Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

kubernetes deployment - htadmin/nginx and htpasswd #169

Closed
mmguero opened this issue Mar 29, 2023 · 0 comments
Closed

kubernetes deployment - htadmin/nginx and htpasswd #169

mmguero opened this issue Mar 29, 2023 · 0 comments
Assignees
@mmguero @piercema
Labels
cloud Relating to deployment of Malcolm in the cloud and/or with Kubernetes nginx Relating to Malcolm's use of nginx security Related to issues with bearing on the security of Malcolm itself
Milestone
v23.05.0

Comments

@mmguero
Copy link
Collaborator

mmguero commented Mar 29, 2023 •
edited
Loading

Sub issue of #149

the way things sit now, a local ./nginx/htpasswd file is being created by control.py's auth_setup and a read-only configmap is created and mounted and used by nginx. However, the htadmin container is for dynamically creating and modifying usernames/passwords, so the htpasswd file needs to be read-writeable and shared across both the htadmin and nginx containers. What we've proposed is that the original htpasswd file is created and initially put into the nginx container this way, but then just used to "bootstrap" and in the nginx container entrypoint it can be checked against a location in the config PeristentVolume. If the persistentvolume one exists, then that's the one that will be used and take precedence. If not, the configmap htpasswd will be copied into the persistenvolume and then that will be used from then on out.
@mmguero mmguero added security Related to issues with bearing on the security of Malcolm itself cloud Relating to deployment of Malcolm in the cloud and/or with Kubernetes labels Mar 29, 2023
@mmguero mmguero added this to Malcolm Mar 29, 2023
@mmguero mmguero added the nginx Relating to Malcolm's use of nginx label Mar 29, 2023
@mmguero mmguero moved this to In Progress in Malcolm Mar 29, 2023
piercema added a commit that referenced this issue Mar 30, 2023
@piercema
Nginx container edits for #169
a512492
piercema added a commit that referenced this issue Mar 30, 2023
@piercema
Fix bash scripting syntax error for #169
0f228c1
piercema added a commit that referenced this issue Mar 30, 2023
@piercema
Add in htadmin backup configs for #169
30df74f
piercema added a commit that referenced this issue Mar 30, 2023
@piercema
Put in config files before starting htadmin for #169
7dc4a26
piercema added a commit that referenced this issue Apr 5, 2023
@piercema
Additional edits for htadmin #169
54d50bf
piercema added a commit that referenced this issue Apr 6, 2023
@piercema
Enable htadmin for #169
695e59b
@mmguero mmguero self-assigned this Apr 12, 2023
mmguero added a commit that referenced this issue Apr 12, 2023
@mmguero
#169, make htadmin work with an /auth URI instead of a separate :488 …
1947780 
…port
@mmguero mmguero moved this from In Progress to Testing in Malcolm Apr 12, 2023
mmguero added a commit that referenced this issue Apr 12, 2023
@mmguero
we can't nest mohunt points inside a container, make them siblings in…
9c006aa 
…stead (#169)
mmguero added a commit that referenced this issue Apr 13, 2023
@mmguero
make sure htadmin/nginx auth files get created with correct ownership (…
e32b802 
…#169)
@mmguero mmguero moved this from Testing to Done in Malcolm Apr 13, 2023
@mmguero mmguero closed this as completed Apr 13, 2023
@mmguero mmguero mentioned this issue Apr 14, 2023
Closed
@mmguero mmguero added this to the v23.05.0 milestone Apr 26, 2023
This was referenced May 1, 2023
Merged
Merged
mmguero added a commit that referenced this issue May 1, 2023
@mmguero
Merge pull request #191 from idaholab/v23.05.0_merge_idaholab
3438f9c 
Malcolm v23.05.0

Malcolm v23.05.0 is a major release with new features, enhancements, component version updates and bug fixes.

IMPORTANT NOTE: Malcolm v23.05.0 has completely changed the way it manages its settings: rather than using environment variables found at the top of the `docker-compose.yml` file, it uses environment variables in `.env` files inside of the `config` directory. The locations of a number of configuration files have also changed. It's not recommended to update to Malcolm v23.05.0 from a previous version of Malcolm. Instead, shut down Malcolm, rename your old Malcolm installation directory to something else, and reconfigure Malcolm using `./scripts/configure` and `./scripts/auth_setup`.

v23.04.0...v23.05.0

* New features
    - integrate [ICSNPP-Synchrophasor](https://github.com/cisagov/icsnpp-synchrophasor/) parser (#190)
    - [End-to-end Malcolm and Hedgehog Linux ISO Installation]((https://idaholab.github.io/Malcolm/docs/malcolm-hedgehog-e2e-iso-install.html#InstallationExample) document (#181)
    - support Malcolm deployment with Kubernetes (#149)
        + see [Deploying Malcolm with Kubernetes](https://idaholab.github.io/Malcolm/docs/kubernetes.html#Kubernetes)
        + This could be considered a "beta" release for Malcolm deployment with Kubernetes, as there is still [some work](https://github.com/idaholab/Malcolm/issues?q=is%3Aissue+is%3Aopen+kubernetes) to be done in this area. Please let us know what issues or suggestions you have via the [issue tracker](https://github.com/idaholab/Malcolm/issues) or via email to [[email protected]](mailto:[email protected]?subject=Malcolm).
        + contributing issues:
            * inotify issue (#168)
            * htadmin/nginx and htpasswd (#169)
            * opensearch (#170)
            * uploading large PCAP files (#171)
            * script consolidation (#172)
            * documentation (#173)
            * user-defined persistent volumes (#174)
            * opensearch keystore (#176)
            * expose other TCP services (#183)
            * provide with filebeat access to nginx access and error logs (#186)
            * use Secrets for some environment variables instead of ConfigMaps (#189)

* Enhancements and fixes
    * remove name-map-ui container (#165) in favor of using NetBox for asset identification
    * Python script refactoring, consolidation and cleanup
    * standardization of Docker container entrypoints
    * create `./scripts/configure` alias for `./scripts/install.py --configure`

* Component version updates
    - Arkime to [v4.3.0](https://github.com/arkime/arkime/blob/fa0db2415bdc109be7a4dd8ee2c2838673980b5f/CHANGELOG#L33-L72)
    - Capa to [v5.1.0](https://github.com/mandiant/capa/releases/tag/v5.1.0)
    - Fluent Bit to [v2.1.2](https://fluentbit.io/announcements/v2.1.2/)
    - NetBox to [v3.5.0](https://github.com/netbox-community/netbox/releases/tag/v3.5.0)
    - NGINX to [v1.22.1](http://nginx.org/en/CHANGES-1.22)
    - Supercronic to [v0.2.24](https://github.com/aptible/supercronic/releases/tag/v0.2.24)
    - Suricata to [v6.0.10](https://suricata.io/2023/01/31/suricata-6-0-10-released/)
    - Yara to [v4.3.0](https://github.com/VirusTotal/yara/releases/tag/v4.3.0)
    - Zeek to [v5.2.1](https://github.com/zeek/zeek/releases/tag/v5.2.1)
mmguero added a commit to cisagov/Malcolm that referenced this issue May 1, 2023
@mmguero
Merge pull request #249 from cisagov/v23.05.0_merge_cisagov
c02a6e9 
Malcolm v23.05.0

Malcolm v23.05.0 is a major release with new features, enhancements, component version updates and bug fixes.

IMPORTANT NOTE: Malcolm v23.05.0 has completely changed the way it manages its settings: rather than using environment variables found at the top of the `docker-compose.yml` file, it uses environment variables in `.env` files inside of the `config` directory. The locations of a number of configuration files have also changed. It's not recommended to update to Malcolm v23.05.0 from a previous version of Malcolm. Instead, shut down Malcolm, rename your old Malcolm installation directory to something else, and reconfigure Malcolm using `./scripts/configure` and `./scripts/auth_setup`.

v23.04.0...v23.05.0

* New features
    - integrate [ICSNPP-Synchrophasor](https://github.com/cisagov/icsnpp-synchrophasor/) parser (idaholab#190)
    - [End-to-end Malcolm and Hedgehog Linux ISO Installation((cisagov://cisagov.github.io/Malcolm/docs/malcolm-hedgehog-e2e-iso-install.html#InstallationExample) document (idaholab#181)
    - support Malcolm deployment with Kubernetes (idaholab#149)
        + see [Deploying Malcolm with Kubernetes](https://idaholab.github.io/Malcolm/docs/kubernetes.html#Kubernetes)
        + This could be considered a "beta" release for Malcolm deployment with Kubernetes, as there is still [some work](https://github.com/idaholab/Malcolm/issues?q=is%3Aissue+is%3Aopen+kubernetes) to be done in this area. Please let us know what issues or suggestions you have via the [issue tracker](https://github.com/idaholab/Malcolm/issues) or via email to [[email protected]](mailto:[email protected]?subject=Malcolm).
        + contributing issues:
            * inotify issue (idaholab#168)
            * htadmin/nginx and htpasswd (idaholab#169)
            * opensearch (idaholab#170)
            * uploading large PCAP files (idaholab#171)
            * script consolidation (idaholab#172)
            * documentation (idaholab#173)
            * user-defined persistent volumes (idaholab#174)
            * opensearch keystore (idaholab#176)
            * expose other TCP services (idaholab#183)
            * provide with filebeat access to nginx access and error logs (idaholab#186)
            * use Secrets for some environment variables instead of ConfigMaps (idaholab#189)

* Enhancements and fixes
    * remove name-map-ui container (idaholab#165) in favor of using NetBox for asset identification
    * Python script refactoring, consolidation and cleanup
    * standardization of Docker container entrypoints
    * create `./scripts/configure` alias for `./scripts/install.py --configure`

* Component version updates
    - Arkime to [v4.3.0](https://github.com/arkime/arkime/blob/fa0db2415bdc109be7a4dd8ee2c2838673980b5f/CHANGELOG#L33-L72)
    - Capa to [v5.1.0](https://github.com/mandiant/capa/releases/tag/v5.1.0)
    - Fluent Bit to [v2.1.2](https://fluentbit.io/announcements/v2.1.2/)
    - NetBox to [v3.5.0](https://github.com/netbox-community/netbox/releases/tag/v3.5.0)
    - NGINX to [v1.22.1](http://nginx.org/en/CHANGES-1.22)
    - Supercronic to [v0.2.24](https://github.com/aptible/supercronic/releases/tag/v0.2.24)
    - Suricata to [v6.0.10](https://suricata.io/2023/01/31/suricata-6-0-10-released/)
    - Yara to [v4.3.0](https://github.com/VirusTotal/yara/releases/tag/v4.3.0)
    - Zeek to [v5.2.1](https://github.com/zeek/zeek/releases/tag/v5.2.1)
@mmguero mmguero moved this from Done to Released in Malcolm May 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mmguero mmguero

@piercema piercema

Labels
cloud Relating to deployment of Malcolm in the cloud and/or with Kubernetes nginx Relating to Malcolm's use of nginx security Related to issues with bearing on the security of Malcolm itself
Projects
Malcolm
Status: Released
Milestone
v23.05.0
Development

No branches or pull requests
2 participants
@mmguero @piercema