terrylinooo / shieldon

Web Application Firewall (WAF) for PHP.
https://shieldon.io
MIT License
838 stars 96 forks source link

installation confusion #42

Closed SpecialEdCT closed 1 year ago

SpecialEdCT commented 3 years ago

I have a "pure PHP project" that I am trying to deploy/test this on and I can't seem to figure it out.

When I try to access /firewall/panel all I get is a blank page and no php/nginx errors.

The install guide says to have "pretty urls" enabled. What should I rewrite /firewall/panel to? /vendor/autoload.php ?

SpecialEdCT commented 3 years ago

Update: I was able to spin up a fresh system and installed nginx and laravel and had no problems deploying shieldon

I am still unable to get this to work on my "Pure PHP Project" server. The documentation refers to "pretty URLs" which I am assuming is a reference to setting up nginx rewrite or apache mod_rewrite which is simple enough to set up the path "firewall/panel" to point to once I can figure out what exactly this path should actually point to.

maverjk commented 2 years ago

Hello SpecialEdCT, I'm in your same jam. I'm trying to install Shieldon v2 for a pure PHP project and all that I got so far is just a login screen. Do you find out a way to install it properly?

rajeev-cloud commented 2 years ago

Hi Maver,

I am still confuse and do not know how to proceed for installation. if you can help me out to get installation process would be really helpful.

maverjk commented 2 years ago

He

Hi Maver,

I am still confuse and do not know how to proceed for installation. if you can help me out to get installation process would be really helpful.

Hello rajeev,

So far I can say that to properly install version 2 there is the need to use Composer. It will install Shieldon but also all dependencies developed always from Terry. For the way that is built version 2 and how it is developed I found really difficult (almost impossibile) to avoid to use Composer, so with a simple carbon copy of the project, it will not work. Instead it's much easier to use "as it is" version 1. You can actually download repository from github and doing the proper configuration (you need to look at documentation and examples), you'll be able to make it work. A really great tool! But personally, I would like that Terry would continue on version 1 strategy and continue to add features to it (something for example that I was looking for was the introduction of some pattern in url to use as exception policy). By the way hope that this clarification will make easier for you to use this tool.

rajeev-cloud commented 2 years ago

thank you maver,

i tried to install it through composer but after that what do i have to do ?

root@ngnix-virtual-machine:/home/ngnix/Desktop# composer require shieldon/shieldon ^2 Do not run Composer as root/super user! See https://getcomposer.org/root for details Continue as root/super user [yes]? yes ./composer.json has been created Running composer update shieldon/shieldon Loading composer repositories with package information Updating dependencies Lock file operations: 9 installs, 0 updates, 0 removals

maverjk commented 2 years ago

I think that if you wish detailed instruction you have to ask to the author. I'm not able to properly answer and unfortunately documentation is not really rich. You should read comments in code to try to understand how to setup everything.

PacoJM commented 2 years ago

Hello, I had this problem. In my case I managed to solved it by the next Apache instructions in an .htaccess file:

RewriteEngine On
RewriteCond %{REQUEST_URI} ^/firewall/panel/(.*)$ # Change for your panel route
RewriteRule ^(.*)$ index.php [QSA] # Change index.php for your file name which have the integration script.

Basically we have to activate the rewrite, check if a request starts with the panel route. And if a request starts with that route you must call the script again, because the boostrap file has all the routes.

With this you can access to the Panel, but the project won't be protected by Shieldon. In order to apply the firewall in your project the script must be called always.

SpecialEdCT commented 2 years ago

He

Hi Maver, I am still confuse and do not know how to proceed for installation. if you can help me out to get installation process would be really helpful.

Hello rajeev,

So far I can say that to properly install version 2 there is the need to use Composer. It will install Shieldon but also all dependencies developed always from Terry. For the way that is built version 2 and how it is developed I found really difficult (almost impossibile) to avoid to use Composer, so with a simple carbon copy of the project, it will not work. Instead it's much easier to use "as it is" version 1. You can actually download repository from github and doing the proper configuration (you need to look at documentation and examples), you'll be able to make it work. A really great tool! But personally, I would like that Terry would continue on version 1 strategy and continue to add features to it (something for example that I was looking for was the introduction of some pattern in url to use as exception policy). By the way hope that this clarification will make easier for you to use this tool.

Thanks for your response.

I downloaded the 1.x fork but the documentation is really non-existant. All it says is:

Or, download it and include the Shieldon autoloader.
```php
require 'Shieldon/autoload.php';

So I created a test.php with the contents: <?php require 'Shieldon/autoload.php'; ?>

Which yields the same old white screen, no php or nginx errors logged.

I'm trying to read through the code to still try and figure out the path that /firewall/panel needs to be rewritten to as well. Still can't find that.

Also, the URL for the demo of this project isn't even online anymore so I can't even try to analyze and reverse engineer it on a functional server.

I've wasted several hours (again) on trying to figure this thing out, getting really frustrated :/ I guess I will keep at it. Eventually I hope to get to the point where you are at.

SpecialEdCT commented 2 years ago

I took another stab at this from a brand new environment.

Following the instructions for version 2 as the documentation claims will install I did:

Installed via composer composer require shieldon/shieldon ^2

Then put the php code in the top of the default index.html file

<?php
require_once(__DIR__.'/../vendor/autoload.php');

// Implement Shieldon Firewall.
$shieldon = new \Shieldon\Firewall\Integration\Bootstrap();
$shieldon->run();
?>

When I reload the index.html file at the top I see: run(); ?>

When I tried to browse to /firewall/panel all I get is:

Not Found
The requested URL was not found on this server.

I confirmed I have mod_rewrite enabled, followed the instructions exactly with no luck. Any ideas?

SpecialEdCT commented 2 years ago

I've tried again with zero luck, using both apache and nginx and using both the 1.x fork and current 2.0.2 release

Does anyone have instructions on how to install this?

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days.

github-actions[bot] commented 1 year ago

This issue was closed because it has been inactive for 14 since being marked as stale.