[yurividal]

yes, but it takes some time, but why is modsecurity eol? the last commit was 5 days ago and the last release 4 months ago

https://www.f5.com/company/blog/nginx/f5-nginx-modsecurity-waf-transitioning-to-eol

[Zoey2936]

yes it was planned to go eol, but this never happened: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trustwave-transfers-modsecurity-custodianship-to-the-open-worldwide-application-security-project/ https://owasp.org/blog/2024/01/09/ModSecurity.html

[Zoey2936]

I got attachment compiled into nginx, now I only need to find out how to configure it

[Zoey2936]

(it seems like no configuration from npmplus is needed, beside loading the nginx module, and everything else is handled by the openappsec container? and both are communicating via ipc?)

[shedowe19]

https://github.com/openappsec/open-appsec-npm?tab=readme-ov-file#additional-prerequisites-for-compiling-against-other-nginx-proxy-manager-version

And the answer from the Developer:

if you would like to protect your NPMplus with open-appsec WAF already today, here's what you can do:
Compile the open-appsec "attachment" yourself, add it to your NPMplus container and do a slight adjustment to the NGINX configuration to have NGINX load that open-appsec "attachment" module. Here you find the relevant Github repo for the open-appsec attachment: https://github.com/openappsec/attachment

Configuration can then be done either locally using open-appsec's local, declarative configuration file or centrally using open-appsec's central management WebUI (SaaS), whatever you prefer.

[Zoey2936]

so I everything I now need to do is to add this line to the compose.yaml# ipc: host # uncomment if you want to use openappsec and I need to add an env to load the openappsec nginx module, and everything else need to be configured by the user, since configuration happens outside npmplus

[Zoey2936]

It seems to be only this, maybe I will add something in the readme for the appsec x crowdsec part, but then everything should be done, release could maybe happen already tomorrow (And I'm a she not a he, because of openappsec/openappsec#218, just want to mention that)

[shedowe19]

Any new Information? Currently its not Available.

[Zoey2936]

I'm thinking how I want to do it, either I write a full guide, which can be outdated fast, or I link to the documentation of openappsec, which is not the best in my opinion and will lead to many questions. But I will add the required env now, so you can test it using the develop tag and report back if it worked for you, if you want

[Zoey2936]

I've added the env option and added documentation to the compose.yaml

[stathismes]

Is this correct? I mean, is it encoded as ATTCHMENT instead of ATTACHMENT?

[Zoey2936]

thanks for the hint, will be changed

[shedowe19]

It worked!

[Zoey2936]

Thanks for testing, did you use the examples from the compose file and if yes did you used all containers or did you use their webui?

I want to change some small other things, but I think a release could happen on Thursday

[Zoey2936]

release will take longer because of: https://gitlab.alpinelinux.org/alpine/aports/-/issues/16864

[Zoey2936]

got build fixed, but release will take longer, will still close this since it is done, testing is still welcome