diff --git a/content/includes/dos/dockerfiles/alpine-ebpf-manager.md b/content/includes/dos/dockerfiles/alpine-ebpf-manager.md new file mode 100644 index 000000000..4a7a008b7 --- /dev/null +++ b/content/includes/dos/dockerfiles/alpine-ebpf-manager.md @@ -0,0 +1,28 @@ +--- +--- + +```dockerfile +# syntax=docker/dockerfile:1 + +# Supported OS_VER's are 3.21/3.22 +ARG OS_VER="3.22" + +# Base image +FROM alpine:${OS_VER} + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ + wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub \ + && printf "https://pkgs.nginx.com/app-protect-dos/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories \ + && apk update \ + && apk add app-protect-dos-ebpf-manager \ + && rm -rf /var/cache/apk/* \ + && adduser -D -S -H -s /sbin/nologin nginx + +RUN ebpf_manager_dos -v + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/alpine-plus-dos-waf.md b/content/includes/dos/dockerfiles/alpine-plus-dos-waf.md index 736689084..7845f0d72 100644 --- a/content/includes/dos/dockerfiles/alpine-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/alpine-plus-dos-waf.md @@ -10,7 +10,40 @@ ARG OS_VER="3.22" # Base image FROM alpine:${OS_VER} -# Install NGINX Plus and F5 DOS for NGINX +# Download and add the NGINX signing keys: +RUN wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub && \ + wget -O /etc/apk/keys/app-protect-security-updates.rsa.pub https://cs.nginx.com/static/keys/app-protect-security-updates.rsa.pub +# Add NGINX Plus repository: +RUN printf "https://pkgs.nginx.com/plus/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories +# Add F5 WAF for NGINX & Dos repositories: +RUN printf "https://pkgs.nginx.com/app-protect-dos/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories && \ + printf "https://pkgs.nginx.com/app-protect/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories && \ + printf "https://pkgs.nginx.com/app-protect-security-updates/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories + +# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): +RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ + --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ + apk update && apk add app-protect app-protect-dos && \ + cat license.jwt > /etc/nginx/license.jwt + +# Forward request logs to Docker log collector: +RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ + ln -sf /dev/stderr /var/log/nginx/error.log + +RUN nginx -v && admd -v +RUN cat /opt/app_protect/VERSION /opt/app_protect/RELEASE + +# Copy configuration files: +COPY nginx.conf custom_log_format.json /etc/nginx/ +COPY entrypoint.sh /root/ +RUN chmod +x /root/entrypoint.sh + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["sh", "/root/entrypoint.sh"] ``` diff --git a/content/includes/dos/dockerfiles/alpine-plus-dos.md b/content/includes/dos/dockerfiles/alpine-plus-dos.md index df18076e3..02cc66995 100644 --- a/content/includes/dos/dockerfiles/alpine-plus-dos.md +++ b/content/includes/dos/dockerfiles/alpine-plus-dos.md @@ -24,6 +24,8 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ && ln -sf /dev/stderr /var/log/nginx/error.log \ && rm -rf /var/cache/apk/* +RUN nginx -v && admd -v + # Copy configuration files: COPY nginx.conf custom_log_format.json /etc/nginx/ COPY entrypoint.sh /root/ @@ -34,5 +36,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/amazon-ebpf-manager.md b/content/includes/dos/dockerfiles/amazon-ebpf-manager.md new file mode 100644 index 000000000..b926c197f --- /dev/null +++ b/content/includes/dos/dockerfiles/amazon-ebpf-manager.md @@ -0,0 +1,23 @@ +--- +--- + +```dockerfile +# For AmazonLinux 2023: +FROM amazonlinux:2023 + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf -y install ca-certificates shadow-utils \ + && curl -o /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-dos-amazonlinux2023.repo \ + && dnf install -y app-protect-dos-ebpf-manager \ + && dnf clean all \ + && rm -rf /var/cache/dnf \ + && useradd -r -s /usr/sbin/nologin nginx + +RUN ebpf_manager_dos -v + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/amazon-plus-dos-waf.md b/content/includes/dos/dockerfiles/amazon-plus-dos-waf.md index e69de29bb..dc023d49b 100644 --- a/content/includes/dos/dockerfiles/amazon-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/amazon-plus-dos-waf.md @@ -0,0 +1,46 @@ +--- +--- + +```dockerfile +# syntax=docker/dockerfile:1 +FROM amazonlinux:2023 + +# Install prerequisite packages: +RUN dnf -y install ca-certificates + +# Add NGINX/NAP WAF/NAP DOS repositories: +RUN curl -o /etc/yum.repos.d/plus-amazonlinux2023.repo https://cs.nginx.com/static/files/plus-amazonlinux2023.repo && \ + curl -o /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-dos-amazonlinux2023.repo && \ + curl -o /etc/yum.repos.d/app-protect-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-amazonlinux2023.repo && \ + curl -o /etc/yum.repos.d/dependencies.amazonlinux2023.repo https://cs.nginx.com/static/files/dependencies.amazonlinux2023.repo + +# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ + dnf -y install app-protect app-protect-dos && \ + cat license.jwt > /etc/nginx/license.jwt && \ + rm /etc/yum.repos.d/plus-amazonlinux2023.repo && \ + rm /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo && \ + dnf clean all && \ + rm -rf /var/cache/dnf && \ + rm -rf /var/cache/yum + +# Forward request logs to Docker log collector: +RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ + ln -sf /dev/stderr /var/log/nginx/error.log + +RUN nginx -v && admd -v +RUN cat /opt/app_protect/VERSION /opt/app_protect/RELEASE + +# Copy configuration files: +COPY nginx.conf custom_log_format.json /etc/nginx/ +COPY entrypoint.sh /root/ +RUN chmod +x /root/entrypoint.sh + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["sh", "/root/entrypoint.sh"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/amazon-plus-dos.md b/content/includes/dos/dockerfiles/amazon-plus-dos.md index aeff507ad..db497f208 100644 --- a/content/includes/dos/dockerfiles/amazon-plus-dos.md +++ b/content/includes/dos/dockerfiles/amazon-plus-dos.md @@ -2,7 +2,6 @@ --- ```dockerfile - # For AmazonLinux 2023: FROM amazonlinux:2023 @@ -20,6 +19,8 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log +RUN nginx -v && admd -v + # Copy configuration files: COPY nginx.conf custom_log_format.json /etc/nginx/ COPY entrypoint.sh /root/ @@ -30,5 +31,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/debian-ebpf-manager.md b/content/includes/dos/dockerfiles/debian-ebpf-manager.md new file mode 100644 index 000000000..bef23b5a5 --- /dev/null +++ b/content/includes/dos/dockerfiles/debian-ebpf-manager.md @@ -0,0 +1,34 @@ +--- +--- + +```dockerfile +# Where can be bullseye/bookworm +FROM debian:bullseye + +# Install F5 DoS for NGINX +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + apt-get update \ + && apt-get install -y --no-install-recommends \ + apt-transport-https \ + lsb-release \ + ca-certificates \ + wget \ + gnupg2 \ + debian-archive-keyring \ + && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \ + | gpg --dearmor \ + | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian $(lsb_release -cs) nginx-plus" \ + > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + && wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect-dos-ebpf-manager \ + && apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* + +RUN ebpf_manager_dos -v + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/debian-plus-dos-waf.md b/content/includes/dos/dockerfiles/debian-plus-dos-waf.md index e69de29bb..a69204a42 100644 --- a/content/includes/dos/dockerfiles/debian-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/debian-plus-dos-waf.md @@ -0,0 +1,48 @@ +--- +--- + +```dockerfile +# Where version can be: bullseye/bookworm +FROM debian:bullseye + +# Install prerequisite packages: +RUN apt-get update && \ + apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 debian-archive-keyring && \ + wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ + wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor | tee /usr/share/keyrings/app-protect-security-updates.gpg > /dev/null + +# Add NGINX Plus, NGINX App Protect and F5 DoS for NGINX repository: +RUN printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-plus.list \ + && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect.list \ + && printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] https://pkgs.nginx.com/app-protect-security-updates/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/app-protect-security-updates.list + +# Download the apt configuration to `/etc/apt/apt.conf.d`: +RUN wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx + +# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which includes NGINX Plus): +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ + apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect app-protect-dos && \ + cat license.jwt > /etc/nginx/license.jwt && \ + apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list /etc/apt/sources.list.d/nginx-app-protect.list /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ + rm -rf /etc/apt/apt.conf.d/90nginx /var/lib/apt/lists/* + +# Forward request logs to Docker log collector: +RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ + ln -sf /dev/stderr /var/log/nginx/error.log + +RUN nginx -v && admd -v +RUN cat /opt/app_protect/VERSION /opt/app_protect/RELEASE + +COPY nginx.conf /etc/nginx/ +COPY entrypoint.sh /root/ +RUN chmod +x /root/entrypoint.sh + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["sh", "/root/entrypoint.sh"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/debian-plus-dos.md b/content/includes/dos/dockerfiles/debian-plus-dos.md index 2f544d367..2a62131ec 100644 --- a/content/includes/dos/dockerfiles/debian-plus-dos.md +++ b/content/includes/dos/dockerfiles/debian-plus-dos.md @@ -2,7 +2,6 @@ --- ```dockerfile - # Where can be bullseye/bookworm FROM debian:bullseye @@ -11,19 +10,29 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ apt-get update \ - && DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 debian-archive-keyring \ - && mkdir -p /etc/ssl/nginx/ /etc/nginx/ \ - && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + && apt-get install -y --no-install-recommends \ + apt-transport-https \ + lsb-release \ + ca-certificates \ + wget \ + gnupg2 \ + debian-archive-keyring \ + && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \ + | gpg --dearmor \ + | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian $(lsb_release -cs) nginx-plus" \ + > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ && wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect-dos \ && cat license.jwt > /etc/nginx/license.jwt \ - && apt-get remove --purge --auto-remove -y \ - && rm -rf /var/lib/apt/lists/* \ + && apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log +RUN nginx -v && admd -v + COPY nginx.conf /etc/nginx/ COPY entrypoint.sh /root/ RUN chmod +x /root/entrypoint.sh @@ -33,5 +42,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rhel8-ebpf-manager.md b/content/includes/dos/dockerfiles/rhel8-ebpf-manager.md new file mode 100644 index 000000000..58498ebbb --- /dev/null +++ b/content/includes/dos/dockerfiles/rhel8-ebpf-manager.md @@ -0,0 +1,28 @@ +--- +--- + +```dockerfile +# For UBI 8 +FROM registry.access.redhat.com/ubi8 + +ARG RHEL_ORG +ARG RHEL_ACTIVATION_KEY + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \ + && dnf -y install ca-certificates \ + && curl -o /etc/yum.repos.d/app-protect-dos-8.repo https://cs.nginx.com/static/files/app-protect-dos-8.repo \ + && dnf -y install app-protect-dos-ebpf-manager \ + && rm /etc/yum.repos.d/app-protect-dos-8.repo \ + && dnf clean all \ + && rm -rf /var/cache/yum \ + && useradd -r -s /usr/sbin/nologin nginx + +RUN ebpf_manager_dos -v + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rhel8-plus-dos-waf.md b/content/includes/dos/dockerfiles/rhel8-plus-dos-waf.md index e69de29bb..8fcc9ce82 100644 --- a/content/includes/dos/dockerfiles/rhel8-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/rhel8-plus-dos-waf.md @@ -0,0 +1,5 @@ +--- +--- + +```dockerfile +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rhel8-plus-dos.md b/content/includes/dos/dockerfiles/rhel8-plus-dos.md index 12be0b12c..4568937e2 100644 --- a/content/includes/dos/dockerfiles/rhel8-plus-dos.md +++ b/content/includes/dos/dockerfiles/rhel8-plus-dos.md @@ -8,13 +8,22 @@ FROM registry.access.redhat.com/ubi8 ARG RHEL_ORG ARG RHEL_ACTIVATION_KEY -# Install F5 DoS for NGINX +# Install F5 DoS for NGINXWhat is the diff between following I see in F5 WAF for NGINX + +https://docs.nginx.com/waf/install/docker/#ubuntu + +apt install -y app-protect-module-plus + +and following that we have on F5 DOS for NGINX + +apt-get install -y app-protect + + RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ subscription-manager register --org=${RHEL_ORG} --activationkey=${RHEL_ACTIVATION_KEY} \ && subscription-manager refresh \ - && subscription-manager attach --auto || true \ && subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms \ && subscription-manager repos --enable=rhel-8-for-x86_64-appstream-rpms \ && dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \ @@ -28,9 +37,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && dnf clean all \ && rm -rf /var/cache/yum \ && ln -sf /dev/stdout /var/log/nginx/access.log \ - && ln -sf /dev/stderr /var/log/nginx/error.log + && ln -sf /dev/stderr /var/log/nginx/error.log \ + && subscription-manager unregister + +RUN nginx -v && admd -v -# Copy configuration files: COPY nginx.conf custom_log_format.json /etc/nginx/ COPY entrypoint.sh /root/ RUN chmod +x /root/entrypoint.sh @@ -40,5 +51,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rhel9-ebpf-manager.md b/content/includes/dos/dockerfiles/rhel9-ebpf-manager.md new file mode 100644 index 000000000..1080e5f18 --- /dev/null +++ b/content/includes/dos/dockerfiles/rhel9-ebpf-manager.md @@ -0,0 +1,28 @@ +--- +--- + +```dockerfile +# For UBI 9 +FROM registry.access.redhat.com/ubi9 + +ARG RHEL_ORG +ARG RHEL_ACTIVATION_KEY + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \ + && dnf -y install ca-certificates \ + && curl -o /etc/yum.repos.d/app-protect-dos-9.repo https://cs.nginx.com/static/files/app-protect-dos-9.repo \ + && dnf -y install app-protect-dos-ebpf-manager \ + && rm /etc/yum.repos.d/app-protect-dos-9.repo \ + && dnf clean all \ + && rm -rf /var/cache/yum \ + && useradd -r -s /usr/sbin/nologin nginx + +RUN ebpf_manager_dos -v + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rhel9-plus-dos-waf.md b/content/includes/dos/dockerfiles/rhel9-plus-dos-waf.md index e69de29bb..8fcc9ce82 100644 --- a/content/includes/dos/dockerfiles/rhel9-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/rhel9-plus-dos-waf.md @@ -0,0 +1,5 @@ +--- +--- + +```dockerfile +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rhel9-plus-dos.md b/content/includes/dos/dockerfiles/rhel9-plus-dos.md index f9bd2550d..cb0f3e589 100644 --- a/content/includes/dos/dockerfiles/rhel9-plus-dos.md +++ b/content/includes/dos/dockerfiles/rhel9-plus-dos.md @@ -14,7 +14,6 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ subscription-manager register --org=${RHEL_ORG} --activationkey=${RHEL_ACTIVATION_KEY} \ && subscription-manager refresh \ - && subscription-manager attach --auto || true \ && subscription-manager repos --enable=rhel-9-for-x86_64-baseos-rpms \ && subscription-manager repos --enable=rhel-9-for-x86_64-appstream-rpms \ && dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \ @@ -28,7 +27,8 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && dnf clean all \ && rm -rf /var/cache/yum \ && ln -sf /dev/stdout /var/log/nginx/access.log \ - && ln -sf /dev/stderr /var/log/nginx/error.log + && ln -sf /dev/stderr /var/log/nginx/error.log \ + && subscription-manager unregister # Copy configuration files: COPY nginx.conf custom_log_format.json /etc/nginx/ @@ -40,5 +40,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rocky9-ebpf-manager.md b/content/includes/dos/dockerfiles/rocky9-ebpf-manager.md new file mode 100644 index 000000000..83e3ea9a8 --- /dev/null +++ b/content/includes/dos/dockerfiles/rocky9-ebpf-manager.md @@ -0,0 +1,25 @@ +--- +--- + +```dockerfile +# syntax=docker/dockerfile:1 +# For Rocky Linux 9 +FROM rockylinux:9 + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf -y install ca-certificates epel-release 'dnf-command(config-manager)' \ + && curl -o /etc/yum.repos.d/app-protect-dos-9.repo https://cs.nginx.com/static/files/app-protect-dos-9.repo \ + && dnf config-manager --set-enabled crb \ + && dnf install -y app-protect-dos-ebpf-manager \ + && dnf clean all \ + && rm -rf /var/cache/dnf \ + && useradd -r -s /usr/sbin/nologin nginx + +RUN ebpf_manager_dos -v + +STOPSIGNAL SIGQUIT + +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rocky9-plus-dos-waf.md b/content/includes/dos/dockerfiles/rocky9-plus-dos-waf.md index e69de29bb..8fcc9ce82 100644 --- a/content/includes/dos/dockerfiles/rocky9-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/rocky9-plus-dos-waf.md @@ -0,0 +1,5 @@ +--- +--- + +```dockerfile +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/rocky9-plus-dos.md b/content/includes/dos/dockerfiles/rocky9-plus-dos.md index b779713b2..cff5570bc 100644 --- a/content/includes/dos/dockerfiles/rocky9-plus-dos.md +++ b/content/includes/dos/dockerfiles/rocky9-plus-dos.md @@ -2,7 +2,6 @@ --- ```dockerfile - # syntax=docker/dockerfile:1 # For Rocky Linux 9 FROM rockylinux:9 @@ -32,5 +31,4 @@ EXPOSE 80 STOPSIGNAL SIGQUIT CMD ["sh", "/root/entrypoint.sh"] - ``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/ubuntu-ebpf-manager.md b/content/includes/dos/dockerfiles/ubuntu-ebpf-manager.md new file mode 100644 index 000000000..e58e530dc --- /dev/null +++ b/content/includes/dos/dockerfiles/ubuntu-ebpf-manager.md @@ -0,0 +1,40 @@ +--- +--- + +```dockerfile +# syntax=docker/dockerfile:1 +# For Ubuntu + +# Where version can be: jammy/noble +FROM ubuntu:noble + +# Install F5 DoS ebpf manager for NGINX and create required nginx user +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + apt-get update \ + && apt-get install -y --no-install-recommends \ + apt-transport-https \ + lsb-release \ + ca-certificates \ + wget \ + gnupg2 \ + ubuntu-keyring \ + && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \ + | gpg --dearmor \ + | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu $(lsb_release -cs) nginx-plus" \ + > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + && wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y app-protect-dos-ebpf-manager \ + && apt-get remove --purge --auto-remove -y \ + && rm -rf /var/lib/apt/lists/* \ + && useradd -r -s /usr/sbin/nologin nginx + +STOPSIGNAL SIGQUIT + +RUN ebpf_manager_dos -v + +# Idle forever +CMD ["bash", "-c", "/usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/ubuntu-plus-dos-waf.md b/content/includes/dos/dockerfiles/ubuntu-plus-dos-waf.md index e69de29bb..17c657d18 100644 --- a/content/includes/dos/dockerfiles/ubuntu-plus-dos-waf.md +++ b/content/includes/dos/dockerfiles/ubuntu-plus-dos-waf.md @@ -0,0 +1,48 @@ +--- +--- + +```dockerfile +# Where version can be:jammy/noble +FROM ubuntu:noble + +# Install prerequisite packages: +RUN apt-get update && \ + apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 ubuntu-keyring && \ + wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ + wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor | tee /usr/share/keyrings/app-protect-security-updates.gpg > /dev/null + +# Add NGINX Plus, NGINX App Protect and F5 DoS for NGINX repository: +RUN printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-plus.list \ + && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect.list \ + && printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] https://pkgs.nginx.com/app-protect-security-updates/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/app-protect-security-updates.list + +# Download the apt configuration to `/etc/apt/apt.conf.d`: +RUN wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx + +# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ + apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect app-protect-dos && \ + cat license.jwt > /etc/nginx/license.jwt && \ + apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list /etc/apt/sources.list.d/nginx-app-protect.list /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ + rm -rf /etc/apt/apt.conf.d/90nginx /var/lib/apt/lists/* + +# Forward request logs to Docker log collector: +RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ + ln -sf /dev/stderr /var/log/nginx/error.log + +RUN nginx -v && admd -v +RUN cat /opt/app_protect/VERSION /opt/app_protect/RELEASE + +COPY nginx.conf /etc/nginx/ +COPY entrypoint.sh /root/ +RUN chmod +x /root/entrypoint.sh + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["sh", "/root/entrypoint.sh"] +``` \ No newline at end of file diff --git a/content/includes/dos/dockerfiles/ubuntu-plus-dos.md b/content/includes/dos/dockerfiles/ubuntu-plus-dos.md index 90db16e60..132b93e2c 100644 --- a/content/includes/dos/dockerfiles/ubuntu-plus-dos.md +++ b/content/includes/dos/dockerfiles/ubuntu-plus-dos.md @@ -2,32 +2,40 @@ --- ```dockerfile - # syntax=docker/dockerfile:1 # For Ubuntu # Where version can be: jammy/noble FROM ubuntu:noble -# Setup repository keys -RUN apt-get update && \ - # Install F5 DoS for NGINX RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ apt-get update \ - && apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 ubuntu-keyring \ - && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/ubuntu $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ + && apt-get install -y --no-install-recommends \ + apt-transport-https \ + lsb-release \ + ca-certificates \ + wget \ + gnupg2 \ + ubuntu-keyring \ + && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \ + | gpg --dearmor \ + | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/ubuntu $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \ + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu $(lsb_release -cs) nginx-plus" \ + > /etc/apt/sources.list.d/nginx-app-protect-dos.list \ && wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \ + && DEBIAN_FRONTEND=noninteractive apt-get update \ && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect-dos \ && cat license.jwt > /etc/nginx/license.jwt \ && apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log +RUN nginx -v && admd -v + COPY nginx.conf /etc/nginx/ COPY entrypoint.sh /root/ RUN chmod +x /root/entrypoint.sh diff --git a/content/includes/dos/dos-arbitrator.md b/content/includes/dos/dos-arbitrator.md new file mode 100644 index 000000000..6c3612a44 --- /dev/null +++ b/content/includes/dos/dos-arbitrator.md @@ -0,0 +1,57 @@ +--- +nd-docs: null +nd-files: +- content/nap-dos/deployment-guide/kubernetes.md +- content/nap-dos/deployment-guide/kubernetes-with-L3-mitigation.md +--- +## F5 DoS for NGINX Arbitrator + +### Overview + +F5 DoS for NGINX arbitrator orchestrates all the running F5 DoS for NGINX instances to synchronize local/global attack start/stop. + +F5 DoS for NGINX arbitrator serves as a central coordinating component for managing multiple instances of App Protect DoS in a network. It is needed when there are more than one F5 DoS for NGINX instances. Its primary function is to ensure that all instances are aware of and share the same state for each protected object. Here's a clearer breakdown of how it works and why it's necessary: + +How F5 DoS for NGINX Arbitrator Works: + +- **Collecting State Periodically**: The arbitrator regularly collects the state information from all running instances of App Protect DoS. This collection occurs at set intervals, typically every 10 seconds. +- **State Initialization for New Instances**: When a new App Protect DoS instance is created, it doesn't start with a blank or uninitialized state for a protected object. Instead, it retrieves the initial state for the protected object from the arbitrator. +- **Updating State in Case of an Attack**: If an attack is detected by one of the App Protect DoS instances, that instance sends an attack notification to the arbitrator. The arbitrator then updates the state of the affected protected object to indicate that it is under attack. Importantly, this updated state is propagated to all other instances. + +### Why F5 DoS for NGINX Arbitrator is Necessary + +F5 DoS for NGINX Arbitrator is essential for several reasons: + +- **Global State Management**: Without the arbitrator, each individual instance of App Protect DoS would manage its own isolated state for each protected object. This isolation could lead to inconsistencies. For example, if instance A declared an attack on a protected object named "PO-Example," instance B would remain unaware of this attack, potentially leaving the object vulnerable. +- **Uniform Attack Detection**: With the arbitrator in place, when instance A detects an attack on "PO-Example" and reports it to the arbitrator, the state of "PO-Example" is immediately updated to indicate an attack. This means that all instances, including instance B, are aware of the attack and can take appropriate measures to mitigate it. + +In summary, F5 DoS for NGINX Arbitrator acts as a central coordinator to maintain a consistent and up-to-date global state for protected objects across multiple instances of App Protect DoS. This coordination helps ensure that attacks are properly detected and mitigated, and that knowledge gained by one instance is efficiently shared with others, enhancing the overall security of the network. + + +### F5 DoS for NGINX Arbitrator Deployment + +1. Pull the official F5 DoS for NGINX Arbitrator image with the command: + + ```shell + docker pull docker-registry.nginx.com/nap-dos/app_protect_dos_arb:latest + ``` + +2. Create a container based on this image, for example, `app-protect-dos-arb` container: + + ```shell + docker run --name app_protect_dos_arb -p 3000:3000 -d docker-registry.nginx.com/nap-dos/app_protect_dos_arb + ``` + +3. Verify that the `app-protect-dos-arb` container is up and running with the `docker ps` command. + +4. DNS records are required for F5 DoS for NGINX Arbitrator to work properly and be accessible by F5 DoS for NGINX servers. Ensure that the `svc-appprotect-dos-arb` or configured Arbitrator FQDN (with `app_protect_dos_arb_fqdn` directive) has a valid DNS resolution. + This step is necessary only for VM/Docker deployments with arbitrator. When the arbitrator is in the same Kubernetes namespace as F5 DoS for NGINX, this step is not needed. + +### Multi-VM Deployment + +The Arbitrator service is standalone. Once it is down, it can be seamlessly re-started. It will immediately recover all the needed information from F5 DoS for NGINX instances that communicate to it every 10 sec. It’s downtime is around 10-20 seconds which will not affect the F5 DoS for NGINX working. + +F5 DoS for NGINX Arbitrator service connects to port 3000 and can be seen under App Protect DoS instances. All modules try to connect to this service automatically. If it’s not accessible, each instance works in standalone mode. + +There is no such option for authentications between F5 DoS for NGINX servers and Arbitrator service like MTLS or password . Currently Arbitrator service is not exposed outside of the namespace. It is customers responsibility to isolate it from outside. It is applicable to any deployment of Arbitrator, not only to multi-VM. + diff --git a/content/includes/dos/dos-entrypoint.md b/content/includes/dos/dos-entrypoint.md new file mode 100644 index 000000000..3f66756a7 --- /dev/null +++ b/content/includes/dos/dos-entrypoint.md @@ -0,0 +1,24 @@ +--- +nd-docs: null +nd-files: +- content/nap-dos/deployment-guide/learn-about-deployment.md +- content/nap-dos/deployment-guide/kubernetes.md +- content/nap-dos/deployment-guide/kubernetes-with-L3-mitigation.md +--- + +```shell + #!/usr/bin/env bash + + USER=nginx + LOGDIR=/var/log/adm + + # prepare environment + mkdir -p /var/run/adm /tmp/cores ${LOGDIR} + chmod 755 /var/run/adm /tmp/cores ${LOGDIR} + chown ${USER}:${USER} /var/run/adm /tmp/cores ${LOGDIR} + + # run processes + /bin/su -s /bin/bash -c "/usr/bin/adminstall > ${LOGDIR}/adminstall.log 2>&1" ${USER} + /bin/su -s /bin/bash -c "/usr/bin/admd -d --log info > ${LOGDIR}/admd.log 2>&1 &" ${USER} + /usr/sbin/nginx -g 'daemon off;' +``` \ No newline at end of file diff --git a/content/includes/dos/dos-waf-entrypoint.md b/content/includes/dos/dos-waf-entrypoint.md new file mode 100644 index 000000000..ce1ad43f5 --- /dev/null +++ b/content/includes/dos/dos-waf-entrypoint.md @@ -0,0 +1,27 @@ +--- +nd-docs: null +nd-files: +- content/nap-dos/deployment-guide/learn-about-deployment.md +- content/nap-dos/deployment-guide/kubernetes.md +- content/nap-dos/deployment-guide/kubernetes-with-L3-mitigation.md +--- + + +```shell + + #!/usr/bin/env bash + USER=nginx + LOGDIR=/var/log/adm + + # prepare environment + mkdir -p /var/run/adm /tmp/cores ${LOGDIR} + chmod 755 /var/run/adm /tmp/cores ${LOGDIR} + chown ${USER}:${USER} /var/run/adm /tmp/cores ${LOGDIR} + + # run processes + /bin/su -s /bin/bash -c "/usr/bin/adminstall > ${LOGDIR}/adminstall.log 2>&1" ${USER} + /bin/su -s /bin/bash -c "/opt/app_protect/bin/bd_agent &" ${USER} + /bin/su -s /bin/bash -c "/usr/share/ts/bin/bd-socket-plugin tmm_count 4 proc_cpuinfo_cpu_mhz 2000000 total_xml_memory 307200000 total_umu_max_size 3129344 sys_max_account_id 1024 no_static_config 2>&1 > /var/log/app_protect/bd-socket-plugin.log &" ${USER} + /bin/su -s /bin/bash -c "/usr/bin/admd -d --log info > ${LOGDIR}/admd.log 2>&1 &" ${USER} + /usr/sbin/nginx -g 'daemon off;' +``` \ No newline at end of file diff --git a/content/includes/dos/ebpf-manager-entrypoint.md b/content/includes/dos/ebpf-manager-entrypoint.md new file mode 100644 index 000000000..385e3219d --- /dev/null +++ b/content/includes/dos/ebpf-manager-entrypoint.md @@ -0,0 +1,7 @@ +--- +nd-docs: null +nd-files: +- content/nap-dos/deployment-guide/learn-about-deployment.md +- content/nap-dos/deployment-guide/kubernetes.md +- content/nap-dos/deployment-guide/kubernetes-with-L3-mitigation.md +--- \ No newline at end of file diff --git a/content/includes/dos/install-post-checks.md b/content/includes/dos/install-post-checks.md new file mode 100644 index 000000000..f106ddf36 --- /dev/null +++ b/content/includes/dos/install-post-checks.md @@ -0,0 +1,91 @@ +--- +nd-docs: null +nd-files: +- content/nap-dos/deployment-guide/learn-about-deployment.md +- content/nap-dos/deployment-guide/kubernetes.md +- content/nap-dos/deployment-guide/kubernetes-with-L3-mitigation.md +--- + +You can run the following commands to ensure that F5 DoS for NGINX enforcement is operational. + +1. Check that the three processes needed for F5 DoS for NGINX are running using `ps aux`: + + - admd + - nginx: master process + - nginx: worker process + + ```shell + USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND + nginx 7759 0.0 0.0 113120 1200 ? Ss Sep06 0:00 /bin/sh -c /usr/bin/admd -d --log info > /var/log/adm/admd.log 2>&1 + root 7765 0.0 0.0 87964 1464 ? Ss Sep06 0:00 nginx: master process /usr/sbin/nginx -g daemon off; + nginx 7767 0.0 0.1 615868 8188 ? Sl Sep06 0:04 nginx: worker process + ``` + +2. Verify that there are no NGINX errors in the `/var/log/nginx/error.log` and that the policy compiled successfully: + + ```shell + 2025/12/07 09:14:34 [notice] 675#675: APP_PROTECT_DOS { "event": "shared_memory_connected", "worker_pid": 675, "mode": "operational", "mode_changed": true } + 2025/12/07 09:14:34 [notice] 675#675: using the "epoll" event method + 2025/12/07 09:14:34 [notice] 675#675: APP_PROTECT_DOS { "event": "configuration_load_success", "software_version": "36+4.8.3-1.el8.ngx"} + 2025/12/07 09:14:34 [notice] 675#675: nginx/1.29.3 (nginx-plus-r36) + 2025/12/07 09:14:34 [notice] 675#675: built by gcc 8.5.0 20210514 (Red Hat 8.5.0-28) (GCC) + 2025/12/07 09:14:34 [notice] 675#675: OS: Linux 6.8.0-88-generic + 2025/12/07 09:14:34 [notice] 675#675: getrlimit(RLIMIT_NOFILE): 1048576:1048576 + 2025/12/07 09:14:34 [notice] 675#675: start worker processes + 2025/12/07 09:14:34 [notice] 675#675: start worker process 679 + 2025/12/07 09:14:34 [notice] 679#679: APP_PROTECT_DOS { "event": "shared_memory_connected", "worker_pid": 679, "mode": "operational", "mode_changed": true } + ``` + +3. Check that by applying an attack, the attacker IP addresses are blocked while the good traffic pass through: + + a. Simulate good traffic: + + ```shell + echo "Start Good Traffic 2" + while true; do + curl ${VS}/good1 & + curl ${VS}/good2 & + curl ${VS}/good3 & + curl ${VS}/good4 + sleep 0.1 + done & + ``` + + b. After 7 minutes start the attack: + + ```shell + while [ true ] + do + ab -B ${BAD_IP1} -l -r -n 1000000 -c 150 -d -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ & + ab -B ${BAD_IP2} -l -r -n 1000000 -c 150 -d -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ & + ab -B ${BAD_IP3} -l -r -n 1000000 -c 150 -d -s 10 -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ + + killall ab + done + ``` + + c. See that the good traffic continue as usual while the attackers receive denial of service. + +4. For DOS with L3 mitigation enabled + +Check that the ebpf_manager_dos process needed for F5 DoS for NGINX is running using `ps aux | grep /usr/bin/ebpf_manager_dos`: + +``` +root 1 0.0 0.0 4324 3072 ? Ss 19:32 0:00 bash -c /usr/bin/ebpf_manager_dos 2>&1 | tee /shared/ebpf_dos.log +root 7 0.2 0.0 1722732 14208 ? Sl 19:32 0:01 /usr/bin/ebpf_manager_dos +root 46 0.0 0.0 3528 1792 pts/0 S+ 19:44 0:00 grep --color=auto /usr/bin/ebpf_manager_dos +``` + +Verify that there are no errors in the `/shared/ebpf_dos.log` and that the XDP program uploaded successfully: + +```[2025-12-02 19:32:12] INFO: Uninstall old eBPF maps and XDP program +[2025-12-02 19:32:13] INFO: Install eBPF maps and XDP program +[2025-12-02 19:32:13] INFO: Start ebpf manager +[2025-12-02 19:32:13] INFO: Version: 36+4.8.3-1~noble +[2025-12-02 19:32:13] INFO: Start Periodic task for update time +[2025-12-02 19:32:13] INFO: Owner of the UDS has been changed to user nginx and group nginx. +[2025-12-02 19:32:13] INFO: Permissions of the UDS have been changed successfully for user nginx and group nginx. +[2025-12-02 19:32:13] INFO: Async Callback Server listening on unix:/shared/ebpf_manager_dos_uds +``` + +To check F5 WAF for NGINX alongside F5 DoS for NGINX, just perform the normal tests as specified at [Admin Guide](https://docs.nginx.com/waf/install/virtual-environment/#post-installation-checks) diff --git a/content/includes/dos/k8s_arbitrator/appprotect-dos-arb.md b/content/includes/dos/k8s_arbitrator/appprotect-dos-arb.md new file mode 100644 index 000000000..05576f6f2 --- /dev/null +++ b/content/includes/dos/k8s_arbitrator/appprotect-dos-arb.md @@ -0,0 +1,32 @@ +--- +--- + +```appprotect-dos-arb.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: appprotect-dos-arb + namespace: app-protect-dos +spec: + replicas: 1 + selector: + matchLabels: + app: appprotect-dos-arb + template: + metadata: + labels: + app: appprotect-dos-arb + spec: + containers: + - name: arb-svc + image: docker-registry.nginx.com/nap-dos/app_protect_dos_arb:latest + resources: + requests: + cpu: "200m" + memory: "500Mi" + limits: + cpu: "900m" + memory: "800Mi" + ports: + - containerPort: 3000 +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_arbitrator/svc-appprotect-dos-arb.md b/content/includes/dos/k8s_arbitrator/svc-appprotect-dos-arb.md new file mode 100644 index 000000000..68cd8f538 --- /dev/null +++ b/content/includes/dos/k8s_arbitrator/svc-appprotect-dos-arb.md @@ -0,0 +1,20 @@ +--- +--- + +```svc-appprotect-dos-arb.yaml +apiVersion: v1 +kind: Service +metadata: + name: svc-appprotect-dos + namespace: appprotect-dos-wp-diff + labels: + app: appprotect-dos +spec: + ports: + - name: app + port: 80 + protocol: TCP + nodePort: 80 + selector: + app: appprotect-dos + type: NodePort``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/backend-nginx.md b/content/includes/dos/k8s_manifest/backend-nginx.md new file mode 100644 index 000000000..0f2024150 --- /dev/null +++ b/content/includes/dos/k8s_manifest/backend-nginx.md @@ -0,0 +1,50 @@ +--- +--- + +```backend-nginx.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: backend-nginx + namespace: app-protect-dos + labels: + app: backend-nginx +spec: + replicas: 1 + selector: + matchLabels: + app: backend-nginx + template: + metadata: + labels: + app: backend-nginx + spec: + containers: + - name: nginx + image: nginx:stable + ports: + - containerPort: 8080 + command: ["/bin/sh", "-c"] + args: + - | + # Change default port from 80 to 8080 + sed -i 's/listen 80;/listen 8080;/g' /etc/nginx/conf.d/default.conf + nginx -g "daemon off;" +--- +apiVersion: v1 +kind: Service +metadata: + name: svc-backend-nginx + namespace: app-protect-dos + labels: + app: backend-nginx +spec: + type: ClusterIP + selector: + app: backend-nginx + ports: + - name: http + port: 8080 + targetPort: 8080 + protocol: TCP +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-deployment.md b/content/includes/dos/k8s_manifest/dos-deployment.md new file mode 100644 index 000000000..563809493 --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-deployment.md @@ -0,0 +1,96 @@ +--- +--- + +```dos-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: app-protect-dos + namespace: app-protect-dos + labels: + app: app-protect-dos +spec: + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app: app-protect-dos + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 2 + maxUnavailable: 1 + template: + metadata: + labels: + app: app-protect-dos + spec: + containers: + - name: nginx-app-protect-dos + image: /: + imagePullPolicy: Always + + command: ["/bin/bash", "-c"] + args: + - | + /root/entrypoint.sh + + resources: + requests: + cpu: "200m" + memory: "500Mi" + limits: + cpu: "900m" + memory: "800Mi" + + ports: + - containerPort: 80 + name: web + - containerPort: 8090 + name: probe + - containerPort: 8091 + name: probe500 + + livenessProbe: + httpGet: + path: /app_protect_dos_liveness + port: 8090 + initialDelaySeconds: 5 + periodSeconds: 10 + + readinessProbe: + httpGet: + path: /app_protect_dos_readiness + port: 8090 + initialDelaySeconds: 5 + periodSeconds: 10 + + volumeMounts: + - name: shared-dir + mountPath: /shared/ + - name: conf + mountPath: /etc/nginx/nginx.conf + subPath: nginx.conf + - name: log-default + mountPath: /etc/app_protect_dos/log-default.json + subPath: log-default.json + + volumes: + - name: shared-dir + persistentVolumeClaim: + claimName: pvc-app-protect-dos-shared + - name: conf + configMap: + name: dos-nginx-conf + items: + - key: nginx.conf + path: nginx.conf + - name: log-default + configMap: + name: dos-log-default + defaultMode: 0644 + items: + - key: log-default.json + path: log-default.json + +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-log-default-configmap.md b/content/includes/dos/k8s_manifest/dos-log-default-configmap.md new file mode 100644 index 000000000..7d1d4848d --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-log-default-configmap.md @@ -0,0 +1,19 @@ +--- +--- + +```dos-log-default-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: dos-log-default + namespace: app-protect-dos +data: + log-default.json: | + { + "filter": { + "traffic-mitigation-stats": "all", + "bad-actors": "all", + "attack-signatures": "all" + } + } +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-namespace.md b/content/includes/dos/k8s_manifest/dos-namespace.md new file mode 100644 index 000000000..1e91798fc --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-namespace.md @@ -0,0 +1,9 @@ +--- +--- + +```dos-namespace.yaml +apiVersion: v1 +kind: Namespace +metadata: + name: app-protect-dos +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-nginx-conf-configmap.md b/content/includes/dos/k8s_manifest/dos-nginx-conf-configmap.md new file mode 100644 index 000000000..35095aab7 --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-nginx-conf-configmap.md @@ -0,0 +1,67 @@ +--- +--- + +```dos-nginx-conf-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: dos-nginx-conf + namespace: app-protect-dos +data: + nginx.conf: | + + user nginx; + worker_processes auto; + error_log /var/log/nginx/error.log error; + worker_rlimit_nofile 65535; + + load_module modules/ngx_http_app_protect_dos_module.so; + + working_directory /tmp/cores; + + events { + worker_connections 65535; + } + + http { + + app_protect_dos_arb_fqdn svc-appprotect-dos-arb.arb.svc.cluster.local; + + sendfile on; + tcp_nopush on; + keepalive_timeout 65; + + log_format log_dos + ', vs_name_al=$app_protect_dos_vs_name, ip=$remote_addr, tls_fp=$app_protect_dos_tls_fp, ' + 'outcome=$app_protect_dos_outcome, reason=$app_protect_dos_outcome_reason, ' + 'ip_tls=$remote_addr:$app_protect_dos_tls_fp, '; + + upstream backend { + server svc-backend-nginx:8080; + } + + # Health endpoints for probes + server { + listen 8090; + location /app_protect_dos_liveness { return 200; } + location /app_protect_dos_readiness { return 200; } + } + + server { + listen 80 reuseport; + server_name serv; + + access_log /var/log/nginx/access.log log_dos if=$loggable; + app_protect_dos_security_log_enable on; + app_protect_dos_security_log "/etc/app_protect_dos/log-default.json" syslog:server=10.197.30.219:5261; + app_protect_dos_policy_file "/etc/app_protect_dos/BADOSDefaultPolicy.json"; + + location / { + app_protect_dos_enable on; + app_protect_dos_name "main_serv"; + app_protect_dos_monitor uri=http://serv:80/ protocol=http1; + proxy_pass http://backend; + } + } + } +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-service.md b/content/includes/dos/k8s_manifest/dos-service.md new file mode 100644 index 000000000..6f5e776b2 --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-service.md @@ -0,0 +1,18 @@ +--- +--- + +```dos-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: nap-dos + namespace: app-protect-dos +spec: + type: LoadBalancer + ports: + - port: 80 + targetPort: 80 + protocol: TCP + selector: + app: app-protect-dos +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_manifest/dos-storage.md b/content/includes/dos/k8s_manifest/dos-storage.md new file mode 100644 index 000000000..609d817a7 --- /dev/null +++ b/content/includes/dos/k8s_manifest/dos-storage.md @@ -0,0 +1,16 @@ +--- +--- + +```dos-storage.yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: pvc-app-protect-dos-shared + namespace: app-protect-dos +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/backend-nginx.md b/content/includes/dos/k8s_with_ebpf_manifest/backend-nginx.md new file mode 100644 index 000000000..0f2024150 --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/backend-nginx.md @@ -0,0 +1,50 @@ +--- +--- + +```backend-nginx.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: backend-nginx + namespace: app-protect-dos + labels: + app: backend-nginx +spec: + replicas: 1 + selector: + matchLabels: + app: backend-nginx + template: + metadata: + labels: + app: backend-nginx + spec: + containers: + - name: nginx + image: nginx:stable + ports: + - containerPort: 8080 + command: ["/bin/sh", "-c"] + args: + - | + # Change default port from 80 to 8080 + sed -i 's/listen 80;/listen 8080;/g' /etc/nginx/conf.d/default.conf + nginx -g "daemon off;" +--- +apiVersion: v1 +kind: Service +metadata: + name: svc-backend-nginx + namespace: app-protect-dos + labels: + app: backend-nginx +spec: + type: ClusterIP + selector: + app: backend-nginx + ports: + - name: http + port: 8080 + targetPort: 8080 + protocol: TCP +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-deployment.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-deployment.md new file mode 100644 index 000000000..30891f58c --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-deployment.md @@ -0,0 +1,112 @@ +--- +--- + +```dos-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: app-protect-dos + namespace: app-protect-dos + labels: + app: app-protect-dos +spec: + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app: app-protect-dos + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 2 + maxUnavailable: 1 + template: + metadata: + labels: + app: app-protect-dos + spec: + containers: + - name: nginx-app-protect-dos + image: /: + imagePullPolicy: Always + + command: ["/bin/bash", "-c"] + args: + - | + /root/entrypoint.sh + + resources: + requests: + cpu: "200m" + memory: "500Mi" + limits: + cpu: "900m" + memory: "800Mi" + + ports: + - containerPort: 80 + name: web + - containerPort: 8090 + name: probe + - containerPort: 8091 + name: probe500 + + livenessProbe: + httpGet: + path: /app_protect_dos_liveness + port: 8090 + initialDelaySeconds: 5 + periodSeconds: 10 + + readinessProbe: + httpGet: + path: /app_protect_dos_readiness + port: 8090 + initialDelaySeconds: 5 + periodSeconds: 10 + + + volumeMounts: + - name: shared-dir + mountPath: /shared/ + - name: bpf + mountPath: /sys/fs/bpf + - name: conf + mountPath: /etc/nginx/nginx.conf + subPath: nginx.conf + - name: log-default + mountPath: /etc/app_protect_dos/log-default.json + subPath: log-default.json + + - name: dos-ebpf-manager + image: /: + securityContext: + privileged: true + volumeMounts: + - name: shared-dir + mountPath: /shared + - name: bpf + mountPath: /sys/fs/bpf + volumes: + - name: shared-dir + persistentVolumeClaim: + claimName: pvc-app-protect-dos-shared + - name: bpf + hostPath: + path: /sys/fs/bpf + type: DirectoryOrCreate + - name: conf + configMap: + name: dos-nginx-conf + items: + - key: nginx.conf + path: nginx.conf + - name: log-default + configMap: + name: dos-log-default + defaultMode: 0644 + items: + - key: log-default.json + path: log-default.json + +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-log-default-configmap.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-log-default-configmap.md new file mode 100644 index 000000000..7d1d4848d --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-log-default-configmap.md @@ -0,0 +1,19 @@ +--- +--- + +```dos-log-default-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: dos-log-default + namespace: app-protect-dos +data: + log-default.json: | + { + "filter": { + "traffic-mitigation-stats": "all", + "bad-actors": "all", + "attack-signatures": "all" + } + } +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-namespace.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-namespace.md new file mode 100644 index 000000000..1e91798fc --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-namespace.md @@ -0,0 +1,9 @@ +--- +--- + +```dos-namespace.yaml +apiVersion: v1 +kind: Namespace +metadata: + name: app-protect-dos +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-nginx-conf-configmap.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-nginx-conf-configmap.md new file mode 100644 index 000000000..f444fd0bc --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-nginx-conf-configmap.md @@ -0,0 +1,69 @@ +--- +--- + +```dos-nginx-conf-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: dos-nginx-conf + namespace: app-protect-dos +data: + nginx.conf: | + + user nginx; + worker_processes auto; + error_log /var/log/nginx/error.log error; + worker_rlimit_nofile 65535; + + load_module modules/ngx_http_app_protect_dos_module.so; + + working_directory /tmp/cores; + + events { + worker_connections 65535; + } + + http { + + app_protect_dos_arb_fqdn svc-appprotect-dos-arb.arb.svc.cluster.local; + + sendfile on; + tcp_nopush on; + keepalive_timeout 65; + + log_format log_dos + ', vs_name_al=$app_protect_dos_vs_name, ip=$remote_addr, tls_fp=$app_protect_dos_tls_fp, ' + 'outcome=$app_protect_dos_outcome, reason=$app_protect_dos_outcome_reason, ' + 'ip_tls=$remote_addr:$app_protect_dos_tls_fp, '; + + app_protect_dos_accelerated_mitigation on syn_drop=on; + + upstream backend { + server svc-backend-nginx:8080; + } + + # Health endpoints for probes + server { + listen 8090; + location /app_protect_dos_liveness { return 200; } + location /app_protect_dos_readiness { return 200; } + } + + server { + listen 80 reuseport; + server_name serv; + + access_log /var/log/nginx/access.log log_dos if=$loggable; + app_protect_dos_security_log_enable on; + app_protect_dos_security_log "/etc/app_protect_dos/log-default.json" syslog:server=10.197.30.219:5261; + app_protect_dos_policy_file "/etc/app_protect_dos/BADOSDefaultPolicy.json"; + + location / { + app_protect_dos_enable on; + app_protect_dos_name "main_serv"; + app_protect_dos_monitor uri=http://serv:80/ protocol=http1; + proxy_pass http://backend; + } + } + } +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-service.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-service.md new file mode 100644 index 000000000..6f5e776b2 --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-service.md @@ -0,0 +1,18 @@ +--- +--- + +```dos-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: nap-dos + namespace: app-protect-dos +spec: + type: LoadBalancer + ports: + - port: 80 + targetPort: 80 + protocol: TCP + selector: + app: app-protect-dos +``` \ No newline at end of file diff --git a/content/includes/dos/k8s_with_ebpf_manifest/dos-storage.md b/content/includes/dos/k8s_with_ebpf_manifest/dos-storage.md new file mode 100644 index 000000000..609d817a7 --- /dev/null +++ b/content/includes/dos/k8s_with_ebpf_manifest/dos-storage.md @@ -0,0 +1,16 @@ +--- +--- + +```dos-storage.yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: pvc-app-protect-dos-shared + namespace: app-protect-dos +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi +``` \ No newline at end of file diff --git a/content/nap-dos/deployment-guide/best-practices.md b/content/nap-dos/deployment-guide/best-practices.md index af2f39c0d..ba1ef8188 100644 --- a/content/nap-dos/deployment-guide/best-practices.md +++ b/content/nap-dos/deployment-guide/best-practices.md @@ -3,7 +3,7 @@ description: F5 DoS for NGINX Best Practices Deployment. nd-docs: DOCS-666 title: Best Practices toc: true -weight: 100 +weight: 130 nd-content-type: how-to nd-product: F5DOSN --- diff --git a/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md b/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md index 6211ef16f..8a4a89217 100644 --- a/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md +++ b/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md @@ -6,7 +6,7 @@ description: Install F5 NGINX Plus, F5 WAF & DoS for NGINX Plus on Amazon Web Se nd-docs: DOCS-1204 title: Installing F5 WAF & DoS for NGINX AMIs on Amazon EC2 toc: true -weight: 110 +weight: 120 nd-content-type: how-to nd-product: F5DOSN --- diff --git a/content/nap-dos/deployment-guide/kubernetes-with-L3-mitigation.md b/content/nap-dos/deployment-guide/kubernetes-with-L3-mitigation.md new file mode 100644 index 000000000..562c4a35f --- /dev/null +++ b/content/nap-dos/deployment-guide/kubernetes-with-L3-mitigation.md @@ -0,0 +1,345 @@ +--- +# We use sentence case and present imperative tone +title: "Kubernetes with L3 mitigation" +# Weights are assigned in increments of 100: determines sorting order +weight: 110 +# Creates a table of contents and sidebar, useful for large documents +toc: true +# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this +nd-content-type: how-to +nd-product: DOS +--- + +This page describes how to install F5 DOS for NGINX using Kubernetes. + +It explains the common steps necessary for any Kubernetes-based deployment, then provides details specific to Helm or Manifests. + +## Before you begin + +To complete this guide, you will need the following pre-requisites: + +- A functional Kubernetes cluster +- An active F5 DOS for NGINX subscription (Purchased or trial) +- [Docker](https://docs.docker.com/get-started/get-docker/) + +To review supported operating systems, read the [Releases]({{< ref "/nap-dos/releases" >}}) topic. + +## Download your subscription credentials + +{{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}} + +## Create a Dockerfile + +In the same folder as your credential files, create a _Dockerfile_ based on your desired operating system image using an example from the following sections. + +### Alpine Linux + +{{< tabs name="alpine-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/alpine-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="alpine-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/alpine-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Amazon Linux + +{{< tabs name="amazon-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/amazon-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="amazon-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/amazon-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Debian + +{{< tabs name="debian-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/debian-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="debian-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/debian-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### RHEL 8 + +{{< tabs name="rhel8-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rhel8-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="rhel8-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/rhel8-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### RHEL 9 + +{{< tabs name="rhel9-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rhel9-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="rhel9-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/rhel9-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Rocky Linux 9 + +{{< tabs name="rocky-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rocky9-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="rocky9-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/rocky9-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Ubuntu + +{{< tabs name="ubuntu-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/ubuntu-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +{{< tabs name="ubuntu-instructions-ebpf" >}} + +{{% tab name="EBPF Manager" %}} + +{{< include "/dos/dockerfiles/ubuntu-ebpf-manager.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +## Create DOS entrypoint.sh +Docker startup script which spins up all App Protect DoS processes, must have executable permissions + +{{< include "/dos/dos-entrypoint.md" >}} + +## Build the DOS Docker image + +Your folder should contain the following files: + +- _nginx-repo.crt_ +- _nginx-repo.key_ +- _license.jwt_ +- _entrypoint.sh_ +- _nginx.conf_ +- _Dockerfile_ + +To build an image, use the following command, replacing `` as appropriate: + +```shell +sudo docker build --no-cache --platform linux/amd64 \ + --secret id=nginx-crt,src=nginx-repo.crt \ + --secret id=nginx-key,src=nginx-repo.key \ + --secret id=license-jwt,src=license.jwt \ + -t . +``` + +## Build the EBPF Manager Docker image + +Your folder should contain the following files: + +- _nginx-repo.crt_ +- _nginx-repo.key_ +- _Dockerfile_ + +To build an image, use the following command, replacing `` as appropriate: + +```shell +sudo docker build --no-cache --platform linux/amd64 \ + --secret id=nginx-crt,src=nginx-repo.crt \ + --secret id=nginx-key,src=nginx-repo.key \ + -t . +``` + +Once you have built the DOS and EBPF images, push them to your private image repository, which should be accessible to your Kubernetes cluster. + +From this point, the steps change based on your installation method: + +- [Use Manifests to install F5 DOS for NGINX](#use-manifests-to-install-f5-dos-for-nginx) + +## Use Manifests to install F5 DOS for NGINX + +### Create Manifest files + +The default configuration provided creates two replicas, each hosting NGINX and DOS services together in a single Kubernetes pod. + +Create all of these files in a single folder (Such as `/manifests`). + +In each file, replace + `/:` with your actual nginx-dos image tag. + `/:` with your actual ebpf-manager image tag. + +{{< tabs name="manifest-files" >}} + +{{% tab name=dos-namespace.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-namespace.md" >}} + +{{% /tab %}} + +{{% tab name=dos-storage.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-storage.md" >}} + +{{% /tab %}} + +{{% tab name=dos-nginx-conf-configmap.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-nginx-conf-configmap.md" >}} + +{{% /tab %}} + +{{% tab name=dos-log-default-configmap.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-log-default-configmap.md" >}} + +{{% /tab %}} + +{{% tab name=dos-deployment.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-deployment.md" >}} + +{{% /tab %}} + +{{% tab name=dos-service.yaml %}} + +{{< include "dos/k8s_with_ebpf_manifest/dos-service.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Start the Manifest deployment + +From the folder containing the YAML files from the previous step (Suggested as `/manifests`), deploy F5 DOS for NGINX using `kubectl`: + +```shell +kubectl apply -f manifests/dos-namespace.yaml +kubectl apply -f manifests/dos-storage.yaml +kubectl apply -f manifests/dos-nginx-conf-configmap.yaml +kubectl apply -f manifests/dos-log-default-configmap.yaml +kubectl apply -f manifests/dos-deployment.yaml +kubectl apply -f manifests/dos-service.yaml +``` + +It will apply all the configuration defined in the files to your Kubernetes cluster. + +You can then check the status of the deployment with `kubectl get`: + +```shell +kubectl -n app-protect-dos get deployments +kubectl -n app-protect-dos get pods +kubectl -n app-protect-dos get services +``` + +You should see output similar to the following: + +```text +~$ kubectl -n app-protect-dos get deployments +NAME READY UP-TO-DATE AVAILABLE AGE +app-protect-dos 1/1 1 1 33s + +~$ kubectl -n app-protect-dos get pods +NAME READY STATUS RESTARTS AGE +app-protect-dos-7f9798654c-7ncbl 2/2 Running 0 68s + +$ kubectl -n app-protect-dos get pods -o jsonpath='{range .items[*]}Pod: {.metadata.name} -> Containers: {.spec.containers[*].name}{"\n"}{end}' +Pod: app-protect-dos-7f9798654c-7ncbl -> Containers: dos-ebpf-manager nginx-app-protect-dos + +~$ kubectl -n app-protect-dos get services +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +nap-dos LoadBalancer 10.43.212.232 80:32586/TCP 93s +``` +## Post-Installation Checks +At this stage, you have finished deploying F5 DOS for NGINX with EBPF L3 mitigation enabled +You can login to dos-ebpf-manager container like following command +```text +kubectl exec -it app-protect-dos-586fb94947-8sjnc -n app-protect-dos -c nginx-app-protect-dos -- bash +kubectl exec -it app-protect-dos-586fb94947-8sjnc -n app-protect-dos -c dos-ebpf-manager -- bash +``` +and can look at . +{{< include "dos/install-post-checks.md" >}} + +## F5 DoS for NGINX Arbitrator + +{{< include "/dos/dos-arbitrator.md" >}} + +## Next steps diff --git a/content/nap-dos/deployment-guide/kubernetes.md b/content/nap-dos/deployment-guide/kubernetes.md new file mode 100644 index 000000000..c8b17b438 --- /dev/null +++ b/content/nap-dos/deployment-guide/kubernetes.md @@ -0,0 +1,254 @@ +--- +# We use sentence case and present imperative tone +title: "Kubernetes" +# Weights are assigned in increments of 100: determines sorting order +weight: 100 +# Creates a table of contents and sidebar, useful for large documents +toc: true +# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this +nd-content-type: how-to +nd-product: DOS +--- + +This page describes how to install F5 DOS for NGINX using Kubernetes. + +It explains the common steps necessary for any Kubernetes-based deployment, then provides details specific to Helm or Manifests. + +## Before you begin + +To complete this guide, you will need the following pre-requisites: + +- A functional Kubernetes cluster +- An active F5 DOS for NGINX subscription (Purchased or trial) +- [Docker](https://docs.docker.com/get-started/get-docker/) + +To review supported operating systems, read the [Releases]({{< ref "/nap-dos/releases" >}}) topic. + +## Download your subscription credentials + +{{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}} + +## Create a Dockerfile + +In the same folder as your credential files, create a _Dockerfile_ based on your desired operating system image using an example from the following sections. + +### Alpine Linux + +{{< tabs name="alpine-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/alpine-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Amazon Linux + +{{< tabs name="amazon-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/amazon-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Debian + +{{< tabs name="debian-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/debian-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### RHEL 8 + +{{< tabs name="rhel8-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rhel8-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### RHEL 9 + +{{< tabs name="rhel9-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rhel9-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Rocky Linux 9 + +{{< tabs name="rocky-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/rocky9-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Ubuntu + +{{< tabs name="ubuntu-instructions" >}} + +{{% tab name="NGINX Plus" %}} + +{{< include "/dos/dockerfiles/ubuntu-plus-dos.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +## Create DOS entrypoint.sh +Docker startup script which spins up all App Protect DoS processes, must have executable permissions + +{{< include "/dos/dos-entrypoint.md" >}} + +## Build the Docker image + +Your folder should contain the following files: + +- _nginx-repo.crt_ +- _nginx-repo.key_ +- _license.jwt_ +- _entrypoint.sh_ +- _nginx.conf_ +- _Dockerfile_ + +To build an image, use the following command, replacing `` as appropriate: + +```shell +sudo docker build --no-cache --platform linux/amd64 \ + --secret id=nginx-crt,src=nginx-repo.crt \ + --secret id=nginx-key,src=nginx-repo.key \ + --secret id=license-jwt,src=license.jwt \ + -t . +``` + +Once you have built the image, push it to your private image repository, which should be accessible to your Kubernetes cluster. + +From this point, the steps change based on your installation method: + +- [Use Manifests to install F5 DOS for NGINX](#use-manifests-to-install-f5-dos-for-nginx) + +## Use Manifests to install F5 DOS for NGINX + +The `` argument should be the _contents_ of the file, not the file itself. Ensure there are no additional characters such as extra whitespace. + +### Create Manifest files + +The default configuration provided creates two replicas, each hosting NGINX and DOS services together in a single Kubernetes pod. + +Create all of these files in a single folder (Such as `/manifests`). + +In each file, replace `/:` with your actual image tag. + +{{< tabs name="manifest-files" >}} + +{{% tab name=dos-namespace.yaml %}} + +{{< include "dos/k8s_manifest/dos-namespace.md" >}} + +{{% /tab %}} + +{{% tab name=dos-storage.yaml %}} + +{{< include "dos/k8s_manifest/dos-storage.md" >}} + +{{% /tab %}} + +{{% tab name=dos-nginx-conf-configmap.yaml %}} + +{{< include "dos/k8s_manifest/dos-nginx-conf-configmap.md" >}} + +{{% /tab %}} + +{{% tab name=dos-log-default-configmap.yaml %}} + +{{< include "dos/k8s_manifest/dos-log-default-configmap.md" >}} + +{{% /tab %}} + +{{% tab name=dos-deployment.yaml %}} + +{{< include "dos/k8s_manifest/dos-deployment.md" >}} + +{{% /tab %}} + +{{% tab name=dos-service.yaml %}} + +{{< include "dos/k8s_manifest/dos-service.md" >}} + +{{% /tab %}} + +{{< /tabs >}} + +### Start the Manifest deployment + +From the folder containing the YAML files from the previous step (Suggested as `/manifests`), deploy F5 DOS for NGINX using `kubectl`: + +```shell +kubectl apply -f manifests/dos-namespace.yaml +kubectl apply -f manifests/dos-storage.yaml +kubectl apply -f manifests/dos-nginx-conf-configmap.yaml +kubectl apply -f manifests/dos-log-default-configmap.yaml +kubectl apply -f manifests/dos-deployment.yaml +kubectl apply -f manifests/dos-service.yaml +``` + +It will apply all the configuration defined in the files to your Kubernetes cluster. + +You can then check the status of the deployment with `kubectl get`: + +```shell +kubectl -n app-protect-dos get deployments +kubectl -n app-protect-dos get pods +kubectl -n app-protect-dos get services +``` + +You should see output similar to the following: + +```text +~$ kubectl -n app-protect-dos get deployments +NAME READY UP-TO-DATE AVAILABLE AGE +app-protect-dos 1/1 1 1 1m + +~$ kubectl -n app-protect-dos get pods +NAME READY STATUS RESTARTS AGE +app-protect-dos-586fb94947-8sjnc 1/1 Running 0 1m + +~$ kubectl -n app-protect-dos get services +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +nap-dos LoadBalancer 10.43.83.225 80:30307/TCP 1m +``` +## Post-Installation Checks +At this stage, you have finished deploying F5 DOS for NGINX. +You csn login to app-protect-dos pod like following command +```text +kubectl exec -it app-protect-dos-586fb94947-8sjnc -n app-protect-dos -c nginx-app-protect-dos -- bash +``` +and can look at . +{{< include "dos/install-post-checks.md" >}} + +## F5 DoS for NGINX Arbitrator + +{{< include "/dos/dos-arbitrator.md" >}} + +## Next steps diff --git a/content/nap-dos/deployment-guide/learn-about-deployment.md b/content/nap-dos/deployment-guide/learn-about-deployment.md index eb6abc904..98f00d28f 100644 --- a/content/nap-dos/deployment-guide/learn-about-deployment.md +++ b/content/nap-dos/deployment-guide/learn-about-deployment.md @@ -1,7 +1,7 @@ --- description: Learn about F5 DoS for NGINX Deployment. nd-docs: DOCS-666 -title: Deployment +title: Virtual Machine and Docker toc: true weight: 90 nd-content-type: how-to @@ -1025,22 +1025,7 @@ You need root permissions to execute the following steps. 5. In the same directory create an `entrypoint.sh` file with executable permissions, with the following content: - ```shell - #!/usr/bin/env bash - - USER=nginx - LOGDIR=/var/log/adm - - # prepare environment - mkdir -p /var/run/adm /tmp/cores ${LOGDIR} - chmod 755 /var/run/adm /tmp/cores ${LOGDIR} - chown ${USER}:${USER} /var/run/adm /tmp/cores ${LOGDIR} - - # run processes - /bin/su -s /bin/bash -c "/usr/bin/adminstall > ${LOGDIR}/adminstall.log 2>&1" ${USER} - /bin/su -s /bin/bash -c "/usr/bin/admd -d --log info > ${LOGDIR}/admd.log 2>&1 &" ${USER} - /usr/sbin/nginx -g 'daemon off;' - ``` + {{< include "/dos/dos-entrypoint.md" >}} 6. Create a Docker image: @@ -1050,7 +1035,7 @@ You need root permissions to execute the following steps. The `--no-cache` option tells Docker to build the image from scratch and ensures the installation of the latest version of NGINX Plus and F5 DoS for NGINX. If the Dockerfile was previously used to build an image without the `--no-cache` option, the new image uses versions from the previously built image from the Docker cache. - For RHEL8/9 with subctiption manager setup add build arguments: + For RHEL8/9 with subscription manager setup add build arguments: ```shell DOCKER_BUILDKIT=1 docker build --build-arg RHEL_ORG=... --build-arg RHEL_ACTIVATION_KEY=... --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key --secret id=license-jwt,src=./license.jwt -t app-protect-dos . @@ -1127,251 +1112,31 @@ You need root permissions to execute the following steps. ### Alpine Docker Deployment Example -```Dockerfile -# syntax=docker/dockerfile:1 -# For Alpine 3.22: -FROM alpine:3.22 - -# Download and add the NGINX signing keys: -RUN wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub - -# Add NGINX Plus/F5 DoS for NGINX repository: -RUN printf "https://pkgs.nginx.com/plus/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories && \ - printf "https://pkgs.nginx.com/app-protect-dos/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories - -# Update the repository and install the most recent version of the F5 DoS for NGINX package (which includes NGINX Plus): -RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apk update && apk add app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/alpine-plus-dos.md" >}} ### AmazonLinux 2023 Docker Deployment Example -```Dockerfile -# For AmazonLinux 2023: -FROM amazonlinux:2023 - -# Install prerequisite packages: -RUN dnf -y install ca-certificates - -# Add NGINX Plus/F5 DoS for NGINX repository: -RUN curl -o /etc/yum.repos.d/plus-amazonlinux2023.repo https://cs.nginx.com/static/files/plus-amazonlinux2023.repo && \ - curl -o /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-dos-amazonlinux2023.repo - -# Install F5 DoS for NGINX: -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - dnf install -y app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - rm /etc/yum.repos.d/plus-amazonlinux2023.repo && \ - rm /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo && \ - dnf clean all && \ - rm -rf /var/cache/dnf - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/amazon-plus-dos.md" >}} ### Debian 11 (Bullseye) / Debian 12 (Bookworm) Docker Deployment Example -```Dockerfile -# Where can be bullseye/bookworm -FROM debian:bullseye - -# Setup repository keys -RUN mkdir -p /etc/ssl/nginx/ /etc/nginx/ && \ - apt-get update && \ - apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 debian-archive-keyring && \ - wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ - printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list && \ - printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx - -# Install F5 DoS for NGINX -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - rm -rf /etc/apt/apt.conf.d/90nginx /var/lib/apt/lists/* - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -COPY nginx.conf /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/debian-plus-dos.md" >}} ### Ubuntu 22.04 (Jammy) / 24.04 (Noble) Docker Deployment Example -```Dockerfile -# Where version can be: jammy/noble -FROM ubuntu:noble - -# Setup repository keys -RUN apt-get update && \ - apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 ubuntu-keyring && \ - wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ - printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/ubuntu $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list && \ - printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx - -# Install F5 DoS for NGINX -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - rm -rf /etc/apt/apt.conf.d/90nginx /var/lib/apt/lists/* +{{< include "/dos/dockerfiles/ubuntu-plus-dos.md" >}} -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -COPY nginx.conf /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh +### RHEL 8 Docker Deployment Example -EXPOSE 80 +{{< include "/dos/dockerfiles/rhel8-plus-dos.md" >}} -STOPSIGNAL SIGQUIT +### RHEL 9 Docker Deployment Example -CMD ["sh", "/root/entrypoint.sh"] -``` - -### RHEL 8 Docker Deployment Example - -```Dockerfile -# For UBI 8 -FROM registry.access.redhat.com/ubi8 - -ARG RHEL_ORG -ARG RHEL_ACTIVATION_KEY - -# Setup repository keys -RUN subscription-manager register --org=${RHEL_ORG} --activationkey=${RHEL_ACTIVATION_KEY} && \ - subscription-manager refresh && \ - subscription-manager attach --auto || true && \ - subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms && \ - subscription-manager repos --enable=rhel-8-for-x86_64-appstream-rpms && \ - dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \ - dnf -y install ca-certificates && \ - curl -o /etc/yum.repos.d/plus-8.repo https://cs.nginx.com/static/files/plus-8.repo && \ - curl -o /etc/yum.repos.d/app-protect-dos-8.repo https://cs.nginx.com/static/files/app-protect-dos-8.repo - -# Install F5 DoS for NGINX -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - dnf -y install app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - rm /etc/yum.repos.d/plus-8.repo && \ - rm /etc/yum.repos.d/app-protect-dos-8.repo && \ - dnf clean all && \ - rm -rf /var/cache/yum - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/rhel9-plus-dos.md" >}} ### Rocky Linux 9 Docker Deployment Example -```Dockerfile -# syntax=docker/dockerfile:1 -# For Rocky Linux 9: -FROM rockylinux:9 - -# Install prerequisite packages: -RUN dnf -y install ca-certificates epel-release 'dnf-command(config-manager)' - -# Add NGINX App-protect-DoS & NGINX Plus repo to Yum: -RUN curl -o /etc/yum.repos.d/plus-9.repo https://cs.nginx.com/static/files/plus-9.repo && \ - curl -o /etc/yum.repos.d/app-protect-dos-9.repo https://cs.nginx.com/static/files/app-protect-dos-9.repo && \ - dnf config-manager --set-enabled crb && \ - dnf clean all - -# Install F5 DoS for NGINX: -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - dnf install -y app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - rm /etc/yum.repos.d/plus-9.repo && \ - rm /etc/yum.repos.d/app-protect-dos-9.repo && \ - dnf clean all && \ - rm -rf /var/cache/dnf - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/rocky9-plus-dos.md" >}} ## Docker Deployment with NGINX App Protect @@ -1509,26 +1274,10 @@ Make sure to replace upstream and proxy pass directives in this example with rel 7. In the same directory create an `entrypoint.sh` file with executable permissions, with the following content: - For Alpine / Debian / Ubuntu / UBI 8 / UBI 9: + For Alpine /AmazonLinux 2023/ Debian / Ubuntu / UBI 8/ UBI 9: + +{{< include "/dos/dos-waf-entrypoint.md" >}} - ```shell - #!/usr/bin/env bash - USER=nginx - LOGDIR=/var/log/adm - - # prepare environment - mkdir -p /var/run/adm /tmp/cores ${LOGDIR} - chmod 755 /var/run/adm /tmp/cores ${LOGDIR} - chown ${USER}:${USER} /var/run/adm /tmp/cores ${LOGDIR} - - # run processes - /bin/su -s /bin/bash -c "/usr/bin/adminstall > ${LOGDIR}/adminstall.log 2>&1" ${USER} - /bin/su -s /bin/bash -c "/opt/app_protect/bin/bd_agent &" ${USER} - /bin/su -s /bin/bash -c "/usr/share/ts/bin/bd-socket-plugin tmm_count 4 proc_cpuinfo_cpu_mhz 2000000 total_xml_memory 307200000 total_umu_max_size 3129344 sys_max_account_id 1024 no_static_config 2>&1 > /var/log/app_protect/bd-socket-plugin.log &" ${USER} - /bin/su -s /bin/bash -c "/usr/bin/admd -d --log info > ${LOGDIR}/admd.log 2>&1 &" ${USER} - /usr/sbin/nginx -g 'daemon off;' - ``` - 8. Create a Docker image: For Debian/Ubuntu/Alpine/Amazon Linux: @@ -1568,293 +1317,27 @@ Make sure to replace upstream and proxy pass directives in this example with rel ### Alpine Dockerfile example -```dockerfile -# syntax=docker/dockerfile:1 -# For Alpine 3.22: -FROM alpine:3.22 - -# Download and add the NGINX signing keys: -RUN wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub && \ - wget -O /etc/apk/keys/app-protect-security-updates.rsa.pub https://cs.nginx.com/static/keys/app-protect-security-updates.rsa.pub - -# Add NGINX Plus repository: -RUN printf "https://pkgs.nginx.com/plus/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories - -# Add F5 WAF for NGINX & Dos repositories: -RUN printf "https://pkgs.nginx.com/app-protect-dos/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories && \ - printf "https://pkgs.nginx.com/app-protect/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories && \ - printf "https://pkgs.nginx.com/app-protect-security-updates/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories - -# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): -RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apk update && apk add app-protect app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/alpine-plus-dos-waf.md" >}} ### Amazon Linux Dockerfile example -```dockerfile -# syntax=docker/dockerfile:1 -FROM amazonlinux:2023 - -# Install prerequisite packages: -RUN dnf -y install ca-certificates - -# Add NGINX/NAP WAF/NAP DOS repositories: -RUN curl -o /etc/yum.repos.d/plus-amazonlinux2023.repo https://cs.nginx.com/static/files/plus-amazonlinux2023.repo && \ - curl -o /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-dos-amazonlinux2023.repo && \ - curl -o /etc/yum.repos.d/app-protect-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-amazonlinux2023.repo && \ - curl -o /etc/yum.repos.d/dependencies.amazonlinux2023.repo https://cs.nginx.com/static/files/dependencies.amazonlinux2023.repo - -# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - dnf -y install app-protect app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - rm /etc/yum.repos.d/plus-amazonlinux2023.repo && \ - rm /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo && \ - dnf clean all && \ - rm -rf /var/cache/dnf && \ - rm -rf /var/cache/yum - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -# Copy configuration files: -COPY nginx.conf custom_log_format.json /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/amazon-plus-dos-waf.md" >}} ### Debian Docker Deployment Example -```Dockerfile -# Where version can be: bullseye/bookworm -FROM debian:bullseye - -# Install prerequisite packages: -RUN apt-get update && \ - apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 debian-archive-keyring && \ - wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ - wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor | tee /usr/share/keyrings/app-protect-security-updates.gpg > /dev/null - -# Add NGINX Plus, NGINX App Protect and F5 DoS for NGINX repository: -RUN printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-plus.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect-dos.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect.list \ - && printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] https://pkgs.nginx.com/app-protect-security-updates/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/app-protect-security-updates.list - -# Download the apt configuration to `/etc/apt/apt.conf.d`: -RUN wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx - -# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which includes NGINX Plus): -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list /etc/apt/sources.list.d/nginx-app-protect.list /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - rm -rf /etc/apt/apt.conf.d/90nginx /var/lib/apt/lists/* - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -COPY nginx.conf /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/debian-plus-dos-waf.md" >}} ### Ubuntu Docker Deployment Example -```Dockerfile -# Where version can be:jammy/noble -FROM ubuntu:noble - -# Install prerequisite packages: -RUN apt-get update && \ - apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 ubuntu-keyring && \ - wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null && \ - wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor | tee /usr/share/keyrings/app-protect-security-updates.gpg > /dev/null - -# Add NGINX Plus, NGINX App Protect and F5 DoS for NGINX repository: -RUN printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-plus.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect-dos.list \ - && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/ubuntu `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-app-protect.list \ - && printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] https://pkgs.nginx.com/app-protect-security-updates/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/app-protect-security-updates.list - -# Download the apt configuration to `/etc/apt/apt.conf.d`: -RUN wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx - -# Update the repository and install the most recent versions of the F5 WAF and F5 DoS for NGINX packages (which include NGINX Plus): -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - --mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \ - apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect app-protect-dos && \ - cat license.jwt > /etc/nginx/license.jwt && \ - apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list /etc/apt/sources.list.d/nginx-app-protect.list /etc/apt/sources.list.d/nginx-app-protect-dos.list && \ - rm -rf /etc/apt/apt.conf.d/90nginx /var/lib/apt/lists/* - -# Forward request logs to Docker log collector: -RUN ln -sf /dev/stdout /var/log/nginx/access.log && \ - ln -sf /dev/stderr /var/log/nginx/error.log - -COPY nginx.conf /etc/nginx/ -COPY entrypoint.sh /root/ -RUN chmod +x /root/entrypoint.sh - -EXPOSE 80 - -STOPSIGNAL SIGQUIT - -CMD ["sh", "/root/entrypoint.sh"] -``` +{{< include "/dos/dockerfiles/ubuntu-plus-dos-waf.md" >}} ## F5 DoS for NGINX Arbitrator -### Overview - -F5 DoS for NGINX arbitrator orchestrates all the running F5 DoS for NGINX instances to synchronize local/global attack start/stop. - -F5 DoS for NGINX arbitrator serves as a central coordinating component for managing multiple instances of App Protect DoS in a network. It is needed when there are more than one F5 DoS for NGINX instances. Its primary function is to ensure that all instances are aware of and share the same state for each protected object. Here's a clearer breakdown of how it works and why it's necessary: - -How F5 DoS for NGINX Arbitrator Works: - -- **Collecting State Periodically**: The arbitrator regularly collects the state information from all running instances of App Protect DoS. This collection occurs at set intervals, typically every 10 seconds. -- **State Initialization for New Instances**: When a new App Protect DoS instance is created, it doesn't start with a blank or uninitialized state for a protected object. Instead, it retrieves the initial state for the protected object from the arbitrator. -- **Updating State in Case of an Attack**: If an attack is detected by one of the App Protect DoS instances, that instance sends an attack notification to the arbitrator. The arbitrator then updates the state of the affected protected object to indicate that it is under attack. Importantly, this updated state is propagated to all other instances. - -### Why F5 DoS for NGINX Arbitrator is Necessary - -F5 DoS for NGINX Arbitrator is essential for several reasons: - -- **Global State Management**: Without the arbitrator, each individual instance of App Protect DoS would manage its own isolated state for each protected object. This isolation could lead to inconsistencies. For example, if instance A declared an attack on a protected object named "PO-Example," instance B would remain unaware of this attack, potentially leaving the object vulnerable. -- **Uniform Attack Detection**: With the arbitrator in place, when instance A detects an attack on "PO-Example" and reports it to the arbitrator, the state of "PO-Example" is immediately updated to indicate an attack. This means that all instances, including instance B, are aware of the attack and can take appropriate measures to mitigate it. - -In summary, F5 DoS for NGINX Arbitrator acts as a central coordinator to maintain a consistent and up-to-date global state for protected objects across multiple instances of App Protect DoS. This coordination helps ensure that attacks are properly detected and mitigated, and that knowledge gained by one instance is efficiently shared with others, enhancing the overall security of the network. - - -### F5 DoS for NGINX Arbitrator Deployment - -1. Pull the official F5 DoS for NGINX Arbitrator image with the command: - - ```shell - docker pull docker-registry.nginx.com/nap-dos/app_protect_dos_arb:latest - ``` - -2. Create a container based on this image, for example, `app-protect-dos-arb` container: - - ```shell - docker run --name app_protect_dos_arb -p 3000:3000 -d docker-registry.nginx.com/nap-dos/app_protect_dos_arb - ``` - -3. Verify that the `app-protect-dos-arb` container is up and running with the `docker ps` command. - -4. DNS records are required for F5 DoS for NGINX Arbitrator to work properly and be accessible by F5 DoS for NGINX servers. Ensure that the `svc-appprotect-dos-arb` or configured Arbitrator FQDN (with `app_protect_dos_arb_fqdn` directive) has a valid DNS resolution. -This step is necessary only for VM/Docker deployments with arbitrator. When the arbitrator is in the same Kubernetes namespace as F5 DoS for NGINX, this step is not needed. - -### Multi-VM Deployment - -The Arbitrator service is standalone. Once it is down, it can be seamlessly re-started. It will immediately recover all the needed information from F5 DoS for NGINX instances that communicate to it every 10 sec. It’s downtime is around 10-20 seconds which will not affect the F5 DoS for NGINX working. - -F5 DoS for NGINX Arbitrator service connects to port 3000 and can be seen under App Protect DoS instances. All modules try to connect to this service automatically. If it’s not accessible, each instance works in standalone mode. - -There is no such option for authentications between F5 DoS for NGINX servers and Arbitrator service like MTLS or password . Currently Arbitrator service is not exposed outside of the namespace. It is customers responsibility to isolate it from outside. It is applicable to any deployment of Arbitrator, not only to multi-VM. - +{{< include "/dos/dos-arbitrator.md" >}} + ## Post-Installation Checks -You can run the following commands to ensure that F5 DoS for NGINX enforcement is operational. - -1. Check that the three processes needed for F5 DoS for NGINX are running using `ps aux`: - - - admd - - nginx: master process - - nginx: worker process - - ```shell - USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND - nginx 7759 0.0 0.0 113120 1200 ? Ss Sep06 0:00 /bin/sh -c /usr/bin/admd -d --log info > /var/log/adm/admd.log 2>&1 - root 7765 0.0 0.0 87964 1464 ? Ss Sep06 0:00 nginx: master process /usr/sbin/nginx -g daemon off; - nginx 7767 0.0 0.1 615868 8188 ? Sl Sep06 0:04 nginx: worker process - ``` - -2. Verify that there are no NGINX errors in the `/var/log/nginx/error.log` and that the policy compiled successfully: - - ```shell - 2020/09/07 15:33:44 [notice] 9307#9307: using the "epoll" event method - 2020/09/07 15:33:44 [notice] 9307#9307: nginx/1.19.0 (nginx-plus-r22) - 2020/09/07 15:33:44 [notice] 9307#9307: built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC) - 2020/09/07 15:33:44 [notice] 9307#9307: OS: Linux 3.10.0-327.28.3.el7.x86_64 - 2020/09/07 15:33:44 [notice] 9307#9307: getrlimit(RLIMIT_NOFILE): 1024:4096 - 2020/09/07 15:33:44 [notice] 9310#9310: start worker processes - 2020/09/07 15:33:44 [notice] 9310#9310: start worker process 9311 - PID <9311>, WORKER <0>, Function adm_ngx_init_process, line 684, version: 22+1.19.4-1.el7.ngx - ``` - -3. Check that by applying an attack, the attacker IP addresses are blocked while the good traffic pass through: - - a. Simulate good traffic: - - ```shell - echo "Start Good Traffic 2" - while true; do - curl ${VS}/good1 & - curl ${VS}/good2 & - curl ${VS}/good3 & - curl ${VS}/good4 - sleep 0.1 - done & - ``` - - b. After 7 minutes start the attack: - - ```shell - while [ true ] - do - ab -B ${BAD_IP1} -l -r -n 1000000 -c 150 -d -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ & - ab -B ${BAD_IP2} -l -r -n 1000000 -c 150 -d -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ & - ab -B ${BAD_IP3} -l -r -n 1000000 -c 150 -d -s 10 -H "Host: evil.net" -H "Pragma: no-cache" -H "Cache-Control: no-cache" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" -H "Upgrade-Insecure-Requests: 1" -H "User-Agent: WireXBot" -H "x-requested-with:" -H "Referer: http://10.0.2.1/none.html" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US" http://${VS}/ - - killall ab - done - ``` - - c. See that the good traffic continue as usual while the attackers receive denial of service. +{{< include "dos/install-post-checks.md" >}} To check F5 WAF for NGINX alongside F5 DoS for NGINX, just perform the normal tests as specified at [Admin Guide](https://docs.nginx.com/waf/install/virtual-environment/#post-installation-checks) @@ -1897,315 +1380,6 @@ Review the syslog ports by entering the following command: semanage port -l | grep syslog ``` -## Kubernetes Deployment Examples - -### App Protect DoS - -`appprotect-dos.yaml`: - -```yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: appprotect-dos - namespace: appprotect-dos-wp-diff - labels: - app: appprotect-dos -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - matchLabels: - app: appprotect-dos - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 2 - maxUnavailable: 1 - template: - metadata: - labels: - app: appprotect-dos - spec: - containers: - - name: ubuntu-bados - image: example.com/ubuntu_app_protect_dos_r36:latest - imagePullPolicy: Always - resources: - requests: - cpu: "200m" - memory: "500Mi" - limits: - cpu: "900m" - memory: "800Mi" - ports: - - containerPort: 80 - name: web - - containerPort: 8090 - name: probe - - containerPort: 8091 - name: probe500 - livenessProbe: - httpGet: - path: /app_protect_dos_liveness - port: 8090 - initialDelaySeconds: 0 - periodSeconds: 10 - readinessProbe: - httpGet: - path: /app_protect_dos_readiness - port: 8090 - initialDelaySeconds: 0 - periodSeconds: 10 - volumeMounts: - - name: shared - mountPath: /shared/ - - name: conf - mountPath: /etc/nginx/nginx.conf - subPath: nginx.conf - - name: root-script - mountPath: /root/entrypoint.sh - subPath: entrypoint.sh - - name: log-default - mountPath: /etc/app_protect_dos/log-default.json - subPath: log-default.json - volumes: - - name: shared - persistentVolumeClaim: - claimName: pvc-appprotect-dos-shared - - name: conf - configMap: - name: cm-appprotect-dos-nginx - items: - - key: nginx.conf - path: nginx.conf - - name: root-script - configMap: - name: cm-appprotect-dos-entry - defaultMode: 0755 - items: - - key: entrypoint.sh - path: entrypoint.sh - - name: log-default - configMap: - name: cm-appprotect-dos-log-default - defaultMode: 0755 - items: - - key: log-default.json - path: log-default.json -``` - -`svc-appprotect-dos.yaml`: - -```yaml -apiVersion: v1 -kind: Service -metadata: - name: svc-appprotect-dos - namespace: appprotect-dos-wp-diff - labels: - app: appprotect-dos -spec: - ports: - - name: app - port: 80 - protocol: TCP - nodePort: 80 - selector: - app: appprotect-dos - type: NodePort -``` - -`log-default.json`: - -```json -{ - "filter": { - "traffic-mitigation-stats": "all", - "bad-actors": "all", - "attack-signatures": "all" - } -} -``` - -`entrypoint.sh`: - -```shell -#!/usr/bin/env bash -USER=nginx -LOGDIR=/var/log/adm - -# prepare environment -mkdir -p /var/run/adm /tmp/cores ${LOGDIR} -chmod 755 /var/run/adm /tmp/cores ${LOGDIR} -chown ${USER}:${USER} /var/run/adm /tmp/cores ${LOGDIR} - -# run processes -/bin/su -s /bin/bash -c "/usr/bin/adminstall > ${LOGDIR}/adminstall.log 2>&1" ${USER} -/usr/sbin/nginx -g 'daemon off;' & -/bin/su -s /bin/bash -c "/usr/bin/admd -d --log info > ${LOGDIR}/admd.log 2>&1 &" ${USER} -``` - -`install.sh`: - -```shell -#!/bin/bash -set -ex -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" -kubectl -n appprotect-dos-wp-diff create cm cm-appprotect-dos-nginx --from-file ${DIR}/nginx.conf -kubectl -n appprotect-dos-wp-diff create cm cm-appprotect-dos-entry --from-file ${DIR}/entrypoint.sh -kubectl -n appprotect-dos-wp-diff create cm cm-appprotect-dos-log-default --from-file ${DIR}/log-default.json -kubectl create -f ${DIR}/appprotect-dos.yaml -#kubectl create -f ${DIR}/svc-appprotect-dos.yaml -``` - -`nginx.conf`: - -```nginx -user nginx; -worker_processes 1; -error_log /var/log/nginx/error.log debug; -worker_rlimit_nofile 65535; -working_directory /tmp/cores; - -load_module modules/ngx_http_app_protect_dos_module.so; - -events { - worker_connections 65535; -} -http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - - log_format log_napd ', vs_name_al=$app_protect_dos_vs_name, ip=$remote_addr, tls_fp=$app_protect_dos_tls_fp, ' - 'outcome=$app_protect_dos_outcome, reason=$app_protect_dos_outcome_reason, ' - 'ip_tls=$remote_addr:$app_protect_dos_tls_fp, '; - - app_protect_dos_security_log_enable on; - app_protect_dos_security_log "/etc/app_protect_dos/log-default.json" /var/log/adm/logger.log; - # app_protect_dos_security_log "/etc/app_protect_dos/log-default.json" syslog:server=1.2.3.4:5261; - - app_protect_dos_liveness on; # uri:/app_protect_dos_liveness port:8090 - app_protect_dos_readiness on; # uri:/app_protect_dos_readiness port:8090 - - server { - listen 80 reuseport; - server_name serv; - - set $loggable '0'; - access_log /var/log/nginx/access.log log_napd if=$loggable; - # access_log syslog:server=1.1.1.1:5561 log_napd if=$loggable; - - app_protect_dos_policy_file "/etc/app_protect_dos/BADOSDefaultPolicy.json"; - - location / { - app_protect_dos_enable on; - app_protect_dos_name "App1"; - app_protect_dos_monitor uri=http://serv:80/ protocol=http1; - proxy_pass http://1.2.3.4:80; - } - } - - server { - listen 8090; - server_name probe; - - location / { - proxy_pass http://localhost:8091; - } - } - - server { - listen 8091; - return 503; - } - - sendfile on; - tcp_nopush on; - keepalive_timeout 65; -} -``` - -### App Protect DoS Arbitrator - -Arbitrator (arb) is an internal service that is essential for the scaling scenarios. The arbitrator service should be deployed in the same namespace as F5 DoS for NGINX. - -`appprotect-dos-arb.yaml`: - -```yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: appprotect-dos-arb - namespace: appprotect-dos-wp-diff -spec: - replicas: 1 - selector: - matchLabels: - app: appprotect-dos-arb - template: - metadata: - labels: - app: appprotect-dos-arb - spec: - containers: - - name: arb-svc - image: example.com/app_protect_dos_arb:latest - resources: - requests: - cpu: "200m" - memory: "500Mi" - limits: - cpu: "900m" - memory: "800Mi" - ports: - - containerPort: 3000 -``` - -`svc-appprotect-dos-arb.yaml`: - -```yaml -apiVersion: v1 -kind: Service -metadata: - name: svc-appprotect-dos-arb - namespace: appprotect-dos-wp-diff -spec: - selector: - app: appprotect-dos-arb - ports: - - name: arb - port: 3000 - protocol: TCP - targetPort: 3000 - clusterIP: None -``` - -`install_appprotect-arb.sh`: - -```shell -#!/bin/bash - -set -ex -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" -kubectl -n appprotect-dos-wp-diff apply -f ${DIR}/appprotect-dos-arb.yaml -kubectl -n appprotect-dos-wp-diff apply -f ${DIR}/svc-appprotect-dos-arb.yaml -``` - -`install F5 DoS for NGINX with ARB service`: - -```shell -#!/bin/bash - -set -ex -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" -kubectl create ns appprotect-dos-wp-diff -${DIR}/appprotect-dos/install.sh -${DIR}/appprotect-dos-arb/install_appprotect-dos-arb.sh -``` - ---- - ## App Protect DoS eBPF manager ### Overview diff --git a/content/nap-dos/monitoring/types-of-logs.md b/content/nap-dos/monitoring/types-of-logs.md index eea14621c..3a1d9de4d 100644 --- a/content/nap-dos/monitoring/types-of-logs.md +++ b/content/nap-dos/monitoring/types-of-logs.md @@ -12,8 +12,8 @@ There are 4 types of logs corresponding to App Protect DoS: - [Security Log](#security-log): The general picture of the site and how App Protect DoS processed it, including anomalies and signatures found. - [Operation Log](#operation-log): Events such as configuration errors or warnings. -- [Debug Logs](#debug-log): Technical messages at different levels of severity used to debug and resolve incidents and error behaviors. - [Request Logging](#request-log): F5 DoS for NGINX adds information to each request logged to NGINX's access logging mechanism. +- [Debug Logs](#debug-log): Technical messages at different levels of severity used to debug and resolve incidents and error behaviors. {{< call-out "note" >}} NGINX does not have audit logs in the sense of *"**who** did **what**"*. This can be done either from the orchestration system controlling NGINX (such as NGINX Controller) or by tracking the configuration files and the systemd invocations using Linux tools. @@ -48,7 +48,7 @@ This directive determines the destination of the `access_log` and the name of th ### App Protect DoS Variables These are the variables added to Access Log. They are a subset of the Security log attributes. The Security log names are prefixed with `$app_protect_dos`.
For more information refer to [F5 DoS for NGINX Access Log]({{< ref "/nap-dos/monitoring/access-log.md" >}}) -## Debug Log - F5 DoS for NGINX +## Debug Log The F5 DoS for NGINX Debug log is used to troubleshoot the functionality of the product.
The path of the log is at a fixed location: `/var/log/adm/admd.log`. diff --git a/content/nap-dos/troubleshooting/how-to-troubleshoot.md b/content/nap-dos/troubleshooting/how-to-troubleshoot.md index 019de886e..123f80522 100644 --- a/content/nap-dos/troubleshooting/how-to-troubleshoot.md +++ b/content/nap-dos/troubleshooting/how-to-troubleshoot.md @@ -28,7 +28,7 @@ This Troubleshooting Guide is intended to provide guidance to customers in the d | More protected objects than expected | The `app_protect_dos_enable` directive is inherited by all server and location blocks beneath it, each block will be a protected object.
Consider moving this directive from outer to inner block.
Refer to: [F5 DoS for NGINX - Directives and Policy]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md" >}}) | | `No DOS protection for ngx_worker at idx X` warning message | There are more nginx processes than allowed.
Either decrease the number of nginx processes (ngx_processes directive in `nginx.conf` file) or increase the number of supported workers for F5 DoS for NGINX using the flag `--max-workers NUM` for `/usr/bin/adminstall`. | | `unknown directive 'app_protect_dos_xxx'` error message | App Protect DOS module is not loaded. Add this line to the main (global) context of nginx.conf:
`load_module "/etc/nginx/modules/ngx_http_app_protect_dos_module.so";` | -| NGINX struggles handling a high rate of incoming connections | Linux machine should be tuned for optimal performance.
Refer to [Tuning NGINX for Performance](https://www.nginx.com/blog/tuning-nginx/) | +| NGINX struggles handling a high rate of incoming connections | Linux machine should be tuned for optimal performance.
Refer to [Tuning NGINX for Performance](https://www.f5.com/company/blog/nginx/tuning-nginx) | | Error in `adminstall` process, such as `Failed to allocate` | Insufficient memory to allocate all the required resources.
Increase the `--memory` size or decrease the number of nginx workers (`--max_workers`) if not all of them are going to be in use.
Use the `--help` flag for more info. | {{}}