From d9b0f0dd073dc12f5ec1a498adccd4d6c0a734db Mon Sep 17 00:00:00 2001 From: Mourad Dmeiri Date: Thu, 29 May 2025 10:49:03 +0000 Subject: [PATCH 1/2] chore: add IP intelligence (new) --- .../config/common/ip-intelligence-conf.md | 118 +++++++++++++++ content/includes/nap-waf/ip-intelligence.md | 69 +++++++++ content/nap-waf/v4/admin-guide/install.md | 138 ++++++++++++++++++ .../v4/configuration-guide/configuration.md | 4 + .../v5/admin-guide/deploy-on-docker.md | 10 ++ content/nap-waf/v5/admin-guide/install.md | 27 +++- .../v5/configuration-guide/configuration.md | 4 + 7 files changed, 367 insertions(+), 3 deletions(-) create mode 100644 content/includes/nap-waf/config/common/ip-intelligence-conf.md create mode 100644 content/includes/nap-waf/ip-intelligence.md diff --git a/content/includes/nap-waf/config/common/ip-intelligence-conf.md b/content/includes/nap-waf/config/common/ip-intelligence-conf.md new file mode 100644 index 000000000..4af0b9d91 --- /dev/null +++ b/content/includes/nap-waf/config/common/ip-intelligence-conf.md @@ -0,0 +1,118 @@ + + + +As of NAP version 4.15.0 (for NAP V4 deployments), and NAP version 5.7.0 (for NAP V5 deployments), NGINX App Protect WAF includes a new feature named IP Intelligence. This features allows customizing the enforcement based on the source IP of the request to limit access from IP addresses with questionable reputation. Please note that: +- The IP intelligence feature is disabled by default and needs to be explicitly enabled and configured in the policy. +- The package `app-protect-ip-intelligence` needs to be installed (for NAP V4 deployments), or the IP Intelligence image deployed (for NAP V5 deployments), before configuring and using the feature. This package installs the client that downloads and updates the database required for enforcing IP Intelligence. + +After installing the package or image, enable the feature in the following two places in the policy: +1. By enabling the corresponding violation in the violation list: `"name": "VIOL_MALICIOUS_IP"` and assigning the required `block` and `alarm` values to the violation. + +2. By enabling the featue in the corresponding IP Intelligence JSON section: `"ip-intelligence": {"enabled": true}` and define actions for the IP Intelligence categories listed below. + +An example policy where both elements are enabled, and all the IP intelligence categories are configured to `block` and `alarm` can be found here: + +```json +{ + "policy": { + "name": "ip_intelligency_policy", + "template": { + "name": "POLICY_TEMPLATE_NGINX_BASE" + }, + "applicationLanguage": "utf-8", + "caseInsensitive": false, + "enforcementMode": "blocking", + "blocking-settings": { + "violations": [ + { + "name": "VIOL_MALICIOUS_IP", + "alarm": true, + "block": true + } + ] + }, + "ip-intelligence": { + "enabled": true, + "ipIntelligenceCategories": [ + { + "category": "Anonymous Proxy", + "alarm": true, + "block": true + }, + { + "category": "BotNets", + "alarm": true, + "block": true + }, + { + "category": "Cloud-based Services", + "alarm": true, + "block": true + }, + { + "category": "Denial of Service", + "alarm": true, + "block": true + }, + { + "category": "Infected Sources", + "alarm": true, + "block": true + }, + { + "category": "Mobile Threats", + "alarm": true, + "block": true + }, + { + "category": "Phishing Proxies", + "alarm": true, + "block": true + }, + { + "category": "Scanners", + "alarm": true, + "block": true + }, + { + "category": "Spam Sources", + "alarm": true, + "block": true + }, + { + "category": "Tor Proxies", + "alarm": true, + "block": true + }, + { + "category": "Web Attacks", + "alarm": true, + "block": true + }, + { + "category": "Windows Exploits", + "alarm": true, + "block": true + } + ] + } + } +} +``` +This policy will basically block `"block": true` all IP addresses that are part of any threat category and add a log entry `"alarm": true` for the transaction. + +The IP address database is managed by an external provider and is constantly updated (every 1 minute by default). The database also categorizes IP addresses into one or more threat categories. These are the same categories that can be configured individually in the IP intelligence section: +- Anonymous Proxy +- BotNets +- Cloud-based Services +- Denial of Service +- Infected Sources +- Mobile Threats +- Phishing Proxies +- Scanners +- Spam Sources +- Tor Proxies +- Web Attacks +- Windows Exploits + +Note that since the IP address database is constantly updated, IP address enforcement is also expected to change. IP Addresses may be added, removed, or moved from one category to another based on the reported activity of the IP address. diff --git a/content/includes/nap-waf/ip-intelligence.md b/content/includes/nap-waf/ip-intelligence.md new file mode 100644 index 000000000..adf5ecdef --- /dev/null +++ b/content/includes/nap-waf/ip-intelligence.md @@ -0,0 +1,69 @@ +### Docker Compose File with IP Intelligence + +If the deployment intends to use the IP intelligence Feature (avaiable from version 5.7.0), then the IP intelligence container needs to be added to the deployment in the docker compose file. + +Modify the original `docker-compose.yml` file to include the additional IP Intelligence container: + +```yaml +services: + waf-enforcer: + container_name: waf-enforcer + image: private-registry.nginx.com/nap/waf-enforcer:5.7.0 + environment: + - ENFORCER_PORT=50000 + ports: + - "50000:50000" + volumes: + - /opt/app_protect/bd_config:/opt/app_protect/bd_config + - /var/IpRep:/var/IpRep + networks: + - waf_network + restart: always + user: "101:101" + depends_on: + - waf-ip-intelligence + + waf-config-mgr: + container_name: waf-config-mgr + image: private-registry.nginx.com/nap/waf-config-mgr:5.7.0 + volumes: + - /opt/app_protect/bd_config:/opt/app_protect/bd_config + - /opt/app_protect/config:/opt/app_protect/config + - /etc/app_protect/conf:/etc/app_protect/conf + restart: always + user: "101:101" + network_mode: none + depends_on: + waf-enforcer: + condition: service_started + + waf-ip-intelligence: + container_name: waf-ip-intelligence + image: private-registry.nginx.com/nap/waf-ip-intelligence:5.7.0 + volumes: + - /var/IpRep:/var/IpRep + networks: + - waf_network + restart: always + user: "101:101" + +networks: + waf_network: + driver: bridge +``` + +Notes: +- Replace `waf-config-mgr`, `waf-enforcer` and `waf-ip-intelligence` tags with the actual release version tag you are deploying. We are using version 5.7.0 for this example deployment. +- By default, the containers `waf-config-mgr`, `waf-enforcer` and `waf-ip-intelligence` operate with the user and group IDs set to 101:101. Ensure that the folders and files are accessible to these IDs. + +Before you create the deployment in docker compose, create the directories: + +```shell +sudo mkdir -p /opt/app_protect/config /opt/app_protect/bd_config /var/IpRep +``` + +Then set ownership: + +```shell +sudo chown -R 101:101 /opt/app_protect/ /var/IpRep +``` \ No newline at end of file diff --git a/content/nap-waf/v4/admin-guide/install.md b/content/nap-waf/v4/admin-guide/install.md index c3e0575dc..8b3cb0185 100644 --- a/content/nap-waf/v4/admin-guide/install.md +++ b/content/nap-waf/v4/admin-guide/install.md @@ -51,6 +51,8 @@ The NGINX App Protect WAF package has the following dependencies: See the NGINX Plus full list of prerequisites for more details. NGINX App Protect WAF can be installed as a module to an existing NGINX Plus installation or as a complete NGINX Plus with App Protect installation in a clean environment. +Please note that an additional package **app-protect-ip-intelligence** is required if the customer intends to use the IP Intelligence feature. This package does not come as a dependency of App Protect and needs to be installed and maintained separately. This package installs the client that downloads and updates the database required for enforcing IP Intelligence. + ## Storage I/O Performance When deploying App Protect on NGINX Plus take into consideration the performance of storage on which it is going to be installed. @@ -214,6 +216,18 @@ If a user other than **nginx** is to be used, note the following: sudo service nginx start ``` +14. As of version 4.15.0, a new feature feature `IP Intelligence` is available. The feature requires the installation of an additional package to function properly: + + ```shell + sudo apk add app-protect-ip-intelligence + ``` + + After installing the package, run the client: + + ```shell + /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 & + ``` + --- ## Amazon Linux Installation @@ -328,6 +342,18 @@ If a user other than **nginx** is to be used, note the following: sudo systemctl start nginx ``` +1. As of version 4.15.0, a new feature feature `IP Intelligence` is available. The feature requires the installation of an additional package to function properly: + + ```shell + sudo dnf install app-protect-ip-intelligence + ``` + + After installing the package, run the client: + + ```shell + /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 & + ``` + ## Debian Installation 1. If you already have NGINX packages in your system, back up your configs and logs: @@ -467,6 +493,18 @@ If a user other than **nginx** is to be used, note the following: sudo systemctl start nginx ``` +16. As of version 4.15.0, a new feature feature `IP Intelligence` is available. The feature requires the installation of an additional package to function properly: + + ```shell + sudo apt install app-protect-ip-intelligence + ``` + + After installing the package, run the client: + + ```shell + /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 & + ``` + {{< warning >}} Debian enables **AppArmor** by default, but NGINX App Protect WAF will run in unconfined mode after being installed as it is shipped with no AppArmor profile. To benefit from AppArmor access control capabilities for NGINX App Protect WAF, you will have to write your own AppArmor profile for NGINX App Protect WAF executables found in `/opt/app_protect/bin` such that it best suits your environment. {{< /warning >}} @@ -588,6 +626,18 @@ If a user other than **nginx** is to be used, note the following: sudo systemctl start nginx ``` +17. As of version 4.15.0, a new feature feature `IP Intelligence` is available. The feature requires the installation of an additional package to function properly: + + ```shell + sudo dnf install app-protect-ip-intelligence + ``` + + After installing the package, run the client: + + ```shell + /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 & + ``` + --- ## RHEL 9+ Installation @@ -708,6 +758,18 @@ If a user other than **nginx** is to be used, note the following: sudo systemctl start nginx ``` +1. As of version 4.15.0, a new feature feature `IP Intelligence` is available. The feature requires the installation of an additional package to function properly: + + ```shell + sudo dnf install app-protect-ip-intelligence + ``` + + After installing the package, run the client: + + ```shell + /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 & + ``` + --- ## Ubuntu Installation @@ -843,6 +905,18 @@ If a user other than **nginx** is to be used, note the following: sudo systemctl start nginx ``` +16. As of version 4.15.0 (not avaiable for the deprecated Ubuntu 20.04), a new feature `IP Intelligence` is available. The feature requires the installation of an additional package to function properly: + + ```shell + sudo apt install app-protect-ip-intelligence + ``` + + After installing the package, run the client: + + ```shell + /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 & + ``` + {{< note >}} Ubuntu 20.04 / Ubuntu 22.04 / Ubuntu 24.04 activates **AppArmor** by default, but NGINX App Protect WAF will run in unconfined mode after being installed as it is shipped with no AppArmor profile. To benefit from AppArmor access control capabilities for NGINX App Protect WAF, you will have to write your own AppArmor profile for NGINX App Protect WAF executables found in `/opt/app_protect/bin` such that it best suits your environment. {{< /note >}} @@ -933,7 +1007,13 @@ If a user other than **nginx** is to be used, note the following: /bin/su -s /bin/sh -c "/usr/share/ts/bin/bd-socket-plugin tmm_count 4 proc_cpuinfo_cpu_mhz 2000000 total_xml_memory 307200000 total_umu_max_size 3129344 sys_max_account_id 1024 no_static_config 2>&1 >> /var/log/app_protect/bd-socket-plugin.log &" nginx /usr/sbin/nginx -g 'daemon off;' ``` + + If you want to use IP intelligence feature (Available from versions 4.15.0 and above), add this additional line to your `entrypoint.sh` file: + ```shell + /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 & + ``` + 7. Create a Docker image: - For Oracle Linux/Debian/Ubuntu/Alpine/Amazon Linux: @@ -996,6 +1076,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ apk update && apk add app-protect +# Only use if you want to install and use the IP intelligence feature: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ + apk update && apk app-protect-ip-intelligence + # Forward request logs to Docker log collector: RUN ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log @@ -1033,6 +1118,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && dnf clean all \ && rm -rf /var/cache/yum +# Only use if you want to install and use the IP intelligence feature: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf -y install app-protect-ip-intelligence + # Forward request logs to Docker log collector: RUN ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log @@ -1085,6 +1175,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ apt-get update && apt-get install -y app-protect +# Only use if you want to install and use the IP intelligence feature: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + apt-get install -y app-protect-ip-intelligence + # Forward request logs to Docker log collector: RUN ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log @@ -1125,6 +1220,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && dnf clean all \ && rm -rf /var/cache/dnf +# Only use if you want to install and use the IP intelligence feature: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf install -y app-protect-ip-intelligence + # Forward request logs to Docker log collector: RUN ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log @@ -1163,6 +1263,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && dnf clean all \ && rm -rf /var/cache/dnf +# Only use if you want to install and use the IP intelligence feature: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf install -y app-protect-ip-intelligence + # Forward request logs to Docker log collector: RUN ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log @@ -1204,6 +1309,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && dnf clean all \ && rm -rf /var/cache/dnf +# Only use if you want to install and use the IP intelligence feature: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf install -y app-protect-ip-intelligence + # Forward request logs to Docker log collector: RUN ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log @@ -1256,6 +1366,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect +# Only use if you want to install and use the IP intelligence feature: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + apt-get install -y app-protect-ip-intelligence + # Forward request logs to Docker log collector: RUN ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log @@ -1628,6 +1743,12 @@ On a host with access to the NGINX App Protect WAF repository: yum install --downloadonly --downloaddir=/etc/packages/ app-protect ``` +Only use if you want to install and use the IP intelligence feature: + + ```shell + yum install --downloadonly --downloaddir=/etc/packages/ app-protect-ip-intelligence + ``` + 3. Download the `epel-release` dependency package: For RHEL 8.1+ / Oracle Linux 8.1+: @@ -1656,6 +1777,12 @@ On an offline host: yum -y install app-protect ``` +Only use if you want to install and use the IP intelligence feature: + + ```shell + yum -y install app-protect-ip-intelligence + ``` + ### Example Deployment for Debian/Ubuntu #### Add the NGINX App Protect WAF Packages to an Internal Repository @@ -1670,6 +1797,12 @@ On a host with access to the NGINX App Protect WAF repository: apt-get update for i in $(apt-cache depends --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances app-protect | grep "^\w" | sort -u); do apt-get download $i 2>>errors.txt; done ``` +Only use if you want to install and use the IP intelligence feature: + + ```shell + cd /etc/packages/ + apt-get download app-protect-ip-intelligence + ``` 2. Add the packages in `/etc/packages` to your local repository. @@ -1685,6 +1818,11 @@ On an offline host: apt-get update apt-get install -y app-protect ``` +Only use if you want to install and use the IP intelligence feature: + + ```shell + apt-get install -y app-protect-ip-intelligence + ``` ## Post-Installation Checks diff --git a/content/nap-waf/v4/configuration-guide/configuration.md b/content/nap-waf/v4/configuration-guide/configuration.md index 025870d05..318f90c96 100644 --- a/content/nap-waf/v4/configuration-guide/configuration.md +++ b/content/nap-waf/v4/configuration-guide/configuration.md @@ -240,6 +240,10 @@ http { {{< include "nap-waf/config/common/enforcer-cookie-settings.md" >}} +### IP Intelligence Configuration + +{{< include "nap-waf/config/common/ip-intelligence-conf.md" >}} + ### Additional Configuration Options diff --git a/content/nap-waf/v5/admin-guide/deploy-on-docker.md b/content/nap-waf/v5/admin-guide/deploy-on-docker.md index 40ab5e5b3..e89c1a046 100644 --- a/content/nap-waf/v5/admin-guide/deploy-on-docker.md +++ b/content/nap-waf/v5/admin-guide/deploy-on-docker.md @@ -346,6 +346,11 @@ volumes: ``` +### Docker Compose File with IP Intelligence + +{{< include "nap-waf/ip-intelligence.md" >}} + + ### Docker Compose File with mTLS To secure traffic between NGINX and App Protect Enforcer using mTLS, create a `docker-compose.yml` with the following configuration: @@ -665,6 +670,11 @@ volumes: app_protect_config: app_protect_etc_config: ``` + +#### Docker Compose File with IP Intelligence + +{{< include "nap-waf/ip-intelligence.md" >}} + ### Start Deployment 1. To start the NGINX and WAF services, navigate to the directory that contains the `docker-compose.yml` file and run: diff --git a/content/nap-waf/v5/admin-guide/install.md b/content/nap-waf/v5/admin-guide/install.md index 3a125b0a9..f39b3743a 100644 --- a/content/nap-waf/v5/admin-guide/install.md +++ b/content/nap-waf/v5/admin-guide/install.md @@ -294,6 +294,10 @@ networks: In some operating systems, security mechanisms like **SELinux** or **AppArmor** are enabled by default, potentially blocking necessary file access for the `nginx` process and `waf-config-mgr` and `waf-enforcer` containers. To ensure NGINX App Protect WAF v5 operates smoothly without compromising security, consider setting up a custom SELinux policy or AppArmor profile. For short-term troubleshooting, you may use `permissive` (SELinux) or `complain` (AppArmor) mode to avoid these restrictions, but keep in mind that this lowers security and isn't advised for prolonged use. {{< /note >}} +### Docker Compose File with IP Intelligence + +{{< include "nap-waf/ip-intelligence.md" >}} + ## Start the Deployment 1. To start the WAF services, navigate to the directory that contains the `docker-compose.yml` file and run: @@ -893,18 +897,25 @@ docker pull private-registry.nginx.com/nap/waf-enforcer:5.2.0 docker pull private-registry.nginx.com/nap/waf-config-mgr:5.2.0 ``` +If IP Intelligence feature is to be used on the deployment, download the `waf-ip-intelligence` as well: + +```shell +docker pull private-registry.nginx.com/nap/waf-ip-intelligence:5.2.0 +``` + #### Saving and Transferring Images -1. Save the `waf-enforcer` docker image: +1. Save the `waf-enforcer` and `waf-config-mgr` docker images: ```shell docker save -o waf-enforcer.tar waf-enforcer:5.2.0 + docker save -o waf-config-mgr.tar waf-config-mgr:5.2.0 ``` -2. Save the `waf-config-mgr` docker image: +2. If IP Intelligence feature is to be used on the deployment, save the `waf-ip-intelligence` docker image: ```shell - docker save -o waf-config-mgr.tar waf-config-mgr:5.2.0 + docker save -o waf-ip-intelligence.tar waf-ip-intelligence:5.2.0 ``` 3. Transfer the tar files from the online machine to the offline/air-gapped machine: @@ -916,6 +927,12 @@ docker pull private-registry.nginx.com/nap/waf-config-mgr:5.2.0 docker load -i waf-config-mgr.tar ``` +5. If IP Intelligence feature is to be used on the deployment, on the offline machine load the docker images: + + ```shell + docker load -i waf-ip-intelligence.tar + ``` + #### Docker Compose File Create a `docker-compose.yml` with the following configuration on the offline machine: @@ -959,6 +976,10 @@ networks: In some operating systems, security mechanisms like **SELinux** or **AppArmor** are enabled by default, potentially blocking necessary file access for the `nginx` process and `waf-config-mgr` and `waf-enforcer` containers. To ensure NGINX App Protect WAF v5 operates smoothly without compromising security, consider setting up a custom SELinux policy or AppArmor profile. For short-term troubleshooting, you may use `permissive` (SELinux) or `complain` (AppArmor) mode to avoid these restrictions, but keep in mind that this lowers security and isn't advised for prolonged use. {{< /note >}} +#### Docker Compose File with IP Intelligence + +{{< include "nap-waf/ip-intelligence.md" >}} + ### Start the Deployment 1. To start the WAF services, navigate to the directory that contains the `docker-compose.yml` file and run: diff --git a/content/nap-waf/v5/configuration-guide/configuration.md b/content/nap-waf/v5/configuration-guide/configuration.md index a17322367..1a8319108 100644 --- a/content/nap-waf/v5/configuration-guide/configuration.md +++ b/content/nap-waf/v5/configuration-guide/configuration.md @@ -259,6 +259,10 @@ app_protect_policy_file /policies_mount/new_default_policy.tgz; {{< include "nap-waf/config/common/enforcer-cookie-settings.md" >}} +### IP Intelligence Configuration + +{{< include "nap-waf/config/common/ip-intelligence-conf.md" >}} + ### Additional Configuration Options {{< include "nap-waf/config/common/additional-config-options.md" >}} From ce877e5b24acf0e18b2737d00926cbdb3914d425 Mon Sep 17 00:00:00 2001 From: Mourad Dmeiri Date: Thu, 29 May 2025 12:06:01 +0000 Subject: [PATCH 2/2] fix: last minute fixes --- .../nap-waf/config/common/ip-intelligence-conf.md | 7 ++++--- content/includes/nap-waf/ip-intelligence.md | 8 +++----- content/nap-waf/v4/admin-guide/install.md | 11 ++++++----- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/content/includes/nap-waf/config/common/ip-intelligence-conf.md b/content/includes/nap-waf/config/common/ip-intelligence-conf.md index 4af0b9d91..efe50b78d 100644 --- a/content/includes/nap-waf/config/common/ip-intelligence-conf.md +++ b/content/includes/nap-waf/config/common/ip-intelligence-conf.md @@ -2,11 +2,11 @@ As of NAP version 4.15.0 (for NAP V4 deployments), and NAP version 5.7.0 (for NAP V5 deployments), NGINX App Protect WAF includes a new feature named IP Intelligence. This features allows customizing the enforcement based on the source IP of the request to limit access from IP addresses with questionable reputation. Please note that: -- The IP intelligence feature is disabled by default and needs to be explicitly enabled and configured in the policy. -- The package `app-protect-ip-intelligence` needs to be installed (for NAP V4 deployments), or the IP Intelligence image deployed (for NAP V5 deployments), before configuring and using the feature. This package installs the client that downloads and updates the database required for enforcing IP Intelligence. +- The IP intelligence feature is **disabled** by default and needs to be explicitly enabled and configured in the policy. +- The package `app-protect-ip-intelligence` must be installed (for NAP V4 deployments), or the IP Intelligence image deployed (for NAP V5 deployments), before configuring and using the feature. This package installs the client that downloads and updates the database required for enforcing IP Intelligence. After installing the package or image, enable the feature in the following two places in the policy: -1. By enabling the corresponding violation in the violation list: `"name": "VIOL_MALICIOUS_IP"` and assigning the required `block` and `alarm` values to the violation. +1. By enabling the corresponding violation in the violation list: `"name": "VIOL_MALICIOUS_IP"` and assigning the appropriate `block` and `alarm` values to the violation. 2. By enabling the featue in the corresponding IP Intelligence JSON section: `"ip-intelligence": {"enabled": true}` and define actions for the IP Intelligence categories listed below. @@ -99,6 +99,7 @@ An example policy where both elements are enabled, and all the IP intelligence c } } ``` + This policy will basically block `"block": true` all IP addresses that are part of any threat category and add a log entry `"alarm": true` for the transaction. The IP address database is managed by an external provider and is constantly updated (every 1 minute by default). The database also categorizes IP addresses into one or more threat categories. These are the same categories that can be configured individually in the IP intelligence section: diff --git a/content/includes/nap-waf/ip-intelligence.md b/content/includes/nap-waf/ip-intelligence.md index adf5ecdef..558545985 100644 --- a/content/includes/nap-waf/ip-intelligence.md +++ b/content/includes/nap-waf/ip-intelligence.md @@ -1,5 +1,3 @@ -### Docker Compose File with IP Intelligence - If the deployment intends to use the IP intelligence Feature (avaiable from version 5.7.0), then the IP intelligence container needs to be added to the deployment in the docker compose file. Modify the original `docker-compose.yml` file to include the additional IP Intelligence container: @@ -56,14 +54,14 @@ Notes: - Replace `waf-config-mgr`, `waf-enforcer` and `waf-ip-intelligence` tags with the actual release version tag you are deploying. We are using version 5.7.0 for this example deployment. - By default, the containers `waf-config-mgr`, `waf-enforcer` and `waf-ip-intelligence` operate with the user and group IDs set to 101:101. Ensure that the folders and files are accessible to these IDs. -Before you create the deployment in docker compose, create the directories: +Before creating the deployment in docker compose, create the required directories: ```shell sudo mkdir -p /opt/app_protect/config /opt/app_protect/bd_config /var/IpRep ``` -Then set ownership: +Then set correct ownership: ```shell sudo chown -R 101:101 /opt/app_protect/ /var/IpRep -``` \ No newline at end of file +``` diff --git a/content/nap-waf/v4/admin-guide/install.md b/content/nap-waf/v4/admin-guide/install.md index 8b3cb0185..e02c2ad46 100644 --- a/content/nap-waf/v4/admin-guide/install.md +++ b/content/nap-waf/v4/admin-guide/install.md @@ -1079,7 +1079,7 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ # Only use if you want to install and use the IP intelligence feature: RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \ - apk update && apk app-protect-ip-intelligence + apk update && apk add app-protect-ip-intelligence # Forward request logs to Docker log collector: RUN ln -sf /dev/stdout /var/log/nginx/access.log \ @@ -1743,7 +1743,7 @@ On a host with access to the NGINX App Protect WAF repository: yum install --downloadonly --downloaddir=/etc/packages/ app-protect ``` -Only use if you want to install and use the IP intelligence feature: + Only use if you want to install and use the IP intelligence feature: ```shell yum install --downloadonly --downloaddir=/etc/packages/ app-protect-ip-intelligence @@ -1777,7 +1777,7 @@ On an offline host: yum -y install app-protect ``` -Only use if you want to install and use the IP intelligence feature: + Only use if you want to install and use the IP intelligence feature: ```shell yum -y install app-protect-ip-intelligence @@ -1797,7 +1797,8 @@ On a host with access to the NGINX App Protect WAF repository: apt-get update for i in $(apt-cache depends --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances app-protect | grep "^\w" | sort -u); do apt-get download $i 2>>errors.txt; done ``` -Only use if you want to install and use the IP intelligence feature: + + Only use if you want to install and use the IP intelligence feature: ```shell cd /etc/packages/ @@ -1818,7 +1819,7 @@ On an offline host: apt-get update apt-get install -y app-protect ``` -Only use if you want to install and use the IP intelligence feature: + Only use if you want to install and use the IP intelligence feature: ```shell apt-get install -y app-protect-ip-intelligence