mirror of https://github.com/MISP/MISP
Merge remote-tracking branch 'origin/2.4' into feature-report-extract-data
mokaddem
commit
53f3a38d0a
|
|
@ -0,0 +1,34 @@
|
|||
<?php
|
||||
|
||||
class ButtonWidget
|
||||
{
|
||||
public $title = 'Button Widget';
|
||||
public $render = 'Button';
|
||||
public $width = 3;
|
||||
public $height = 2;
|
||||
public $cacheLifetime = false;
|
||||
public $autoRefreshDelay = false;
|
||||
public $params = array(
|
||||
'url' => 'URL (after base url) to redirect to',
|
||||
'text' => 'Text to display on the button'
|
||||
);
|
||||
public $description = 'Simple button to allow shortcuts';
|
||||
public $placeholder =
|
||||
'{
|
||||
"url": "/events/index",
|
||||
"text": "Go to events"
|
||||
}';
|
||||
|
||||
public function handler($user, $options = array())
|
||||
{
|
||||
$data = array();
|
||||
if(isset($options['url'])) {
|
||||
$data['url'] = $options['url'];
|
||||
}
|
||||
if(isset($options['text'])) {
|
||||
$data['text'] = $options['text'];
|
||||
}
|
||||
|
||||
return $data;
|
||||
}
|
||||
}
|
||||
|
|
@ -4,6 +4,10 @@ App::uses('GpgTool', 'Tools');
|
|||
|
||||
class Server extends AppModel
|
||||
{
|
||||
const SETTING_CRITICAL = 0,
|
||||
SETTING_RECOMMENDED = 1,
|
||||
SETTING_OPTIONAL = 2;
|
||||
|
||||
public $name = 'Server';
|
||||
|
||||
public $actsAs = array('SysLogLogable.SysLogLogable' => array(
|
||||
|
|
@ -1100,7 +1104,33 @@ class Server extends AppModel
|
|||
'test' => 'testBool',
|
||||
'type' => 'boolean',
|
||||
'null' => true
|
||||
)
|
||||
),
|
||||
'attachment_scan_module' => [
|
||||
'level' => self::SETTING_OPTIONAL,
|
||||
'description' => __('Name of enrichment module that will be used for attachment malware scanning. This module must return av-signature or sb-signature object.'),
|
||||
'value' => '',
|
||||
'errorMessage' => '',
|
||||
'type' => 'string',
|
||||
'null' => true,
|
||||
],
|
||||
'attachment_scan_hash_only' => [
|
||||
'level' => self::SETTING_OPTIONAL,
|
||||
'description' => __('Send to attachment scan module just file hash. This can be useful if module sends attachment to remote service and you don\'t want to leak real data.'),
|
||||
'value' => false,
|
||||
'errorMessage' => '',
|
||||
'test' => 'testBool',
|
||||
'type' => 'boolean',
|
||||
'null' => true,
|
||||
],
|
||||
'attachment_scan_timeout' => [
|
||||
'level' => self::SETTING_OPTIONAL,
|
||||
'description' => __('How long to wait for scan results in seconds.'),
|
||||
'value' => 30,
|
||||
'errorMessage' => '',
|
||||
'test' => 'testForPositiveInteger',
|
||||
'type' => 'numeric',
|
||||
'null' => true,
|
||||
]
|
||||
),
|
||||
'GnuPG' => array(
|
||||
'branch' => 1,
|
||||
|
|
@ -3426,6 +3456,14 @@ class Server extends AppModel
|
|||
return true;
|
||||
}
|
||||
|
||||
public function testForPositiveInteger($value)
|
||||
{
|
||||
if ((is_int($value) && $value >= 0) || ctype_digit($value)) {
|
||||
return true;
|
||||
}
|
||||
return __('The value has to be a whole number greater or equal 0.');
|
||||
}
|
||||
|
||||
public function testForCookieTimeout($value)
|
||||
{
|
||||
$numeric = $this->testForNumeric($value);
|
||||
|
|
|
|||
|
|
@ -5,6 +5,72 @@ This plugin enables CakePHP applications to use Single Sign-On to authenticate i
|
|||
|
||||
## Usage
|
||||
|
||||
### Prerequisites - Shibboleth Service Provider
|
||||
The MISP plugin takes care of the mapping of your shibboleth session attributes to MISP, but you will still need to install the service provider (SP) and configure it yourself. The documentation for Shibboleth Service Provider 3 can be found at https://wiki.shibboleth.net/confluence/display/SP3/Home.
|
||||
|
||||
To install Shibboleth SP3 on Ubuntu, you can use the instructions provided by SWITCH at https://www.switch.ch/aai/guides/sp/installation/ and then follow the below steps. If you already installed and configured Shibboleth you can skip this section.
|
||||
|
||||
Create signing and encryption certificate. The value following -e should be your entity ID, for example https://<host>/shibboleth.
|
||||
```bash
|
||||
sudo shib-keygen -f -u _shibd -h <host> -y 5 -e https://<host>/shibboleth -o /etc/shibboleth
|
||||
```
|
||||
|
||||
Edit /etc/shibboleth/shibboleth2.xml to use the created certificate for both signing and encryption (change the values for key and certificate).
|
||||
```xml
|
||||
<CredentialResolver type="File" use="signing"
|
||||
key="sp-key.pem" certificate="sp-cert.pem"/>
|
||||
<CredentialResolver type="File" use="encryption"
|
||||
key="sp-key.pem" certificate="sp-cert.pem"/>
|
||||
```
|
||||
|
||||
Edit /etc/shibboleth/shibboleth2.xml to set secure cookie properties (cookieProps) if you want to.
|
||||
```xml
|
||||
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
|
||||
checkAddress="false" handlerSSL="false" cookieProps="https"
|
||||
redirectLimit="exact">
|
||||
```
|
||||
|
||||
At this point, you should already be able to test your configuration. The last line of the output should be "overall configuration is loadable, check console for non-fatal problems".
|
||||
```bash
|
||||
sudo shibd -t
|
||||
```
|
||||
|
||||
Set entityID in /etc/shibboleth/shibboleth2.xml.
|
||||
```xml
|
||||
<ApplicationDefaults entityID="https://<host>/shibboleth"
|
||||
REMOTE_USER="eppn subject-id pairwise-id persistent-id"
|
||||
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
|
||||
```
|
||||
|
||||
Copy your identity provider metadata to /etc/shibboleth, for example to /etc/shibboleth/idp-metadata.xml and refer to it in /etc/shibboleth/shibboleth2.xml. Uncomment and edit the relevant line.
|
||||
```xml
|
||||
<MetadataProvider type="XML" validate="true" path="idp-metadata.xml"/>
|
||||
```
|
||||
|
||||
Optionally, you can make sure the service provider does not create a session if some attributes, like OrgTag and GroupTag are missing. If users attempt to login an this happens, they will receive a pre-configured reply (default at /etc/shibboleth/attrChecker.html).
|
||||
In /etc/shibboleth/shibboleth2.xml, edit ApplicationDefaults by adding the sessionHook:
|
||||
```xml
|
||||
<ApplicationDefaults entityID="https://<HOST>/shibboleth"
|
||||
REMOTE_USER="eppn persistent-id targeted-id"
|
||||
signing="front" encryption="false"
|
||||
sessionHook="/Shibboleth.sso/AttrChecker"
|
||||
```
|
||||
Optional for attribute checking: add your checks (note that the incoming attribute names can be different for you, for more info on possible checks refer to https://wiki.shibboleth.net/confluence/display/SP3/Attribute+Checker+Handler):
|
||||
```xml
|
||||
<Handler type="AttributeChecker" Location="/AttrChecker" template="attrChecker.html" attributes="OrgTag GroupTag" flushSession="true"/>
|
||||
```
|
||||
|
||||
At this point you will have to send your metadata to your identity provider. You can get template metadata based on your configuration from https://<host>/Shibboleth.sso/Metadata.
|
||||
|
||||
### MISP plugin configuration
|
||||
|
||||
Edit your MISP apache configuration by adding the below (location depends on your handler path, /Shibboleth.sso by default).
|
||||
```Apache
|
||||
<Location /Shibboleth.sso>
|
||||
SetHandler shib
|
||||
</Locations>
|
||||
```
|
||||
|
||||
Enable the plugin at bootstrap.php:
|
||||
|
||||
```php
|
||||
|
|
@ -18,43 +84,68 @@ Uncomment the following line to enable SSO authorization
|
|||
'auth'=>array('ShibbAuth.ApacheShibb'),
|
||||
```
|
||||
|
||||
And configure it. MailTag, OrgTag and GroupTag are the string that represent the key for the values needed by the plugin.
|
||||
For example if you are using ADFS OrgTag will be ADFS_FEDERATION, GroupTag will be ADFS_GROUP, etc. meaning the key for the values needed.
|
||||
DefaultOrg are values that come by default just in case they are not defined or obtained from the environment variables.
|
||||
The GroupRoleMatching is an array that allows the definition and correlation between groups and roles in MISP, being them updated
|
||||
If the line does not exist, add it to 'Security' array, for example like below. Note that you should just add the line to your own existing config.
|
||||
```php
|
||||
'Security' =>
|
||||
array (
|
||||
'level' => 'medium',
|
||||
'salt' => '',
|
||||
'cipherSeed' => '',
|
||||
'password_policy_length' => 12,
|
||||
'password_policy_complexity' => '/^((?=.*\\d)|(?=.*\\W+))(?![\\n])(?=.*[A-Z])(?=.*[a-z]).*$|.{16,}/',
|
||||
'self_registration_message' => 'If you would like to send us a registration request, please fill out the form below. Make sure you fill out as much information as possible in order to ease the task of the administrators.',
|
||||
'auth'=>array('ShibbAuth.ApacheShibb'),
|
||||
)
|
||||
```
|
||||
|
||||
And configure it. MailTag, OrgTag and GroupTag are the keys for the values needed by the plugin.
|
||||
For example if you are using ADFS you should replace IDP_FEDERATION_TAG by ADFS_FEDERATION, IDP_GROUP_TAG by ADFS_GROUP, etc.
|
||||
Replace MISP_DEFAULT_ORG by the organization you want users to be assigned to in case no organization value is given by the identity provider.
|
||||
The GroupRoleMatching is an array that allows the definition and correlation between groups and roles in MISP. These get updated
|
||||
if the groups are updated (i.e. a user that was admin and their groups changed inside the organization will have his role changed in MISP
|
||||
upon the next login being now user or org admin respectively). The GroupSeparator is the character used to separate the different groups
|
||||
in the list given by apache.
|
||||
in the list given by apache. By default, you can leave it at ';'.
|
||||
|
||||
```php
|
||||
'ApacheShibbAuth' => // Configuration for shibboleth authentication
|
||||
array(
|
||||
'MailTag' => 'EMAIL_TAG',
|
||||
'OrgTag' => 'FEDERATION_TAG',
|
||||
'GroupTag' => 'GROUP_TAG',
|
||||
'MailTag' => 'IDP_EMAIL_TAG',
|
||||
'OrgTag' => 'IDP_FEDERATION_TAG',
|
||||
'GroupTag' => 'IDP_GROUP_TAG',
|
||||
'GroupSeparator' => ';',
|
||||
'GroupRoleMatching' => array( // 3:User, 1:admin. May be good to set "1" for the first user
|
||||
'group_three' => '3',
|
||||
'group_two' => 2,
|
||||
'group_one' => 1,
|
||||
'possible_group_attribute_value_3' => '3',
|
||||
'possible_group_attribute_value_2' => 2,
|
||||
'possible_group_attribute_value_1' => 1,
|
||||
),
|
||||
'DefaultOrg' => 'DEFAULT_ORG',
|
||||
'DefaultOrg' => 'MISP_DEFAULT_ORG',
|
||||
),
|
||||
```
|
||||
If used with Apache as webserver it might be useful to make a distinction to filter out API/Syncs from SSO login. It can be added to the vhost as follows:
|
||||
If used with Apache as webserver it might be useful to make a distinction to filter out API/Syncs from SSO login. It can be added to the vhost as follows (Added lines are the If/Else clauses):
|
||||
|
||||
```Apache
|
||||
<If "-T req('Authorization')">
|
||||
Require all granted
|
||||
AuthType None
|
||||
</If>
|
||||
<Else>
|
||||
Require valid-user
|
||||
AuthType shibboleth
|
||||
ShibRequestSetting requiresession On
|
||||
ShibRequestSetting shibexportassertion Off
|
||||
ShibUseHeaders On
|
||||
</Else>
|
||||
<Directory /var/www/MISP/app/webroot>
|
||||
Options -Indexes
|
||||
AllowOverride all
|
||||
<If "-T req('Authorization')">
|
||||
Require all granted
|
||||
AuthType None
|
||||
</If>
|
||||
<Else>
|
||||
Require valid-user
|
||||
AuthType shibboleth
|
||||
ShibRequestSetting requiresession On
|
||||
ShibRequestSetting shibexportassertion Off
|
||||
ShibUseHeaders On
|
||||
</Else>
|
||||
</Directory>
|
||||
```
|
||||
|
||||
If you want the logout button to work for killing your session, you can use the CustomAuth plugin to configure a custom logout url, by default the url should be https://<host>/Shibboleth.sso/Logout. This leads to a local logout. If you want to also trigger a logout at the identity provider, you can use the return mechanism. In this case you will need to change the allowed redirects. Your logout url will look like https://<host>/Shibboleth.sso/Logout?return=https://<idp_host>/Logout. Edit your shibboleth configuration (often at /etc/shibboleth/shibboleth2.xml) as necessary. Relevant shibboleth documentation can be found at https://wiki.shibboleth.net/confluence/display/SP3/Logout and https://wiki.shibboleth.net/confluence/display/SP3/Sessions.
|
||||
```xml
|
||||
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
|
||||
checkAddress="false" handlerSSL="false" cookieProps="https"
|
||||
redirectLimit="exact+whitelist" redirectWhitelist="https://<idp_host>">
|
||||
```
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,27 @@
|
|||
<div>
|
||||
<?php
|
||||
/*
|
||||
* A simple button to add a link to a specific section
|
||||
*
|
||||
* Expected input:
|
||||
* { url: <relative url>, text: <text to be displayed on the button>}
|
||||
*
|
||||
* Example:
|
||||
* {url: "/events/index", text: "To the list of events"}
|
||||
*
|
||||
*/
|
||||
echo '<a href="'.$baseurl.h($data['url']).'">';
|
||||
echo '<button class="btn btn-primary widget-button">';
|
||||
echo h($data['text']);
|
||||
echo '</button></a>';
|
||||
?>
|
||||
</div>
|
||||
|
||||
<style widget-scoped>
|
||||
.widget-button {
|
||||
height: 100%;
|
||||
width: 100%;
|
||||
text-align: center;
|
||||
font-size: large;
|
||||
}
|
||||
</style>
|
||||
|
|
@ -144,7 +144,7 @@
|
|||
?></pre>
|
||||
<code><request><type>ip</type><eventid>!51</eventid><eventid>!62</eventid><withAttachment>false</withAttachment><tags>APT1</tags><tags>!OSINT</tags><from>false</from><to>2015-02-15</to></request></code><br /><br />
|
||||
<p><?php echo __('Alternatively, it is also possible to pass the filters via the parameters in the URL, though it is highly advised to use POST requests with JSON objects instead. The format is as described below');?>:</p>
|
||||
<pre><?php echo $baseurl.'/attributes/bro/download/[type]/[tags]/[event_id]/[allowNonIDS]/[from]/[to]/[last]'; ?></pre>
|
||||
<pre><?php echo $baseurl.'/attributes/bro/download/[type]/[tags]/[event_id]/[from]/[to]/[last]'; ?></pre>
|
||||
<b>type</b>: <?php echo __('The Bro type, any valid Bro type is accepted. The mapping between Bro and MISP types is as follows');?>:<br />
|
||||
<pre><?php
|
||||
foreach ($broTypes as $key => $value) {
|
||||
|
|
|
|||
|
|
@ -118,7 +118,7 @@ function genericPopup(url, popupTarget, callback) {
|
|||
if (callback !== undefined) {
|
||||
callback();
|
||||
}
|
||||
});
|
||||
}).fail(xhrFailCallback)
|
||||
}
|
||||
|
||||
function screenshotPopup(url, title) {
|
||||
|
|
@ -2523,33 +2523,42 @@ function serverSettingsPostActivationScripts(name, setting, id) {
|
|||
}
|
||||
|
||||
function serverSettingSubmitForm(name, setting, id) {
|
||||
subGroup = getSubGroupFromSetting(setting);
|
||||
var subGroup = getSubGroupFromSetting(setting);
|
||||
var formData = $(name + '_field').closest("form").serialize();
|
||||
$.ajax({
|
||||
data: formData,
|
||||
cache: false,
|
||||
beforeSend: function (XMLHttpRequest) {
|
||||
beforeSend: function () {
|
||||
$(".loading").show();
|
||||
},
|
||||
success:function (data, textStatus) {
|
||||
success: function (data) {
|
||||
if (!data.saved) {
|
||||
$(".loading").hide();
|
||||
showMessage('fail', data.errors);
|
||||
resetForms();
|
||||
$('.inline-field-placeholder').hide();
|
||||
return;
|
||||
}
|
||||
|
||||
$.ajax({
|
||||
type:"get",
|
||||
type: "get",
|
||||
url: baseurl + "/servers/serverSettingsReloadSetting/" + setting + "/" + id,
|
||||
success:function (data2, textStatus2) {
|
||||
success: function (data2) {
|
||||
$('#' + subGroup + "_" + id + '_row').replaceWith(data2);
|
||||
$(".loading").hide();
|
||||
},
|
||||
error:function() {
|
||||
error: function() {
|
||||
showMessage('fail', 'Could not refresh the table.');
|
||||
}
|
||||
});
|
||||
},
|
||||
error:function() {
|
||||
error: function() {
|
||||
$(".loading").hide();
|
||||
showMessage('fail', 'Request failed for an unknown reason.');
|
||||
resetForms();
|
||||
$('.inline-field-placeholder').hide();
|
||||
},
|
||||
type:"post",
|
||||
type: "post",
|
||||
url: baseurl + "/servers/serverSettingsEdit/" + setting + "/" + id + "/" + 1
|
||||
});
|
||||
$(name + '_field').unbind("keyup");
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
Subproject commit 0d6db44c80afd81976f54f58c8cb02e4d33acc16
|
||||
Subproject commit 52d806b349333d40c5dd75b62e8e64d6a18fcdf4
|
||||
Loading…
Reference in New Issue