Improve Threat Shield UI

[gsanchietti]

Description:

We can no longer postpone the improvement of the banIP UI, or half of the reporting becomes ineffective. To enhance the utility of the Threat Shield reporting, the following improvements must be made to both the UI and backend functionalities:

To-Do List:

1. Modify Dashboard Counter:

   • Display a warning message if logging is disabled.

2. Settings Page:

   Logging options (all options are enabled/disabled):

   • Log packets blocked in pre-routing chain, ban_logprerouting: Log suspicious packets in the prerouting chain.
   • Log packets blocked in input chain, ban_loginput: Log suspicious packets in the WAN-input chain.
   • Log packets blocked in forward chain chain, ban_logforwardwan: Log suspicious packets in the WAN-forward chain.
   • Log packets blocked in forwarded from lan ban_logforwardlan: Log suspicious packets in the LAN-forward chain.

   Prevent brute attacks:

   • Block brute force attack, ban_loglimit (enabled/disabled): Enable or disable monitoring for brute-force attacks.
   • Ban after x failed access, ban_logcount (text, number): Specify how many times an IP must appear in the log to be considered suspicious.
   • Pattern to search for attacks, ban_logterm (list): Display regex for logfile parsing (visible only if ban_loglimit is enabled).
   • Prevent ICMP DoS, ban_icmplimit (enabled/disabled): Detect ICMP DoS in prerouting chain
   • Prevent SYN DoS, ban_synlimit (enabled/disabled): Detect SYN DoS in prerouting chain
   • Prevent UDP DoS, ban_udplimit (enabled/disabled): Detect UDP DoS in prerouting chain
   • Add to the description that attacker IP will be blocked for 30 minutes
   • Ban time (combobox): Select ban time from a list of predefined values

Notes:

• Ensure that both the UI and backend modifications improve the overall functionality and effectiveness of the Threat Shield reports and provide clear user feedback on logging and list management features.

---

Resources:

• Figma Mockups
• Draft API PR: https://github.com/NethServer/nethsecurity/pull/793

[Tbaile]

Backend appears to be ready, not merging until UI is available

[andre8244]

Testing image

23.05.5-ns.1.2.99-alpha1-49-gd35f90fee2

Test case 1

• Go to Security > Threat shield
• Go to Local blocklist tab
• Verify that address creation, editing and deletion work as expected
• Go to Settings tab
• Enable Threat shield
• Verify that all new configuration parameters work as expected

Test case 2

• Go to Security > Threat shield
• Go to Settings tab
• Enable Threat shield and disable all logging options
• Verify that a warning inline notification is shown
• Save Threat shield settings with all logging opitions disabled
• Go to Dashboard page
• Verify that a warning is shown in Threat shield card

[Tbaile]

Cases verified.