AniNIX/Kapisi
1
0
Fork 0
Code Issues 31 Pull Requests 1 Projects 1 Releases Wiki Activity

Webserver Port #9

New Issue
Closed
opened 2020-08-27 05:46:24 -05:00 by DarkFeather · 2 comments
DarkFeather commented 2020-08-27 05:46:24 -05:00
Owner
Copy Link
Copy Source

We need to drop lighttpd for OpenResty for HTTP/2 streaming proxy support. This means all vhosts on lighttpd and the security hardening need to come with.

We need to drop lighttpd for OpenResty for HTTP/2 streaming proxy support. This means all vhosts on lighttpd and the security hardening need to come with.
DarkFeather commented 2020-11-05 15:33:44 -06:00
Author
Owner
Copy Link
Copy Source

We should include ModSecurity as a Web Application Firewall, to serve in a similar capacity to sshguard.

https://aur.archlinux.org/packages/modsecurity/

This will result in a 3-layer firewalling model for our three externally-facing ports.

  1. Router firewall
  2. Host firewall
  3. Application firewall (sshguard, ModSecurity, IRC z-line)

This need for WAF puts a kink into #12 -- using HA Proxy in this way would break the header and WAF controls we're using today.

We should include ModSecurity as a Web Application Firewall, to serve in a similar capacity to sshguard. https://aur.archlinux.org/packages/modsecurity/ This will result in a 3-layer firewalling model for our three externally-facing ports. 1. Router firewall 1. Host firewall 1. Application firewall (sshguard, ModSecurity, IRC z-line) This need for WAF puts a kink into #12 -- using HA Proxy in this way would break the header and WAF controls we're using today.
DarkFeather added the RFC label 2020-11-05 15:33:56 -06:00
DarkFeather added this to the Kanban project 2022-08-04 00:40:39 -05:00
DarkFeather added the On-hold label 2022-08-04 00:46:51 -05:00
DarkFeather added Peer-review and removed On-holdRFC labels 2023-11-09 13:11:09 -06:00
DarkFeather commented 2023-11-09 13:14:35 -06:00
Author
Owner
Copy Link
Copy Source

!27 implements the WAF portion. Because OpenResty isn't keeping up with core Nginx development, it throws an error like the below:

nginx: [emerg] module "/usr/lib/nginx/modules/ngx_http_modsecurity_module.so" version 1024000 instead of 1021004 in /opt/openresty/nginx/conf/nginx.conf:4

I'd rather not pull a fork of the libmodsecurity package & connector just for OpenResty. As such, we're moving to mainline nginx.

This can close -- when !27 closes, the work will have been delivered.

!27 implements the WAF portion. Because OpenResty isn't keeping up with core Nginx development, it throws an error like the below: ``` nginx: [emerg] module "/usr/lib/nginx/modules/ngx_http_modsecurity_module.so" version 1024000 instead of 1021004 in /opt/openresty/nginx/conf/nginx.conf:4 ``` I'd rather not pull a fork of the [libmodsecurity](https://archlinux.org/packages/extra/x86_64/libmodsecurity/) package & connector just for OpenResty. As such, we're moving to mainline nginx. This can close -- when !27 closes, the work will have been delivered.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Blocked
There are functional or technical reasons this can't be implemented yet
 Duplicate
Another issue or PR already describes this issue
 On-hold
Evaluated but not enough resources to complete now
 Peer-review
Being reviewed for quality prior to merge
 RFC
More information and feedback is needed
 Wontfix
Not a bug -- way it works
Blocked
There are functional or technical reasons this can't be implemented yet
 Duplicate
Another issue or PR already describes this issue
 In-progress
Being worked.
 On-hold
Evaluated but not enough resources to complete now
 Peer-review
Being reviewed for quality prior to merge
 RFC
More information and feedback is needed
 Wontfix
Not a bug -- way it works
No labels Peer-review
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Kanban
To Do
Assignees
Clear assignees
DarkFeather (DarkFeather)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: AniNIX/Kapisi#9