search

Tribler / tribler

Privacy enhanced BitTorrent client with P2P content discovery
https://www.tribler.org
GNU General Public License v3.0
4.73k stars 445 forks source link

EBSI digital identity DDoS hardening using IP reputation #7481

Open synctext opened 1 year ago

synctext commented 1 year ago

Survey Q1 + Starting thesis 10 jan {job next to thesis}

Also interested in the problem of online trust. General intro and overview by Bruce {rockstar of security research} Ten Risks of PKI: What You’re not Being Told about Public Key Infrastructure. Technical discussion on HackerNews on passport failures and public key directories.

{duplicate from # 7423} Topic Title of paper and URL
strong identity A Truly Self-Sovereign Identity System
strong identity TrustVault: A privacy-first data wallet for the European Blockchain Services Infrastructure
strong identity Zero-Trust Architecture for Legal Entities
strong identity Distributed Attestation Revocation in Self-Sovereign Identity

More on passport-level digital identity. Warning given :smile_cat: "this is complex stuff". identity is the foundation of trust in the old analog world. Please make a reading list about SSI, EBSI, EBP and eIDAS2

please note the survey @ Tribler lab methodology: https://github.com/Tribler/tribler/wiki/MasterThesis#10-ects-literature-survey-at-tribler-lab (e.g. try out all known open source wallets for suvey and grade them with stong/weak analysis in a table with screenshots { https://walt.id/ebsi ; https://github.com/walt-id })

AdiDumi commented 1 year ago

why has public key infrastructure failed for 35 years

synctext commented 10 months ago

Ask Google Scholar about PKI failure. First result: https://www.nics.uma.es/pub/papers/JavierLopez2005.pdf With the upcoming European passport this given a nice modern twist to 35(?) years of failure: Failure of Public Key Infrastructure for 35 years: lessons for the European passport-grade digital identity (EBSI) {putting 2 storylines into 1 title}. Shorter attempt: 35 years of failure: European Digital Identity lessons

see 2016 ideas on Self-sovereign identity (SSI). TUDelft Master student full-time on EU digital ID from 2021. Discussed the Literature Survey wiki documentation

{brainstorm in bit harsh term} A fraud-resilient authentication method is notoriously hard to realise. Academic thinkers have offered little help, academic literature extensively documents numerous ideas and design sketches. Public key cryptography was invented in the year: ... In the 35 years since this invention we have failed to utilise this invention. The European Digital Identity project (EBSI) is only the latest in a long line of failed attempts. For instance, "Overview of the German identity card project and lessons learned (2020 update)" and "The giant is lagging behind - How the German electronic ID fails to reap its potential. This survey lists the numerous projects to provide digital identity and also highlights the decades scientific research. To date, no solution exists for the 400 million citizens within the EU. Finally, we list the vital lessons for the upcoming project to provide an EU-wide passport-grade digital identity. Contrary to numerous past projects, a refreshing amount of transparency is provided. For instance, see the detailed public EBSI node operator operational handbook.

Bit of general info news article "Digital Identity: Where We Began, Where We Are And Where We Are Going"

{early brainstorm for master thesis} The above builds expertise on wide scope of upcoming EU digital ID. Security will we essential, but EBSI server is based upon IBM Hyperledger technology. This is expected to only serve a good purpose during development. For full-scale production usage as the underpinning of the entire EU digital economy Hyperledger server probably needs replacing. Ideal outcome would be re-using the infrastructure at Delft to develop a 12-line Kotlin script to bring down such a EBSI Hyperledger server. See 2021 Delft master student who made the first open source Android EBSI v2 communications lib. Good news, save this project with application-level firewall rules????

AdiDumi commented 10 months ago

On the risk of misbehaving RPKI authorities

REGULATION (EU) on eid 'Building trust in the online environment is key to economic and social development. Lack of trust, in particular because of a perceived lack of legal certainty, makes consumers, businesses and public authorities hesitate to carry out transactions electronically and to adopt new services.'

AdiDumi commented 9 months ago

Survey Template

synctext commented 9 months ago

Lots of written documents in the past 35 years, yet no generic solution for digital identity:

AdiDumi commented 8 months ago

Additional read:

synctext commented 8 months ago
AdiDumi commented 8 months ago

overleaf Secure Web Client Using SPKI/SDSI SDSI Java imple Simple Public Key Infrastructure Analysis Protocol Analysis and Design Attribute-Based Identity Management Bridging the Cryptographic Design of ABCs with the Real World IRMA Glass

To get more from: Blockchain-based identity management systems: A review

synctext commented 8 months ago
AdiDumi commented 7 months ago

Almost final draft Missing abstract, conclusion and some table information Literature_Survey_IN4306.pdf

synctext commented 7 months ago

image

AdiDumi commented 7 months ago

Ursula von der Leyen statement

AdiDumi commented 6 months ago

Finished final version of the Survey. Worked on the abstract, conclusions, history of PKI evolution, added countries to the survey and completed the taxonomy table. Rephrasing some paragraphs and added more literature about PKI failures and EU eIDs. Literature_Survey_IN4306_final.pdf

synctext commented 6 months ago
AdiDumi commented 5 months ago

The survey is uploaded to arXiv with the lastest version. Literature_Survey_IN4306 (2).pdf

synctext commented 5 months ago

Completed! Today the master thesis work starts :tada:

AdiDumi commented 5 months ago

Studied the code for existing EBSI wallet in the SuperApp Studied the server code and also on the gitlab with the APIs and wallets available now and wallets

synctext commented 5 months ago

Concrete tasks to further explore your thesis focus.

synctext commented 5 months ago

Please read all these details: https://medium.com/@schwalm.steffen/qualified-ledgers-bridging-the-gap-between-blockchain-technology-and-legal-compliance-c08d24a68db9

synctext commented 4 months ago

Next week we should get an EBSI server image to install, so there is movement...

AdiDumi commented 4 months ago

Update sprint:

synctext commented 4 months ago
AdiDumi commented 3 months ago

Sprint update:

Full draft docker magic ``` ARG HTTPD_VERSION="1" FROM httpd:${HTTPD_VERSION} as build ARG MODSEC2_VERSION="1" ARG LUA_VERSION="1" RUN set -eux; \ echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections; \ apt-get update -qq; \ apt-get install -y -qq --no-install-recommends --no-install-suggests \ automake \ ca-certificates \ g++ \ git \ libapr1-dev \ libaprutil1-dev \ libcurl4-gnutls-dev \ libfuzzy-dev \ libpcre3-dev \ libtool \ libxml2-dev \ libyajl-dev \ lua${LUA_VERSION}-dev \ make \ pkgconf \ wget RUN set -eux; \ wget --quiet https://github.com/owasp-modsecurity/ModSecurity/archive/refs/tags/v${MODSEC2_VERSION}.tar.gz; \ tar -zxvf v${MODSEC2_VERSION}.tar.gz; \ cd ModSecurity-${MODSEC2_VERSION}; \ ./autogen.sh; \ ./configure --with-yajl --with-ssdeep; \ make; \ make install; \ make clean FROM httpd:${HTTPD_VERSION} as crs_release ARG CRS_RELEASE # hadolint ignore=DL3008,SC2016 RUN set -eux; \ apt-get update; \ apt-get -y install --no-install-recommends \ ca-certificates \ curl \ gnupg; \ mkdir /opt/owasp-crs; \ curl -SL https://github.com/coreruleset/coreruleset/archive/v${CRS_RELEASE}.tar.gz -o v${CRS_RELEASE}.tar.gz; \ curl -SL https://github.com/coreruleset/coreruleset/releases/download/v${CRS_RELEASE}/coreruleset-${CRS_RELEASE}.tar.gz.asc -o coreruleset-${CRS_RELEASE}.tar.gz.asc; \ gpg --fetch-key https://coreruleset.org/security.asc; \ gpg --verify coreruleset-${CRS_RELEASE}.tar.gz.asc v${CRS_RELEASE}.tar.gz; \ tar -zxf v${CRS_RELEASE}.tar.gz --strip-components=1 -C /opt/owasp-crs; \ rm -f v${CRS_RELEASE}.tar.gz coreruleset-${CRS_RELEASE}.tar.gz.asc; \ mv -v /opt/owasp-crs/crs-setup.conf.example /opt/owasp-crs/crs-setup.conf FROM httpd:${HTTPD_VERSION} ARG MODSEC2_VERSION ARG LUA_VERSION ARG LUA_MODULES ENV APACHE_ALWAYS_TLS_REDIRECT=off \ APACHE_LOGFORMAT='"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""' \ APACHE_ERRORLOG_FORMAT='"[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"' \ APACHE_METRICS_LOGFORMAT='"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""' \ ACCESSLOG=/var/log/apache2/access.log \ BACKEND=http://localhost:80 \ BACKEND_WS=ws://localhost:8080 \ ERRORLOG='/proc/self/fd/2' \ H2_PROTOCOLS='h2 http/1.1' \ LOGLEVEL=warn \ METRICS_ALLOW_FROM='127.0.0.0/255.0.0.0 ::1/128' \ METRICS_DENY_FROM='All' \ MUTEX='default' \ METRICSLOG='/dev/null' \ MODSEC_AUDIT_ENGINE="RelevantOnly" \ MODSEC_AUDIT_LOG_FORMAT=JSON \ MODSEC_AUDIT_LOG_TYPE=Serial \ MODSEC_AUDIT_LOG=/dev/stdout \ MODSEC_AUDIT_LOG_PARTS='ABIJDEFHZ' \ MODSEC_AUDIT_STORAGE=/var/log/modsecurity/audit/ \ MODSEC_DATA_DIR=/tmp/modsecurity/data \ MODSEC_DEBUG_LOG=/dev/null \ MODSEC_DEBUG_LOGLEVEL=0 \ MODSEC_DEFAULT_PHASE1_ACTION="phase:1,pass,log,tag:'\${MODSEC_TAG}'" \ MODSEC_DEFAULT_PHASE2_ACTION="phase:2,pass,log,tag:'\${MODSEC_TAG}'" \ MODSEC_DISABLE_BACKEND_COMPRESSION="On" \ MODSEC_PCRE_MATCH_LIMIT_RECURSION=100000 \ MODSEC_PCRE_MATCH_LIMIT=100000 \ MODSEC_REQ_BODY_ACCESS=on \ MODSEC_REQ_BODY_LIMIT=13107200 \ MODSEC_REQ_BODY_LIMIT_ACTION="Reject" \ MODSEC_REQ_BODY_JSON_DEPTH_LIMIT=512 \ MODSEC_REQ_BODY_NOFILES_LIMIT=131072 \ MODSEC_RESP_BODY_ACCESS=on \ MODSEC_RESP_BODY_LIMIT=1048576 \ MODSEC_RESP_BODY_LIMIT_ACTION="ProcessPartial" \ MODSEC_RESP_BODY_MIMETYPE="text/plain text/html text/xml" \ MODSEC_RULE_ENGINE=on \ MODSEC_SERVER_SIGNATURE="Apache" \ MODSEC_STATUS_ENGINE="Off" \ MODSEC_TAG=modsecurity \ MODSEC_TMP_DIR=/tmp/modsecurity/tmp \ MODSEC_TMP_SAVE_UPLOADED_FILES="on" \ MODSEC_UPLOAD_DIR=/tmp/modsecurity/upload \ PORT=80 \ PROXY_ERROR_OVERRIDE=on \ PROXY_PRESERVE_HOST=on \ PROXY_SSL=off \ PROXY_SSL_CA_CERT=/etc/ssl/certs/ca-certificates.crt \ PROXY_SSL_CERT=/usr/local/apache2/conf/proxy.crt \ PROXY_SSL_CERT_KEY=/usr/local/apache2/conf/proxy.key \ PROXY_SSL_CHECK_PEER_NAME=off \ PROXY_SSL_CIPHERS="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" \ PROXY_SSL_PROTOCOLS="all -SSLv3 -TLSv1 -TLSv1.1" \ PROXY_SSL_VERIFY=none \ PROXY_TIMEOUT=60 \ REMOTEIP_INT_PROXY='10.1.0.0/16' \ REQ_HEADER_FORWARDED_PROTO='https' \ SERVER_ADMIN=root@localhost \ SERVER_NAME=localhost \ SERVER_SIGNATURE=Off \ SERVER_TOKENS=Full \ SSL_CERT=/usr/local/apache2/conf/server.crt \ SSL_CERT_KEY=/usr/local/apache2/conf/server.key \ SSL_CIPHERS="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" \ SSL_ENGINE=on \ SSL_HONOR_CIPHER_ORDER=off \ SSL_PORT=443 \ SSL_PROTOCOLS="all -SSLv3 -TLSv1 -TLSv1.1" \ SSL_SESSION_TICKETS=off \ SSL_OCSP_STAPLING=On \ TIMEOUT=60 \ WORKER_CONNECTIONS=400 \ # CRS specific variables PARANOIA=1 \ ANOMALY_INBOUND=5 \ ANOMALY_OUTBOUND=4 \ BLOCKING_PARANOIA=1 COPY --from=build /usr/local/apache2/modules/mod_security2.so /usr/local/apache2/modules/mod_security2.so COPY --from=build /usr/local/apache2/ModSecurity-${MODSEC2_VERSION}/modsecurity.conf-recommended /etc/modsecurity.d/modsecurity.conf COPY --from=build /usr/local/apache2/ModSecurity-${MODSEC2_VERSION}/unicode.mapping /etc/modsecurity.d/unicode.mapping COPY --from=crs_release /opt/owasp-crs /opt/owasp-crs COPY src/etc/modsecurity.d/*.conf /etc/modsecurity.d/ COPY src/bin/* /usr/local/bin/ COPY apache/conf/extra/*.conf /usr/local/apache2/conf/extra/ COPY src/etc/modsecurity.d/*.conf /etc/modsecurity.d/ COPY src/opt/modsecurity/activate-*.sh /opt/modsecurity/ COPY apache/docker-entrypoint.sh / RUN set -eux; \ echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections; \ apt-get update -qq; \ apt-get install -qq -y --no-install-recommends --no-install-suggests \ ca-certificates \ curl \ gnupg \ iproute2 \ libcurl3-gnutls \ libfuzzy2 \ liblua${LUA_VERSION} \ ${LUA_MODULES} \ libxml2 \ libyajl2; \ update-ca-certificates -f; \ apt-get clean; \ rm -rf /var/lib/apt/lists/* RUN set -eux; \ mkdir -p /etc/modsecurity.d/; \ mkdir -p /tmp/modsecurity/data; \ mkdir -p /tmp/modsecurity/upload; \ mkdir -p /tmp/modsecurity/tmp; \ chown -R $(awk '/^User/ { print $2;}' /usr/local/apache2/conf/httpd.conf) /tmp/modsecurity; \ mkdir -p /var/log/apache2/; \ ln -s /opt/owasp-crs /etc/modsecurity.d/; \ sed -i -E 's|(Listen) [0-9]+|\1 ${PORT}|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|(ServerTokens) Full|\1 ${SERVER_TOKENS}|' /usr/local/apache2/conf/extra/httpd-default.conf; \ sed -i -E 's|(ServerSignature) Off|\1 ${SERVER_SIGNATURE}|' /usr/local/apache2/conf/extra/httpd-default.conf; \ sed -i -E 's|#(ServerName) www.example.com:80|\1 ${SERVER_NAME}|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|(ServerAdmin) you@example.com|\1 ${SERVER_ADMIN}|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|^(\s*CustomLog)(\s+\S+)+|\1 ${ACCESSLOG} modsec "env=!nologging"|g' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|^(\s*ErrorLog)\s+\S+|\1 ${ERRORLOG}|g' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|^(\s*TransferLog)\s+\S+|\1 ${ACCESSLOG}|g' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(LoadModule unique_id_module)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(LoadModule rewrite_module modules/mod_rewrite.so)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(LoadModule proxy_module modules/mod_proxy.so)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(LoadModule proxy_http_module modules/mod_proxy_http.so)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(LoadModule remoteip_module modules/mod_remoteip.so)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(LoadModule socache_shmcb_module modules/mod_socache_shmcb.so)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(LoadModule ssl_module modules/mod_ssl.so)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(LoadModule http2_module modules/mod_http2.so)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(Include conf/extra/httpd-default.conf)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(Include conf/extra/httpd-proxy.conf)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(Include conf/extra/httpd-ssl.conf)|\1|' /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|#(Include conf/extra/httpd-vhosts.conf)|\1|' /usr/local/apache2/conf/httpd.conf; \ echo 'Include conf/extra/httpd-locations.conf' >> /usr/local/apache2/conf/httpd.conf; \ echo 'Include conf/extra/httpd-modsecurity.conf' >> /usr/local/apache2/conf/httpd.conf; \ sed -i -E 's|(MaxRequestWorkers[ ]*)[0-9]*|\1${WORKER_CONNECTIONS}|' /usr/local/apache2/conf/extra/httpd-mpm.conf; \ chgrp -R 0 /var/log/ /usr/local/apache2/; \ chmod -R g=u /var/log/ /usr/local/apache2/ ENTRYPOINT ["/docker-entrypoint.sh"] FROM alpine:3.17 as builder RUN apk add --no-cache build-base git openssl-dev autoconf automake WORKDIR /build COPY . /build RUN ./configure && make FROM alpine:3.17 RUN apk add --no-cache libstdc++ COPY --from=builder /build/src/slowhttptest /usr/local/bin/ ENTRYPOINT ["slowhttptest"] services: slowhttp: build: context: ./slowhttp modsecurity: build: context: ./modsecurity ```
synctext commented 3 months ago
AdiDumi commented 3 months ago

Update sprint:

image

image

synctext commented 3 months ago
AdiDumi commented 2 months ago

Short sprint update:

Problem_Description_thesis (1).pdf

synctext commented 2 months ago
AdiDumi commented 2 months ago

Brainstorming sprint:

synctext commented 2 months ago

:astonished: :astonished: :astonished: You have a viable roadmap to fix The Internet.

P2P Modsecurity is a brilliant idea. With a bit of tweaking it is also incrementally expandable. However, no smart contracts, gas payments, and Turing incompleteness please.

Re-architecting The Internet using zero-trust principle, Modsecurity, and PUFs

We create a layer of trust The Internet always needed, but never had. In 1962 the architecture of The Internet for the thermonuclear era was written down in report P2626. The highly survivable system structure is fundamentally unsuitable for today's world. For instance, Internet address 180.101.88.232 owned by ISP ChinaNet Jiangsu Province has been launching SSH login attacks for multiple years. First we create a universal trust token. It consists of a non-revocable self-sovereign identity with list of trust attestations. Second, we instrument Modsecurity with trust scoring, real-time threat signalling, coordination with others, and automatic formation of a global web-of-trust. Third, we present a trust model which is grounded in the laws of physics and mathematical axioms. By combing zero-trust principle and physical unclonable functions we create strong identity and web-of-trust framework which can serve as a mid-life upgrade of The Internet.

Roadmap till 31 Oct graduation

update: strong related work of a -simulation- of attack info sharing https://github.com/LukasForst/fides + proper code: https://github.com/stratosphereips/StratosphereLinuxIPS

AdiDumi commented 1 month ago

Back to coding 🎊 The first experiment work in progress. https://github.com/AdiDumi/IpRepMaster Created a simple login python app to protect and containerized it with Apache2 ModSecurity which acts as a proxy for requests and responses. Every login fail is detected by the modsecurity in the response. image Clean up on the last docker container used. Made it more simple and efficient (building was taking too long). -> very basic configuration with logging enabled for detection rule.

# Basic configuration
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess On
SecStatusEngine Off

# Enable audit logging
SecAuditEngine On
SecAuditLogType Serial
SecAuditLogFormat JSON
SecAuditLogParts ABIJDEFHZ
SecAuditLog /var/log/apache2/modsec_audit.log

Created custom rules for modsecurity to apply on failed login and detect. Lots of options from documentation with different level of details to add to the logging and rules for specific requests https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-%28v3.x%29

# Log failed login attempts
SecRule REQUEST_URI "/login" "phase:1,log,auditlog,id:1001,msg:'Login attempt detected'"
SecRule RESPONSE_STATUS "@streq 403" "phase:3,log,auditlog,msg:'Failed login attempt detected',id:101"
Logging in an audit.log file that creates JSON for a transaction ```json { "transaction": { "time": "20/May/2024:09:29:53.332742 +0000", "transaction_id": "Zk27Eeazul3OewgjLhj2PAAAAAA", "remote_address": "172.17.0.1", "remote_port": 37570, "local_address": "172.17.0.2", "local_port": 80 }, "request": { "request_line": "POST /login HTTP/1.1", "headers": { "Host": "localhost", "User-Agent": "python-requests/2.32.0", "Accept-Encoding": "gzip, deflate", "Accept": "*/*", "Connection": "keep-alive", "Content-Length": "35", "Content-Type": "application/x-www-form-urlencoded" }, "body": [ "username=admin&password=faspassword" ] }, "response": { "protocol": "HTTP/1.1", "status": 403, "headers": { "Content-Type": "application/json", "Content-Length": "27", "Keep-Alive": "timeout=5, max=100", "Connection": "Keep-Alive" }, "body": "" }, "audit_data": { "messages": [ "Warning. String match \"403\" at RESPONSE_STATUS. [file \"/etc/modsecurity/custom_rules.conf\"] [line \"3\"] [id \"1001\"] [msg \"Failed login attempt detected\"]" ], "error_messages": [ "[file \"apache2_util.c\"] [line 275] [level 3] [client 172.17.0.1] ModSecurity: Warning. String match \"403\" at RESPONSE_STATUS. [file \"/etc/modsecurity/custom_rules.conf\"] [line \"3\"] [id \"1001\"] [msg \"Failed login attempt detected\"] [hostname \"localhost\"] [uri \"/login\"] [unique_id \"Zk27Eeazul3OewgjLhj2PAAAAAA\"]" ], "handler": "proxy-server", "stopwatch": { "p1": 589, "p2": 882, "p3": 75, "p4": 115, "p5": 1215, "sr": 111, "sw": 1115, "l": 0, "gc": 0 }, "response_body_dechunked": true, "producer": [ "ModSecurity for Apache/2.9.7 (http://www.modsecurity.org/)", "OWASP_CRS/3.3.4" ], "server": "Apache/2.4.59 (Debian)", "engine_mode": "ENABLED" } } ```

Working on processing the JSON transaction through a script that runs every time the log file is updates with a new entry(crons). Extract the relevant information about the login fail. Example:

{
  "ip_address": "172.18.0.1",
  "request_method": "POST",
  "request_uri": "/login HTTP/1.1",
  "status_code": 403,
  "message": "Warning. String match \"403\" at RESPONSE_STATUS. [file \"/etc/modsecurity/custom_rules.conf\"] [line \"3\"] [id \"1001\"] [msg \"Failed login attempt detected\"]"
}

Next steps:

synctext commented 1 month ago
AdiDumi commented 2 weeks ago

Work in progress:

synctext commented 2 weeks ago

:tada: :tada: :tada:

Next sprints: idea gets bigger, experiments become more focused. 15Sep talk to EBSI server or cancel that part.

AdiDumi commented 2 days ago

Experiment update:

Full Rules set 
SecRule REQUEST_URI "/login" "phase:1,log,auditlog,id:1001,msg:'Login attempt detected'"
SecRule RESPONSE_STATUS "@streq 403" "phase:3,log,auditlog,msg:'Failed login attempt detected',id:101"
SecRule RESPONSE_STATUS "^200$" \
    "id:10003, \
    phase:4, \
    t:none, \
    pass"

SecRule RESPONSE_HEADERS:X-User-Public-Key "!@streq 0" \
    "id:10008, \
    phase:4, \
    t:none, \
    pass, \
    setvar:tx.header_value=%{RESPONSE_HEADERS.X-User-Public-Key}, \
    log, \
    msg:'received message', \
    exec:'/app/add_token.py %{tx.header_value}'"

SecRule REQUEST_HEADERS:X-User-Public-Key "!@streq 0" \
     "id:4001, \
     phase:1, \
     t:none, \
     setenv:key=%{REQUEST_HEADERS:X-User-Public-Key}, \
     deny, \
     log, \
     msg:'Missing X-User-Public-Key header'"

SecRule REQUEST_HEADERS:User-Signatures "!@streq 0" \
    "id:4002, \
     phase:1, \
     t:none, \
     setenv:sign=%{REQUEST_HEADERS:User-Signatures}, \
     pass, \
     nolog"

SecRule REQUEST_HEADERS:User-Signatures "!@streq 0" \
    "id:4009,phase:1,t:none,exec:'/app/check_signatures.py %{env.sign} %{env.key}',setenv:EXEC_RESULT=%{TX.exec.ret}"

SecRule ENV:EXEC_RESULT "@eq 0" \
    "id:7002, \
     phase:1, \
     t:none, \
     deny, \
     log, \
     msg:'Python script denied the request'"

SecRule ENV:EXEC_RESULT "!@eq 0" \
    "id:7003, \
     phase:1, \
     t:none, \
     pass, \
     log, \
     msg:'Python script allowed the request'"

synctext commented 2 days ago

ToDo: write small text with state-of-the-art in DDoS + IPv4 reputation. Expand experiment.