diff --git a/content/includes/dos/dockerfiles/alpine-ebpf-manager.md b/content/includes/dos/dockerfiles/alpine-ebpf-manager.md new file mode 100644 index 0000000000..0174515b51 --- /dev/null +++ b/content/includes/dos/dockerfiles/alpine-ebpf-manager.md @@ -0,0 +1,29 @@ +--- +--- + +```dockerfile +# syntax=docker/dockerfile:1 + +# Supported OS_VER's are 3.21/3.22 +ARG OS_VER="3.22" + +# Base image +FROM alpine:${OS_VER} + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && addgroup -S -g 101 nginx \ + && adduser -S -u 101 -G nginx -h /nonexistent -s /sbin/nologin nginx \ + && wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub \ + && printf "https://pkgs.nginx.com/app-protect-dos/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories \ + && apk update \ + && apk add app-protect-dos-ebpf-manager \ + && rm -rf /var/cache/apk/* + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/alpine-plus-dos-waf.md b/content/includes/dos/dockerfiles/alpine-plus-dos-waf.md index 7366890841..0521412801 100644 --- a/content/includes/dos/dockerfiles/alpine-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/alpine-plus-dos-waf.md @@ -10,7 +10,41 @@ ARG OS_VER="3.22" # Base image FROM alpine:${OS_VER} -# Install NGINX Plus and F5 DOS for NGINX +# Download and add the NGINX signing keys: +RUN wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub && \ + wget -O /etc/apk/keys/app-protect-security-updates.rsa.pub https://cs.nginx.com/static/keys/app-protect-security-updates.rsa.pub +# Add NGINX Plus repository: +RUN printf "https://pkgs.nginx.com/plus/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories +# Add F5 WAF for NGINX & Dos repositories: +RUN printf "https://pkgs.nginx.com/app-protect-dos/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories && \ + printf "https://pkgs.nginx.com/app-protect/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories && \ + printf "https://pkgs.nginx.com/app-protect-security-updates/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories + +# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): +RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && addgroup -S -g 101 nginx \ + && adduser -S -u 101 -G nginx -h /nonexistent -s /sbin/nologin nginx \ + && apk update && apk add app-protect app-protect-dos \ + && ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log \ + && rm -rf /var/cache/apk/* + +RUN nginx -v && admd -v +RUN echo "RELEASE:" && cat /opt/app_protect/RELEASE && echo "VERSION:" && cat /opt/app_protect/VERSION + +# Copy configuration files: +COPY entrypoint.sh /root/ +RUN chmod +x /root/entrypoint.sh + +EXPOSE 80 + + +STOPSIGNAL SIGQUIT + +CMD ["sh", "/root/entrypoint.sh"] ``` diff --git a/content/includes/dos/dockerfiles/alpine-plus-dos.md b/content/includes/dos/dockerfiles/alpine-plus-dos.md index df18076e3a..1b26fd099a 100644 --- a/content/includes/dos/dockerfiles/alpine-plus-dos.md +++ b/content/includes/dos/dockerfiles/alpine-plus-dos.md @@ -13,19 +13,19 @@ FROM alpine:${OS_VER} # Install F5 DoS for NGINX RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && addgroup -S -g 101 nginx \ + && adduser -S -u 101 -G nginx -h /nonexistent -s /sbin/nologin nginx \ + && wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub \ && printf "https://pkgs.nginx.com/plus/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories \ && printf "https://pkgs.nginx.com/app-protect-dos/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories \ && apk update \ && apk add app-protect-dos \ - && cat license.jwt > /etc/nginx/license.jwt \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log \ && rm -rf /var/cache/apk/* -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ COPY entrypoint.sh /root/ RUN chmod +x /root/entrypoint.sh @@ -34,5 +34,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/amazon-ebpf-manager.md b/content/includes/dos/dockerfiles/amazon-ebpf-manager.md new file mode 100644 index 0000000000..25e1ac7fbd --- /dev/null +++ b/content/includes/dos/dockerfiles/amazon-ebpf-manager.md @@ -0,0 +1,23 @@ +--- +--- + +```dockerfile +# For AmazonLinux 2023: +FROM amazonlinux:2023 + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + set -x \ + && dnf -y install ca-certificates shadow-utils \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && curl -o /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-dos-amazonlinux2023.repo \ + && dnf install -y app-protect-dos-ebpf-manager \ + && dnf clean all \ + && rm -rf /var/cache/dnf + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/amazon-plus-dos-waf.md b/content/includes/dos/dockerfiles/amazon-plus-dos-waf.md index e69de29bb2..490707482e 100644 --- a/content/includes/dos/dockerfiles/amazon-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/amazon-plus-dos-waf.md @@ -0,0 +1,45 @@ +--- +--- + +```dockerfile +# syntax=docker/dockerfile:1 +FROM amazonlinux:2023 + +# Install prerequisite packages: +RUN dnf -y install ca-certificates + +# Add NGINX/NAP WAF/NAP DOS repositories: +RUN curl -o /etc/yum.repos.d/plus-amazonlinux2023.repo https://cs.nginx.com/static/files/plus-amazonlinux2023.repo && \ + curl -o /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-dos-amazonlinux2023.repo && \ + curl -o /etc/yum.repos.d/app-protect-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-amazonlinux2023.repo && \ + curl -o /etc/yum.repos.d/dependencies.amazonlinux2023.repo https://cs.nginx.com/static/files/dependencies.amazonlinux2023.repo + +# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + set -x \ + && dnf -y install ca-certificates shadow-utils \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && dnf -y install app-protect app-protect-dos \ + && rm /etc/yum.repos.d/plus-amazonlinux2023.repo \ + && rm /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo \ + && dnf clean all \ + && rm -rf /var/cache/dnf \ + && rm -rf /var/cache/yum \ + && ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log + +RUN nginx -v && admd -v +RUN echo "RELEASE:" && cat /opt/app_protect/RELEASE && echo "VERSION:" && cat /opt/app_protect/VERSION + +# Copy configuration files: +COPY entrypoint.sh /root/ +RUN chmod +x /root/entrypoint.sh + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["sh", "/root/entrypoint.sh"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/amazon-plus-dos.md b/content/includes/dos/dockerfiles/amazon-plus-dos.md index aeff507adb..640738b6a3 100644 --- a/content/includes/dos/dockerfiles/amazon-plus-dos.md +++ b/content/includes/dos/dockerfiles/amazon-plus-dos.md @@ -2,26 +2,24 @@ --- ```dockerfile - # For AmazonLinux 2023: FROM amazonlinux:2023 # Install F5 DoS for NGINX RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - dnf -y install ca-certificates \ + set -x \ + && dnf -y install ca-certificates shadow-utils \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ && curl -o /etc/yum.repos.d/plus-amazonlinux2023.repo https://cs.nginx.com/static/files/plus-amazonlinux2023.repo \ && curl -o /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-dos-amazonlinux2023.repo \ && dnf install -y app-protect-dos \ - && cat license.jwt > /etc/nginx/license.jwt \ && dnf clean all \ - && rm -rf /var/cache/dnf \ + && rm -rf /var/cache/dnf \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ COPY entrypoint.sh /root/ RUN chmod +x /root/entrypoint.sh @@ -30,5 +28,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/debian-ebpf-manager.md b/content/includes/dos/dockerfiles/debian-ebpf-manager.md new file mode 100644 index 0000000000..e07085279a --- /dev/null +++ b/content/includes/dos/dockerfiles/debian-ebpf-manager.md @@ -0,0 +1,37 @@ +--- +--- + +```dockerfile +# Where can be bullseye/bookworm +FROM debian:bullseye + +# Install F5 DoS for NGINX +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ + apt-transport-https \ + lsb-release \ + ca-certificates \ + wget \ + gnupg2 \ + debian-archive-keyring \ + && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \ + | gpg --dearmor \ + | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian $(lsb_release -cs) nginx-plus" \ + > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + && wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y app-protect-dos-ebpf-manager \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/debian-plus-dos-waf.md b/content/includes/dos/dockerfiles/debian-plus-dos-waf.md index e69de29bb2..36bcd75b40 100644 --- a/content/includes/dos/dockerfiles/debian-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/debian-plus-dos-waf.md @@ -0,0 +1,48 @@ +--- +--- + +```dockerfile +# Where version can be: bullseye/bookworm +FROM debian:bullseye + +# Install prerequisite packages: +RUN DEBIAN_FRONTEND=noninteractive apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 debian-archive-keyring && \ + wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ + wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor | tee /usr/share/keyrings/app-protect-security-updates.gpg > /dev/null + +# Add NGINX Plus, NGINX App Protect and F5 DoS for NGINX repository: +RUN printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-plus.list \ + && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect.list \ + && printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] https://pkgs.nginx.com/app-protect-security-updates/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/app-protect-security-updates.list + +# Download the apt configuration to `/etc/apt/apt.conf.d`: +RUN wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx + +# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which includes NGINX Plus): +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y app-protect app-protect-dos \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* \ + && ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log + +RUN nginx -v && admd -v +RUN echo "RELEASE:" && cat /opt/app_protect/RELEASE && echo "VERSION:" && cat /opt/app_protect/VERSION + +COPY entrypoint.sh /root/ +RUN chmod +x /root/entrypoint.sh + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["sh", "/root/entrypoint.sh"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/debian-plus-dos.md b/content/includes/dos/dockerfiles/debian-plus-dos.md index 2f544d3679..95340fccc9 100644 --- a/content/includes/dos/dockerfiles/debian-plus-dos.md +++ b/content/includes/dos/dockerfiles/debian-plus-dos.md @@ -2,29 +2,38 @@ --- ```dockerfile - # Where can be bullseye/bookworm FROM debian:bullseye # Install F5 DoS for NGINX RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apt-get update \ - && DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 debian-archive-keyring \ - && mkdir -p /etc/ssl/nginx/ /etc/nginx/ \ - && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ + apt-transport-https \ + lsb-release \ + ca-certificates \ + wget \ + gnupg2 \ + debian-archive-keyring \ + && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \ + | gpg --dearmor \ + | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian $(lsb_release -cs) nginx-plus" \ + > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ && wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \ - && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect-dos \ - && cat license.jwt > /etc/nginx/license.jwt \ - && apt-get remove --purge --auto-remove -y \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y app-protect-dos \ + && apt-get clean \ && rm -rf /var/lib/apt/lists/* \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log -COPY nginx.conf /etc/nginx/ COPY entrypoint.sh /root/ RUN chmod +x /root/entrypoint.sh @@ -33,5 +42,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rhel8-ebpf-manager.md b/content/includes/dos/dockerfiles/rhel8-ebpf-manager.md new file mode 100644 index 0000000000..bf316a7592 --- /dev/null +++ b/content/includes/dos/dockerfiles/rhel8-ebpf-manager.md @@ -0,0 +1,29 @@ +--- +--- + +```dockerfile +# For UBI 8 +FROM registry.access.redhat.com/ubi8 + +ARG RHEL_ORG +ARG RHEL_ACTIVATION_KEY + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \ + && dnf -y install ca-certificates \ + && curl -o /etc/yum.repos.d/app-protect-dos-8.repo https://cs.nginx.com/static/files/app-protect-dos-8.repo \ + && dnf -y install app-protect-dos-ebpf-manager \ + && rm /etc/yum.repos.d/app-protect-dos-8.repo \ + && dnf clean all \ + && rm -rf /var/cache/yum + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rhel8-plus-dos-waf.md b/content/includes/dos/dockerfiles/rhel8-plus-dos-waf.md deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/content/includes/dos/dockerfiles/rhel8-plus-dos.md b/content/includes/dos/dockerfiles/rhel8-plus-dos.md index 12be0b12c1..af77d4743e 100644 --- a/content/includes/dos/dockerfiles/rhel8-plus-dos.md +++ b/content/includes/dos/dockerfiles/rhel8-plus-dos.md @@ -11,10 +11,12 @@ ARG RHEL_ACTIVATION_KEY # Install F5 DoS for NGINX RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - subscription-manager register --org=${RHEL_ORG} --activationkey=${RHEL_ACTIVATION_KEY} \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && subscription-manager register --org=${RHEL_ORG} --activationkey=${RHEL_ACTIVATION_KEY} \ && subscription-manager refresh \ - && subscription-manager attach --auto || true \ && subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms \ && subscription-manager repos --enable=rhel-8-for-x86_64-appstream-rpms \ && dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \ @@ -22,16 +24,12 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && curl -o /etc/yum.repos.d/plus-8.repo https://cs.nginx.com/static/files/plus-8.repo \ && curl -o /etc/yum.repos.d/app-protect-dos-8.repo https://cs.nginx.com/static/files/app-protect-dos-8.repo \ && dnf -y install app-protect-dos \ - && cat license.jwt > /etc/nginx/license.jwt \ - && rm /etc/yum.repos.d/plus-8.repo \ - && rm /etc/yum.repos.d/app-protect-dos-8.repo \ && dnf clean all \ && rm -rf /var/cache/yum \ + && subscription-manager unregister \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ COPY entrypoint.sh /root/ RUN chmod +x /root/entrypoint.sh @@ -40,5 +38,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rhel9-ebpf-manager.md b/content/includes/dos/dockerfiles/rhel9-ebpf-manager.md new file mode 100644 index 0000000000..640b585272 --- /dev/null +++ b/content/includes/dos/dockerfiles/rhel9-ebpf-manager.md @@ -0,0 +1,29 @@ +--- +--- + +```dockerfile +# For UBI 9 +FROM registry.access.redhat.com/ubi9 + +ARG RHEL_ORG +ARG RHEL_ACTIVATION_KEY + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \ + && dnf -y install ca-certificates \ + && curl -o /etc/yum.repos.d/app-protect-dos-9.repo https://cs.nginx.com/static/files/app-protect-dos-9.repo \ + && dnf -y install app-protect-dos-ebpf-manager \ + && rm /etc/yum.repos.d/app-protect-dos-9.repo \ + && dnf clean all \ + && rm -rf /var/cache/yum + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rhel9-plus-dos-waf.md b/content/includes/dos/dockerfiles/rhel9-plus-dos-waf.md deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/content/includes/dos/dockerfiles/rhel9-plus-dos.md b/content/includes/dos/dockerfiles/rhel9-plus-dos.md index f9bd2550d0..ee2b26eccf 100644 --- a/content/includes/dos/dockerfiles/rhel9-plus-dos.md +++ b/content/includes/dos/dockerfiles/rhel9-plus-dos.md @@ -11,10 +11,12 @@ ARG RHEL_ACTIVATION_KEY # Install F5 DoS for NGINX RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - subscription-manager register --org=${RHEL_ORG} --activationkey=${RHEL_ACTIVATION_KEY} \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && subscription-manager register --org=${RHEL_ORG} --activationkey=${RHEL_ACTIVATION_KEY} \ && subscription-manager refresh \ - && subscription-manager attach --auto || true \ && subscription-manager repos --enable=rhel-9-for-x86_64-baseos-rpms \ && subscription-manager repos --enable=rhel-9-for-x86_64-appstream-rpms \ && dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \ @@ -22,16 +24,13 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && curl -o /etc/yum.repos.d/plus-9.repo https://cs.nginx.com/static/files/plus-9.repo \ && curl -o /etc/yum.repos.d/app-protect-dos-9.repo https://cs.nginx.com/static/files/app-protect-dos-9.repo \ && dnf -y install app-protect-dos \ - && cat license.jwt > /etc/nginx/license.jwt \ - && rm /etc/yum.repos.d/plus-9.repo \ - && rm /etc/yum.repos.d/app-protect-dos-9.repo \ && dnf clean all \ && rm -rf /var/cache/yum \ + && subscription-manager unregister \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log # Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ COPY entrypoint.sh /root/ RUN chmod +x /root/entrypoint.sh @@ -40,5 +39,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rocky9-ebpf-manager.md b/content/includes/dos/dockerfiles/rocky9-ebpf-manager.md new file mode 100644 index 0000000000..4aaad1d121 --- /dev/null +++ b/content/includes/dos/dockerfiles/rocky9-ebpf-manager.md @@ -0,0 +1,26 @@ +--- +--- + +```dockerfile +# syntax=docker/dockerfile:1 +# For Rocky Linux 9 +FROM rockylinux:9 + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && dnf -y install ca-certificates epel-release 'dnf-command(config-manager)' \ + && curl -o /etc/yum.repos.d/app-protect-dos-9.repo https://cs.nginx.com/static/files/app-protect-dos-9.repo \ + && dnf config-manager --set-enabled crb \ + && dnf install -y app-protect-dos-ebpf-manager \ + && dnf clean all \ + && rm -rf /var/cache/dnf + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rocky9-plus-dos-waf.md b/content/includes/dos/dockerfiles/rocky9-plus-dos-waf.md index e69de29bb2..e03012aee2 100644 --- a/content/includes/dos/dockerfiles/rocky9-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/rocky9-plus-dos-waf.md @@ -0,0 +1,39 @@ +--- +--- + +```dockerfile +# syntax=docker/dockerfile:1 +# For Rocky Linux 9 +FROM rockylinux:9 + +# Install F5 DoS for NGINX: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && dnf -y install ca-certificates epel-release 'dnf-command(config-manager)' \ + && curl -o /etc/yum.repos.d/plus-9.repo https://cs.nginx.com/static/files/plus-9.repo \ + && curl -o /etc/yum.repos.d/app-protect-dos-9.repo https://cs.nginx.com/static/files/app-protect-dos-9.repo \ + && curl -o /etc/yum.repos.d/app-protect-9.repo https://cs.nginx.com/static/files/app-protect-9.repo \ + && curl -o /etc/yum.repos.d/dependencies.9.repo https://cs.nginx.com/static/files/dependencies.9.repo \ + && dnf config-manager --set-enabled crb \ + && dnf install -y app-protect app-protect-dos \ + && dnf clean all \ + && rm -rf /var/cache/dnf \ + && ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log + +RUN nginx -v && admd -v +RUN echo "RELEASE:" && cat /opt/app_protect/RELEASE && echo "VERSION:" && cat /opt/app_protect/VERSION + +COPY entrypoint.sh /root/ +RUN chmod +x /root/entrypoint.sh + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["sh", "/root/entrypoint.sh"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rocky9-plus-dos.md b/content/includes/dos/dockerfiles/rocky9-plus-dos.md index b779713b22..05224a22fd 100644 --- a/content/includes/dos/dockerfiles/rocky9-plus-dos.md +++ b/content/includes/dos/dockerfiles/rocky9-plus-dos.md @@ -2,7 +2,6 @@ --- ```dockerfile - # syntax=docker/dockerfile:1 # For Rocky Linux 9 FROM rockylinux:9 @@ -10,20 +9,21 @@ FROM rockylinux:9 # Install F5 DoS for NGINX: RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - dnf -y install ca-certificates epel-release 'dnf-command(config-manager)' \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && dnf -y install ca-certificates epel-release 'dnf-command(config-manager)' \ && curl -o /etc/yum.repos.d/plus-9.repo https://cs.nginx.com/static/files/plus-9.repo \ && curl -o /etc/yum.repos.d/app-protect-dos-9.repo https://cs.nginx.com/static/files/app-protect-dos-9.repo \ && dnf config-manager --set-enabled crb \ && dnf install -y app-protect-dos \ - && cat license.jwt > /etc/nginx/license.jwt \ && dnf clean all \ && rm -rf /var/cache/dnf \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log # Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ COPY entrypoint.sh /root/ RUN chmod +x /root/entrypoint.sh @@ -32,5 +32,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/ubuntu-ebpf-manager.md b/content/includes/dos/dockerfiles/ubuntu-ebpf-manager.md new file mode 100644 index 0000000000..9db04c03f4 --- /dev/null +++ b/content/includes/dos/dockerfiles/ubuntu-ebpf-manager.md @@ -0,0 +1,41 @@ +--- +--- + +```dockerfile +# syntax=docker/dockerfile:1 +# For Ubuntu + +# Where version can be: jammy/noble +FROM ubuntu:noble + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ + apt-transport-https \ + lsb-release \ + ca-certificates \ + wget \ + gnupg2 \ + ubuntu-keyring \ + && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \ + | gpg --dearmor \ + | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu $(lsb_release -cs) nginx-plus" \ + > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + && wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y app-protect-dos-ebpf-manager \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* + +STOPSIGNAL SIGQUIT + +# Idle forever +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/ubuntu-plus-dos-waf.md b/content/includes/dos/dockerfiles/ubuntu-plus-dos-waf.md index e69de29bb2..281ebab378 100644 --- a/content/includes/dos/dockerfiles/ubuntu-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/ubuntu-plus-dos-waf.md @@ -0,0 +1,48 @@ +--- +--- + +```dockerfile +# Where version can be: noble/jammy +FROM ubuntu:noble + +# Install prerequisite packages: +RUN DEBIAN_FRONTEND=noninteractive apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 ubuntu-keyring && \ + wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ + wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor | tee /usr/share/keyrings/app-protect-security-updates.gpg > /dev/null + +# Add NGINX Plus, NGINX App Protect and F5 DoS for NGINX repository: +RUN printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-plus.list \ + && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect.list \ + && printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] https://pkgs.nginx.com/app-protect-security-updates/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/app-protect-security-updates.list + +# Download the apt configuration to `/etc/apt/apt.conf.d`: +RUN wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx + +# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which includes NGINX Plus): +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y app-protect app-protect-dos \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* \ + && ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log + +RUN nginx -v && admd -v +RUN echo "RELEASE:" && cat /opt/app_protect/RELEASE && echo "VERSION:" && cat /opt/app_protect/VERSION + +COPY entrypoint.sh /root/ +RUN chmod +x /root/entrypoint.sh + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["sh", "/root/entrypoint.sh"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/ubuntu-plus-dos.md b/content/includes/dos/dockerfiles/ubuntu-plus-dos.md index 90db16e600..4dfb3fa9a3 100644 --- a/content/includes/dos/dockerfiles/ubuntu-plus-dos.md +++ b/content/includes/dos/dockerfiles/ubuntu-plus-dos.md @@ -2,33 +2,41 @@ --- ```dockerfile - # syntax=docker/dockerfile:1 # For Ubuntu # Where version can be: jammy/noble FROM ubuntu:noble -# Setup repository keys -RUN apt-get update && \ - # Install F5 DoS for NGINX RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apt-get update \ - && apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 ubuntu-keyring \ - && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/ubuntu $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + set -x \ + # Create nginx user/group first, to be consistent throughout Docker variants \ + && groupadd --system --gid 101 nginx \ + && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ + apt-transport-https \ + lsb-release \ + ca-certificates \ + wget \ + gnupg2 \ + ubuntu-keyring \ + && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \ + | gpg --dearmor \ + | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/ubuntu $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu $(lsb_release -cs) nginx-plus" \ + > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ && wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \ - && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect-dos \ - && cat license.jwt > /etc/nginx/license.jwt \ - && apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y app-protect-dos \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log -COPY nginx.conf /etc/nginx/ COPY entrypoint.sh /root/ RUN chmod +x /root/entrypoint.sh diff --git a/content/includes/dos/dos-arbitrator.md b/content/includes/dos/dos-arbitrator.md new file mode 100644 index 0000000000..8981917a17 --- /dev/null +++ b/content/includes/dos/dos-arbitrator.md @@ -0,0 +1,57 @@ +--- +nd-docs: null +nd-files: +- content/nap-dos/deployment-guide/kubernetes.md +- content/nap-dos/deployment-guide/kubernetes-with-L4-accelerated-mitigation..md +--- +## F5 DoS for NGINX Arbitrator + +### Overview + +F5 DoS for NGINX arbitrator orchestrates all the running F5 DoS for NGINX instances to synchronize local/global attack start/stop. + +F5 DoS for NGINX arbitrator serves as a central coordinating component for managing multiple instances of App Protect DoS in a network. It is needed when there are more than one F5 DoS for NGINX instances. Its primary function is to ensure that all instances are aware of and share the same state for each protected object. Here's a clearer breakdown of how it works and why it's necessary: + +How F5 DoS for NGINX Arbitrator Works: + +- **Collecting State Periodically**: The arbitrator regularly collects the state information from all running instances of App Protect DoS. This collection occurs at set intervals, typically every 10 seconds. +- **State Initialization for New Instances**: When a new App Protect DoS instance is created, it doesn't start with a blank or uninitialized state for a protected object. Instead, it retrieves the initial state for the protected object from the arbitrator. +- **Updating State in Case of an Attack**: If an attack is detected by one of the App Protect DoS instances, that instance sends an attack notification to the arbitrator. The arbitrator then updates the state of the affected protected object to indicate that it is under attack. Importantly, this updated state is propagated to all other instances. + +### Why F5 DoS for NGINX Arbitrator is Necessary + +F5 DoS for NGINX Arbitrator is essential for several reasons: + +- **Global State Management**: Without the arbitrator, each individual instance of App Protect DoS would manage its own isolated state for each protected object. This isolation could lead to inconsistencies. For example, if instance A declared an attack on a protected object named "PO-Example," instance B would remain unaware of this attack, potentially leaving the object vulnerable. +- **Uniform Attack Detection**: With the arbitrator in place, when instance A detects an attack on "PO-Example" and reports it to the arbitrator, the state of "PO-Example" is immediately updated to indicate an attack. This means that all instances, including instance B, are aware of the attack and can take appropriate measures to mitigate it. + +In summary, F5 DoS for NGINX Arbitrator acts as a central coordinator to maintain a consistent and up-to-date global state for protected objects across multiple instances of App Protect DoS. This coordination helps ensure that attacks are properly detected and mitigated, and that knowledge gained by one instance is efficiently shared with others, enhancing the overall security of the network. + + +### F5 DoS for NGINX Arbitrator Deployment + +1. Pull the official F5 DoS for NGINX Arbitrator image with the command: + + ```shell + docker pull docker-registry.nginx.com/nap-dos/app_protect_dos_arb:latest + ``` + +2. Create a container based on this image, for example, `app-protect-dos-arb` container: + + ```shell + docker run --name app_protect_dos_arb -p 3000:3000 -d docker-registry.nginx.com/nap-dos/app_protect_dos_arb + ``` + +3. Verify that the `app-protect-dos-arb` container is up and running with the `docker ps` command. + +4. DNS records are required for F5 DoS for NGINX Arbitrator to work properly and be accessible by F5 DoS for NGINX servers. Ensure that the `svc-appprotect-dos-arb` or configured Arbitrator FQDN (with `app_protect_dos_arb_fqdn` directive) has a valid DNS resolution. + This step is necessary only for VM/Docker deployments with arbitrator. When the arbitrator is in the same Kubernetes namespace as F5 DoS for NGINX, this step is not needed. + +### Multi-VM Deployment + +The Arbitrator service is standalone. Once it is down, it can be seamlessly re-started. It will immediately recover all the needed information from F5 DoS for NGINX instances that communicate to it every 10 sec. It’s downtime is around 10-20 seconds which will not affect the F5 DoS for NGINX working. + +F5 DoS for NGINX Arbitrator service connects to port 3000 and can be seen under App Protect DoS instances. All modules try to connect to this service automatically. If it’s not accessible, each instance works in standalone mode. + +There is no such option for authentications between F5 DoS for NGINX servers and Arbitrator service like MTLS or password . Currently Arbitrator service is not exposed outside of the namespace. It is customers responsibility to isolate it from outside. It is applicable to any deployment of Arbitrator, not only to multi-VM. + diff --git a/content/includes/dos/dos-entrypoint.md b/content/includes/dos/dos-entrypoint.md new file mode 100644 index 0000000000..8650cdffeb --- /dev/null +++ b/content/includes/dos/dos-entrypoint.md @@ -0,0 +1,24 @@ +--- +nd-docs: null +nd-files: +- content/nap-dos/deployment-guide/learn-about-deployment.md +- content/nap-dos/deployment-guide/kubernetes.md +- content/nap-dos/deployment-guide/kubernetes-with-L4-accelerated-mitigation..md +--- + +```shell + #!/usr/bin/env bash + + USER=nginx + LOGDIR=/var/log/adm + + # prepare environment + mkdir -p /var/run/adm /tmp/cores ${LOGDIR} + chmod 755 /var/run/adm /tmp/cores ${LOGDIR} + chown ${USER}:${USER} /var/run/adm /tmp/cores ${LOGDIR} + + # run processes + /bin/su -s /bin/bash -c "/usr/bin/adminstall > ${LOGDIR}/adminstall.log 2>&1" ${USER} + /bin/su -s /bin/bash -c "/usr/bin/admd -d --log info > ${LOGDIR}/admd.log 2>&1 &" ${USER} + /usr/sbin/nginx -g 'daemon off;' +``` \ No newline at end of file diff --git a/content/includes/dos/dos-waf-entrypoint.md b/content/includes/dos/dos-waf-entrypoint.md new file mode 100644 index 0000000000..593bca48c7 --- /dev/null +++ b/content/includes/dos/dos-waf-entrypoint.md @@ -0,0 +1,26 @@ +--- +nd-docs: null +nd-files: +- content/nap-dos/deployment-guide/learn-about-deployment.md +- content/nap-dos/deployment-guide/kubernetes.md +- content/nap-dos/deployment-guide/kubernetes-with-L4-accelerated-mitigation..md +--- + + +```shell + #!/usr/bin/env bash + USER=nginx + LOGDIR=/var/log/adm + + # prepare environment + mkdir -p /var/run/adm /tmp/cores ${LOGDIR} + chmod 755 /var/run/adm /tmp/cores ${LOGDIR} + chown ${USER}:${USER} /var/run/adm /tmp/cores ${LOGDIR} + + # run processes + /bin/su -s /bin/bash -c "/usr/bin/adminstall > ${LOGDIR}/adminstall.log 2>&1" ${USER} + /bin/su -s /bin/bash -c "/opt/app_protect/bin/bd_agent &" ${USER} + /bin/su -s /bin/bash -c "/usr/share/ts/bin/bd-socket-plugin tmm_count 4 proc_cpuinfo_cpu_mhz 2000000 total_xml_memory 307200000 total_umu_max_size 3129344 sys_max_account_id 1024 no_static_config 2>&1 > /var/log/app_protect/bd-socket-plugin.log &" ${USER} + /bin/su -s /bin/bash -c "/usr/bin/admd -d --log info > ${LOGDIR}/admd.log 2>&1 &" ${USER} + /usr/sbin/nginx -g 'daemon off;' +``` \ No newline at end of file diff --git a/content/includes/dos/install-post-checks.md b/content/includes/dos/install-post-checks.md new file mode 100644 index 0000000000..690da4e047 --- /dev/null +++ b/content/includes/dos/install-post-checks.md @@ -0,0 +1,91 @@ +--- +nd-docs: null +nd-files: +- content/nap-dos/deployment-guide/learn-about-deployment.md +- content/nap-dos/deployment-guide/kubernetes.md +- content/nap-dos/deployment-guide/kubernetes-with-L4-accelerated-mitigation..md +--- + +You can run the following commands to ensure that F5 DoS for NGINX enforcement is operational. + +1. Check that the three processes needed for F5 DoS for NGINX are running using `ps aux`: + + - admd + - nginx: master process + - nginx: worker process + + ```shell + USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND + nginx 7759 0.0 0.0 113120 1200 ? Ss Sep06 0:00 /bin/sh -c /usr/bin/admd -d --log info > /var/log/adm/admd.log 2>&1 + root 7765 0.0 0.0 87964 1464 ? Ss Sep06 0:00 nginx: master process /usr/sbin/nginx -g daemon off; + nginx 7767 0.0 0.1 615868 8188 ? Sl Sep06 0:04 nginx: worker process + ``` + +2. Verify that there are no NGINX errors in the `/var/log/nginx/error.log` and that the policy compiled successfully: + + ```shell + 2025/12/07 09:14:34 [notice] 675#675: APP_PROTECT_DOS { "event": "shared_memory_connected", "worker_pid": 675, "mode": "operational", "mode_changed": true } + 2025/12/07 09:14:34 [notice] 675#675: using the "epoll" event method + 2025/12/07 09:14:34 [notice] 675#675: APP_PROTECT_DOS { "event": "configuration_load_success", "software_version": "36+4.8.3-1.el8.ngx"} + 2025/12/07 09:14:34 [notice] 675#675: nginx/1.29.3 (nginx-plus-r36) + 2025/12/07 09:14:34 [notice] 675#675: built by gcc 8.5.0 20210514 (Red Hat 8.5.0-28) (GCC) + 2025/12/07 09:14:34 [notice] 675#675: OS: Linux 6.8.0-88-generic + 2025/12/07 09:14:34 [notice] 675#675: getrlimit(RLIMIT_NOFILE): 1048576:1048576 + 2025/12/07 09:14:34 [notice] 675#675: start worker processes + 2025/12/07 09:14:34 [notice] 675#675: start worker process 679 + 2025/12/07 09:14:34 [notice] 679#679: APP_PROTECT_DOS { "event": "shared_memory_connected", "worker_pid": 679, "mode": "operational", "mode_changed": true } + ``` + +3. Check that by applying an attack, the attacker IP addresses are blocked while the good traffic pass through: + + a. Simulate good traffic: + + ```shell + echo "Start Good Traffic 2" + while true; do + curl ${VS}/good1 & + curl ${VS}/good2 & + curl ${VS}/good3 & + curl ${VS}/good4 + sleep 0.1 + done & + ``` + + b. After 7 minutes start the attack: + + ```shell + while [ true ] + do + ab -B ${BAD_IP1} -l -r -n 1000000 -c 150 -d -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ & + ab -B ${BAD_IP2} -l -r -n 1000000 -c 150 -d -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ & + ab -B ${BAD_IP3} -l -r -n 1000000 -c 150 -d -s 10 -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ + + killall ab + done + ``` + + c. See that the good traffic continue as usual while the attackers receive denial of service. + +4. For DOS with L4 accelerated mitigation enabled + +Check that the ebpf_manager_dos process needed for F5 DoS for NGINX is running using `ps aux | grep /usr/bin/ebpf_manager_dos`: + +``` +root 1 0.0 0.0 4324 3072 ? Ss 19:32 0:00 bash -c /usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log +root 7 0.2 0.0 1722732 14208 ? Sl 19:32 0:01 /usr/bin/ebpf_manager_dos +root 46 0.0 0.0 3528 1792 pts/0 S+ 19:44 0:00 grep --color=auto /usr/bin/ebpf_manager_dos +``` + +Verify that there are no errors in the `/shared/ebpf_dos.log` and that the XDP program uploaded successfully: + +```[2025-12-02 19:32:12] INFO: Uninstall old eBPF maps and XDP program +[2025-12-02 19:32:13] INFO: Install eBPF maps and XDP program +[2025-12-02 19:32:13] INFO: Start ebpf manager +[2025-12-02 19:32:13] INFO: Version: 36+4.8.3-1~noble +[2025-12-02 19:32:13] INFO: Start Periodic task for update time +[2025-12-02 19:32:13] INFO: Owner of the UDS has been changed to user nginx and group nginx. +[2025-12-02 19:32:13] INFO: Permissions of the UDS have been changed successfully for user nginx and group nginx. +[2025-12-02 19:32:13] INFO: Async Callback Server listening on unix:/shared/ebpf_manager_dos_uds +``` + +To check F5 WAF for NGINX alongside F5 DoS for NGINX, just perform the normal tests as specified at [Admin Guide](https://docs.nginx.com/waf/install/virtual-environment/#post-installation-checks) diff --git a/content/includes/dos/k8s_arbitrator/appprotect-dos-arb.md b/content/includes/dos/k8s_arbitrator/appprotect-dos-arb.md new file mode 100644 index 0000000000..13d30c533c --- /dev/null +++ b/content/includes/dos/k8s_arbitrator/appprotect-dos-arb.md @@ -0,0 +1,25 @@ +--- +--- + +```appprotect-dos-arb.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: app-protect-dos-arb + namespace: app-protect-dos +spec: + replicas: 1 + selector: + matchLabels: + app: appprotect-dos-arb + template: + metadata: + labels: + app: appprotect-dos-arb + spec: + containers: + - name: arb-svc + image: docker-registry.nginx.com/nap-dos/app_protect_dos_arb:latest + ports: + - containerPort: 3000 +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_arbitrator/svc-appprotect-dos-arb.md b/content/includes/dos/k8s_arbitrator/svc-appprotect-dos-arb.md new file mode 100644 index 0000000000..5938fb99bc --- /dev/null +++ b/content/includes/dos/k8s_arbitrator/svc-appprotect-dos-arb.md @@ -0,0 +1,19 @@ +--- +--- + +```svc-appprotect-dos-arb.yaml +apiVersion: v1 +kind: Service +metadata: + name: svc-appprotect-dos-arb + namespace: app-protect-dos +spec: + selector: + app: appprotect-dos-arb + ports: + - name: arb + port: 3000 + protocol: TCP + targetPort: 3000 + clusterIP: None +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-deployment.md b/content/includes/dos/k8s_manifest/dos-deployment.md new file mode 100644 index 0000000000..fb2956c090 --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-deployment.md @@ -0,0 +1,105 @@ +--- +--- + +```dos-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: app-protect-dos + namespace: app-protect-dos + labels: + app: app-protect-dos +spec: + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app: app-protect-dos + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 2 + maxUnavailable: 1 + template: + metadata: + labels: + app: app-protect-dos + spec: + containers: + - name: nginx-app-protect-dos + image: ${DOS_IMAGE_REPOSITORY}:${DOS_IMAGE_TAG} + imagePullPolicy: Always + + command: ["/bin/bash", "-c"] + args: + - | + /root/entrypoint.sh + + resources: + requests: + cpu: "200m" + memory: "500Mi" + limits: + cpu: "900m" + memory: "800Mi" + + ports: + - containerPort: 80 + name: web + - containerPort: 8090 + name: probe + - containerPort: 8091 + name: probe500 + + livenessProbe: + httpGet: + path: /app_protect_dos_liveness + port: 8090 + initialDelaySeconds: 5 + periodSeconds: 10 + + readinessProbe: + httpGet: + path: /app_protect_dos_readiness + port: 8090 + initialDelaySeconds: 5 + periodSeconds: 10 + + volumeMounts: + - name: shared-dir + mountPath: /shared/ + - name: conf + mountPath: /etc/nginx/nginx.conf + subPath: nginx.conf + - name: log-default + mountPath: /etc/app_protect_dos/log-default.json + subPath: log-default.json + - name: license-token-volume + mountPath: /etc/nginx/license.jwt + subPath: license.jwt + readOnly: true + + volumes: + - name: shared-dir + emptyDir: { } + - name: conf + configMap: + name: dos-nginx-conf + items: + - key: nginx.conf + path: nginx.conf + - name: log-default + configMap: + name: dos-log-default + defaultMode: 0644 + items: + - key: log-default.json + path: log-default.json + - name: license-token-volume + secret: + secretName: license-token + items: + - key: license.jwt + path: license.jwt + +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-log-default-configmap.md b/content/includes/dos/k8s_manifest/dos-log-default-configmap.md new file mode 100644 index 0000000000..7d1d4848d6 --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-log-default-configmap.md @@ -0,0 +1,19 @@ +--- +--- + +```dos-log-default-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: dos-log-default + namespace: app-protect-dos +data: + log-default.json: | + { + "filter": { + "traffic-mitigation-stats": "all", + "bad-actors": "all", + "attack-signatures": "all" + } + } +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-namespace.md b/content/includes/dos/k8s_manifest/dos-namespace.md new file mode 100644 index 0000000000..1e91798fc0 --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-namespace.md @@ -0,0 +1,9 @@ +--- +--- + +```dos-namespace.yaml +apiVersion: v1 +kind: Namespace +metadata: + name: app-protect-dos +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-nginx-conf-configmap.md b/content/includes/dos/k8s_manifest/dos-nginx-conf-configmap.md new file mode 100644 index 0000000000..5dbc9407fa --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-nginx-conf-configmap.md @@ -0,0 +1,84 @@ +--- +--- + +```dos-nginx-conf-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: dos-nginx-conf + namespace: app-protect-dos +data: + nginx.conf: | + + user nginx; + worker_processes auto; + error_log /var/log/nginx/error.log error; + worker_rlimit_nofile 65535; + + load_module modules/ngx_http_app_protect_dos_module.so; + + working_directory /tmp/cores; + + events { + worker_connections 65535; + } + + http { + + app_protect_dos_arb_fqdn svc-appprotect-dos-arb.arb.svc.cluster.local; + + sendfile on; + tcp_nopush on; + keepalive_timeout 65; + + log_format log_dos + ', vs_name_al=$app_protect_dos_vs_name, ip=$remote_addr, tls_fp=$app_protect_dos_tls_fp, ' + 'outcome=$app_protect_dos_outcome, reason=$app_protect_dos_outcome_reason, ' + 'ip_tls=$remote_addr:$app_protect_dos_tls_fp, '; + + # Health endpoints for probes + app_protect_dos_liveness on; # uri:/app_protect_dos_liveness port:8090 + app_protect_dos_readiness on; # uri:/app_protect_dos_readiness port:8090 + + server { + listen 8090; + server_name probe; + + location / { + proxy_pass http://localhost:8091; + } + } + + server { + listen 8091; + return 503; + } + + server { + listen 80 reuseport; + server_name serv; + proxy_http_version 1.1; + + access_log /var/log/nginx/access.log log_dos if=$loggable; + app_protect_dos_security_log_enable on; + app_protect_dos_security_log "/etc/app_protect_dos/log-default.json" syslog:server=10.197.30.219:5261; + app_protect_dos_policy_file "/etc/app_protect_dos/BADOSDefaultPolicy.json"; + + location / { + app_protect_dos_enable on; + app_protect_dos_name "main_serv"; + app_protect_dos_monitor uri=http://serv:80/ protocol=http1; + proxy_pass http://127.0.0.1/proxy$request_uri; + } + + location /proxy { + app_protect_dos_enable off; + client_max_body_size 0; + default_type text/html; + return 200 "Hello! I got your URI request - $request_uri\n"; + } + + } + } + +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-service.md b/content/includes/dos/k8s_manifest/dos-service.md new file mode 100644 index 0000000000..65bfdedb00 --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-service.md @@ -0,0 +1,18 @@ +--- +--- + +```dos-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: nap-dos + namespace: app-protect-dos +spec: + ports: + - name: app + port: 80 + protocol: TCP + selector: + app: app-protect-dos + type: NodePort +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-deployment.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-deployment.md new file mode 100644 index 0000000000..ac0101b493 --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-deployment.md @@ -0,0 +1,125 @@ +--- +--- + +```dos-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: app-protect-dos + namespace: app-protect-dos + labels: + app: app-protect-dos +spec: + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app: app-protect-dos + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 2 + maxUnavailable: 1 + template: + metadata: + labels: + app: app-protect-dos + spec: + containers: + - name: nginx-app-protect-dos + image: ${DOS_IMAGE_REPOSITORY}:${DOS_IMAGE_TAG} + imagePullPolicy: Always + + command: ["/bin/bash", "-c"] + args: + - | + /root/entrypoint.sh + + resources: + requests: + cpu: "200m" + memory: "500Mi" + limits: + cpu: "900m" + memory: "800Mi" + + ports: + - containerPort: 80 + name: web + - containerPort: 8090 + name: probe + - containerPort: 8091 + name: probe500 + + livenessProbe: + httpGet: + path: /app_protect_dos_liveness + port: 8090 + initialDelaySeconds: 5 + periodSeconds: 10 + + readinessProbe: + httpGet: + path: /app_protect_dos_readiness + port: 8090 + initialDelaySeconds: 5 + periodSeconds: 10 + + volumeMounts: + - name: shared-dir + mountPath: /shared/ + - name: bpf + mountPath: /sys/fs/bpf + - name: conf + mountPath: /etc/nginx/nginx.conf + subPath: nginx.conf + - name: log-default + mountPath: /etc/app_protect_dos/log-default.json + subPath: log-default.json + - name: license-token-volume + mountPath: /etc/nginx/license.jwt + subPath: license.jwt + readOnly: true + + - name: dos-ebpf-manager + image: ${EBPF_IMAGE_REPOSITORY}:${EBPF_IMAGE_TAG} + securityContext: + privileged: true + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name # This is unique for every Pod + volumeMounts: + - name: shared-dir + mountPath: /shared/ + - name: bpf + mountPath: /sys/fs/bpf + + volumes: + - name: shared-dir + emptyDir: {} + - name: bpf + hostPath: + path: /sys/fs/bpf + type: DirectoryOrCreate + - name: conf + configMap: + name: dos-nginx-conf + items: + - key: nginx.conf + path: nginx.conf + - name: log-default + configMap: + name: dos-log-default + defaultMode: 0644 + items: + - key: log-default.json + path: log-default.json + - name: license-token-volume + secret: + secretName: license-token + items: + - key: license.jwt + path: license.jwt +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-log-default-configmap.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-log-default-configmap.md new file mode 100644 index 0000000000..7d1d4848d6 --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-log-default-configmap.md @@ -0,0 +1,19 @@ +--- +--- + +```dos-log-default-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: dos-log-default + namespace: app-protect-dos +data: + log-default.json: | + { + "filter": { + "traffic-mitigation-stats": "all", + "bad-actors": "all", + "attack-signatures": "all" + } + } +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-namespace.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-namespace.md new file mode 100644 index 0000000000..1e91798fc0 --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-namespace.md @@ -0,0 +1,9 @@ +--- +--- + +```dos-namespace.yaml +apiVersion: v1 +kind: Namespace +metadata: + name: app-protect-dos +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-nginx-conf-configmap.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-nginx-conf-configmap.md new file mode 100644 index 0000000000..83900f2871 --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-nginx-conf-configmap.md @@ -0,0 +1,83 @@ +--- +--- + +```dos-nginx-conf-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: dos-nginx-conf + namespace: app-protect-dos +data: + nginx.conf: | + + user nginx; + worker_processes auto; + error_log /var/log/nginx/error.log error; + worker_rlimit_nofile 65535; + + load_module modules/ngx_http_app_protect_dos_module.so; + + working_directory /tmp/cores; + + events { + worker_connections 65535; + } + + http { + + app_protect_dos_arb_fqdn svc-appprotect-dos-arb.arb.svc.cluster.local; + + sendfile on; + tcp_nopush on; + keepalive_timeout 65; + + log_format log_dos + ', vs_name_al=$app_protect_dos_vs_name, ip=$remote_addr, tls_fp=$app_protect_dos_tls_fp, ' + 'outcome=$app_protect_dos_outcome, reason=$app_protect_dos_outcome_reason, ' + 'ip_tls=$remote_addr:$app_protect_dos_tls_fp, '; + + app_protect_dos_accelerated_mitigation on syn_drop=on; + + # Health endpoints for probes + app_protect_dos_liveness on; # uri:/app_protect_dos_liveness port:8090 + app_protect_dos_readiness on; # uri:/app_protect_dos_readiness port:8090 + + server { + listen 8090; + server_name probe; + + location / { + proxy_pass http://localhost:8091; + } + } + + server { + listen 8091; + return 503; + } + + server { + listen 80 reuseport; + server_name serv; + + access_log /var/log/nginx/access.log log_dos if=$loggable; + app_protect_dos_security_log_enable on; + app_protect_dos_security_log "/etc/app_protect_dos/log-default.json" syslog:server=10.197.30.219:5261; + app_protect_dos_policy_file "/etc/app_protect_dos/BADOSDefaultPolicy.json"; + + location / { + app_protect_dos_enable on; + app_protect_dos_name "main_serv"; + app_protect_dos_monitor uri=http://serv:80/ protocol=http1; + proxy_pass http://127.0.0.1/proxy$request_uri; + } + + location /proxy { + app_protect_dos_enable off; + client_max_body_size 0; + default_type text/html; + return 200 "Hello! I got your URI request - $request_uri\n"; + } + } + } +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-service.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-service.md new file mode 100644 index 0000000000..c7c7916fde --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-service.md @@ -0,0 +1,19 @@ +--- +--- + +```dos-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: nap-dos + namespace: app-protect-dos +spec: + externalTrafficPolicy: Local + ports: + - name: app + port: 80 + protocol: TCP + selector: + app: app-protect-dos + type: LoadBalancer +``` \ No newline at end of file diff --git a/content/nap-dos/deployment-guide/best-practices.md b/content/nap-dos/deployment-guide/best-practices.md index af2f39c0de..ba1ef81888 100644 --- a/content/nap-dos/deployment-guide/best-practices.md +++ b/content/nap-dos/deployment-guide/best-practices.md @@ -3,7 +3,7 @@ description: F5 DoS for NGINX Best Practices Deployment. nd-docs: DOCS-666 title: Best Practices toc: true -weight: 100 +weight: 130 nd-content-type: how-to nd-product: F5DOSN --- diff --git a/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md b/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md index 6211ef16fe..8a4a89217a 100644 --- a/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md +++ b/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md @@ -6,7 +6,7 @@ description: Install F5 NGINX Plus, F5 WAF & DoS for NGINX Plus on Amazon Web Se nd-docs: DOCS-1204 title: Installing F5 WAF & DoS for NGINX AMIs on Amazon EC2 toc: true -weight: 110 +weight: 120 nd-content-type: how-to nd-product: F5DOSN --- diff --git a/content/nap-dos/deployment-guide/kubernetes-with-L4-accelerated-mitigation..md b/content/nap-dos/deployment-guide/kubernetes-with-L4-accelerated-mitigation..md new file mode 100644 index 0000000000..ab062f786f --- /dev/null +++ b/content/nap-dos/deployment-guide/kubernetes-with-L4-accelerated-mitigation..md @@ -0,0 +1,412 @@ +--- +# We use sentence case and present imperative tone +title: "Kubernetes with L4 accelerated mitigation" +# Weights are assigned in increments of 100: determines sorting order +weight: 110 +# Creates a table of contents and sidebar, useful for large documents +toc: true +# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this +nd-content-type: how-to +nd-product: F5DOSN +--- + +This page describes how to install F5 DOS for NGINX using Kubernetes with L4 accelerated mitigation service. +By enabling [accelerated-mitigation-directive-app_protect_dos_accelerated_mitigation](https://docs.nginx.com/nginx-app-protect-dos/directives-and-policy/learn-about-directives-and-policy/#accelerated-mitigation-directive-app_protect_dos_accelerated_mitigation) +and running the [DOS EBPF Manager]() as a sidecar container alongside the NGINX container, you can offload Layer 4 DoS mitigation to eBPF programs running in the Linux kernel. This improves mitigation performance and reduces CPU usage on the NGINX container. + +Such with L4 accelerated mitigation require the NGINX and DOS containers to run with elevated privileges, as well as additional Linux capabilities. Therefore, this guide assumes you have a good understanding of Kubernetes security best practices and have taken the necessary steps to secure your cluster accordingly. +The F5 Dos For NGINX require the service to run with [externalTrafficPolicy](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip) set to Local in order to preserve the client source IP address for accurate DoS mitigation. +```text +spec: + externalTrafficPolicy: Local +``` + + +It explains the common steps necessary for any Kubernetes-based deployment, then provides details specific to Helm or Manifests. + +## Before you begin + +To complete this guide, you will need the following pre-requisites: + +- A functional Kubernetes cluster +- An active F5 DOS for NGINX subscription (Purchased or trial) +- [Docker](https://docs.docker.com/get-started/get-docker/) + +To review supported operating systems, read the [Releases]({{< ref "/nap-dos/releases" >}}) topic. + +## Download your subscription credentials + +{{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}} + +## Create a Dockerfile + +In the same folder as your credential files, create a _Dockerfile_ based on your desired operating system image using an example from the following sections. + +### Alpine Linux + +{{< tabs name="alpine-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/alpine-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="alpine-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/alpine-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Amazon Linux + +{{< tabs name="amazon-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/amazon-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="amazon-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/amazon-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Debian + +{{< tabs name="debian-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/debian-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="debian-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/debian-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### RHEL 8 + +{{< tabs name="rhel8-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rhel8-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="rhel8-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/rhel8-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### RHEL 9 + +{{< tabs name="rhel9-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rhel9-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="rhel9-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/rhel9-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Rocky Linux 9 + +{{< tabs name="rocky-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rocky9-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="rocky9-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/rocky9-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Ubuntu + +{{< tabs name="ubuntu-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/ubuntu-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="ubuntu-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/ubuntu-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +## Create DOS entrypoint.sh +Docker startup script which spins up all App Protect DoS processes, must have executable permissions + +{{< include "/dos/dos-entrypoint.md" >}} + +## Build the DOS Docker image + +Your folder should contain the following files: + +- _nginx-repo.crt_ +- _nginx-repo.key_ +- _license.jwt_ +- _entrypoint.sh_ +- _nginx.conf_ +- _Dockerfile_ + +To build an image, use the following command, replacing `` as appropriate: + +```shell +sudo docker build --no-cache --platform linux/amd64 \ + --secret id=nginx-crt,src=nginx-repo.crt \ + --secret id=nginx-key,src=nginx-repo.key \ + -t . +``` + +## Build the EBPF Manager Docker image + +Your folder should contain the following files: + +- _nginx-repo.crt_ +- _nginx-repo.key_ +- _Dockerfile_ + +To build an image, use the following command, replacing `` as appropriate: + +```shell +sudo docker build --no-cache --platform linux/amd64 \ + --secret id=nginx-crt,src=nginx-repo.crt \ + --secret id=nginx-key,src=nginx-repo.key \ + -t . +``` + +Once you have built the DOS and EBPF images, push them to your private image repository, which should be accessible to your Kubernetes cluster. + +From this point, the steps change based on your installation method: + +- [Use Helm to install F5 DOS for NGINX](#use-helm-to-install-f5-dos-for-nginx) +- [Use Manifests to install F5 DOS for NGINX](#use-manifests-to-install-f5-dos-for-nginx) + +## Use Helm to install F5 DOS for NGINX + +You will need to edit the `values.yaml` file for a few changes: + +- Update _appprotectdos.nginxImage.repository_ and _appprotectdos.nginxImage.tag_ with the image name chosen during when [building the Docker image](#build-the-docker-image). + +The `` argument should be the _contents_ of the file, not the file itself. Ensure there are no additional characters such as extra whitespace. + +On helm deployment environment variables need to be set for image repository and tag. +`set enviorment variable DOS_IMAGE_REPOSITORY` with your actual nginx-dos image anmae. +`set enviorment variable DOS_IMAGE_TAG` with your actual nginx-dos image tag. +`set enviorment variable EBPF_IMAGE_REPOSITORY` with your actual ebpf-manager image name. +`set enviorment variable EBPF_IMAGE_TAG` with your actual ebpf-manager image tag. + +Once you have updated `values.yaml`, you can install F5 WAF for NGINX using `helm install`: + +```shell +export DOS_IMAGE_REPOSITORY= + +export DOS_IMAGE_TAG= + +export EBPF_IMAGE_REPOSITORY= + +export EBPF_IMAGE_TAG= + +helm repo add nginx-stable https://helm.nginx.com/stable && helm repo update + +kubectl create namespace --dry-run=client -o yaml | kubectl apply -f - + +kubectl create secret generic license-token \ + --from-file=license.jwt=${PWD}/license.jwt --type=nginx.com/license --namespace + +helm install dos-release dos-ebpf-helm-chart --namespace \ + --set namespace.create=false --set service.type=NodePort \ + --set appProtectDos.nginxImage.repository=${DOS_IMAGE_REPOSITORY} \ + --set appProtectDos.nginxImage.tag=${DOS_IMAGE_TAG} \ + --set appProtectDos.ebpfManagerImage.repository=$EBPF_IMAGE_REPOSITORY} \ + --set appProtectDos.ebpfManagerImage.tag=${EBPF_IMAGE_TAG} + +helm install dos-arbitrator nginx-stable/nginx-appprotect-dos-arbitrator --namespace + +kubectl wait --for=condition=available --timeout=300s deployment/app-protect-dos -n +``` + +You can verify the deployment is successful with `kubectl get`, replacing `namespace` accordingly: + +```shell +kubectl get pods --namespac +kubectl get svc --namespac +``` + +{{< call-out "note" >}} + +At this stage, you have finished deploying F5 DOS for NGINX and can look at [Post-installation checks](#post-installation-checks). + +{{< /call-out >}} + +## Use Manifests to install F5 DOS for NGINX + +### Create Manifest files + +The default configuration provided creates two replicas, each hosting NGINX and DOS services together in a single Kubernetes pod. + +Create all of these files in a single folder (Such as `/manifests`). + +On manifest deployment environment variables need to be set for image repository and tag. + `set enviorment variable DOS_IMAGE_REPOSITORY` with your actual nginx-dos image anmae. + `set enviorment variable DOS_IMAGE_TAG` with your actual nginx-dos image tag. + `set enviorment variable EBPF_IMAGE_REPOSITORY` with your actual ebpf-manager image name. + `set enviorment variable EBPF_IMAGE_TAG` with your actual ebpf-manager image tag. + +{{< tabs name="manifest-files" >}} + +{{% tab name=dos-namespace.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-namespace.md" >}} + +{{% /tab %}} + + +{{% tab name=dos-nginx-conf-configmap.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-nginx-conf-configmap.md" >}} + +{{% /tab %}} + +{{% tab name=dos-log-default-configmap.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-log-default-configmap.md" >}} + +{{% /tab %}} + +{{% tab name=dos-deployment.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-deployment.md" >}} + +{{% /tab %}} + +{{% tab name=dos-service.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-service.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Start the Manifest deployment + +From the folder containing the YAML files from the previous step (Suggested as `/manifests`), deploy F5 DOS for NGINX using `kubectl`: + +```shell +export DOS_IMAGE_REPOSITORY= +export DOS_IMAGE_TAG= +export EBPF_IMAGE_REPOSITORY= +export EBPF_IMAGE_TAG= +kubectl apply -f manifests/dos-namespace.yaml +kubectl apply -f manifests/dos-nginx-conf-configmap.yaml +kubectl apply -f manifests/dos-log-default-configmap.yaml +kubectl apply -f manifests/dos-deployment.yaml +kubectl apply -f manifests/dos-service.yaml +``` + +It will apply all the configuration defined in the files to your Kubernetes cluster. + +You can then check the status of the deployment with `kubectl get`: + +```shell +kubectl -n app-protect-dos get deployments +kubectl -n app-protect-dos get pods +kubectl -n app-protect-dos get services +``` + +You should see output similar to the following: + +```text +~$ kubectl -n app-protect-dos get deployments +NAME READY UP-TO-DATE AVAILABLE AGE +app-protect-dos 1/1 1 1 33s + +~$ kubectl -n app-protect-dos get pods +NAME READY STATUS RESTARTS AGE +app-protect-dos-7f9798654c-7ncbl 2/2 Running 0 68s + +$ kubectl -n app-protect-dos get pods -o jsonpath='{range .items[*]}Pod: {.metadata.name} -> Containers: {.spec.containers[*].name}{"\n"}{end}' +Pod: app-protect-dos-7f9798654c-7ncbl -> Containers: dos-ebpf-manager nginx-app-protect-dos + +~$ kubectl -n app-protect-dos get services +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +nap-dos LoadBalancer 10.43.212.232 80:32586/TCP 93s +``` +## Post-Installation Checks +At this stage, you have finished deploying F5 DOS for NGINX with EBPF L4 accelerated mitigation enabled +You can login to dos-ebpf-manager container like following command +```text +kubectl exec -it app-protect-dos-586fb94947-8sjnc -n app-protect-dos -c nginx-app-protect-dos -- bash +kubectl exec -it app-protect-dos-586fb94947-8sjnc -n app-protect-dos -c dos-ebpf-manager -- bash +``` +and can look at . +{{< include "dos/install-post-checks.md" >}} + +## F5 DoS for NGINX Arbitrator + +{{< include "/dos/dos-arbitrator.md" >}} + +## Next steps diff --git a/content/nap-dos/deployment-guide/kubernetes.md b/content/nap-dos/deployment-guide/kubernetes.md new file mode 100644 index 0000000000..4685ff9765 --- /dev/null +++ b/content/nap-dos/deployment-guide/kubernetes.md @@ -0,0 +1,299 @@ +--- +# We use sentence case and present imperative tone +title: "Kubernetes" +# Weights are assigned in increments of 100: determines sorting order +weight: 100 +# Creates a table of contents and sidebar, useful for large documents +toc: true +# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this +nd-content-type: how-to +nd-product: F5DOSN +--- + +This page describes how to install F5 DOS for NGINX using Kubernetes. + +It explains the common steps necessary for any Kubernetes-based deployment, then provides details specific to Helm or Manifests. + +## Before you begin + +To complete this guide, you will need the following pre-requisites: + +- A functional Kubernetes cluster +- An active F5 DOS for NGINX subscription (Purchased or trial) +- [Docker](https://docs.docker.com/get-started/get-docker/) + +To review supported operating systems, read the [Releases]({{< ref "/nap-dos/releases" >}}) topic. + +## Download your subscription credentials + +{{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}} + +## Create a Dockerfile + +In the same folder as your credential files, create a _Dockerfile_ based on your desired operating system image using an example from the following sections. + +### Alpine Linux + +{{< tabs name="alpine-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/alpine-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Amazon Linux + +{{< tabs name="amazon-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/amazon-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Debian + +{{< tabs name="debian-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/debian-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### RHEL 8 + +{{< tabs name="rhel8-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rhel8-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### RHEL 9 + +{{< tabs name="rhel9-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rhel9-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Rocky Linux 9 + +{{< tabs name="rocky-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rocky9-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Ubuntu + +{{< tabs name="ubuntu-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/ubuntu-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +## Create DOS entrypoint.sh +Docker startup script which spins up all App Protect DoS processes, must have executable permissions + +{{< include "/dos/dos-entrypoint.md" >}} + +## Build the Docker image + +Your folder should contain the following files: + +- _nginx-repo.crt_ +- _nginx-repo.key_ +- _entrypoint.sh_ +- _nginx.conf_ +- _Dockerfile_ + +To build an image, use the following command, replacing `` as appropriate: + +```shell +sudo docker build --no-cache --platform linux/amd64 \ + --secret id=nginx-crt,src=nginx-repo.crt \ + --secret id=nginx-key,src=nginx-repo.key \ + -t . +``` + +Once you have built the image, push it to your private image repository, which should be accessible to your Kubernetes cluster. + +From this point, the steps change based on your installation method: + +- [Use Helm to install F5 DOS for NGINX](#use-helm-to-install-f5-dos-for-nginx) +- [Use Manifests to install F5 DOS for NGINX](#use-manifests-to-install-f5-dos-for-nginx) + +## Use Helm to install F5 DOS for NGINX + +You will need to edit the `values.yaml` file for a few changes: + +- Update _appprotectdos.nginxImage.repository_ and _appprotectdos.nginxImage.tag_ with the image name chosen during when [building the Docker image](#build-the-docker-image). + +The `` argument should be the _contents_ of the file, not the file itself. Ensure there are no additional characters such as extra whitespace. + +On helm deployment environment variables need to be set for image repository and tag. +`set enviorment variable DOS_IMAGE_REPOSITORY` with your actual nginx-dos image anmae. +`set enviorment variable DOS_IMAGE_TAG` with your actual nginx-dos image tag. + +Once you have updated `values.yaml`, you can install F5 WAF for NGINX using `helm install`: + +```shell +export DOS_IMAGE_REPOSITORY= + +export DOS_IMAGE_TAG= + +helm repo add nginx-stable https://helm.nginx.com/stable && helm repo update + +kubectl create namespace --dry-run=client -o yaml | kubectl apply -f - + +kubectl create secret generic license-token \ + --from-file=license.jwt=${PWD}/license.jwt --type=nginx.com/license --namespace + +helm install dos-release dos-helm-chart --namespace \ + --set namespace.create=false --set service.type=NodePort \ + --set appProtectDos.nginxImage.repository=${DOS_IMAGE_REPOSITORY} \ + --set appProtectDos.nginxImage.tag=${DOS_IMAGE_TAG} + +helm install dos-arbitrator nginx-stable/nginx-appprotect-dos-arbitrator --namespace + +kubectl wait --for=condition=available --timeout=300s deployment/app-protect-dos -n +``` +You can verify the deployment is successful with `kubectl get`, replacing `namespace` accordingly: + +```shell +kubectl get pods -n +kubectl get svc -n +``` + +{{< call-out "note" >}} + +At this stage, you have finished deploying F5 DOS for NGINX and can look at [Post-installation checks](#post-installation-checks). + +{{< /call-out >}} + +## Use Manifests to install F5 DOS for NGINX + +The `` argument should be the _contents_ of the file, not the file itself. Ensure there are no additional characters such as extra whitespace. + +### Create Manifest files + +The default configuration provided creates two replicas, each hosting NGINX and DOS services together in a single Kubernetes pod. + +Create all of these files in a single folder (Such as `/manifests`). + +On manifest deployment environment variables need to be set for image repository and tag. +`set enviorment variable DOS_IMAGE_REPOSITORY` with your actual nginx-dos image anmae. +`set enviorment variable DOS_IMAGE_TAG` with your actual nginx-dos image tag. + +{{< tabs name="manifest-files" >}} + +{{% tab name=dos-namespace.yaml %}} + +{{< include "dos/k8s_manifest/dos-namespace.md" >}} + +{{% /tab %}} + +{{% tab name=dos-nginx-conf-configmap.yaml %}} + +{{< include "dos/k8s_manifest/dos-nginx-conf-configmap.md" >}} + +{{% /tab %}} + +{{% tab name=dos-log-default-configmap.yaml %}} + +{{< include "dos/k8s_manifest/dos-log-default-configmap.md" >}} + +{{% /tab %}} + +{{% tab name=dos-deployment.yaml %}} + +{{< include "dos/k8s_manifest/dos-deployment.md" >}} + +{{% /tab %}} + +{{% tab name=dos-service.yaml %}} + +{{< include "dos/k8s_manifest/dos-service.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Start the Manifest deployment + +From the folder containing the YAML files from the previous step (Suggested as `/manifests`), deploy F5 DOS for NGINX using `kubectl`: + +```shell +export DOS_IMAGE_REPOSITORY= +export DOS_IMAGE_TAG= +kubectl apply -f manifests/dos-namespace.yaml +kubectl create secret generic license-token --from-file=license.jwt=license.jwt --type=nginx.com/license --namespace app-protect-dos +kubectl apply -f dos-manifest/dos-log-default-configmap.yaml +kubectl apply -f dos-manifest/dos-nginx-conf-configmap.yaml +kubectl apply -f manifests/dos-deployment.yaml +kubectl apply -f manifests/dos-service.yaml +``` + +It will apply all the configuration defined in the files to your Kubernetes cluster. + +You can then check the status of the deployment with `kubectl get`: + +```shell +kubectl --namespace app-protect-dos get deployments +kubectl --namespace app-protect-dos get pods +kubectl --namespace app-protect-dos get services +``` + +You should see output similar to the following: + +```text +~$ kubectl --namespace app-protect-dos get deployments +NAME READY UP-TO-DATE AVAILABLE AGE +app-protect-dos 1/1 1 1 1m + +~$ kubectl --namespace app-protect-dos get pods +NAME READY STATUS RESTARTS AGE +app-protect-dos-586fb94947-8sjnc 1/1 Running 0 1m + +~$ kubectl --namespace app-protect-dos get services +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +nap-dos LoadBalancer 10.43.83.225 80:30307/TCP 1m +``` +## Post-Installation Checks +At this stage, you have finished deploying F5 DOS for NGINX. +You csn login to app-protect-dos pod like following command +```text +kubectl exec -it app-protect-dos-586fb94947-8sjnc -n app-protect-dos -c nginx-app-protect-dos -- bash +``` +and can look at . +{{< include "dos/install-post-checks.md" >}} + +## F5 DoS for NGINX Arbitrator + +{{< include "/dos/dos-arbitrator.md" >}} + +## Next steps diff --git a/content/nap-dos/deployment-guide/learn-about-deployment.md b/content/nap-dos/deployment-guide/learn-about-deployment.md index eb6abc9040..0527353aa9 100644 --- a/content/nap-dos/deployment-guide/learn-about-deployment.md +++ b/content/nap-dos/deployment-guide/learn-about-deployment.md @@ -1,7 +1,7 @@ --- description: Learn about F5 DoS for NGINX Deployment. nd-docs: DOCS-666 -title: Deployment +title: Virtual Machine and Docker toc: true weight: 90 nd-content-type: how-to @@ -262,7 +262,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s sudo systemctl start nginx ``` -18. L4 mitigation +18. L4 accelerated mitigation To enable the `app-protect-dos-ebpf-manager` service to start at boot, run the command: ```shell @@ -479,7 +479,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s sudo systemctl start nginx ``` -18. L4 mitigation +18. L4 accelerated mitigation To enable the `app-protect-dos-ebpf-manager` service to start at boot, run the command: ```shell @@ -908,7 +908,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s sudo systemctl start nginx ``` -16. L4 mitigation +16. L4 accelerated mitigation To enable the `app-protect-dos-ebpf-manager` service to start at boot, run the command: ```shell @@ -933,7 +933,7 @@ You need root permissions to execute the following steps. - `license.jwt`: JWT license file for NGINX Plus license management - `nginx.conf`: User defined `nginx.conf` with `app-protect-dos` enabled - `entrypoint.sh`: Docker startup script which spins up all App Protect DoS processes, must have executable permissions - - custom_log_format.json: Optional user-defined security log format file (if not used - remove its references from the nginx.conf and Dockerfile) + - `custom_log_format.json`: Optional user-defined security log format file (if not used - remove its references from the nginx.conf and Dockerfile) 2. Log in to NGINX Plus Customer Portal and download your `nginx-repo.crt`, `nginx-repo.key` and `license.jwt` files. @@ -1025,35 +1025,20 @@ You need root permissions to execute the following steps. 5. In the same directory create an `entrypoint.sh` file with executable permissions, with the following content: - ```shell - #!/usr/bin/env bash - - USER=nginx - LOGDIR=/var/log/adm - - # prepare environment - mkdir -p /var/run/adm /tmp/cores ${LOGDIR} - chmod 755 /var/run/adm /tmp/cores ${LOGDIR} - chown ${USER}:${USER} /var/run/adm /tmp/cores ${LOGDIR} - - # run processes - /bin/su -s /bin/bash -c "/usr/bin/adminstall > ${LOGDIR}/adminstall.log 2>&1" ${USER} - /bin/su -s /bin/bash -c "/usr/bin/admd -d --log info > ${LOGDIR}/admd.log 2>&1 &" ${USER} - /usr/sbin/nginx -g 'daemon off;' - ``` + {{< include "/dos/dos-entrypoint.md" >}} 6. Create a Docker image: ```shell - DOCKER_BUILDKIT=1 docker build --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key --secret id=license-jwt,src=./license.jwt -t app-protect-dos . + DOCKER_BUILDKIT=1 docker build --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key -t app-protect-dos . ``` The `--no-cache` option tells Docker to build the image from scratch and ensures the installation of the latest version of NGINX Plus and F5 DoS for NGINX. If the Dockerfile was previously used to build an image without the `--no-cache` option, the new image uses versions from the previously built image from the Docker cache. - For RHEL8/9 with subctiption manager setup add build arguments: + For RHEL8/9 with subscription manager setup add build arguments: ```shell - DOCKER_BUILDKIT=1 docker build --build-arg RHEL_ORG=... --build-arg RHEL_ACTIVATION_KEY=... --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key --secret id=license-jwt,src=./license.jwt -t app-protect-dos . + DOCKER_BUILDKIT=1 docker build --build-arg RHEL_ORG=... --build-arg RHEL_ACTIVATION_KEY=... --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key -t app-protect-dos . ``` 8. Verify that the `app-protect-dos` image was created successfully with the docker images command: @@ -1065,7 +1050,7 @@ You need root permissions to execute the following steps. 9. Create a container based on this image, for example, `my-app-protect-dos` container: ```shell - docker run --name my-app-protect-dos -p 80:80 -d app-protect-dos + docker run --name my-app-protect-dos -p 80:80 -v $(PWD)/license.jwt:/etc/nginx/license.jwt -d app-protect-dos ``` 10. Verify that the `my-app-protect-dos` container is up and running with the `docker ps` command: @@ -1082,7 +1067,7 @@ You need root permissions to execute the following steps. mkdir /shared ``` This folder will be used to share data between containers. - Modify the `entrypoint.sh` to run the L4 mitigation: + Modify the `entrypoint.sh` to run the L4 accelerated mitigation: ```shell # run processes @@ -1096,17 +1081,17 @@ You need root permissions to execute the following steps. Create and run the main `app-protect-dos` container: ```shell - docker run --name my-app-protect-dos -v /shared:/shared -p 80:80 -d app-protect-dos + docker run --name my-app-protect-dos -v /shared:/shared -p 80:80 -v $(PWD)/license.jwt:/etc/nginx/license.jwt -d app-protect-dos ``` 2. Deploy Directly on the Host.
To run L4 mitigation directly on the host:
- 1. Install the L4 mitigation on the host, as described in the OS-specific instructions. + 1. Install the L4 accelerated mitigation on the host, as described in the OS-specific instructions. 2. Run the app-protect-dos container: ```shell - docker run --name my-app-protect-dos -v /shared:/shared -p 80:80 -d app-protect-dos + docker run --name my-app-protect-dos -v /shared:/shared -p 80:80 -v $(PWD)/license.jwt:/etc/nginx/license.jwt -d app-protect-dos ``` - 3. Run L4 Mitigation Inside the Same Container as `app-protect-dos`.
- To run both L4 mitigation and the main application within the same container:
+ 3. Run L4 Accelerated Mitigation Inside the Same Container as `app-protect-dos`.
+ To run both L4 accelerated mitigation and the main application within the same container:
1. Modify the `entrypoint.sh`: ```shell ... @@ -1116,7 +1101,7 @@ You need root permissions to execute the following steps. ``` 2. run the container: ```shell - docker run --name my-app-protect-dos -p 80:80 -d app-protect-dos + docker run --name my-app-protect-dos -p 80:80 -v $(PWD)/license.jwt:/etc/nginx/license.jwt -d app-protect-dos ``` {{< call-out "note" >}} @@ -1127,251 +1112,31 @@ You need root permissions to execute the following steps. ### Alpine Docker Deployment Example -```Dockerfile -# syntax=docker/dockerfile:1 -# For Alpine 3.22: -FROM alpine:3.22 - -# Download and add the NGINX signing keys: -RUN wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub - -# Add NGINX Plus/F5 DoS for NGINX repository: -RUN printf "https://pkgs.nginx.com/plus/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories && \ - printf "https://pkgs.nginx.com/app-protect-dos/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories - -# Update the repository and install the most recent version of the F5 DoS for NGINX package (which includes NGINX Plus): -RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apk update && apk add app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/alpine-plus-dos.md" >}} ### AmazonLinux 2023 Docker Deployment Example -```Dockerfile -# For AmazonLinux 2023: -FROM amazonlinux:2023 - -# Install prerequisite packages: -RUN dnf -y install ca-certificates - -# Add NGINX Plus/F5 DoS for NGINX repository: -RUN curl -o /etc/yum.repos.d/plus-amazonlinux2023.repo https://cs.nginx.com/static/files/plus-amazonlinux2023.repo && \ - curl -o /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-dos-amazonlinux2023.repo - -# Install F5 DoS for NGINX: -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - dnf install -y app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - rm /etc/yum.repos.d/plus-amazonlinux2023.repo && \ - rm /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo && \ - dnf clean all && \ - rm -rf /var/cache/dnf - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/amazon-plus-dos.md" >}} ### Debian 11 (Bullseye) / Debian 12 (Bookworm) Docker Deployment Example -```Dockerfile -# Where can be bullseye/bookworm -FROM debian:bullseye - -# Setup repository keys -RUN mkdir -p /etc/ssl/nginx/ /etc/nginx/ && \ - apt-get update && \ - apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 debian-archive-keyring && \ - wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ - printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list && \ - printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx - -# Install F5 DoS for NGINX -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - rm -rf /etc/apt/apt.conf.d/90nginx /var/lib/apt/lists/* - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -COPY nginx.conf /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/debian-plus-dos.md" >}} ### Ubuntu 22.04 (Jammy) / 24.04 (Noble) Docker Deployment Example -```Dockerfile -# Where version can be: jammy/noble -FROM ubuntu:noble - -# Setup repository keys -RUN apt-get update && \ - apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 ubuntu-keyring && \ - wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ - printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/ubuntu $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list && \ - printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx - -# Install F5 DoS for NGINX -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - rm -rf /etc/apt/apt.conf.d/90nginx /var/lib/apt/lists/* +{{< include "/dos/dockerfiles/ubuntu-plus-dos.md" >}} -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -COPY nginx.conf /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh +### RHEL 8 Docker Deployment Example -EXPOSE 80 +{{< include "/dos/dockerfiles/rhel8-plus-dos.md" >}} -STOPSIGNAL SIGQUIT +### RHEL 9 Docker Deployment Example -CMD ["sh", "/root/entrypoint.sh"] -``` - -### RHEL 8 Docker Deployment Example - -```Dockerfile -# For UBI 8 -FROM registry.access.redhat.com/ubi8 - -ARG RHEL_ORG -ARG RHEL_ACTIVATION_KEY - -# Setup repository keys -RUN subscription-manager register --org=${RHEL_ORG} --activationkey=${RHEL_ACTIVATION_KEY} && \ - subscription-manager refresh && \ - subscription-manager attach --auto || true && \ - subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms && \ - subscription-manager repos --enable=rhel-8-for-x86_64-appstream-rpms && \ - dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \ - dnf -y install ca-certificates && \ - curl -o /etc/yum.repos.d/plus-8.repo https://cs.nginx.com/static/files/plus-8.repo && \ - curl -o /etc/yum.repos.d/app-protect-dos-8.repo https://cs.nginx.com/static/files/app-protect-dos-8.repo - -# Install F5 DoS for NGINX -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - dnf -y install app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - rm /etc/yum.repos.d/plus-8.repo && \ - rm /etc/yum.repos.d/app-protect-dos-8.repo && \ - dnf clean all && \ - rm -rf /var/cache/yum - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/rhel9-plus-dos.md" >}} ### Rocky Linux 9 Docker Deployment Example -```Dockerfile -# syntax=docker/dockerfile:1 -# For Rocky Linux 9: -FROM rockylinux:9 - -# Install prerequisite packages: -RUN dnf -y install ca-certificates epel-release 'dnf-command(config-manager)' - -# Add NGINX App-protect-DoS & NGINX Plus repo to Yum: -RUN curl -o /etc/yum.repos.d/plus-9.repo https://cs.nginx.com/static/files/plus-9.repo && \ - curl -o /etc/yum.repos.d/app-protect-dos-9.repo https://cs.nginx.com/static/files/app-protect-dos-9.repo && \ - dnf config-manager --set-enabled crb && \ - dnf clean all - -# Install F5 DoS for NGINX: -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - dnf install -y app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - rm /etc/yum.repos.d/plus-9.repo && \ - rm /etc/yum.repos.d/app-protect-dos-9.repo && \ - dnf clean all && \ - rm -rf /var/cache/dnf - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/rocky9-plus-dos.md" >}} ## Docker Deployment with NGINX App Protect @@ -1509,38 +1274,22 @@ Make sure to replace upstream and proxy pass directives in this example with rel 7. In the same directory create an `entrypoint.sh` file with executable permissions, with the following content: - For Alpine / Debian / Ubuntu / UBI 8 / UBI 9: + For Alpine /AmazonLinux 2023/ Debian / Ubuntu / UBI 8/ UBI 9: + +{{< include "/dos/dos-waf-entrypoint.md" >}} - ```shell - #!/usr/bin/env bash - USER=nginx - LOGDIR=/var/log/adm - - # prepare environment - mkdir -p /var/run/adm /tmp/cores ${LOGDIR} - chmod 755 /var/run/adm /tmp/cores ${LOGDIR} - chown ${USER}:${USER} /var/run/adm /tmp/cores ${LOGDIR} - - # run processes - /bin/su -s /bin/bash -c "/usr/bin/adminstall > ${LOGDIR}/adminstall.log 2>&1" ${USER} - /bin/su -s /bin/bash -c "/opt/app_protect/bin/bd_agent &" ${USER} - /bin/su -s /bin/bash -c "/usr/share/ts/bin/bd-socket-plugin tmm_count 4 proc_cpuinfo_cpu_mhz 2000000 total_xml_memory 307200000 total_umu_max_size 3129344 sys_max_account_id 1024 no_static_config 2>&1 > /var/log/app_protect/bd-socket-plugin.log &" ${USER} - /bin/su -s /bin/bash -c "/usr/bin/admd -d --log info > ${LOGDIR}/admd.log 2>&1 &" ${USER} - /usr/sbin/nginx -g 'daemon off;' - ``` - 8. Create a Docker image: For Debian/Ubuntu/Alpine/Amazon Linux: ```shell - DOCKER_BUILDKIT=1 docker build --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key --secret id=license-jwt,src=./license.jwt -t app-protect-dos . + DOCKER_BUILDKIT=1 docker build --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key -t app-protect-dos . ``` For RHEL: ```shell - DOCKER_BUILDKIT=1 docker build --build-arg RHEL_ORG=... --build-arg RHEL_ACTIVATION_KEY=... --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key --secret id=license-jwt,src=./license.jwt -t app-protect-dos . + DOCKER_BUILDKIT=1 docker build --build-arg RHEL_ORG=... --build-arg RHEL_ACTIVATION_KEY=... --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key -t app-protect-dos . ``` **Notes:** @@ -1557,7 +1306,7 @@ Make sure to replace upstream and proxy pass directives in this example with rel 10. Create a container based on this image, for example, `my-app-protect-dos` container: ```shell - docker run --name my-app-protect-dos -p 80:80 -d app-protect-dos + docker run --name my-app-protect-dos -p 80:80 -v $(PWD)/license.jwt:/etc/nginx/license.jwt -d app-protect-dos ``` 11. Verify that the `my-app-protect-dos` container is up and running with the `docker ps` command: @@ -1568,293 +1317,27 @@ Make sure to replace upstream and proxy pass directives in this example with rel ### Alpine Dockerfile example -```dockerfile -# syntax=docker/dockerfile:1 -# For Alpine 3.22: -FROM alpine:3.22 - -# Download and add the NGINX signing keys: -RUN wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub && \ - wget -O /etc/apk/keys/app-protect-security-updates.rsa.pub https://cs.nginx.com/static/keys/app-protect-security-updates.rsa.pub - -# Add NGINX Plus repository: -RUN printf "https://pkgs.nginx.com/plus/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories - -# Add F5 WAF for NGINX & Dos repositories: -RUN printf "https://pkgs.nginx.com/app-protect-dos/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories && \ - printf "https://pkgs.nginx.com/app-protect/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories && \ - printf "https://pkgs.nginx.com/app-protect-security-updates/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories - -# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): -RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apk update && apk add app-protect app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/alpine-plus-dos-waf.md" >}} ### Amazon Linux Dockerfile example -```dockerfile -# syntax=docker/dockerfile:1 -FROM amazonlinux:2023 - -# Install prerequisite packages: -RUN dnf -y install ca-certificates - -# Add NGINX/NAP WAF/NAP DOS repositories: -RUN curl -o /etc/yum.repos.d/plus-amazonlinux2023.repo https://cs.nginx.com/static/files/plus-amazonlinux2023.repo && \ - curl -o /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-dos-amazonlinux2023.repo && \ - curl -o /etc/yum.repos.d/app-protect-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-amazonlinux2023.repo && \ - curl -o /etc/yum.repos.d/dependencies.amazonlinux2023.repo https://cs.nginx.com/static/files/dependencies.amazonlinux2023.repo - -# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - dnf -y install app-protect app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - rm /etc/yum.repos.d/plus-amazonlinux2023.repo && \ - rm /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo && \ - dnf clean all && \ - rm -rf /var/cache/dnf && \ - rm -rf /var/cache/yum - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/amazon-plus-dos-waf.md" >}} ### Debian Docker Deployment Example -```Dockerfile -# Where version can be: bullseye/bookworm -FROM debian:bullseye - -# Install prerequisite packages: -RUN apt-get update && \ - apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 debian-archive-keyring && \ - wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ - wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor | tee /usr/share/keyrings/app-protect-security-updates.gpg > /dev/null - -# Add NGINX Plus, NGINX App Protect and F5 DoS for NGINX repository: -RUN printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-plus.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect-dos.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect.list \ - && printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] https://pkgs.nginx.com/app-protect-security-updates/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/app-protect-security-updates.list - -# Download the apt configuration to `/etc/apt/apt.conf.d`: -RUN wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx - -# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which includes NGINX Plus): -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list /etc/apt/sources.list.d/nginx-app-protect.list /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - rm -rf /etc/apt/apt.conf.d/90nginx /var/lib/apt/lists/* - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -COPY nginx.conf /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/debian-plus-dos-waf.md" >}} ### Ubuntu Docker Deployment Example -```Dockerfile -# Where version can be:jammy/noble -FROM ubuntu:noble - -# Install prerequisite packages: -RUN apt-get update && \ - apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 ubuntu-keyring && \ - wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ - wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor | tee /usr/share/keyrings/app-protect-security-updates.gpg > /dev/null - -# Add NGINX Plus, NGINX App Protect and F5 DoS for NGINX repository: -RUN printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-plus.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect-dos.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect.list \ - && printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] https://pkgs.nginx.com/app-protect-security-updates/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/app-protect-security-updates.list - -# Download the apt configuration to `/etc/apt/apt.conf.d`: -RUN wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx - -# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list /etc/apt/sources.list.d/nginx-app-protect.list /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - rm -rf /etc/apt/apt.conf.d/90nginx /var/lib/apt/lists/* - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -COPY nginx.conf /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/ubuntu-plus-dos-waf.md" >}} ## F5 DoS for NGINX Arbitrator -### Overview - -F5 DoS for NGINX arbitrator orchestrates all the running F5 DoS for NGINX instances to synchronize local/global attack start/stop. - -F5 DoS for NGINX arbitrator serves as a central coordinating component for managing multiple instances of App Protect DoS in a network. It is needed when there are more than one F5 DoS for NGINX instances. Its primary function is to ensure that all instances are aware of and share the same state for each protected object. Here's a clearer breakdown of how it works and why it's necessary: - -How F5 DoS for NGINX Arbitrator Works: - -- **Collecting State Periodically**: The arbitrator regularly collects the state information from all running instances of App Protect DoS. This collection occurs at set intervals, typically every 10 seconds. -- **State Initialization for New Instances**: When a new App Protect DoS instance is created, it doesn't start with a blank or uninitialized state for a protected object. Instead, it retrieves the initial state for the protected object from the arbitrator. -- **Updating State in Case of an Attack**: If an attack is detected by one of the App Protect DoS instances, that instance sends an attack notification to the arbitrator. The arbitrator then updates the state of the affected protected object to indicate that it is under attack. Importantly, this updated state is propagated to all other instances. - -### Why F5 DoS for NGINX Arbitrator is Necessary - -F5 DoS for NGINX Arbitrator is essential for several reasons: - -- **Global State Management**: Without the arbitrator, each individual instance of App Protect DoS would manage its own isolated state for each protected object. This isolation could lead to inconsistencies. For example, if instance A declared an attack on a protected object named "PO-Example," instance B would remain unaware of this attack, potentially leaving the object vulnerable. -- **Uniform Attack Detection**: With the arbitrator in place, when instance A detects an attack on "PO-Example" and reports it to the arbitrator, the state of "PO-Example" is immediately updated to indicate an attack. This means that all instances, including instance B, are aware of the attack and can take appropriate measures to mitigate it. - -In summary, F5 DoS for NGINX Arbitrator acts as a central coordinator to maintain a consistent and up-to-date global state for protected objects across multiple instances of App Protect DoS. This coordination helps ensure that attacks are properly detected and mitigated, and that knowledge gained by one instance is efficiently shared with others, enhancing the overall security of the network. - - -### F5 DoS for NGINX Arbitrator Deployment - -1. Pull the official F5 DoS for NGINX Arbitrator image with the command: - - ```shell - docker pull docker-registry.nginx.com/nap-dos/app_protect_dos_arb:latest - ``` - -2. Create a container based on this image, for example, `app-protect-dos-arb` container: - - ```shell - docker run --name app_protect_dos_arb -p 3000:3000 -d docker-registry.nginx.com/nap-dos/app_protect_dos_arb - ``` - -3. Verify that the `app-protect-dos-arb` container is up and running with the `docker ps` command. - -4. DNS records are required for F5 DoS for NGINX Arbitrator to work properly and be accessible by F5 DoS for NGINX servers. Ensure that the `svc-appprotect-dos-arb` or configured Arbitrator FQDN (with `app_protect_dos_arb_fqdn` directive) has a valid DNS resolution. -This step is necessary only for VM/Docker deployments with arbitrator. When the arbitrator is in the same Kubernetes namespace as F5 DoS for NGINX, this step is not needed. - -### Multi-VM Deployment - -The Arbitrator service is standalone. Once it is down, it can be seamlessly re-started. It will immediately recover all the needed information from F5 DoS for NGINX instances that communicate to it every 10 sec. It’s downtime is around 10-20 seconds which will not affect the F5 DoS for NGINX working. - -F5 DoS for NGINX Arbitrator service connects to port 3000 and can be seen under App Protect DoS instances. All modules try to connect to this service automatically. If it’s not accessible, each instance works in standalone mode. - -There is no such option for authentications between F5 DoS for NGINX servers and Arbitrator service like MTLS or password . Currently Arbitrator service is not exposed outside of the namespace. It is customers responsibility to isolate it from outside. It is applicable to any deployment of Arbitrator, not only to multi-VM. - +{{< include "/dos/dos-arbitrator.md" >}} + ## Post-Installation Checks -You can run the following commands to ensure that F5 DoS for NGINX enforcement is operational. - -1. Check that the three processes needed for F5 DoS for NGINX are running using `ps aux`: - - - admd - - nginx: master process - - nginx: worker process - - ```shell - USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND - nginx 7759 0.0 0.0 113120 1200 ? Ss Sep06 0:00 /bin/sh -c /usr/bin/admd -d --log info > /var/log/adm/admd.log 2>&1 - root 7765 0.0 0.0 87964 1464 ? Ss Sep06 0:00 nginx: master process /usr/sbin/nginx -g daemon off; - nginx 7767 0.0 0.1 615868 8188 ? Sl Sep06 0:04 nginx: worker process - ``` - -2. Verify that there are no NGINX errors in the `/var/log/nginx/error.log` and that the policy compiled successfully: - - ```shell - 2020/09/07 15:33:44 [notice] 9307#9307: using the "epoll" event method - 2020/09/07 15:33:44 [notice] 9307#9307: nginx/1.19.0 (nginx-plus-r22) - 2020/09/07 15:33:44 [notice] 9307#9307: built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC) - 2020/09/07 15:33:44 [notice] 9307#9307: OS: Linux 3.10.0-327.28.3.el7.x86_64 - 2020/09/07 15:33:44 [notice] 9307#9307: getrlimit(RLIMIT_NOFILE): 1024:4096 - 2020/09/07 15:33:44 [notice] 9310#9310: start worker processes - 2020/09/07 15:33:44 [notice] 9310#9310: start worker process 9311 - PID <9311>, WORKER <0>, Function adm_ngx_init_process, line 684, version: 22+1.19.4-1.el7.ngx - ``` - -3. Check that by applying an attack, the attacker IP addresses are blocked while the good traffic pass through: - - a. Simulate good traffic: - - ```shell - echo "Start Good Traffic 2" - while true; do - curl ${VS}/good1 & - curl ${VS}/good2 & - curl ${VS}/good3 & - curl ${VS}/good4 - sleep 0.1 - done & - ``` - - b. After 7 minutes start the attack: - - ```shell - while [ true ] - do - ab -B ${BAD_IP1} -l -r -n 1000000 -c 150 -d -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ & - ab -B ${BAD_IP2} -l -r -n 1000000 -c 150 -d -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ & - ab -B ${BAD_IP3} -l -r -n 1000000 -c 150 -d -s 10 -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ - - killall ab - done - ``` - - c. See that the good traffic continue as usual while the attackers receive denial of service. +{{< include "dos/install-post-checks.md" >}} To check F5 WAF for NGINX alongside F5 DoS for NGINX, just perform the normal tests as specified at [Admin Guide](https://docs.nginx.com/waf/install/virtual-environment/#post-installation-checks) @@ -1897,315 +1380,6 @@ Review the syslog ports by entering the following command: semanage port -l | grep syslog ``` -## Kubernetes Deployment Examples - -### App Protect DoS - -`appprotect-dos.yaml`: - -```yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: appprotect-dos - namespace: appprotect-dos-wp-diff - labels: - app: appprotect-dos -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - matchLabels: - app: appprotect-dos - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 2 - maxUnavailable: 1 - template: - metadata: - labels: - app: appprotect-dos - spec: - containers: - - name: ubuntu-bados - image: example.com/ubuntu_app_protect_dos_r36:latest - imagePullPolicy: Always - resources: - requests: - cpu: "200m" - memory: "500Mi" - limits: - cpu: "900m" - memory: "800Mi" - ports: - - containerPort: 80 - name: web - - containerPort: 8090 - name: probe - - containerPort: 8091 - name: probe500 - livenessProbe: - httpGet: - path: /app_protect_dos_liveness - port: 8090 - initialDelaySeconds: 0 - periodSeconds: 10 - readinessProbe: - httpGet: - path: /app_protect_dos_readiness - port: 8090 - initialDelaySeconds: 0 - periodSeconds: 10 - volumeMounts: - - name: shared - mountPath: /shared/ - - name: conf - mountPath: /etc/nginx/nginx.conf - subPath: nginx.conf - - name: root-script - mountPath: /root/entrypoint.sh - subPath: entrypoint.sh - - name: log-default - mountPath: /etc/app_protect_dos/log-default.json - subPath: log-default.json - volumes: - - name: shared - persistentVolumeClaim: - claimName: pvc-appprotect-dos-shared - - name: conf - configMap: - name: cm-appprotect-dos-nginx - items: - - key: nginx.conf - path: nginx.conf - - name: root-script - configMap: - name: cm-appprotect-dos-entry - defaultMode: 0755 - items: - - key: entrypoint.sh - path: entrypoint.sh - - name: log-default - configMap: - name: cm-appprotect-dos-log-default - defaultMode: 0755 - items: - - key: log-default.json - path: log-default.json -``` - -`svc-appprotect-dos.yaml`: - -```yaml -apiVersion: v1 -kind: Service -metadata: - name: svc-appprotect-dos - namespace: appprotect-dos-wp-diff - labels: - app: appprotect-dos -spec: - ports: - - name: app - port: 80 - protocol: TCP - nodePort: 80 - selector: - app: appprotect-dos - type: NodePort -``` - -`log-default.json`: - -```json -{ - "filter": { - "traffic-mitigation-stats": "all", - "bad-actors": "all", - "attack-signatures": "all" - } -} -``` - -`entrypoint.sh`: - -```shell -#!/usr/bin/env bash -USER=nginx -LOGDIR=/var/log/adm - -# prepare environment -mkdir -p /var/run/adm /tmp/cores ${LOGDIR} -chmod 755 /var/run/adm /tmp/cores ${LOGDIR} -chown ${USER}:${USER} /var/run/adm /tmp/cores ${LOGDIR} - -# run processes -/bin/su -s /bin/bash -c "/usr/bin/adminstall > ${LOGDIR}/adminstall.log 2>&1" ${USER} -/usr/sbin/nginx -g 'daemon off;' & -/bin/su -s /bin/bash -c "/usr/bin/admd -d --log info > ${LOGDIR}/admd.log 2>&1 &" ${USER} -``` - -`install.sh`: - -```shell -#!/bin/bash -set -ex -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" -kubectl -n appprotect-dos-wp-diff create cm cm-appprotect-dos-nginx --from-file ${DIR}/nginx.conf -kubectl -n appprotect-dos-wp-diff create cm cm-appprotect-dos-entry --from-file ${DIR}/entrypoint.sh -kubectl -n appprotect-dos-wp-diff create cm cm-appprotect-dos-log-default --from-file ${DIR}/log-default.json -kubectl create -f ${DIR}/appprotect-dos.yaml -#kubectl create -f ${DIR}/svc-appprotect-dos.yaml -``` - -`nginx.conf`: - -```nginx -user nginx; -worker_processes 1; -error_log /var/log/nginx/error.log debug; -worker_rlimit_nofile 65535; -working_directory /tmp/cores; - -load_module modules/ngx_http_app_protect_dos_module.so; - -events { - worker_connections 65535; -} -http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - - log_format log_napd ', vs_name_al=$app_protect_dos_vs_name, ip=$remote_addr, tls_fp=$app_protect_dos_tls_fp, ' - 'outcome=$app_protect_dos_outcome, reason=$app_protect_dos_outcome_reason, ' - 'ip_tls=$remote_addr:$app_protect_dos_tls_fp, '; - - app_protect_dos_security_log_enable on; - app_protect_dos_security_log "/etc/app_protect_dos/log-default.json" /var/log/adm/logger.log; - # app_protect_dos_security_log "/etc/app_protect_dos/log-default.json" syslog:server=1.2.3.4:5261; - - app_protect_dos_liveness on; # uri:/app_protect_dos_liveness port:8090 - app_protect_dos_readiness on; # uri:/app_protect_dos_readiness port:8090 - - server { - listen 80 reuseport; - server_name serv; - - set $loggable '0'; - access_log /var/log/nginx/access.log log_napd if=$loggable; - # access_log syslog:server=1.1.1.1:5561 log_napd if=$loggable; - - app_protect_dos_policy_file "/etc/app_protect_dos/BADOSDefaultPolicy.json"; - - location / { - app_protect_dos_enable on; - app_protect_dos_name "App1"; - app_protect_dos_monitor uri=http://serv:80/ protocol=http1; - proxy_pass http://1.2.3.4:80; - } - } - - server { - listen 8090; - server_name probe; - - location / { - proxy_pass http://localhost:8091; - } - } - - server { - listen 8091; - return 503; - } - - sendfile on; - tcp_nopush on; - keepalive_timeout 65; -} -``` - -### App Protect DoS Arbitrator - -Arbitrator (arb) is an internal service that is essential for the scaling scenarios. The arbitrator service should be deployed in the same namespace as F5 DoS for NGINX. - -`appprotect-dos-arb.yaml`: - -```yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: appprotect-dos-arb - namespace: appprotect-dos-wp-diff -spec: - replicas: 1 - selector: - matchLabels: - app: appprotect-dos-arb - template: - metadata: - labels: - app: appprotect-dos-arb - spec: - containers: - - name: arb-svc - image: example.com/app_protect_dos_arb:latest - resources: - requests: - cpu: "200m" - memory: "500Mi" - limits: - cpu: "900m" - memory: "800Mi" - ports: - - containerPort: 3000 -``` - -`svc-appprotect-dos-arb.yaml`: - -```yaml -apiVersion: v1 -kind: Service -metadata: - name: svc-appprotect-dos-arb - namespace: appprotect-dos-wp-diff -spec: - selector: - app: appprotect-dos-arb - ports: - - name: arb - port: 3000 - protocol: TCP - targetPort: 3000 - clusterIP: None -``` - -`install_appprotect-arb.sh`: - -```shell -#!/bin/bash - -set -ex -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" -kubectl -n appprotect-dos-wp-diff apply -f ${DIR}/appprotect-dos-arb.yaml -kubectl -n appprotect-dos-wp-diff apply -f ${DIR}/svc-appprotect-dos-arb.yaml -``` - -`install F5 DoS for NGINX with ARB service`: - -```shell -#!/bin/bash - -set -ex -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" -kubectl create ns appprotect-dos-wp-diff -${DIR}/appprotect-dos/install.sh -${DIR}/appprotect-dos-arb/install_appprotect-dos-arb.sh -``` - ---- - ## App Protect DoS eBPF manager ### Overview diff --git a/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md b/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md index 39dffc953b..397e6ebabe 100644 --- a/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md +++ b/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md @@ -343,7 +343,24 @@ Any other response will indicate that our NGINX module (F5 DoS for NGINX) has no **Example:** ```nginx -app_protect_dos_liveness on uri:/liveness port:8090; +http { + + app_protect_dos_readiness on uri:/liveness port:8090; + + server { + listen 8090; + server_name probe; + + location / { + proxy_pass http://localhost:8091; + } + } + + server { + listen 8091; + return 503; + } +} ``` ### Readiness probe directive (`app_protect_dos_readiness`) @@ -375,7 +392,24 @@ RC 200 "Ready" will occur if two conditions are met: **Example:** ```nginx -app_protect_dos_readiness on uri:/readiness port:8090; +http { + + app_protect_dos_readiness on uri:/readiness port:8090; + + server { + listen 8090; + server_name probe; + + location / { + proxy_pass http://localhost:8091; + } + } + + server { + listen 8091; + return 503; + } +} ``` ### Arbitrator FQDN directive (`app_protect_dos_arb_fqdn`) diff --git a/content/nap-dos/monitoring/types-of-logs.md b/content/nap-dos/monitoring/types-of-logs.md index eea14621c6..3a1d9de4d6 100644 --- a/content/nap-dos/monitoring/types-of-logs.md +++ b/content/nap-dos/monitoring/types-of-logs.md @@ -12,8 +12,8 @@ There are 4 types of logs corresponding to App Protect DoS: - [Security Log](#security-log): The general picture of the site and how App Protect DoS processed it, including anomalies and signatures found. - [Operation Log](#operation-log): Events such as configuration errors or warnings. -- [Debug Logs](#debug-log): Technical messages at different levels of severity used to debug and resolve incidents and error behaviors. - [Request Logging](#request-log): F5 DoS for NGINX adds information to each request logged to NGINX's access logging mechanism. +- [Debug Logs](#debug-log): Technical messages at different levels of severity used to debug and resolve incidents and error behaviors. {{< call-out "note" >}} NGINX does not have audit logs in the sense of *"**who** did **what**"*. This can be done either from the orchestration system controlling NGINX (such as NGINX Controller) or by tracking the configuration files and the systemd invocations using Linux tools. @@ -48,7 +48,7 @@ This directive determines the destination of the `access_log` and the name of th ### App Protect DoS Variables These are the variables added to Access Log. They are a subset of the Security log attributes. The Security log names are prefixed with `$app_protect_dos`.
For more information refer to [F5 DoS for NGINX Access Log]({{< ref "/nap-dos/monitoring/access-log.md" >}}) -## Debug Log - F5 DoS for NGINX +## Debug Log The F5 DoS for NGINX Debug log is used to troubleshoot the functionality of the product.
The path of the log is at a fixed location: `/var/log/adm/admd.log`. diff --git a/content/nap-dos/troubleshooting/how-to-troubleshoot.md b/content/nap-dos/troubleshooting/how-to-troubleshoot.md index 019de886ed..123f805227 100644 --- a/content/nap-dos/troubleshooting/how-to-troubleshoot.md +++ b/content/nap-dos/troubleshooting/how-to-troubleshoot.md @@ -28,7 +28,7 @@ This Troubleshooting Guide is intended to provide guidance to customers in the d | More protected objects than expected | The `app_protect_dos_enable` directive is inherited by all server and location blocks beneath it, each block will be a protected object.
Consider moving this directive from outer to inner block.
Refer to: [F5 DoS for NGINX - Directives and Policy]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md" >}}) | | `No DOS protection for ngx_worker at idx X` warning message | There are more nginx processes than allowed.
Either decrease the number of nginx processes (ngx_processes directive in `nginx.conf` file) or increase the number of supported workers for F5 DoS for NGINX using the flag `--max-workers NUM` for `/usr/bin/adminstall`. | | `unknown directive 'app_protect_dos_xxx'` error message | App Protect DOS module is not loaded. Add this line to the main (global) context of nginx.conf:
`load_module "/etc/nginx/modules/ngx_http_app_protect_dos_module.so";` | -| NGINX struggles handling a high rate of incoming connections | Linux machine should be tuned for optimal performance.
Refer to [Tuning NGINX for Performance](https://www.nginx.com/blog/tuning-nginx/) | +| NGINX struggles handling a high rate of incoming connections | Linux machine should be tuned for optimal performance.
Refer to [Tuning NGINX for Performance](https://www.f5.com/company/blog/nginx/tuning-nginx) | | Error in `adminstall` process, such as `Failed to allocate` | Insufficient memory to allocate all the required resources.
Increase the `--memory` size or decrease the number of nginx workers (`--max_workers`) if not all of them are going to be in use.
Use the `--help` flag for more info. | {{}}