befw - GitLite

KO | EN

gitlite — search

#python #hacktoberfest #llm #golang #android #deep-learning #nodejs #java #windows #awesome #kubernetes #vue #security #openai

befw

(★ 120)

BEFW

파일 탐색기

최종 버전 다운로드 (.zip)

- alias.go
- alias_test.go
- api.go
- config.go
- const.go
- disaster.go
- fw.go
- fwiptables.go
- fwiptables_test.go
- fwnft.go
- fwnft_test.go
- fwnftc7.go
- fwnftc7_test.go
- legacy.go
- legacy_test.go
- nf.go
- nids.go
- nids_test.go
- recovery.go
- run.go
- service.go
- service_test.go
- state.go
- state_test.go
- static.go
- static_test.go
- util.go
- util_test.go
- watcher.go
- - befw-cli.go
- - befw-deny.go
- - befw-firewalld.go
- - befw-sync.go
- befw.conf
- befw.sync.conf
- iptables.rules
- puppetdb.sh
- README.md
- register.sh
- rules.json
- config.go
- git.go
- pgp.go
- run.go
- logger.go
- cleaner.go
- puppetdb.go
- puppetdbs_test.go
- run.go
- struct.go
- sync.go
- anonymous.acl
- befw-firewalld.service
- befw-sync.service
- befw.conf
- befw.rules.accept.json
- befw.rules.reject.json
- befw.sync.conf
- iptables.rules
- master.acl
- node.acl
- post.sh
- pusher.py
- modules.txt
.gitignore
CHANGELOG.md
CONTRIB.md
go.mod
go.sum
ISSUES.md
LICENSE
MAINTAINERS.md
Makefile
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/wgnet/befw

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd befw

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Go

보통 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Go Go 언어 컴파일러 및 도구 모음입니다.

go install github.com/wgnet/befw/cmd/befw-cli

이 명령어를 터미널에 그대로 입력해 실행하세요.

go install github.com/wgnet/befw/cmd/befw-firewalld

이 명령어를 터미널에 그대로 입력해 실행하세요.

go install github.com/wgnet/befw/cmd/befw-sync

이 명령어를 터미널에 그대로 입력해 실행하세요.

✅ 빌드가 에러 없이 끝나면 성공입니다. go run . 을 썼다면 터미널 출력을 확인하세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

3. Make

보통

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Make Linux/macOS는 보통 기본 설치되어 있습니다. Windows는 별도 설치(예: MSYS2, WSL)가 필요합니다.

make

생성된 빌드 설정을 바탕으로 실제 컴파일을 진행해 실행 파일을 만듭니다.

✅ 에러 없이 끝나면 성공입니다. 생성된 실행 파일을 직접 실행해보세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# BEFW project
###### Dynamic Host-Based Firewall
# Intro
**BEFW** is a couple of golang-written tools that are eligible to maintain dynamic firewall rules across the datacenter(s).
The approach is based on the service discovery concept: if we know there's a service, we can protect it. If we know there's a client for the service, we can allow him to connect to.
BEFW is using consul service catalog to store services ( with their tcp/udp ports ) and is using consul key-value storage to store services clients.
It's just a bit smarter than ```curl localhost:8200/v1/agent/services|perl -e '<script>'|iptables-restore```, but 'a bit' is significant here.
# Requirements
- Any modern Linux distro with iptables & ipset support.
- You must have at least one consul cluster with acl support enabled.
- You must have consul agent on every node that runs befw.
- We provide the only PuppetDB orchestration provider. You may need to develop yourth.

# How to build
```
go install github.com/wgnet/befw/cmd/befw-cli
go install github.com/wgnet/befw/cmd/befw-firewalld
go install github.com/wgnet/befw/cmd/befw-sync
```
***
# Deployment scheme
**BEFW** is not only tools but the approach too. If you build dynamic firewall from scratch, you may use our deployment guide.
## Consul cluster
1. [Install](https://www.consul.io/docs/install/index.html) regular consul cluster ( or federated cluster ) with N ( N % 2 == 1) servers and M agents. Each server must have consul agent running.
2. Push [some data](samples/post.sh) and enjoy
### ACLs
To protect your firewall configuration from unauthorized changes you need to create at least 3 acl sets on your consul cluster.
To enable ACL support please read this [article](https://www.consul.io/docs/guides/acl-legacy.html).
#### anonymous ACL
Allows anyone to read data from firewall ( usable for monitoring, metrics & UI for end users). [Example](samples/anonymous.acl).
#### node/agent ACL
Allows node/agent to read firewall configuration and register services. [Example](samples/node.acl).
#### Commit/Master ACL
Allows 3pc software to write firewall configuration and purge expired data. [Example](samples/master.acl).
## Configuration
We use single consul datacenter to store firewall KV and we call it *dc*. You should specify this datacenter into configuration file.
We use multiple consul datacenters ( one per site ) to store services & local KVs.
You may use single-dc configuration, specify it's name as *dc* though.
## Default firewall rules
3. Change default [**iptables template**](samples/iptables.rules)
## Service
4. Install & launch befw-firewalld service on every agent node
5. Edit [sample configuration](samples/befw.conf) and place it to /etc/befw.conf.  Options:
    - firewall (values: "nft"|"nftc7", default: "") - Change firewall provider: nft - nftables, nftc7 - legacy nftables 0.8 (centos7), otherwise - iptables/ipset
6. Place [sample service](samples/service.json) to *services dir* and see what will happen
## Puppet/Hiera/PuppetDB
*We use puppet to do items 3-6 and below as we have a huge puppet installation. Skip this if you don't.*
Puppet provides a great way to enumerate services on every node. You can just add something like that in every role/application-definition class:
```puppet
file { "/etc/befw.service.d/${title}.json":
    ensure  => file,
    content => "<-- json here -->",
}
```
This will provide your services in consul automagically. Just a few patches once will save your time forever.
See [samples](samples/puppet/) for more information.
### befw-sync
Here, in Wargaming, we also use hiera & puppetdb to provide both services & clients for our services. The idea is that if we can collect & commit something to puppetdb ( like 'i_need_this_service_to_work'), that we can just grab it from puppetdb and store into consul.
**befw-sync** does this job, looking into puppetdb for a corresponding *resource* and grabbing parameters to push to consul KV storage.
See [sample config](samples/befw.sync.conf) to get into, but we doubt it is useful if you don't have such huge puppet installation on your world.
# Managing rules
## Adding new service
- Place a service file to *services* directory or
- Post a http request to local consul agent ( v1/agent/register ) or
- Allow consul-supported software ( like vault ) to manage it on its own

**N.B.** use tag 'befw' to generate rules for this service. Use tags 'port/protocol' ( like '80/tcp' ) to specify *additional* ports for the service.
## Adding new rules
- Place ip/network and expiry value to KV storage on *dc* datacenter or
- Place alias and expiry value to KV storage on *dc* datacenter or
- Place a new data to alias definition to KV storage on *dc* datacenter

**N.B.** You can specify world, dc or node level while placing the rules.
### Examples
```go
consul.KV().Put("befw/$service$/service_tcp_443/192.168.1.1/30", time.now()+2*week)
consul.KV().Put("befw/$service$/dc/service_tcp_443/192.168.1.1/30", time.now()+2*week)
consul.KV().Put("befw/$service$/dc/nodename/service_tcp_443/192.168.1.1/30", time.now()+2*week)
consul.KV().Put("befw/$service$/service_tcp_443/$trusted$", -1) // <0 never expires
consul.KV().Put("befw/$alias$/$trusted$/192.168.1.1.30", time.now()+1*hour)
```
## Tools
[**pusher**](samples/pusher.py) is a very primitive python (2.7) tool to manage befw manually. Please avoid using it in production.
**Usage**: ./pusher.py list|add|rm|clist|cadd|crm  [opts]
**Config file**: ~/.pusher.conf
```bash
host=localhost
port=8500
dc=consul
token=2375a28a-75ec-4b5f-a30f-3e68f8239a0a
```
**Example usage**:
```bash
# no clients for service
$ ./pusher.py clist myown_tcp_5672
[+] DC= dc , Node= node
# adding new one for level 3 ( node )
$ ./pusher.py cadd myown_tcp_5672 127.0.0.1 3
[+] DC= dc , Node= node
Added 127.0.0.1 to befw/dc/node/myown_tcp_5672/127.0.0.1 with expiry=1554896188
# yes we have it on KV now
$ ./pusher.py clist myown_tcp_5672
[+] DC= dc , Node= node
befw/dc/node/myown_tcp_5672/
 *127.0.0.1
# deleteting 127.0.0.1 from all levels
$ ./pusher.py crm myown_tcp_5672 127.0.0.1
[+] DC= dc , Node= node
Deleting befw/myown_tcp_5672/127.0.0.1
Deleting befw/dc/myown_tcp_5672/127.0.0.1
Deleting befw/dc/node/myown_tcp_5672/127.0.0.1
# no clients found
$ ./pusher.py clist myown_tcp_5672
[+] DC= dc , Node= node
$
```
# Changelog
See [CHANGELOG](CHANGELOG.md).
# Known issues
See [ISSUES](ISSUES.md).
# Contributing
See [CONTRIB](CONTRIB.md).