mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
.
This commit is contained in:
Toby
@@ -0,0 +1,84 @@
|
||||
---
|
||||
name: firewall-config
|
||||
description: Configure iptables, nftables, and cloud firewalls. Implement network segmentation and traffic filtering. Use when securing network perimeters or implementing security zones.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Firewall Configuration
|
||||
|
||||
Configure host-based and cloud firewalls for network security.
|
||||
|
||||
## iptables
|
||||
|
||||
```bash
|
||||
# Default policies
|
||||
iptables -P INPUT DROP
|
||||
iptables -P FORWARD DROP
|
||||
iptables -P OUTPUT ACCEPT
|
||||
|
||||
# Allow established connections
|
||||
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
# Allow loopback
|
||||
iptables -A INPUT -i lo -j ACCEPT
|
||||
|
||||
# Allow SSH
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
|
||||
# Allow HTTP/HTTPS
|
||||
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
|
||||
|
||||
# Save rules
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
```
|
||||
|
||||
## nftables
|
||||
|
||||
```bash
|
||||
#!/usr/sbin/nft -f
|
||||
flush ruleset
|
||||
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
ct state established,related accept
|
||||
iif "lo" accept
|
||||
tcp dport { 22, 80, 443 } accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## AWS Security Groups
|
||||
|
||||
```bash
|
||||
aws ec2 create-security-group --group-name web-sg --description "Web server SG"
|
||||
|
||||
aws ec2 authorize-security-group-ingress \
|
||||
--group-name web-sg \
|
||||
--protocol tcp --port 443 \
|
||||
--cidr 0.0.0.0/0
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Default deny policy
|
||||
- Minimal rule sets
|
||||
- Regular rule audits
|
||||
- Log denied traffic
|
||||
- Document all rules
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [linux-hardening](../../hardening/linux-hardening/) - System security
|
||||
- [aws-vpc](../../../infrastructure/cloud-aws/aws-vpc/) - AWS networking
|
||||
@@ -0,0 +1,103 @@
|
||||
#!/bin/bash
|
||||
# iptables Firewall Rules Template
|
||||
# Customize and apply with: bash iptables-rules.sh
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# Flush existing rules
|
||||
iptables -F
|
||||
iptables -X
|
||||
iptables -t nat -F
|
||||
iptables -t nat -X
|
||||
|
||||
# Set default policies
|
||||
iptables -P INPUT DROP
|
||||
iptables -P FORWARD DROP
|
||||
iptables -P OUTPUT ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# LOOPBACK
|
||||
#------------------------------------------------------------------------------
|
||||
iptables -A INPUT -i lo -j ACCEPT
|
||||
iptables -A OUTPUT -o lo -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# ESTABLISHED CONNECTIONS
|
||||
#------------------------------------------------------------------------------
|
||||
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# INVALID PACKETS
|
||||
#------------------------------------------------------------------------------
|
||||
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# ICMP (Ping)
|
||||
#------------------------------------------------------------------------------
|
||||
# Allow ping (optional - comment out to disable)
|
||||
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
|
||||
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# SSH (Rate Limited)
|
||||
#------------------------------------------------------------------------------
|
||||
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH
|
||||
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# WEB SERVICES (Uncomment as needed)
|
||||
#------------------------------------------------------------------------------
|
||||
# HTTP
|
||||
# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
|
||||
|
||||
# HTTPS
|
||||
# iptables -A INPUT -p tcp --dport 443 -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# APPLICATION PORTS (Customize)
|
||||
#------------------------------------------------------------------------------
|
||||
# Application (example: 8080)
|
||||
# iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
|
||||
|
||||
# From specific network only
|
||||
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 8080 -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# DATABASE (Internal Only)
|
||||
#------------------------------------------------------------------------------
|
||||
# PostgreSQL from internal network
|
||||
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 5432 -j ACCEPT
|
||||
|
||||
# MySQL from internal network
|
||||
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 3306 -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# MONITORING
|
||||
#------------------------------------------------------------------------------
|
||||
# Prometheus metrics
|
||||
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 9090 -j ACCEPT
|
||||
|
||||
# Node exporter
|
||||
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 9100 -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# LOGGING
|
||||
#------------------------------------------------------------------------------
|
||||
# Log dropped packets (before final DROP)
|
||||
iptables -A INPUT -j LOG --log-prefix "iptables-dropped: " --log-level 4 -m limit --limit 5/min
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# FINAL DROP (Implicit with policy, but explicit for clarity)
|
||||
#------------------------------------------------------------------------------
|
||||
iptables -A INPUT -j DROP
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# SAVE RULES
|
||||
#------------------------------------------------------------------------------
|
||||
echo "Saving rules..."
|
||||
iptables-save > /etc/iptables/rules.v4 2>/dev/null || iptables-save > /tmp/iptables-rules.v4
|
||||
|
||||
echo "Firewall configured successfully!"
|
||||
iptables -L -n -v
|
||||
@@ -0,0 +1,127 @@
|
||||
# iptables Reference Guide
|
||||
|
||||
## Chain Overview
|
||||
|
||||
```
|
||||
PREROUTING
|
||||
│
|
||||
▼
|
||||
┌─────────┐
|
||||
│ ROUTING │
|
||||
└────┬────┘
|
||||
│
|
||||
┌────────────┼────────────┐
|
||||
│ │ │
|
||||
▼ ▼ ▼
|
||||
INPUT FORWARD OUTPUT
|
||||
│ │ │
|
||||
▼ │ ▼
|
||||
Local Process │ Local Process
|
||||
│
|
||||
▼
|
||||
POSTROUTING
|
||||
```
|
||||
|
||||
## Tables
|
||||
|
||||
| Table | Purpose | Chains |
|
||||
|-------|---------|--------|
|
||||
| filter | Default, packet filtering | INPUT, FORWARD, OUTPUT |
|
||||
| nat | Network Address Translation | PREROUTING, OUTPUT, POSTROUTING |
|
||||
| mangle | Packet alteration | All chains |
|
||||
| raw | Connection tracking exemption | PREROUTING, OUTPUT |
|
||||
|
||||
## Basic Commands
|
||||
|
||||
```bash
|
||||
# List rules
|
||||
iptables -L -n -v # All filter rules
|
||||
iptables -L INPUT -n -v # INPUT chain only
|
||||
iptables -t nat -L -n -v # NAT table
|
||||
|
||||
# Add rules
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT # Insert at position 1
|
||||
|
||||
# Delete rules
|
||||
iptables -D INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -D INPUT 3 # Delete rule #3
|
||||
|
||||
# Flush rules
|
||||
iptables -F # Flush all filter rules
|
||||
iptables -t nat -F # Flush NAT rules
|
||||
|
||||
# Set policy
|
||||
iptables -P INPUT DROP
|
||||
iptables -P FORWARD DROP
|
||||
iptables -P OUTPUT ACCEPT
|
||||
```
|
||||
|
||||
## Common Rules
|
||||
|
||||
### Allow Established Connections
|
||||
```bash
|
||||
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
```
|
||||
|
||||
### Allow Loopback
|
||||
```bash
|
||||
iptables -A INPUT -i lo -j ACCEPT
|
||||
iptables -A OUTPUT -o lo -j ACCEPT
|
||||
```
|
||||
|
||||
### Allow SSH
|
||||
```bash
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
|
||||
# Rate limit SSH
|
||||
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
|
||||
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
|
||||
```
|
||||
|
||||
### Allow Web Traffic
|
||||
```bash
|
||||
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
|
||||
```
|
||||
|
||||
### Allow from Specific IP/Network
|
||||
```bash
|
||||
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
|
||||
iptables -A INPUT -s 10.0.0.5 -p tcp --dport 5432 -j ACCEPT
|
||||
```
|
||||
|
||||
### Block IP
|
||||
```bash
|
||||
iptables -A INPUT -s 1.2.3.4 -j DROP
|
||||
```
|
||||
|
||||
### Log Dropped Packets
|
||||
```bash
|
||||
iptables -A INPUT -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
|
||||
iptables -A INPUT -j DROP
|
||||
```
|
||||
|
||||
## NAT Rules
|
||||
|
||||
### SNAT (Source NAT)
|
||||
```bash
|
||||
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||||
```
|
||||
|
||||
### DNAT (Destination NAT / Port Forwarding)
|
||||
```bash
|
||||
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:8080
|
||||
```
|
||||
|
||||
## Save/Restore
|
||||
|
||||
```bash
|
||||
# Save rules
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
ip6tables-save > /etc/iptables/rules.v6
|
||||
|
||||
# Restore rules
|
||||
iptables-restore < /etc/iptables/rules.v4
|
||||
ip6tables-restore < /etc/iptables/rules.v6
|
||||
```
|
||||
@@ -0,0 +1,91 @@
|
||||
#!/bin/bash
|
||||
# Firewall Configuration Audit Script
|
||||
# Usage: ./firewall-audit.sh
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo "========================================="
|
||||
echo "Firewall Configuration Audit"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
# Detect firewall type
|
||||
if command -v ufw &>/dev/null; then
|
||||
FIREWALL="ufw"
|
||||
elif command -v firewall-cmd &>/dev/null; then
|
||||
FIREWALL="firewalld"
|
||||
elif command -v nft &>/dev/null; then
|
||||
FIREWALL="nftables"
|
||||
else
|
||||
FIREWALL="iptables"
|
||||
fi
|
||||
|
||||
echo "Detected Firewall: $FIREWALL"
|
||||
echo ""
|
||||
|
||||
case "$FIREWALL" in
|
||||
ufw)
|
||||
echo "UFW Status:"
|
||||
echo "----------"
|
||||
ufw status verbose
|
||||
echo ""
|
||||
echo "UFW Rules (numbered):"
|
||||
echo "--------------------"
|
||||
ufw status numbered
|
||||
echo ""
|
||||
echo "UFW Application Profiles:"
|
||||
echo "------------------------"
|
||||
ufw app list
|
||||
;;
|
||||
|
||||
firewalld)
|
||||
echo "Firewalld Status:"
|
||||
echo "----------------"
|
||||
firewall-cmd --state
|
||||
echo ""
|
||||
echo "Active Zones:"
|
||||
echo "-------------"
|
||||
firewall-cmd --get-active-zones
|
||||
echo ""
|
||||
echo "Default Zone: $(firewall-cmd --get-default-zone)"
|
||||
echo ""
|
||||
echo "All Zone Rules:"
|
||||
echo "--------------"
|
||||
for zone in $(firewall-cmd --get-zones); do
|
||||
echo "--- Zone: $zone ---"
|
||||
firewall-cmd --zone=$zone --list-all 2>/dev/null || true
|
||||
echo ""
|
||||
done
|
||||
;;
|
||||
|
||||
nftables)
|
||||
echo "nftables Ruleset:"
|
||||
echo "----------------"
|
||||
nft list ruleset
|
||||
;;
|
||||
|
||||
iptables)
|
||||
echo "iptables Rules (Filter):"
|
||||
echo "-----------------------"
|
||||
iptables -L -n -v --line-numbers
|
||||
echo ""
|
||||
echo "iptables Rules (NAT):"
|
||||
echo "--------------------"
|
||||
iptables -t nat -L -n -v --line-numbers 2>/dev/null || true
|
||||
echo ""
|
||||
echo "ip6tables Rules:"
|
||||
echo "---------------"
|
||||
ip6tables -L -n -v --line-numbers 2>/dev/null || true
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Open Ports (listening):"
|
||||
echo "========================================="
|
||||
ss -tlnp 2>/dev/null || netstat -tlnp
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Audit complete"
|
||||
echo "========================================="
|
||||
@@ -0,0 +1,80 @@
|
||||
#!/bin/bash
|
||||
# UFW Firewall Setup Script
|
||||
# Usage: ./setup-ufw.sh [--apply]
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
APPLY="${1:-}"
|
||||
|
||||
if [ "$APPLY" != "--apply" ]; then
|
||||
echo "DRY RUN MODE - showing commands only"
|
||||
echo "Run with --apply to execute"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
run_cmd() {
|
||||
if [ "$APPLY" == "--apply" ]; then
|
||||
eval "$1"
|
||||
else
|
||||
echo "[DRY RUN] $1"
|
||||
fi
|
||||
}
|
||||
|
||||
echo "========================================="
|
||||
echo "UFW Firewall Setup"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
# Reset UFW
|
||||
echo "Resetting UFW to defaults..."
|
||||
run_cmd "ufw --force reset"
|
||||
|
||||
# Set default policies
|
||||
echo ""
|
||||
echo "Setting default policies..."
|
||||
run_cmd "ufw default deny incoming"
|
||||
run_cmd "ufw default allow outgoing"
|
||||
|
||||
# Essential services
|
||||
echo ""
|
||||
echo "Allowing essential services..."
|
||||
|
||||
# SSH (rate limited)
|
||||
run_cmd "ufw limit ssh comment 'SSH with rate limiting'"
|
||||
|
||||
# Common services (uncomment as needed)
|
||||
echo ""
|
||||
echo "Common service rules (customize as needed):"
|
||||
|
||||
# Web server
|
||||
# run_cmd "ufw allow 80/tcp comment 'HTTP'"
|
||||
# run_cmd "ufw allow 443/tcp comment 'HTTPS'"
|
||||
|
||||
# Database (restrict to specific IPs)
|
||||
# run_cmd "ufw allow from 10.0.0.0/8 to any port 5432 comment 'PostgreSQL from internal'"
|
||||
# run_cmd "ufw allow from 10.0.0.0/8 to any port 3306 comment 'MySQL from internal'"
|
||||
|
||||
# Application ports
|
||||
# run_cmd "ufw allow 8080/tcp comment 'Application'"
|
||||
|
||||
# Enable logging
|
||||
echo ""
|
||||
echo "Enabling logging..."
|
||||
run_cmd "ufw logging medium"
|
||||
|
||||
# Enable firewall
|
||||
echo ""
|
||||
echo "Enabling UFW..."
|
||||
run_cmd "ufw --force enable"
|
||||
|
||||
# Show status
|
||||
echo ""
|
||||
echo "Final status:"
|
||||
if [ "$APPLY" == "--apply" ]; then
|
||||
ufw status verbose
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Setup complete"
|
||||
echo "========================================="
|
||||
@@ -0,0 +1,96 @@
|
||||
---
|
||||
name: ssl-tls-management
|
||||
description: Manage SSL/TLS certificates with Let's Encrypt and internal PKI. Configure secure HTTPS, certificate renewal, and cipher suites. Use when implementing secure communications.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# SSL/TLS Management
|
||||
|
||||
Manage certificates and secure communications.
|
||||
|
||||
## Let's Encrypt (Certbot)
|
||||
|
||||
```bash
|
||||
# Install
|
||||
apt install certbot python3-certbot-nginx
|
||||
|
||||
# Get certificate
|
||||
certbot --nginx -d example.com -d www.example.com
|
||||
|
||||
# Auto-renewal
|
||||
certbot renew --dry-run
|
||||
# Cron: 0 0 * * * certbot renew --quiet
|
||||
```
|
||||
|
||||
## cert-manager (Kubernetes)
|
||||
|
||||
```yaml
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-prod
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
email: admin@example.com
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-prod
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: nginx
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: example-cert
|
||||
spec:
|
||||
secretName: example-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-prod
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- example.com
|
||||
```
|
||||
|
||||
## Strong Configuration
|
||||
|
||||
```nginx
|
||||
# nginx ssl config
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
|
||||
ssl_prefer_server_ciphers off;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=63072000" always;
|
||||
```
|
||||
|
||||
## Certificate Monitoring
|
||||
|
||||
```bash
|
||||
# Check expiration
|
||||
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
|
||||
openssl x509 -noout -dates
|
||||
|
||||
# Check certificate chain
|
||||
openssl s_client -connect example.com:443 -showcerts
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Automate renewal
|
||||
- Monitor expiration
|
||||
- Use strong ciphers
|
||||
- Enable HSTS
|
||||
- Regular security audits
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [hashicorp-vault](../../secrets/hashicorp-vault/) - PKI management
|
||||
- [waf-setup](../waf-setup/) - Web protection
|
||||
@@ -0,0 +1,75 @@
|
||||
---
|
||||
name: vpn-setup
|
||||
description: Configure WireGuard, OpenVPN, and cloud VPNs. Implement secure remote access and site-to-site connectivity. Use when setting up secure network tunnels.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# VPN Setup
|
||||
|
||||
Configure secure VPN tunnels for remote access and site connectivity.
|
||||
|
||||
## WireGuard
|
||||
|
||||
```bash
|
||||
# Generate keys
|
||||
wg genkey | tee privatekey | wg pubkey > publickey
|
||||
|
||||
# Server config (/etc/wireguard/wg0.conf)
|
||||
[Interface]
|
||||
Address = 10.0.0.1/24
|
||||
ListenPort = 51820
|
||||
PrivateKey = <server-private-key>
|
||||
|
||||
[Peer]
|
||||
PublicKey = <client-public-key>
|
||||
AllowedIPs = 10.0.0.2/32
|
||||
|
||||
# Enable
|
||||
wg-quick up wg0
|
||||
systemctl enable wg-quick@wg0
|
||||
```
|
||||
|
||||
## OpenVPN
|
||||
|
||||
```bash
|
||||
# Install
|
||||
apt install openvpn easy-rsa
|
||||
|
||||
# Generate certificates
|
||||
cd /etc/openvpn/easy-rsa
|
||||
./easyrsa init-pki
|
||||
./easyrsa build-ca
|
||||
./easyrsa gen-req server nopass
|
||||
./easyrsa sign-req server server
|
||||
./easyrsa gen-dh
|
||||
```
|
||||
|
||||
## AWS Site-to-Site VPN
|
||||
|
||||
```bash
|
||||
aws ec2 create-vpn-gateway --type ipsec.1
|
||||
aws ec2 create-customer-gateway \
|
||||
--type ipsec.1 \
|
||||
--bgp-asn 65000 \
|
||||
--public-ip <on-prem-ip>
|
||||
aws ec2 create-vpn-connection \
|
||||
--type ipsec.1 \
|
||||
--customer-gateway-id cgw-xxx \
|
||||
--vpn-gateway-id vgw-xxx
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use WireGuard for modern deployments
|
||||
- Implement MFA for VPN access
|
||||
- Regular key rotation
|
||||
- Monitor VPN connections
|
||||
- Segment VPN access by role
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [zero-trust](../zero-trust/) - Modern access patterns
|
||||
- [ssl-tls-management](../ssl-tls-management/) - Certificate management
|
||||
@@ -0,0 +1,79 @@
|
||||
---
|
||||
name: waf-setup
|
||||
description: Deploy and tune Web Application Firewalls. Configure rules for OWASP Top 10 protection. Use when protecting web applications from common attacks.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# WAF Setup
|
||||
|
||||
Protect web applications with Web Application Firewalls.
|
||||
|
||||
## AWS WAF
|
||||
|
||||
```bash
|
||||
# Create Web ACL
|
||||
aws wafv2 create-web-acl \
|
||||
--name my-waf \
|
||||
--scope REGIONAL \
|
||||
--default-action Allow={} \
|
||||
--rules file://rules.json
|
||||
|
||||
# Associate with ALB
|
||||
aws wafv2 associate-web-acl \
|
||||
--web-acl-arn arn:aws:wafv2:... \
|
||||
--resource-arn arn:aws:elasticloadbalancing:...
|
||||
```
|
||||
|
||||
## ModSecurity (nginx)
|
||||
|
||||
```nginx
|
||||
# nginx.conf
|
||||
load_module modules/ngx_http_modsecurity_module.so;
|
||||
|
||||
server {
|
||||
modsecurity on;
|
||||
modsecurity_rules_file /etc/nginx/modsec/main.conf;
|
||||
}
|
||||
```
|
||||
|
||||
```bash
|
||||
# Install OWASP CRS
|
||||
git clone https://github.com/coreruleset/coreruleset /etc/nginx/modsec/crs
|
||||
```
|
||||
|
||||
## Cloudflare WAF
|
||||
|
||||
```bash
|
||||
# Enable managed rules via API
|
||||
curl -X PUT "https://api.cloudflare.com/client/v4/zones/{zone}/firewall/waf/packages/{package}/rules/{rule}" \
|
||||
-H "Authorization: Bearer $TOKEN" \
|
||||
-d '{"mode":"block"}'
|
||||
```
|
||||
|
||||
## Common Rules
|
||||
|
||||
```yaml
|
||||
protections:
|
||||
- SQL Injection (SQLi)
|
||||
- Cross-Site Scripting (XSS)
|
||||
- Remote File Inclusion (RFI)
|
||||
- Local File Inclusion (LFI)
|
||||
- Command Injection
|
||||
- Cross-Site Request Forgery (CSRF)
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Start in detection mode
|
||||
- Tune for false positives
|
||||
- Monitor blocked requests
|
||||
- Regular rule updates
|
||||
- Custom rules for app-specific attacks
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [dast-scanning](../../scanning/dast-scanning/) - Web security testing
|
||||
- [ssl-tls-management](../ssl-tls-management/) - HTTPS configuration
|
||||
@@ -0,0 +1,120 @@
|
||||
# WAF Rules Reference
|
||||
|
||||
## AWS WAF
|
||||
|
||||
### Managed Rules
|
||||
```hcl
|
||||
resource "aws_wafv2_web_acl" "main" {
|
||||
name = "myapp-waf"
|
||||
scope = "REGIONAL"
|
||||
|
||||
default_action {
|
||||
allow {}
|
||||
}
|
||||
|
||||
# AWS Managed Rules - Core
|
||||
rule {
|
||||
name = "AWSManagedRulesCommonRuleSet"
|
||||
priority = 1
|
||||
override_action { none {} }
|
||||
|
||||
statement {
|
||||
managed_rule_group_statement {
|
||||
vendor_name = "AWS"
|
||||
name = "AWSManagedRulesCommonRuleSet"
|
||||
}
|
||||
}
|
||||
visibility_config {
|
||||
cloudwatch_metrics_enabled = true
|
||||
metric_name = "CommonRuleSet"
|
||||
sampled_requests_enabled = true
|
||||
}
|
||||
}
|
||||
|
||||
# SQL Injection
|
||||
rule {
|
||||
name = "AWSManagedRulesSQLiRuleSet"
|
||||
priority = 2
|
||||
override_action { none {} }
|
||||
|
||||
statement {
|
||||
managed_rule_group_statement {
|
||||
vendor_name = "AWS"
|
||||
name = "AWSManagedRulesSQLiRuleSet"
|
||||
}
|
||||
}
|
||||
visibility_config {
|
||||
cloudwatch_metrics_enabled = true
|
||||
metric_name = "SQLiRuleSet"
|
||||
sampled_requests_enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Custom Rules
|
||||
```hcl
|
||||
# Rate limiting
|
||||
rule {
|
||||
name = "RateLimit"
|
||||
priority = 0
|
||||
action { block {} }
|
||||
|
||||
statement {
|
||||
rate_based_statement {
|
||||
limit = 2000
|
||||
aggregate_key_type = "IP"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Geo blocking
|
||||
rule {
|
||||
name = "GeoBlock"
|
||||
priority = 3
|
||||
action { block {} }
|
||||
|
||||
statement {
|
||||
geo_match_statement {
|
||||
country_codes = ["CN", "RU"]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Cloudflare WAF
|
||||
|
||||
```hcl
|
||||
resource "cloudflare_ruleset" "waf" {
|
||||
zone_id = var.zone_id
|
||||
name = "WAF Rules"
|
||||
kind = "zone"
|
||||
phase = "http_request_firewall_managed"
|
||||
|
||||
rules {
|
||||
action = "execute"
|
||||
action_parameters {
|
||||
id = "efb7b8c949ac4650a09736fc376e9aee" # OWASP Core Ruleset
|
||||
}
|
||||
expression = "true"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Common Attack Patterns
|
||||
|
||||
| Pattern | Description | Rule |
|
||||
|---------|-------------|------|
|
||||
| SQLi | SQL Injection | Block `' OR 1=1`, UNION |
|
||||
| XSS | Cross-Site Scripting | Block `<script>`, event handlers |
|
||||
| LFI | Local File Inclusion | Block `../`, `/etc/passwd` |
|
||||
| RCE | Remote Code Execution | Block shell commands |
|
||||
|
||||
## Best Practices
|
||||
|
||||
1. Start in monitoring mode
|
||||
2. Tune rules for false positives
|
||||
3. Use rate limiting
|
||||
4. Block known bad IPs
|
||||
5. Log all blocked requests
|
||||
6. Regular rule review
|
||||
@@ -0,0 +1,86 @@
|
||||
---
|
||||
name: zero-trust
|
||||
description: Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Zero Trust Architecture
|
||||
|
||||
Implement "never trust, always verify" security model.
|
||||
|
||||
## Core Principles
|
||||
|
||||
```yaml
|
||||
zero_trust_principles:
|
||||
- Verify explicitly (authenticate all access)
|
||||
- Least privilege access
|
||||
- Assume breach (micro-segmentation)
|
||||
- Continuous validation
|
||||
- End-to-end encryption
|
||||
```
|
||||
|
||||
## Identity-Based Access
|
||||
|
||||
```yaml
|
||||
# Service mesh mTLS
|
||||
apiVersion: security.istio.io/v1beta1
|
||||
kind: PeerAuthentication
|
||||
metadata:
|
||||
name: default
|
||||
spec:
|
||||
mtls:
|
||||
mode: STRICT
|
||||
---
|
||||
apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: frontend-to-backend
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: backend
|
||||
rules:
|
||||
- from:
|
||||
- source:
|
||||
principals: ["cluster.local/ns/default/sa/frontend"]
|
||||
```
|
||||
|
||||
## Network Segmentation
|
||||
|
||||
```yaml
|
||||
# Kubernetes Network Policy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: deny-all
|
||||
spec:
|
||||
podSelector: {}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
```
|
||||
|
||||
## Implementation Steps
|
||||
|
||||
1. Identify sensitive resources
|
||||
2. Map access patterns
|
||||
3. Implement strong authentication
|
||||
4. Apply micro-segmentation
|
||||
5. Enable logging and monitoring
|
||||
6. Continuous verification
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Identity-aware proxies
|
||||
- Device trust verification
|
||||
- Context-based access
|
||||
- Encrypted communications
|
||||
- Continuous monitoring
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [service-mesh](../../../infrastructure/networking/service-mesh/) - mTLS implementation
|
||||
- [kubernetes-hardening](../../hardening/kubernetes-hardening/) - K8s security
|
||||
Reference in New Issue
Block a user